projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
import PULS_20160108
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 #define NUM_SEL_MNT_OPTS 5
99
100 extern struct security_operations *security_ops;
101
102 /* SECMARK reference count */
103 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
104
105 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
106 int selinux_enforcing;
107
108 static int __init enforcing_setup(char *str)
109 {
110 unsigned long enforcing;
111 if (!strict_strtoul(str, 0, &enforcing))
112 selinux_enforcing = enforcing ? 1 : 0;
113 return 1;
114 }
115 __setup("enforcing=", enforcing_setup);
116 #endif
117
118 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
119 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
120
121 static int __init selinux_enabled_setup(char *str)
122 {
123 unsigned long enabled;
124 if (!strict_strtoul(str, 0, &enabled))
125 selinux_enabled = enabled ? 1 : 0;
126 return 1;
127 }
128 __setup("selinux=", selinux_enabled_setup);
129 #else
130 int selinux_enabled = 1;
131 #endif
132
133 static struct kmem_cache *sel_inode_cache;
134
135 /**
136 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
137 *
138 * Description:
139 * This function checks the SECMARK reference counter to see if any SECMARK
140 * targets are currently configured, if the reference counter is greater than
141 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
142 * enabled, false (0) if SECMARK is disabled.
143 *
144 */
145 static int selinux_secmark_enabled(void)
146 {
147 return (atomic_read(&selinux_secmark_refcount) > 0);
148 }
149
150 /*
151 * initialise the security for the init task
152 */
153 static void cred_init_security(void)
154 {
155 struct cred *cred = (struct cred *) current->real_cred;
156 struct task_security_struct *tsec;
157
158 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
159 if (!tsec)
160 panic("SELinux: Failed to initialize initial task.\n");
161
162 tsec->osid = tsec->sid = SECINITSID_KERNEL;
163 cred->security = tsec;
164 }
165
166 /*
167 * get the security ID of a set of credentials
168 */
169 static inline u32 cred_sid(const struct cred *cred)
170 {
171 const struct task_security_struct *tsec;
172
173 tsec = cred->security;
174 return tsec->sid;
175 }
176
177 /*
178 * get the objective security ID of a task
179 */
180 static inline u32 task_sid(const struct task_struct *task)
181 {
182 u32 sid;
183
184 rcu_read_lock();
185 sid = cred_sid(__task_cred(task));
186 rcu_read_unlock();
187 return sid;
188 }
189
190 /*
191 * get the subjective security ID of the current task
192 */
193 static inline u32 current_sid(void)
194 {
195 const struct task_security_struct *tsec = current_security();
196
197 return tsec->sid;
198 }
199
200 /* Allocate and free functions for each kind of security blob. */
201
202 static int inode_alloc_security(struct inode *inode)
203 {
204 struct inode_security_struct *isec;
205 u32 sid = current_sid();
206
207 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
208 if (!isec)
209 return -ENOMEM;
210
211 mutex_init(&isec->lock);
212 INIT_LIST_HEAD(&isec->list);
213 isec->inode = inode;
214 isec->sid = SECINITSID_UNLABELED;
215 isec->sclass = SECCLASS_FILE;
216 isec->task_sid = sid;
217 inode->i_security = isec;
218
219 return 0;
220 }
221
222 static void inode_free_rcu(struct rcu_head *head)
223 {
224 struct inode_security_struct *isec;
225
226 isec = container_of(head, struct inode_security_struct, rcu);
227 kmem_cache_free(sel_inode_cache, isec);
228 }
229
230 static void inode_free_security(struct inode *inode)
231 {
232 struct inode_security_struct *isec = inode->i_security;
233 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
234
235 spin_lock(&sbsec->isec_lock);
236 if (!list_empty(&isec->list))
237 list_del_init(&isec->list);
238 spin_unlock(&sbsec->isec_lock);
239
240 /*
241 * The inode may still be referenced in a path walk and
242 * a call to selinux_inode_permission() can be made
243 * after inode_free_security() is called. Ideally, the VFS
244 * wouldn't do this, but fixing that is a much harder
245 * job. For now, simply free the i_security via RCU, and
246 * leave the current inode->i_security pointer intact.
247 * The inode will be freed after the RCU grace period too.
248 */
249 call_rcu(&isec->rcu, inode_free_rcu);
250 }
251
252 static int file_alloc_security(struct file *file)
253 {
254 struct file_security_struct *fsec;
255 u32 sid = current_sid();
256
257 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
258 if (!fsec)
259 return -ENOMEM;
260
261 fsec->sid = sid;
262 fsec->fown_sid = sid;
263 file->f_security = fsec;
264
265 return 0;
266 }
267
268 static void file_free_security(struct file *file)
269 {
270 struct file_security_struct *fsec = file->f_security;
271 file->f_security = NULL;
272 kfree(fsec);
273 }
274
275 static int superblock_alloc_security(struct super_block *sb)
276 {
277 struct superblock_security_struct *sbsec;
278
279 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
280 if (!sbsec)
281 return -ENOMEM;
282
283 mutex_init(&sbsec->lock);
284 INIT_LIST_HEAD(&sbsec->isec_head);
285 spin_lock_init(&sbsec->isec_lock);
286 sbsec->sb = sb;
287 sbsec->sid = SECINITSID_UNLABELED;
288 sbsec->def_sid = SECINITSID_FILE;
289 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
290 sb->s_security = sbsec;
291
292 return 0;
293 }
294
295 static void superblock_free_security(struct super_block *sb)
296 {
297 struct superblock_security_struct *sbsec = sb->s_security;
298 sb->s_security = NULL;
299 kfree(sbsec);
300 }
301
302 /* The file system's label must be initialized prior to use. */
303
304 static const char *labeling_behaviors[6] = {
305 "uses xattr",
306 "uses transition SIDs",
307 "uses task SIDs",
308 "uses genfs_contexts",
309 "not configured for labeling",
310 "uses mountpoint labeling",
311 };
312
313 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
314
315 static inline int inode_doinit(struct inode *inode)
316 {
317 return inode_doinit_with_dentry(inode, NULL);
318 }
319
320 enum {
321 Opt_error = -1,
322 Opt_context = 1,
323 Opt_fscontext = 2,
324 Opt_defcontext = 3,
325 Opt_rootcontext = 4,
326 Opt_labelsupport = 5,
327 };
328
329 static const match_table_t tokens = {
330 {Opt_context, CONTEXT_STR "%s"},
331 {Opt_fscontext, FSCONTEXT_STR "%s"},
332 {Opt_defcontext, DEFCONTEXT_STR "%s"},
333 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
334 {Opt_labelsupport, LABELSUPP_STR},
335 {Opt_error, NULL},
336 };
337
338 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
339
340 static int may_context_mount_sb_relabel(u32 sid,
341 struct superblock_security_struct *sbsec,
342 const struct cred *cred)
343 {
344 const struct task_security_struct *tsec = cred->security;
345 int rc;
346
347 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELFROM, NULL);
349 if (rc)
350 return rc;
351
352 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
353 FILESYSTEM__RELABELTO, NULL);
354 return rc;
355 }
356
357 static int may_context_mount_inode_relabel(u32 sid,
358 struct superblock_security_struct *sbsec,
359 const struct cred *cred)
360 {
361 const struct task_security_struct *tsec = cred->security;
362 int rc;
363 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
364 FILESYSTEM__RELABELFROM, NULL);
365 if (rc)
366 return rc;
367
368 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
369 FILESYSTEM__ASSOCIATE, NULL);
370 return rc;
371 }
372
373 static int sb_finish_set_opts(struct super_block *sb)
374 {
375 struct superblock_security_struct *sbsec = sb->s_security;
376 struct dentry *root = sb->s_root;
377 struct inode *root_inode = root->d_inode;
378 int rc = 0;
379
380 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
381 /* Make sure that the xattr handler exists and that no
382 error other than -ENODATA is returned by getxattr on
383 the root directory. -ENODATA is ok, as this may be
384 the first boot of the SELinux kernel before we have
385 assigned xattr values to the filesystem. */
386 if (!root_inode->i_op->getxattr) {
387 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
388 "xattr support\n", sb->s_id, sb->s_type->name);
389 rc = -EOPNOTSUPP;
390 goto out;
391 }
392 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
393 if (rc < 0 && rc != -ENODATA) {
394 if (rc == -EOPNOTSUPP)
395 printk(KERN_WARNING "SELinux: (dev %s, type "
396 "%s) has no security xattr handler\n",
397 sb->s_id, sb->s_type->name);
398 else
399 printk(KERN_WARNING "SELinux: (dev %s, type "
400 "%s) getxattr errno %d\n", sb->s_id,
401 sb->s_type->name, -rc);
402 goto out;
403 }
404 }
405
406 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
407
408 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
409 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
410 sb->s_id, sb->s_type->name);
411 else
412 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
413 sb->s_id, sb->s_type->name,
414 labeling_behaviors[sbsec->behavior-1]);
415
416 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
417 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
418 sbsec->behavior == SECURITY_FS_USE_NONE ||
419 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
420 sbsec->flags &= ~SE_SBLABELSUPP;
421
422 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
423 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
424 sbsec->flags |= SE_SBLABELSUPP;
425
426 /*
427 * Special handling for rootfs. Is genfs but supports
428 * setting SELinux context on in-core inodes.
429 */
430 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
431 sbsec->flags |= SE_SBLABELSUPP;
432
433 /* Initialize the root inode. */
434 rc = inode_doinit_with_dentry(root_inode, root);
435
436 /* Initialize any other inodes associated with the superblock, e.g.
437 inodes created prior to initial policy load or inodes created
438 during get_sb by a pseudo filesystem that directly
439 populates itself. */
440 spin_lock(&sbsec->isec_lock);
441 next_inode:
442 if (!list_empty(&sbsec->isec_head)) {
443 struct inode_security_struct *isec =
444 list_entry(sbsec->isec_head.next,
445 struct inode_security_struct, list);
446 struct inode *inode = isec->inode;
447 spin_unlock(&sbsec->isec_lock);
448 inode = igrab(inode);
449 if (inode) {
450 if (!IS_PRIVATE(inode))
451 inode_doinit(inode);
452 iput(inode);
453 }
454 spin_lock(&sbsec->isec_lock);
455 list_del_init(&isec->list);
456 goto next_inode;
457 }
458 spin_unlock(&sbsec->isec_lock);
459 out:
460 return rc;
461 }
462
463 /*
464 * This function should allow an FS to ask what it's mount security
465 * options were so it can use those later for submounts, displaying
466 * mount options, or whatever.
467 */
468 static int selinux_get_mnt_opts(const struct super_block *sb,
469 struct security_mnt_opts *opts)
470 {
471 int rc = 0, i;
472 struct superblock_security_struct *sbsec = sb->s_security;
473 char *context = NULL;
474 u32 len;
475 char tmp;
476
477 security_init_mnt_opts(opts);
478
479 if (!(sbsec->flags & SE_SBINITIALIZED))
480 return -EINVAL;
481
482 if (!ss_initialized)
483 return -EINVAL;
484
485 tmp = sbsec->flags & SE_MNTMASK;
486 /* count the number of mount options for this sb */
487 for (i = 0; i < 8; i++) {
488 if (tmp & 0x01)
489 opts->num_mnt_opts++;
490 tmp >>= 1;
491 }
492 /* Check if the Label support flag is set */
493 if (sbsec->flags & SE_SBLABELSUPP)
494 opts->num_mnt_opts++;
495
496 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
497 if (!opts->mnt_opts) {
498 rc = -ENOMEM;
499 goto out_free;
500 }
501
502 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
503 if (!opts->mnt_opts_flags) {
504 rc = -ENOMEM;
505 goto out_free;
506 }
507
508 i = 0;
509 if (sbsec->flags & FSCONTEXT_MNT) {
510 rc = security_sid_to_context(sbsec->sid, &context, &len);
511 if (rc)
512 goto out_free;
513 opts->mnt_opts[i] = context;
514 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
515 }
516 if (sbsec->flags & CONTEXT_MNT) {
517 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
518 if (rc)
519 goto out_free;
520 opts->mnt_opts[i] = context;
521 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
522 }
523 if (sbsec->flags & DEFCONTEXT_MNT) {
524 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
525 if (rc)
526 goto out_free;
527 opts->mnt_opts[i] = context;
528 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
529 }
530 if (sbsec->flags & ROOTCONTEXT_MNT) {
531 struct inode *root = sbsec->sb->s_root->d_inode;
532 struct inode_security_struct *isec = root->i_security;
533
534 rc = security_sid_to_context(isec->sid, &context, &len);
535 if (rc)
536 goto out_free;
537 opts->mnt_opts[i] = context;
538 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
539 }
540 if (sbsec->flags & SE_SBLABELSUPP) {
541 opts->mnt_opts[i] = NULL;
542 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
543 }
544
545 BUG_ON(i != opts->num_mnt_opts);
546
547 return 0;
548
549 out_free:
550 security_free_mnt_opts(opts);
551 return rc;
552 }
553
554 static int bad_option(struct superblock_security_struct *sbsec, char flag,
555 u32 old_sid, u32 new_sid)
556 {
557 char mnt_flags = sbsec->flags & SE_MNTMASK;
558
559 /* check if the old mount command had the same options */
560 if (sbsec->flags & SE_SBINITIALIZED)
561 if (!(sbsec->flags & flag) ||
562 (old_sid != new_sid))
563 return 1;
564
565 /* check if we were passed the same options twice,
566 * aka someone passed context=a,context=b
567 */
568 if (!(sbsec->flags & SE_SBINITIALIZED))
569 if (mnt_flags & flag)
570 return 1;
571 return 0;
572 }
573
574 /*
575 * Allow filesystems with binary mount data to explicitly set mount point
576 * labeling information.
577 */
578 static int selinux_set_mnt_opts(struct super_block *sb,
579 struct security_mnt_opts *opts)
580 {
581 const struct cred *cred = current_cred();
582 int rc = 0, i;
583 struct superblock_security_struct *sbsec = sb->s_security;
584 const char *name = sb->s_type->name;
585 struct inode *inode = sbsec->sb->s_root->d_inode;
586 struct inode_security_struct *root_isec = inode->i_security;
587 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
588 u32 defcontext_sid = 0;
589 char **mount_options = opts->mnt_opts;
590 int *flags = opts->mnt_opts_flags;
591 int num_opts = opts->num_mnt_opts;
592
593 mutex_lock(&sbsec->lock);
594
595 if (!ss_initialized) {
596 if (!num_opts) {
597 /* Defer initialization until selinux_complete_init,
598 after the initial policy is loaded and the security
599 server is ready to handle calls. */
600 goto out;
601 }
602 rc = -EINVAL;
603 printk(KERN_WARNING "SELinux: Unable to set superblock options "
604 "before the security server is initialized\n");
605 goto out;
606 }
607
608 /*
609 * Binary mount data FS will come through this function twice. Once
610 * from an explicit call and once from the generic calls from the vfs.
611 * Since the generic VFS calls will not contain any security mount data
612 * we need to skip the double mount verification.
613 *
614 * This does open a hole in which we will not notice if the first
615 * mount using this sb set explict options and a second mount using
616 * this sb does not set any security options. (The first options
617 * will be used for both mounts)
618 */
619 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
620 && (num_opts == 0))
621 goto out;
622
623 /*
624 * parse the mount options, check if they are valid sids.
625 * also check if someone is trying to mount the same sb more
626 * than once with different security options.
627 */
628 for (i = 0; i < num_opts; i++) {
629 u32 sid;
630
631 if (flags[i] == SE_SBLABELSUPP)
632 continue;
633 rc = security_context_to_sid(mount_options[i],
634 strlen(mount_options[i]), &sid);
635 if (rc) {
636 printk(KERN_WARNING "SELinux: security_context_to_sid"
637 "(%s) failed for (dev %s, type %s) errno=%d\n",
638 mount_options[i], sb->s_id, name, rc);
639 goto out;
640 }
641 switch (flags[i]) {
642 case FSCONTEXT_MNT:
643 fscontext_sid = sid;
644
645 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
646 fscontext_sid))
647 goto out_double_mount;
648
649 sbsec->flags |= FSCONTEXT_MNT;
650 break;
651 case CONTEXT_MNT:
652 context_sid = sid;
653
654 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
655 context_sid))
656 goto out_double_mount;
657
658 sbsec->flags |= CONTEXT_MNT;
659 break;
660 case ROOTCONTEXT_MNT:
661 rootcontext_sid = sid;
662
663 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
664 rootcontext_sid))
665 goto out_double_mount;
666
667 sbsec->flags |= ROOTCONTEXT_MNT;
668
669 break;
670 case DEFCONTEXT_MNT:
671 defcontext_sid = sid;
672
673 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
674 defcontext_sid))
675 goto out_double_mount;
676
677 sbsec->flags |= DEFCONTEXT_MNT;
678
679 break;
680 default:
681 rc = -EINVAL;
682 goto out;
683 }
684 }
685
686 if (sbsec->flags & SE_SBINITIALIZED) {
687 /* previously mounted with options, but not on this attempt? */
688 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
689 goto out_double_mount;
690 rc = 0;
691 goto out;
692 }
693
694 if (strcmp(sb->s_type->name, "proc") == 0)
695 sbsec->flags |= SE_SBPROC;
696
697 /* Determine the labeling behavior to use for this filesystem type. */
698 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
699 if (rc) {
700 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
701 __func__, sb->s_type->name, rc);
702 goto out;
703 }
704
705 /* sets the context of the superblock for the fs being mounted. */
706 if (fscontext_sid) {
707 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
708 if (rc)
709 goto out;
710
711 sbsec->sid = fscontext_sid;
712 }
713
714 /*
715 * Switch to using mount point labeling behavior.
716 * sets the label used on all file below the mountpoint, and will set
717 * the superblock context if not already set.
718 */
719 if (context_sid) {
720 if (!fscontext_sid) {
721 rc = may_context_mount_sb_relabel(context_sid, sbsec,
722 cred);
723 if (rc)
724 goto out;
725 sbsec->sid = context_sid;
726 } else {
727 rc = may_context_mount_inode_relabel(context_sid, sbsec,
728 cred);
729 if (rc)
730 goto out;
731 }
732 if (!rootcontext_sid)
733 rootcontext_sid = context_sid;
734
735 sbsec->mntpoint_sid = context_sid;
736 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
737 }
738
739 if (rootcontext_sid) {
740 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
741 cred);
742 if (rc)
743 goto out;
744
745 root_isec->sid = rootcontext_sid;
746 root_isec->initialized = 1;
747 }
748
749 if (defcontext_sid) {
750 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
751 rc = -EINVAL;
752 printk(KERN_WARNING "SELinux: defcontext option is "
753 "invalid for this filesystem type\n");
754 goto out;
755 }
756
757 if (defcontext_sid != sbsec->def_sid) {
758 rc = may_context_mount_inode_relabel(defcontext_sid,
759 sbsec, cred);
760 if (rc)
761 goto out;
762 }
763
764 sbsec->def_sid = defcontext_sid;
765 }
766
767 rc = sb_finish_set_opts(sb);
768 out:
769 mutex_unlock(&sbsec->lock);
770 return rc;
771 out_double_mount:
772 rc = -EINVAL;
773 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
774 "security settings for (dev %s, type %s)\n", sb->s_id, name);
775 goto out;
776 }
777
778 static int selinux_cmp_sb_context(const struct super_block *oldsb,
779 const struct super_block *newsb)
780 {
781 struct superblock_security_struct *old = oldsb->s_security;
782 struct superblock_security_struct *new = newsb->s_security;
783 char oldflags = old->flags & SE_MNTMASK;
784 char newflags = new->flags & SE_MNTMASK;
785
786 if (oldflags != newflags)
787 goto mismatch;
788 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
789 goto mismatch;
790 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
791 goto mismatch;
792 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
793 goto mismatch;
794 if (oldflags & ROOTCONTEXT_MNT) {
795 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
796 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
797 if (oldroot->sid != newroot->sid)
798 goto mismatch;
799 }
800 return 0;
801 mismatch:
802 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
803 "different security settings for (dev %s, "
804 "type %s)\n", newsb->s_id, newsb->s_type->name);
805 return -EBUSY;
806 }
807
808 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
809 struct super_block *newsb)
810 {
811 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
812 struct superblock_security_struct *newsbsec = newsb->s_security;
813
814 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
815 int set_context = (oldsbsec->flags & CONTEXT_MNT);
816 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
817
818 /*
819 * if the parent was able to be mounted it clearly had no special lsm
820 * mount options. thus we can safely deal with this superblock later
821 */
822 if (!ss_initialized)
823 return 0;
824
825 /* how can we clone if the old one wasn't set up?? */
826 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
827
828 /* if fs is reusing a sb, make sure that the contexts match */
829 if (newsbsec->flags & SE_SBINITIALIZED)
830 return selinux_cmp_sb_context(oldsb, newsb);
831
832 mutex_lock(&newsbsec->lock);
833
834 newsbsec->flags = oldsbsec->flags;
835
836 newsbsec->sid = oldsbsec->sid;
837 newsbsec->def_sid = oldsbsec->def_sid;
838 newsbsec->behavior = oldsbsec->behavior;
839
840 if (set_context) {
841 u32 sid = oldsbsec->mntpoint_sid;
842
843 if (!set_fscontext)
844 newsbsec->sid = sid;
845 if (!set_rootcontext) {
846 struct inode *newinode = newsb->s_root->d_inode;
847 struct inode_security_struct *newisec = newinode->i_security;
848 newisec->sid = sid;
849 }
850 newsbsec->mntpoint_sid = sid;
851 }
852 if (set_rootcontext) {
853 const struct inode *oldinode = oldsb->s_root->d_inode;
854 const struct inode_security_struct *oldisec = oldinode->i_security;
855 struct inode *newinode = newsb->s_root->d_inode;
856 struct inode_security_struct *newisec = newinode->i_security;
857
858 newisec->sid = oldisec->sid;
859 }
860
861 sb_finish_set_opts(newsb);
862 mutex_unlock(&newsbsec->lock);
863 return 0;
864 }
865
866 static int selinux_parse_opts_str(char *options,
867 struct security_mnt_opts *opts)
868 {
869 char *p;
870 char *context = NULL, *defcontext = NULL;
871 char *fscontext = NULL, *rootcontext = NULL;
872 int rc, num_mnt_opts = 0;
873
874 opts->num_mnt_opts = 0;
875
876 /* Standard string-based options. */
877 while ((p = strsep(&options, "|")) != NULL) {
878 int token;
879 substring_t args[MAX_OPT_ARGS];
880
881 if (!*p)
882 continue;
883
884 token = match_token(p, tokens, args);
885
886 switch (token) {
887 case Opt_context:
888 if (context || defcontext) {
889 rc = -EINVAL;
890 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
891 goto out_err;
892 }
893 context = match_strdup(&args[0]);
894 if (!context) {
895 rc = -ENOMEM;
896 goto out_err;
897 }
898 break;
899
900 case Opt_fscontext:
901 if (fscontext) {
902 rc = -EINVAL;
903 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
904 goto out_err;
905 }
906 fscontext = match_strdup(&args[0]);
907 if (!fscontext) {
908 rc = -ENOMEM;
909 goto out_err;
910 }
911 break;
912
913 case Opt_rootcontext:
914 if (rootcontext) {
915 rc = -EINVAL;
916 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
917 goto out_err;
918 }
919 rootcontext = match_strdup(&args[0]);
920 if (!rootcontext) {
921 rc = -ENOMEM;
922 goto out_err;
923 }
924 break;
925
926 case Opt_defcontext:
927 if (context || defcontext) {
928 rc = -EINVAL;
929 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
930 goto out_err;
931 }
932 defcontext = match_strdup(&args[0]);
933 if (!defcontext) {
934 rc = -ENOMEM;
935 goto out_err;
936 }
937 break;
938 case Opt_labelsupport:
939 break;
940 default:
941 rc = -EINVAL;
942 printk(KERN_WARNING "SELinux: unknown mount option\n");
943 goto out_err;
944
945 }
946 }
947
948 rc = -ENOMEM;
949 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
950 if (!opts->mnt_opts)
951 goto out_err;
952
953 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
954 if (!opts->mnt_opts_flags) {
955 kfree(opts->mnt_opts);
956 goto out_err;
957 }
958
959 if (fscontext) {
960 opts->mnt_opts[num_mnt_opts] = fscontext;
961 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
962 }
963 if (context) {
964 opts->mnt_opts[num_mnt_opts] = context;
965 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
966 }
967 if (rootcontext) {
968 opts->mnt_opts[num_mnt_opts] = rootcontext;
969 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
970 }
971 if (defcontext) {
972 opts->mnt_opts[num_mnt_opts] = defcontext;
973 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
974 }
975
976 opts->num_mnt_opts = num_mnt_opts;
977 return 0;
978
979 out_err:
980 kfree(context);
981 kfree(defcontext);
982 kfree(fscontext);
983 kfree(rootcontext);
984 return rc;
985 }
986 /*
987 * string mount options parsing and call set the sbsec
988 */
989 static int superblock_doinit(struct super_block *sb, void *data)
990 {
991 int rc = 0;
992 char *options = data;
993 struct security_mnt_opts opts;
994
995 security_init_mnt_opts(&opts);
996
997 if (!data)
998 goto out;
999
1000 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1001
1002 rc = selinux_parse_opts_str(options, &opts);
1003 if (rc)
1004 goto out_err;
1005
1006 out:
1007 rc = selinux_set_mnt_opts(sb, &opts);
1008
1009 out_err:
1010 security_free_mnt_opts(&opts);
1011 return rc;
1012 }
1013
1014 static void selinux_write_opts(struct seq_file *m,
1015 struct security_mnt_opts *opts)
1016 {
1017 int i;
1018 char *prefix;
1019
1020 for (i = 0; i < opts->num_mnt_opts; i++) {
1021 char *has_comma;
1022
1023 if (opts->mnt_opts[i])
1024 has_comma = strchr(opts->mnt_opts[i], ',');
1025 else
1026 has_comma = NULL;
1027
1028 switch (opts->mnt_opts_flags[i]) {
1029 case CONTEXT_MNT:
1030 prefix = CONTEXT_STR;
1031 break;
1032 case FSCONTEXT_MNT:
1033 prefix = FSCONTEXT_STR;
1034 break;
1035 case ROOTCONTEXT_MNT:
1036 prefix = ROOTCONTEXT_STR;
1037 break;
1038 case DEFCONTEXT_MNT:
1039 prefix = DEFCONTEXT_STR;
1040 break;
1041 case SE_SBLABELSUPP:
1042 seq_putc(m, ',');
1043 seq_puts(m, LABELSUPP_STR);
1044 continue;
1045 default:
1046 BUG();
1047 return;
1048 };
1049 /* we need a comma before each option */
1050 seq_putc(m, ',');
1051 seq_puts(m, prefix);
1052 if (has_comma)
1053 seq_putc(m, '\"');
1054 seq_puts(m, opts->mnt_opts[i]);
1055 if (has_comma)
1056 seq_putc(m, '\"');
1057 }
1058 }
1059
1060 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1061 {
1062 struct security_mnt_opts opts;
1063 int rc;
1064
1065 rc = selinux_get_mnt_opts(sb, &opts);
1066 if (rc) {
1067 /* before policy load we may get EINVAL, don't show anything */
1068 if (rc == -EINVAL)
1069 rc = 0;
1070 return rc;
1071 }
1072
1073 selinux_write_opts(m, &opts);
1074
1075 security_free_mnt_opts(&opts);
1076
1077 return rc;
1078 }
1079
1080 static inline u16 inode_mode_to_security_class(umode_t mode)
1081 {
1082 switch (mode & S_IFMT) {
1083 case S_IFSOCK:
1084 return SECCLASS_SOCK_FILE;
1085 case S_IFLNK:
1086 return SECCLASS_LNK_FILE;
1087 case S_IFREG:
1088 return SECCLASS_FILE;
1089 case S_IFBLK:
1090 return SECCLASS_BLK_FILE;
1091 case S_IFDIR:
1092 return SECCLASS_DIR;
1093 case S_IFCHR:
1094 return SECCLASS_CHR_FILE;
1095 case S_IFIFO:
1096 return SECCLASS_FIFO_FILE;
1097
1098 }
1099
1100 return SECCLASS_FILE;
1101 }
1102
1103 static inline int default_protocol_stream(int protocol)
1104 {
1105 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1106 }
1107
1108 static inline int default_protocol_dgram(int protocol)
1109 {
1110 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1111 }
1112
1113 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1114 {
1115 switch (family) {
1116 case PF_UNIX:
1117 switch (type) {
1118 case SOCK_STREAM:
1119 case SOCK_SEQPACKET:
1120 return SECCLASS_UNIX_STREAM_SOCKET;
1121 case SOCK_DGRAM:
1122 return SECCLASS_UNIX_DGRAM_SOCKET;
1123 }
1124 break;
1125 case PF_INET:
1126 case PF_INET6:
1127 switch (type) {
1128 case SOCK_STREAM:
1129 if (default_protocol_stream(protocol))
1130 return SECCLASS_TCP_SOCKET;
1131 else
1132 return SECCLASS_RAWIP_SOCKET;
1133 case SOCK_DGRAM:
1134 if (default_protocol_dgram(protocol))
1135 return SECCLASS_UDP_SOCKET;
1136 else
1137 return SECCLASS_RAWIP_SOCKET;
1138 case SOCK_DCCP:
1139 return SECCLASS_DCCP_SOCKET;
1140 default:
1141 return SECCLASS_RAWIP_SOCKET;
1142 }
1143 break;
1144 case PF_NETLINK:
1145 switch (protocol) {
1146 case NETLINK_ROUTE:
1147 return SECCLASS_NETLINK_ROUTE_SOCKET;
1148 case NETLINK_FIREWALL:
1149 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1150 case NETLINK_SOCK_DIAG:
1151 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1152 case NETLINK_NFLOG:
1153 return SECCLASS_NETLINK_NFLOG_SOCKET;
1154 case NETLINK_XFRM:
1155 return SECCLASS_NETLINK_XFRM_SOCKET;
1156 case NETLINK_SELINUX:
1157 return SECCLASS_NETLINK_SELINUX_SOCKET;
1158 case NETLINK_AUDIT:
1159 return SECCLASS_NETLINK_AUDIT_SOCKET;
1160 case NETLINK_IP6_FW:
1161 return SECCLASS_NETLINK_IP6FW_SOCKET;
1162 case NETLINK_DNRTMSG:
1163 return SECCLASS_NETLINK_DNRT_SOCKET;
1164 case NETLINK_KOBJECT_UEVENT:
1165 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1166 default:
1167 return SECCLASS_NETLINK_SOCKET;
1168 }
1169 case PF_PACKET:
1170 return SECCLASS_PACKET_SOCKET;
1171 case PF_KEY:
1172 return SECCLASS_KEY_SOCKET;
1173 case PF_APPLETALK:
1174 return SECCLASS_APPLETALK_SOCKET;
1175 }
1176
1177 return SECCLASS_SOCKET;
1178 }
1179
1180 #ifdef CONFIG_PROC_FS
1181 static int selinux_proc_get_sid(struct dentry *dentry,
1182 u16 tclass,
1183 u32 *sid)
1184 {
1185 int rc;
1186 char *buffer, *path;
1187
1188 buffer = (char *)__get_free_page(GFP_KERNEL);
1189 if (!buffer)
1190 return -ENOMEM;
1191
1192 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1193 if (IS_ERR(path))
1194 rc = PTR_ERR(path);
1195 else {
1196 /* each process gets a /proc/PID/ entry. Strip off the
1197 * PID part to get a valid selinux labeling.
1198 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1199 while (path[1] >= '0' && path[1] <= '9') {
1200 path[1] = '/';
1201 path++;
1202 }
1203 rc = security_genfs_sid("proc", path, tclass, sid);
1204 }
1205 free_page((unsigned long)buffer);
1206 return rc;
1207 }
1208 #else
1209 static int selinux_proc_get_sid(struct dentry *dentry,
1210 u16 tclass,
1211 u32 *sid)
1212 {
1213 return -EINVAL;
1214 }
1215 #endif
1216
1217 /* The inode's security attributes must be initialized before first use. */
1218 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1219 {
1220 struct superblock_security_struct *sbsec = NULL;
1221 struct inode_security_struct *isec = inode->i_security;
1222 u32 sid;
1223 struct dentry *dentry;
1224 #define INITCONTEXTLEN 255
1225 char *context = NULL;
1226 unsigned len = 0;
1227 int rc = 0;
1228
1229 if (isec->initialized)
1230 goto out;
1231
1232 mutex_lock(&isec->lock);
1233 if (isec->initialized)
1234 goto out_unlock;
1235
1236 sbsec = inode->i_sb->s_security;
1237 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1238 /* Defer initialization until selinux_complete_init,
1239 after the initial policy is loaded and the security
1240 server is ready to handle calls. */
1241 spin_lock(&sbsec->isec_lock);
1242 if (list_empty(&isec->list))
1243 list_add(&isec->list, &sbsec->isec_head);
1244 spin_unlock(&sbsec->isec_lock);
1245 goto out_unlock;
1246 }
1247
1248 switch (sbsec->behavior) {
1249 case SECURITY_FS_USE_XATTR:
1250 if (!inode->i_op->getxattr) {
1251 isec->sid = sbsec->def_sid;
1252 break;
1253 }
1254
1255 /* Need a dentry, since the xattr API requires one.
1256 Life would be simpler if we could just pass the inode. */
1257 if (opt_dentry) {
1258 /* Called from d_instantiate or d_splice_alias. */
1259 dentry = dget(opt_dentry);
1260 } else {
1261 /* Called from selinux_complete_init, try to find a dentry. */
1262 dentry = d_find_alias(inode);
1263 }
1264 if (!dentry) {
1265 /*
1266 * this is can be hit on boot when a file is accessed
1267 * before the policy is loaded. When we load policy we
1268 * may find inodes that have no dentry on the
1269 * sbsec->isec_head list. No reason to complain as these
1270 * will get fixed up the next time we go through
1271 * inode_doinit with a dentry, before these inodes could
1272 * be used again by userspace.
1273 */
1274 goto out_unlock;
1275 }
1276
1277 len = INITCONTEXTLEN;
1278 context = kmalloc(len+1, GFP_NOFS);
1279 if (!context) {
1280 rc = -ENOMEM;
1281 dput(dentry);
1282 goto out_unlock;
1283 }
1284 context[len] = '\0';
1285 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1286 context, len);
1287 if (rc == -ERANGE) {
1288 kfree(context);
1289
1290 /* Need a larger buffer. Query for the right size. */
1291 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1292 NULL, 0);
1293 if (rc < 0) {
1294 dput(dentry);
1295 goto out_unlock;
1296 }
1297 len = rc;
1298 context = kmalloc(len+1, GFP_NOFS);
1299 if (!context) {
1300 rc = -ENOMEM;
1301 dput(dentry);
1302 goto out_unlock;
1303 }
1304 context[len] = '\0';
1305 rc = inode->i_op->getxattr(dentry,
1306 XATTR_NAME_SELINUX,
1307 context, len);
1308 }
1309 dput(dentry);
1310 if (rc < 0) {
1311 if (rc != -ENODATA) {
1312 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1313 "%d for dev=%s ino=%ld\n", __func__,
1314 -rc, inode->i_sb->s_id, inode->i_ino);
1315 kfree(context);
1316 goto out_unlock;
1317 }
1318 /* Map ENODATA to the default file SID */
1319 sid = sbsec->def_sid;
1320 rc = 0;
1321 } else {
1322 rc = security_context_to_sid_default(context, rc, &sid,
1323 sbsec->def_sid,
1324 GFP_NOFS);
1325 if (rc) {
1326 char *dev = inode->i_sb->s_id;
1327 unsigned long ino = inode->i_ino;
1328
1329 if (rc == -EINVAL) {
1330 if (printk_ratelimit())
1331 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1332 "context=%s. This indicates you may need to relabel the inode or the "
1333 "filesystem in question.\n", ino, dev, context);
1334 } else {
1335 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1336 "returned %d for dev=%s ino=%ld\n",
1337 __func__, context, -rc, dev, ino);
1338 }
1339 kfree(context);
1340 /* Leave with the unlabeled SID */
1341 rc = 0;
1342 break;
1343 }
1344 }
1345 kfree(context);
1346 isec->sid = sid;
1347 break;
1348 case SECURITY_FS_USE_TASK:
1349 isec->sid = isec->task_sid;
1350 break;
1351 case SECURITY_FS_USE_TRANS:
1352 /* Default to the fs SID. */
1353 isec->sid = sbsec->sid;
1354
1355 /* Try to obtain a transition SID. */
1356 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1357 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1358 isec->sclass, NULL, &sid);
1359 if (rc)
1360 goto out_unlock;
1361 isec->sid = sid;
1362 break;
1363 case SECURITY_FS_USE_MNTPOINT:
1364 isec->sid = sbsec->mntpoint_sid;
1365 break;
1366 default:
1367 /* Default to the fs superblock SID. */
1368 isec->sid = sbsec->sid;
1369
1370 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1371 /* We must have a dentry to determine the label on
1372 * procfs inodes */
1373 if (opt_dentry)
1374 /* Called from d_instantiate or
1375 * d_splice_alias. */
1376 dentry = dget(opt_dentry);
1377 else
1378 /* Called from selinux_complete_init, try to
1379 * find a dentry. */
1380 dentry = d_find_alias(inode);
1381 /*
1382 * This can be hit on boot when a file is accessed
1383 * before the policy is loaded. When we load policy we
1384 * may find inodes that have no dentry on the
1385 * sbsec->isec_head list. No reason to complain as
1386 * these will get fixed up the next time we go through
1387 * inode_doinit() with a dentry, before these inodes
1388 * could be used again by userspace.
1389 */
1390 if (!dentry)
1391 goto out_unlock;
1392 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1393 rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1394 dput(dentry);
1395 if (rc)
1396 goto out_unlock;
1397 isec->sid = sid;
1398 }
1399 break;
1400 }
1401
1402 isec->initialized = 1;
1403
1404 out_unlock:
1405 mutex_unlock(&isec->lock);
1406 out:
1407 if (isec->sclass == SECCLASS_FILE)
1408 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1409 return rc;
1410 }
1411
1412 /* Convert a Linux signal to an access vector. */
1413 static inline u32 signal_to_av(int sig)
1414 {
1415 u32 perm = 0;
1416
1417 switch (sig) {
1418 case SIGCHLD:
1419 /* Commonly granted from child to parent. */
1420 perm = PROCESS__SIGCHLD;
1421 break;
1422 case SIGKILL:
1423 /* Cannot be caught or ignored */
1424 perm = PROCESS__SIGKILL;
1425 break;
1426 case SIGSTOP:
1427 /* Cannot be caught or ignored */
1428 perm = PROCESS__SIGSTOP;
1429 break;
1430 default:
1431 /* All other signals. */
1432 perm = PROCESS__SIGNAL;
1433 break;
1434 }
1435
1436 return perm;
1437 }
1438
1439 /*
1440 * Check permission between a pair of credentials
1441 * fork check, ptrace check, etc.
1442 */
1443 static int cred_has_perm(const struct cred *actor,
1444 const struct cred *target,
1445 u32 perms)
1446 {
1447 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1448
1449 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1450 }
1451
1452 /*
1453 * Check permission between a pair of tasks, e.g. signal checks,
1454 * fork check, ptrace check, etc.
1455 * tsk1 is the actor and tsk2 is the target
1456 * - this uses the default subjective creds of tsk1
1457 */
1458 static int task_has_perm(const struct task_struct *tsk1,
1459 const struct task_struct *tsk2,
1460 u32 perms)
1461 {
1462 const struct task_security_struct *__tsec1, *__tsec2;
1463 u32 sid1, sid2;
1464
1465 rcu_read_lock();
1466 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1467 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1468 rcu_read_unlock();
1469 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1470 }
1471
1472 /*
1473 * Check permission between current and another task, e.g. signal checks,
1474 * fork check, ptrace check, etc.
1475 * current is the actor and tsk2 is the target
1476 * - this uses current's subjective creds
1477 */
1478 static int current_has_perm(const struct task_struct *tsk,
1479 u32 perms)
1480 {
1481 u32 sid, tsid;
1482
1483 sid = current_sid();
1484 tsid = task_sid(tsk);
1485 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1486 }
1487
1488 #if CAP_LAST_CAP > 63
1489 #error Fix SELinux to handle capabilities > 63.
1490 #endif
1491
1492 /* Check whether a task is allowed to use a capability. */
1493 static int cred_has_capability(const struct cred *cred,
1494 int cap, int audit)
1495 {
1496 struct common_audit_data ad;
1497 struct av_decision avd;
1498 u16 sclass;
1499 u32 sid = cred_sid(cred);
1500 u32 av = CAP_TO_MASK(cap);
1501 int rc;
1502
1503 ad.type = LSM_AUDIT_DATA_CAP;
1504 ad.u.cap = cap;
1505
1506 switch (CAP_TO_INDEX(cap)) {
1507 case 0:
1508 sclass = SECCLASS_CAPABILITY;
1509 break;
1510 case 1:
1511 sclass = SECCLASS_CAPABILITY2;
1512 break;
1513 default:
1514 printk(KERN_ERR
1515 "SELinux: out of range capability %d\n", cap);
1516 BUG();
1517 return -EINVAL;
1518 }
1519
1520 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1521 if (audit == SECURITY_CAP_AUDIT) {
1522 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1523 if (rc2)
1524 return rc2;
1525 }
1526 return rc;
1527 }
1528
1529 /* Check whether a task is allowed to use a system operation. */
1530 static int task_has_system(struct task_struct *tsk,
1531 u32 perms)
1532 {
1533 u32 sid = task_sid(tsk);
1534
1535 return avc_has_perm(sid, SECINITSID_KERNEL,
1536 SECCLASS_SYSTEM, perms, NULL);
1537 }
1538
1539 /* Check whether a task has a particular permission to an inode.
1540 The 'adp' parameter is optional and allows other audit
1541 data to be passed (e.g. the dentry). */
1542 static int inode_has_perm(const struct cred *cred,
1543 struct inode *inode,
1544 u32 perms,
1545 struct common_audit_data *adp,
1546 unsigned flags)
1547 {
1548 struct inode_security_struct *isec;
1549 u32 sid;
1550
1551 validate_creds(cred);
1552
1553 if (unlikely(IS_PRIVATE(inode)))
1554 return 0;
1555
1556 sid = cred_sid(cred);
1557 isec = inode->i_security;
1558
1559 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1560 }
1561
1562 /* Same as inode_has_perm, but pass explicit audit data containing
1563 the dentry to help the auditing code to more easily generate the
1564 pathname if needed. */
1565 static inline int dentry_has_perm(const struct cred *cred,
1566 struct dentry *dentry,
1567 u32 av)
1568 {
1569 struct inode *inode = dentry->d_inode;
1570 struct common_audit_data ad;
1571
1572 ad.type = LSM_AUDIT_DATA_DENTRY;
1573 ad.u.dentry = dentry;
1574 return inode_has_perm(cred, inode, av, &ad, 0);
1575 }
1576
1577 /* Same as inode_has_perm, but pass explicit audit data containing
1578 the path to help the auditing code to more easily generate the
1579 pathname if needed. */
1580 static inline int path_has_perm(const struct cred *cred,
1581 struct path *path,
1582 u32 av)
1583 {
1584 struct inode *inode = path->dentry->d_inode;
1585 struct common_audit_data ad;
1586
1587 ad.type = LSM_AUDIT_DATA_PATH;
1588 ad.u.path = *path;
1589 return inode_has_perm(cred, inode, av, &ad, 0);
1590 }
1591
1592 /* Check whether a task can use an open file descriptor to
1593 access an inode in a given way. Check access to the
1594 descriptor itself, and then use dentry_has_perm to
1595 check a particular permission to the file.
1596 Access to the descriptor is implicitly granted if it
1597 has the same SID as the process. If av is zero, then
1598 access to the file is not checked, e.g. for cases
1599 where only the descriptor is affected like seek. */
1600 static int file_has_perm(const struct cred *cred,
1601 struct file *file,
1602 u32 av)
1603 {
1604 struct file_security_struct *fsec = file->f_security;
1605 struct inode *inode = file_inode(file);
1606 struct common_audit_data ad;
1607 u32 sid = cred_sid(cred);
1608 int rc;
1609
1610 ad.type = LSM_AUDIT_DATA_PATH;
1611 ad.u.path = file->f_path;
1612
1613 if (sid != fsec->sid) {
1614 rc = avc_has_perm(sid, fsec->sid,
1615 SECCLASS_FD,
1616 FD__USE,
1617 &ad);
1618 if (rc)
1619 goto out;
1620 }
1621
1622 /* av is zero if only checking access to the descriptor. */
1623 rc = 0;
1624 if (av)
1625 rc = inode_has_perm(cred, inode, av, &ad, 0);
1626
1627 out:
1628 return rc;
1629 }
1630
1631 /* Check whether a task can create a file. */
1632 static int may_create(struct inode *dir,
1633 struct dentry *dentry,
1634 u16 tclass)
1635 {
1636 const struct task_security_struct *tsec = current_security();
1637 struct inode_security_struct *dsec;
1638 struct superblock_security_struct *sbsec;
1639 u32 sid, newsid;
1640 struct common_audit_data ad;
1641 int rc;
1642
1643 dsec = dir->i_security;
1644 sbsec = dir->i_sb->s_security;
1645
1646 sid = tsec->sid;
1647 newsid = tsec->create_sid;
1648
1649 ad.type = LSM_AUDIT_DATA_DENTRY;
1650 ad.u.dentry = dentry;
1651
1652 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1653 DIR__ADD_NAME | DIR__SEARCH,
1654 &ad);
1655 if (rc)
1656 return rc;
1657
1658 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1659 rc = security_transition_sid(sid, dsec->sid, tclass,
1660 &dentry->d_name, &newsid);
1661 if (rc)
1662 return rc;
1663 }
1664
1665 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1666 if (rc)
1667 return rc;
1668
1669 return avc_has_perm(newsid, sbsec->sid,
1670 SECCLASS_FILESYSTEM,
1671 FILESYSTEM__ASSOCIATE, &ad);
1672 }
1673
1674 /* Check whether a task can create a key. */
1675 static int may_create_key(u32 ksid,
1676 struct task_struct *ctx)
1677 {
1678 u32 sid = task_sid(ctx);
1679
1680 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1681 }
1682
1683 #define MAY_LINK 0
1684 #define MAY_UNLINK 1
1685 #define MAY_RMDIR 2
1686
1687 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1688 static int may_link(struct inode *dir,
1689 struct dentry *dentry,
1690 int kind)
1691
1692 {
1693 struct inode_security_struct *dsec, *isec;
1694 struct common_audit_data ad;
1695 u32 sid = current_sid();
1696 u32 av;
1697 int rc;
1698
1699 dsec = dir->i_security;
1700 isec = dentry->d_inode->i_security;
1701
1702 ad.type = LSM_AUDIT_DATA_DENTRY;
1703 ad.u.dentry = dentry;
1704
1705 av = DIR__SEARCH;
1706 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1707 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1708 if (rc)
1709 return rc;
1710
1711 switch (kind) {
1712 case MAY_LINK:
1713 av = FILE__LINK;
1714 break;
1715 case MAY_UNLINK:
1716 av = FILE__UNLINK;
1717 break;
1718 case MAY_RMDIR:
1719 av = DIR__RMDIR;
1720 break;
1721 default:
1722 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1723 __func__, kind);
1724 return 0;
1725 }
1726
1727 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1728 return rc;
1729 }
1730
1731 static inline int may_rename(struct inode *old_dir,
1732 struct dentry *old_dentry,
1733 struct inode *new_dir,
1734 struct dentry *new_dentry)
1735 {
1736 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1737 struct common_audit_data ad;
1738 u32 sid = current_sid();
1739 u32 av;
1740 int old_is_dir, new_is_dir;
1741 int rc;
1742
1743 old_dsec = old_dir->i_security;
1744 old_isec = old_dentry->d_inode->i_security;
1745 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1746 new_dsec = new_dir->i_security;
1747
1748 ad.type = LSM_AUDIT_DATA_DENTRY;
1749
1750 ad.u.dentry = old_dentry;
1751 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1752 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1753 if (rc)
1754 return rc;
1755 rc = avc_has_perm(sid, old_isec->sid,
1756 old_isec->sclass, FILE__RENAME, &ad);
1757 if (rc)
1758 return rc;
1759 if (old_is_dir && new_dir != old_dir) {
1760 rc = avc_has_perm(sid, old_isec->sid,
1761 old_isec->sclass, DIR__REPARENT, &ad);
1762 if (rc)
1763 return rc;
1764 }
1765
1766 ad.u.dentry = new_dentry;
1767 av = DIR__ADD_NAME | DIR__SEARCH;
1768 if (new_dentry->d_inode)
1769 av |= DIR__REMOVE_NAME;
1770 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1771 if (rc)
1772 return rc;
1773 if (new_dentry->d_inode) {
1774 new_isec = new_dentry->d_inode->i_security;
1775 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1776 rc = avc_has_perm(sid, new_isec->sid,
1777 new_isec->sclass,
1778 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1779 if (rc)
1780 return rc;
1781 }
1782
1783 return 0;
1784 }
1785
1786 /* Check whether a task can perform a filesystem operation. */
1787 static int superblock_has_perm(const struct cred *cred,
1788 struct super_block *sb,
1789 u32 perms,
1790 struct common_audit_data *ad)
1791 {
1792 struct superblock_security_struct *sbsec;
1793 u32 sid = cred_sid(cred);
1794
1795 sbsec = sb->s_security;
1796 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1797 }
1798
1799 /* Convert a Linux mode and permission mask to an access vector. */
1800 static inline u32 file_mask_to_av(int mode, int mask)
1801 {
1802 u32 av = 0;
1803
1804 if (!S_ISDIR(mode)) {
1805 if (mask & MAY_EXEC)
1806 av |= FILE__EXECUTE;
1807 if (mask & MAY_READ)
1808 av |= FILE__READ;
1809
1810 if (mask & MAY_APPEND)
1811 av |= FILE__APPEND;
1812 else if (mask & MAY_WRITE)
1813 av |= FILE__WRITE;
1814
1815 } else {
1816 if (mask & MAY_EXEC)
1817 av |= DIR__SEARCH;
1818 if (mask & MAY_WRITE)
1819 av |= DIR__WRITE;
1820 if (mask & MAY_READ)
1821 av |= DIR__READ;
1822 }
1823
1824 return av;
1825 }
1826
1827 /* Convert a Linux file to an access vector. */
1828 static inline u32 file_to_av(struct file *file)
1829 {
1830 u32 av = 0;
1831
1832 if (file->f_mode & FMODE_READ)
1833 av |= FILE__READ;
1834 if (file->f_mode & FMODE_WRITE) {
1835 if (file->f_flags & O_APPEND)
1836 av |= FILE__APPEND;
1837 else
1838 av |= FILE__WRITE;
1839 }
1840 if (!av) {
1841 /*
1842 * Special file opened with flags 3 for ioctl-only use.
1843 */
1844 av = FILE__IOCTL;
1845 }
1846
1847 return av;
1848 }
1849
1850 /*
1851 * Convert a file to an access vector and include the correct open
1852 * open permission.
1853 */
1854 static inline u32 open_file_to_av(struct file *file)
1855 {
1856 u32 av = file_to_av(file);
1857
1858 if (selinux_policycap_openperm)
1859 av |= FILE__OPEN;
1860
1861 return av;
1862 }
1863
1864 /* Hook functions begin here. */
1865
1866 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1867 {
1868 u32 mysid = current_sid();
1869 u32 mgrsid = task_sid(mgr);
1870
1871 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL);
1872 }
1873
1874 static int selinux_binder_transaction(struct task_struct *from, struct task_struct *to)
1875 {
1876 u32 mysid = current_sid();
1877 u32 fromsid = task_sid(from);
1878 u32 tosid = task_sid(to);
1879 int rc;
1880
1881 if (mysid != fromsid) {
1882 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, BINDER__IMPERSONATE, NULL);
1883 if (rc)
1884 return rc;
1885 }
1886
1887 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, NULL);
1888 }
1889
1890 static int selinux_binder_transfer_binder(struct task_struct *from, struct task_struct *to)
1891 {
1892 u32 fromsid = task_sid(from);
1893 u32 tosid = task_sid(to);
1894 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, NULL);
1895 }
1896
1897 static int selinux_binder_transfer_file(struct task_struct *from, struct task_struct *to, struct file *file)
1898 {
1899 u32 sid = task_sid(to);
1900 struct file_security_struct *fsec = file->f_security;
1901 struct inode *inode = file->f_path.dentry->d_inode;
1902 struct inode_security_struct *isec = inode->i_security;
1903 struct common_audit_data ad;
1904 struct selinux_audit_data sad = {0,};
1905 int rc;
1906
1907 ad.type = LSM_AUDIT_DATA_PATH;
1908 ad.u.path = file->f_path;
1909 ad.selinux_audit_data = &sad;
1910
1911 if (sid != fsec->sid) {
1912 rc = avc_has_perm(sid, fsec->sid,
1913 SECCLASS_FD,
1914 FD__USE,
1915 &ad);
1916 if (rc)
1917 return rc;
1918 }
1919
1920 if (unlikely(IS_PRIVATE(inode)))
1921 return 0;
1922
1923 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1924 &ad);
1925 }
1926
1927 static int selinux_ptrace_access_check(struct task_struct *child,
1928 unsigned int mode)
1929 {
1930 int rc;
1931
1932 rc = cap_ptrace_access_check(child, mode);
1933 if (rc)
1934 return rc;
1935
1936 if (mode & PTRACE_MODE_READ) {
1937 u32 sid = current_sid();
1938 u32 csid = task_sid(child);
1939 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1940 }
1941
1942 return current_has_perm(child, PROCESS__PTRACE);
1943 }
1944
1945 static int selinux_ptrace_traceme(struct task_struct *parent)
1946 {
1947 int rc;
1948
1949 rc = cap_ptrace_traceme(parent);
1950 if (rc)
1951 return rc;
1952
1953 return task_has_perm(parent, current, PROCESS__PTRACE);
1954 }
1955
1956 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1957 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1958 {
1959 int error;
1960
1961 error = current_has_perm(target, PROCESS__GETCAP);
1962 if (error)
1963 return error;
1964
1965 return cap_capget(target, effective, inheritable, permitted);
1966 }
1967
1968 static int selinux_capset(struct cred *new, const struct cred *old,
1969 const kernel_cap_t *effective,
1970 const kernel_cap_t *inheritable,
1971 const kernel_cap_t *permitted)
1972 {
1973 int error;
1974
1975 error = cap_capset(new, old,
1976 effective, inheritable, permitted);
1977 if (error)
1978 return error;
1979
1980 return cred_has_perm(old, new, PROCESS__SETCAP);
1981 }
1982
1983 /*
1984 * (This comment used to live with the selinux_task_setuid hook,
1985 * which was removed).
1986 *
1987 * Since setuid only affects the current process, and since the SELinux
1988 * controls are not based on the Linux identity attributes, SELinux does not
1989 * need to control this operation. However, SELinux does control the use of
1990 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1991 */
1992
1993 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1994 int cap, int audit)
1995 {
1996 int rc;
1997
1998 rc = cap_capable(cred, ns, cap, audit);
1999 if (rc)
2000 return rc;
2001
2002 return cred_has_capability(cred, cap, audit);
2003 }
2004
2005 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2006 {
2007 const struct cred *cred = current_cred();
2008 int rc = 0;
2009
2010 if (!sb)
2011 return 0;
2012
2013 switch (cmds) {
2014 case Q_SYNC:
2015 case Q_QUOTAON:
2016 case Q_QUOTAOFF:
2017 case Q_SETINFO:
2018 case Q_SETQUOTA:
2019 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2020 break;
2021 case Q_GETFMT:
2022 case Q_GETINFO:
2023 case Q_GETQUOTA:
2024 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2025 break;
2026 default:
2027 rc = 0; /* let the kernel handle invalid cmds */
2028 break;
2029 }
2030 return rc;
2031 }
2032
2033 static int selinux_quota_on(struct dentry *dentry)
2034 {
2035 const struct cred *cred = current_cred();
2036
2037 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2038 }
2039
2040 static int selinux_syslog(int type)
2041 {
2042 int rc;
2043
2044 switch (type) {
2045 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2046 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2047 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2048 break;
2049 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2050 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2051 /* Set level of messages printed to console */
2052 case SYSLOG_ACTION_CONSOLE_LEVEL:
2053 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2054 break;
2055 case SYSLOG_ACTION_CLOSE: /* Close log */
2056 case SYSLOG_ACTION_OPEN: /* Open log */
2057 case SYSLOG_ACTION_READ: /* Read from log */
2058 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2059 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2060 default:
2061 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2062 break;
2063 }
2064 return rc;
2065 }
2066
2067 /*
2068 * Check that a process has enough memory to allocate a new virtual
2069 * mapping. 0 means there is enough memory for the allocation to
2070 * succeed and -ENOMEM implies there is not.
2071 *
2072 * Do not audit the selinux permission check, as this is applied to all
2073 * processes that allocate mappings.
2074 */
2075 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2076 {
2077 int rc, cap_sys_admin = 0;
2078
2079 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2080 SECURITY_CAP_NOAUDIT);
2081 if (rc == 0)
2082 cap_sys_admin = 1;
2083
2084 return __vm_enough_memory(mm, pages, cap_sys_admin);
2085 }
2086
2087 /* binprm security operations */
2088
2089 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2090 {
2091 const struct task_security_struct *old_tsec;
2092 struct task_security_struct *new_tsec;
2093 struct inode_security_struct *isec;
2094 struct common_audit_data ad;
2095 struct inode *inode = file_inode(bprm->file);
2096 int rc;
2097
2098 rc = cap_bprm_set_creds(bprm);
2099 if (rc)
2100 return rc;
2101
2102 /* SELinux context only depends on initial program or script and not
2103 * the script interpreter */
2104 if (bprm->cred_prepared)
2105 return 0;
2106
2107 old_tsec = current_security();
2108 new_tsec = bprm->cred->security;
2109 isec = inode->i_security;
2110
2111 /* Default to the current task SID. */
2112 new_tsec->sid = old_tsec->sid;
2113 new_tsec->osid = old_tsec->sid;
2114
2115 /* Reset fs, key, and sock SIDs on execve. */
2116 new_tsec->create_sid = 0;
2117 new_tsec->keycreate_sid = 0;
2118 new_tsec->sockcreate_sid = 0;
2119
2120 if (old_tsec->exec_sid) {
2121 new_tsec->sid = old_tsec->exec_sid;
2122 /* Reset exec SID on execve. */
2123 new_tsec->exec_sid = 0;
2124
2125 /*
2126 * Minimize confusion: if no_new_privs and a transition is
2127 * explicitly requested, then fail the exec.
2128 */
2129 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2130 return -EPERM;
2131 } else {
2132 /* Check for a default transition on this program. */
2133 rc = security_transition_sid(old_tsec->sid, isec->sid,
2134 SECCLASS_PROCESS, NULL,
2135 &new_tsec->sid);
2136 if (rc)
2137 return rc;
2138 }
2139
2140 ad.type = LSM_AUDIT_DATA_PATH;
2141 ad.u.path = bprm->file->f_path;
2142
2143 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2144 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2145 new_tsec->sid = old_tsec->sid;
2146
2147 if (new_tsec->sid == old_tsec->sid) {
2148 rc = avc_has_perm(old_tsec->sid, isec->sid,
2149 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2150 if (rc)
2151 return rc;
2152 } else {
2153 /* Check permissions for the transition. */
2154 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2155 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2156 if (rc)
2157 return rc;
2158
2159 rc = avc_has_perm(new_tsec->sid, isec->sid,
2160 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2161 if (rc)
2162 return rc;
2163
2164 /* Check for shared state */
2165 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2166 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2167 SECCLASS_PROCESS, PROCESS__SHARE,
2168 NULL);
2169 if (rc)
2170 return -EPERM;
2171 }
2172
2173 /* Make sure that anyone attempting to ptrace over a task that
2174 * changes its SID has the appropriate permit */
2175 if (bprm->unsafe &
2176 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2177 struct task_struct *tracer;
2178 struct task_security_struct *sec;
2179 u32 ptsid = 0;
2180
2181 rcu_read_lock();
2182 tracer = ptrace_parent(current);
2183 if (likely(tracer != NULL)) {
2184 sec = __task_cred(tracer)->security;
2185 ptsid = sec->sid;
2186 }
2187 rcu_read_unlock();
2188
2189 if (ptsid != 0) {
2190 rc = avc_has_perm(ptsid, new_tsec->sid,
2191 SECCLASS_PROCESS,
2192 PROCESS__PTRACE, NULL);
2193 if (rc)
2194 return -EPERM;
2195 }
2196 }
2197
2198 /* Clear any possibly unsafe personality bits on exec: */
2199 bprm->per_clear |= PER_CLEAR_ON_SETID;
2200 }
2201
2202 return 0;
2203 }
2204
2205 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2206 {
2207 const struct task_security_struct *tsec = current_security();
2208 u32 sid, osid;
2209 int atsecure = 0;
2210
2211 sid = tsec->sid;
2212 osid = tsec->osid;
2213
2214 if (osid != sid) {
2215 /* Enable secure mode for SIDs transitions unless
2216 the noatsecure permission is granted between
2217 the two SIDs, i.e. ahp returns 0. */
2218 atsecure = avc_has_perm(osid, sid,
2219 SECCLASS_PROCESS,
2220 PROCESS__NOATSECURE, NULL);
2221 }
2222
2223 return (atsecure || cap_bprm_secureexec(bprm));
2224 }
2225
2226 static int match_file(const void *p, struct file *file, unsigned fd)
2227 {
2228 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2229 }
2230
2231 /* Derived from fs/exec.c:flush_old_files. */
2232 static inline void flush_unauthorized_files(const struct cred *cred,
2233 struct files_struct *files)
2234 {
2235 struct file *file, *devnull = NULL;
2236 struct tty_struct *tty;
2237 int drop_tty = 0;
2238 unsigned n;
2239
2240 tty = get_current_tty();
2241 if (tty) {
2242 spin_lock(&tty_files_lock);
2243 if (!list_empty(&tty->tty_files)) {
2244 struct tty_file_private *file_priv;
2245
2246 /* Revalidate access to controlling tty.
2247 Use path_has_perm on the tty path directly rather
2248 than using file_has_perm, as this particular open
2249 file may belong to another process and we are only
2250 interested in the inode-based check here. */
2251 file_priv = list_first_entry(&tty->tty_files,
2252 struct tty_file_private, list);
2253 file = file_priv->file;
2254 if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2255 drop_tty = 1;
2256 }
2257 spin_unlock(&tty_files_lock);
2258 tty_kref_put(tty);
2259 }
2260 /* Reset controlling tty. */
2261 if (drop_tty)
2262 no_tty();
2263
2264 /* Revalidate access to inherited open files. */
2265 n = iterate_fd(files, 0, match_file, cred);
2266 if (!n) /* none found? */
2267 return;
2268
2269 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2270 if (IS_ERR(devnull))
2271 devnull = NULL;
2272 /* replace all the matching ones with this */
2273 do {
2274 replace_fd(n - 1, devnull, 0);
2275 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2276 if (devnull)
2277 fput(devnull);
2278 }
2279
2280 /*
2281 * Prepare a process for imminent new credential changes due to exec
2282 */
2283 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2284 {
2285 struct task_security_struct *new_tsec;
2286 struct rlimit *rlim, *initrlim;
2287 int rc, i;
2288
2289 new_tsec = bprm->cred->security;
2290 if (new_tsec->sid == new_tsec->osid)
2291 return;
2292
2293 /* Close files for which the new task SID is not authorized. */
2294 flush_unauthorized_files(bprm->cred, current->files);
2295
2296 /* Always clear parent death signal on SID transitions. */
2297 current->pdeath_signal = 0;
2298
2299 /* Check whether the new SID can inherit resource limits from the old
2300 * SID. If not, reset all soft limits to the lower of the current
2301 * task's hard limit and the init task's soft limit.
2302 *
2303 * Note that the setting of hard limits (even to lower them) can be
2304 * controlled by the setrlimit check. The inclusion of the init task's
2305 * soft limit into the computation is to avoid resetting soft limits
2306 * higher than the default soft limit for cases where the default is
2307 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2308 */
2309 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2310 PROCESS__RLIMITINH, NULL);
2311 if (rc) {
2312 /* protect against do_prlimit() */
2313 task_lock(current);
2314 for (i = 0; i < RLIM_NLIMITS; i++) {
2315 rlim = current->signal->rlim + i;
2316 initrlim = init_task.signal->rlim + i;
2317 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2318 }
2319 task_unlock(current);
2320 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2321 }
2322 }
2323
2324 /*
2325 * Clean up the process immediately after the installation of new credentials
2326 * due to exec
2327 */
2328 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2329 {
2330 const struct task_security_struct *tsec = current_security();
2331 struct itimerval itimer;
2332 u32 osid, sid;
2333 int rc, i;
2334
2335 osid = tsec->osid;
2336 sid = tsec->sid;
2337
2338 if (sid == osid)
2339 return;
2340
2341 /* Check whether the new SID can inherit signal state from the old SID.
2342 * If not, clear itimers to avoid subsequent signal generation and
2343 * flush and unblock signals.
2344 *
2345 * This must occur _after_ the task SID has been updated so that any
2346 * kill done after the flush will be checked against the new SID.
2347 */
2348 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2349 if (rc) {
2350 memset(&itimer, 0, sizeof itimer);
2351 for (i = 0; i < 3; i++)
2352 do_setitimer(i, &itimer, NULL);
2353 spin_lock_irq(&current->sighand->siglock);
2354 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2355 __flush_signals(current);
2356 flush_signal_handlers(current, 1);
2357 sigemptyset(&current->blocked);
2358 }
2359 spin_unlock_irq(&current->sighand->siglock);
2360 }
2361
2362 /* Wake up the parent if it is waiting so that it can recheck
2363 * wait permission to the new task SID. */
2364 read_lock(&tasklist_lock);
2365 __wake_up_parent(current, current->real_parent);
2366 read_unlock(&tasklist_lock);
2367 }
2368
2369 /* superblock security operations */
2370
2371 static int selinux_sb_alloc_security(struct super_block *sb)
2372 {
2373 return superblock_alloc_security(sb);
2374 }
2375
2376 static void selinux_sb_free_security(struct super_block *sb)
2377 {
2378 superblock_free_security(sb);
2379 }
2380
2381 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2382 {
2383 if (plen > olen)
2384 return 0;
2385
2386 return !memcmp(prefix, option, plen);
2387 }
2388
2389 static inline int selinux_option(char *option, int len)
2390 {
2391 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2392 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2393 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2394 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2395 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2396 }
2397
2398 static inline void take_option(char **to, char *from, int *first, int len)
2399 {
2400 if (!*first) {
2401 **to = ',';
2402 *to += 1;
2403 } else
2404 *first = 0;
2405 memcpy(*to, from, len);
2406 *to += len;
2407 }
2408
2409 static inline void take_selinux_option(char **to, char *from, int *first,
2410 int len)
2411 {
2412 int current_size = 0;
2413
2414 if (!*first) {
2415 **to = '|';
2416 *to += 1;
2417 } else
2418 *first = 0;
2419
2420 while (current_size < len) {
2421 if (*from != '"') {
2422 **to = *from;
2423 *to += 1;
2424 }
2425 from += 1;
2426 current_size += 1;
2427 }
2428 }
2429
2430 static int selinux_sb_copy_data(char *orig, char *copy)
2431 {
2432 int fnosec, fsec, rc = 0;
2433 char *in_save, *in_curr, *in_end;
2434 char *sec_curr, *nosec_save, *nosec;
2435 int open_quote = 0;
2436
2437 in_curr = orig;
2438 sec_curr = copy;
2439
2440 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2441 if (!nosec) {
2442 rc = -ENOMEM;
2443 goto out;
2444 }
2445
2446 nosec_save = nosec;
2447 fnosec = fsec = 1;
2448 in_save = in_end = orig;
2449
2450 do {
2451 if (*in_end == '"')
2452 open_quote = !open_quote;
2453 if ((*in_end == ',' && open_quote == 0) ||
2454 *in_end == '\0') {
2455 int len = in_end - in_curr;
2456
2457 if (selinux_option(in_curr, len))
2458 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2459 else
2460 take_option(&nosec, in_curr, &fnosec, len);
2461
2462 in_curr = in_end + 1;
2463 }
2464 } while (*in_end++);
2465
2466 strcpy(in_save, nosec_save);
2467 free_page((unsigned long)nosec_save);
2468 out:
2469 return rc;
2470 }
2471
2472 static int selinux_sb_remount(struct super_block *sb, void *data)
2473 {
2474 int rc, i, *flags;
2475 struct security_mnt_opts opts;
2476 char *secdata, **mount_options;
2477 struct superblock_security_struct *sbsec = sb->s_security;
2478
2479 if (!(sbsec->flags & SE_SBINITIALIZED))
2480 return 0;
2481
2482 if (!data)
2483 return 0;
2484
2485 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2486 return 0;
2487
2488 security_init_mnt_opts(&opts);
2489 secdata = alloc_secdata();
2490 if (!secdata)
2491 return -ENOMEM;
2492 rc = selinux_sb_copy_data(data, secdata);
2493 if (rc)
2494 goto out_free_secdata;
2495
2496 rc = selinux_parse_opts_str(secdata, &opts);
2497 if (rc)
2498 goto out_free_secdata;
2499
2500 mount_options = opts.mnt_opts;
2501 flags = opts.mnt_opts_flags;
2502
2503 for (i = 0; i < opts.num_mnt_opts; i++) {
2504 u32 sid;
2505 size_t len;
2506
2507 if (flags[i] == SE_SBLABELSUPP)
2508 continue;
2509 len = strlen(mount_options[i]);
2510 rc = security_context_to_sid(mount_options[i], len, &sid);
2511 if (rc) {
2512 printk(KERN_WARNING "SELinux: security_context_to_sid"
2513 "(%s) failed for (dev %s, type %s) errno=%d\n",
2514 mount_options[i], sb->s_id, sb->s_type->name, rc);
2515 goto out_free_opts;
2516 }
2517 rc = -EINVAL;
2518 switch (flags[i]) {
2519 case FSCONTEXT_MNT:
2520 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2521 goto out_bad_option;
2522 break;
2523 case CONTEXT_MNT:
2524 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2525 goto out_bad_option;
2526 break;
2527 case ROOTCONTEXT_MNT: {
2528 struct inode_security_struct *root_isec;
2529 root_isec = sb->s_root->d_inode->i_security;
2530
2531 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2532 goto out_bad_option;
2533 break;
2534 }
2535 case DEFCONTEXT_MNT:
2536 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2537 goto out_bad_option;
2538 break;
2539 default:
2540 goto out_free_opts;
2541 }
2542 }
2543
2544 rc = 0;
2545 out_free_opts:
2546 security_free_mnt_opts(&opts);
2547 out_free_secdata:
2548 free_secdata(secdata);
2549 return rc;
2550 out_bad_option:
2551 printk(KERN_WARNING "SELinux: unable to change security options "
2552 "during remount (dev %s, type=%s)\n", sb->s_id,
2553 sb->s_type->name);
2554 goto out_free_opts;
2555 }
2556
2557 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2558 {
2559 const struct cred *cred = current_cred();
2560 struct common_audit_data ad;
2561 int rc;
2562
2563 rc = superblock_doinit(sb, data);
2564 if (rc)
2565 return rc;
2566
2567 /* Allow all mounts performed by the kernel */
2568 if (flags & MS_KERNMOUNT)
2569 return 0;
2570
2571 ad.type = LSM_AUDIT_DATA_DENTRY;
2572 ad.u.dentry = sb->s_root;
2573 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2574 }
2575
2576 static int selinux_sb_statfs(struct dentry *dentry)
2577 {
2578 const struct cred *cred = current_cred();
2579 struct common_audit_data ad;
2580
2581 ad.type = LSM_AUDIT_DATA_DENTRY;
2582 ad.u.dentry = dentry->d_sb->s_root;
2583 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2584 }
2585
2586 static int selinux_mount(const char *dev_name,
2587 struct path *path,
2588 const char *type,
2589 unsigned long flags,
2590 void *data)
2591 {
2592 const struct cred *cred = current_cred();
2593
2594 if (flags & MS_REMOUNT)
2595 return superblock_has_perm(cred, path->dentry->d_sb,
2596 FILESYSTEM__REMOUNT, NULL);
2597 else
2598 return path_has_perm(cred, path, FILE__MOUNTON);
2599 }
2600
2601 static int selinux_umount(struct vfsmount *mnt, int flags)
2602 {
2603 const struct cred *cred = current_cred();
2604
2605 return superblock_has_perm(cred, mnt->mnt_sb,
2606 FILESYSTEM__UNMOUNT, NULL);
2607 }
2608
2609 /* inode security operations */
2610
2611 static int selinux_inode_alloc_security(struct inode *inode)
2612 {
2613 return inode_alloc_security(inode);
2614 }
2615
2616 static void selinux_inode_free_security(struct inode *inode)
2617 {
2618 inode_free_security(inode);
2619 }
2620
2621 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2622 const struct qstr *qstr, char **name,
2623 void **value, size_t *len)
2624 {
2625 const struct task_security_struct *tsec = current_security();
2626 struct inode_security_struct *dsec;
2627 struct superblock_security_struct *sbsec;
2628 u32 sid, newsid, clen;
2629 int rc;
2630 char *namep = NULL, *context;
2631
2632 dsec = dir->i_security;
2633 sbsec = dir->i_sb->s_security;
2634
2635 sid = tsec->sid;
2636 newsid = tsec->create_sid;
2637
2638 if ((sbsec->flags & SE_SBINITIALIZED) &&
2639 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2640 newsid = sbsec->mntpoint_sid;
2641 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2642 rc = security_transition_sid(sid, dsec->sid,
2643 inode_mode_to_security_class(inode->i_mode),
2644 qstr, &newsid);
2645 if (rc) {
2646 printk(KERN_WARNING "%s: "
2647 "security_transition_sid failed, rc=%d (dev=%s "
2648 "ino=%ld)\n",
2649 __func__,
2650 -rc, inode->i_sb->s_id, inode->i_ino);
2651 return rc;
2652 }
2653 }
2654
2655 /* Possibly defer initialization to selinux_complete_init. */
2656 if (sbsec->flags & SE_SBINITIALIZED) {
2657 struct inode_security_struct *isec = inode->i_security;
2658 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2659 isec->sid = newsid;
2660 isec->initialized = 1;
2661 }
2662
2663 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2664 return -EOPNOTSUPP;
2665
2666 if (name) {
2667 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2668 if (!namep)
2669 return -ENOMEM;
2670 *name = namep;
2671 }
2672
2673 if (value && len) {
2674 rc = security_sid_to_context_force(newsid, &context, &clen);
2675 if (rc) {
2676 kfree(namep);
2677 return rc;
2678 }
2679 *value = context;
2680 *len = clen;
2681 }
2682
2683 return 0;
2684 }
2685
2686 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2687 {
2688 return may_create(dir, dentry, SECCLASS_FILE);
2689 }
2690
2691 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2692 {
2693 return may_link(dir, old_dentry, MAY_LINK);
2694 }
2695
2696 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2697 {
2698 return may_link(dir, dentry, MAY_UNLINK);
2699 }
2700
2701 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2702 {
2703 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2704 }
2705
2706 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2707 {
2708 return may_create(dir, dentry, SECCLASS_DIR);
2709 }
2710
2711 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2712 {
2713 return may_link(dir, dentry, MAY_RMDIR);
2714 }
2715
2716 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2717 {
2718 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2719 }
2720
2721 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2722 struct inode *new_inode, struct dentry *new_dentry)
2723 {
2724 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2725 }
2726
2727 static int selinux_inode_readlink(struct dentry *dentry)
2728 {
2729 const struct cred *cred = current_cred();
2730
2731 return dentry_has_perm(cred, dentry, FILE__READ);
2732 }
2733
2734 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2735 {
2736 const struct cred *cred = current_cred();
2737
2738 return dentry_has_perm(cred, dentry, FILE__READ);
2739 }
2740
2741 static noinline int audit_inode_permission(struct inode *inode,
2742 u32 perms, u32 audited, u32 denied,
2743 int result,
2744 unsigned flags)
2745 {
2746 struct common_audit_data ad;
2747 struct inode_security_struct *isec = inode->i_security;
2748 int rc;
2749
2750 ad.type = LSM_AUDIT_DATA_INODE;
2751 ad.u.inode = inode;
2752
2753 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2754 audited, denied, result, &ad, flags);
2755 if (rc)
2756 return rc;
2757 return 0;
2758 }
2759
2760 static int selinux_inode_permission(struct inode *inode, int mask)
2761 {
2762 const struct cred *cred = current_cred();
2763 u32 perms;
2764 bool from_access;
2765 unsigned flags = mask & MAY_NOT_BLOCK;
2766 struct inode_security_struct *isec;
2767 u32 sid;
2768 struct av_decision avd;
2769 int rc, rc2;
2770 u32 audited, denied;
2771
2772 from_access = mask & MAY_ACCESS;
2773 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2774
2775 /* No permission to check. Existence test. */
2776 if (!mask)
2777 return 0;
2778
2779 validate_creds(cred);
2780
2781 if (unlikely(IS_PRIVATE(inode)))
2782 return 0;
2783
2784 perms = file_mask_to_av(inode->i_mode, mask);
2785
2786 sid = cred_sid(cred);
2787 isec = inode->i_security;
2788
2789 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2790 audited = avc_audit_required(perms, &avd, rc,
2791 from_access ? FILE__AUDIT_ACCESS : 0,
2792 &denied);
2793 if (likely(!audited))
2794 return rc;
2795
2796 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2797 if (rc2)
2798 return rc2;
2799 return rc;
2800 }
2801
2802 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2803 {
2804 const struct cred *cred = current_cred();
2805 unsigned int ia_valid = iattr->ia_valid;
2806 __u32 av = FILE__WRITE;
2807
2808 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2809 if (ia_valid & ATTR_FORCE) {
2810 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2811 ATTR_FORCE);
2812 if (!ia_valid)
2813 return 0;
2814 }
2815
2816 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2817 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2818 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2819
2820 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2821 av |= FILE__OPEN;
2822
2823 return dentry_has_perm(cred, dentry, av);
2824 }
2825
2826 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2827 {
2828 const struct cred *cred = current_cred();
2829 struct path path;
2830
2831 path.dentry = dentry;
2832 path.mnt = mnt;
2833
2834 return path_has_perm(cred, &path, FILE__GETATTR);
2835 }
2836
2837 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2838 {
2839 const struct cred *cred = current_cred();
2840
2841 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2842 sizeof XATTR_SECURITY_PREFIX - 1)) {
2843 if (!strcmp(name, XATTR_NAME_CAPS)) {
2844 if (!capable(CAP_SETFCAP))
2845 return -EPERM;
2846 } else if (!capable(CAP_SYS_ADMIN)) {
2847 /* A different attribute in the security namespace.
2848 Restrict to administrator. */
2849 return -EPERM;
2850 }
2851 }
2852
2853 /* Not an attribute we recognize, so just check the
2854 ordinary setattr permission. */
2855 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2856 }
2857
2858 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2859 const void *value, size_t size, int flags)
2860 {
2861 struct inode *inode = dentry->d_inode;
2862 struct inode_security_struct *isec = inode->i_security;
2863 struct superblock_security_struct *sbsec;
2864 struct common_audit_data ad;
2865 u32 newsid, sid = current_sid();
2866 int rc = 0;
2867
2868 if (strcmp(name, XATTR_NAME_SELINUX))
2869 return selinux_inode_setotherxattr(dentry, name);
2870
2871 sbsec = inode->i_sb->s_security;
2872 if (!(sbsec->flags & SE_SBLABELSUPP))
2873 return -EOPNOTSUPP;
2874
2875 if (!inode_owner_or_capable(inode))
2876 return -EPERM;
2877
2878 ad.type = LSM_AUDIT_DATA_DENTRY;
2879 ad.u.dentry = dentry;
2880
2881 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2882 FILE__RELABELFROM, &ad);
2883 if (rc)
2884 return rc;
2885
2886 rc = security_context_to_sid(value, size, &newsid);
2887 if (rc == -EINVAL) {
2888 if (!capable(CAP_MAC_ADMIN)) {
2889 struct audit_buffer *ab;
2890 size_t audit_size;
2891 const char *str;
2892
2893 /* We strip a nul only if it is at the end, otherwise the
2894 * context contains a nul and we should audit that */
2895 if (value) {
2896 str = value;
2897 if (str[size - 1] == '\0')
2898 audit_size = size - 1;
2899 else
2900 audit_size = size;
2901 } else {
2902 str = "";
2903 audit_size = 0;
2904 }
2905 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2906 audit_log_format(ab, "op=setxattr invalid_context=");
2907 audit_log_n_untrustedstring(ab, value, audit_size);
2908 audit_log_end(ab);
2909
2910 return rc;
2911 }
2912 rc = security_context_to_sid_force(value, size, &newsid);
2913 }
2914 if (rc)
2915 return rc;
2916
2917 rc = avc_has_perm(sid, newsid, isec->sclass,
2918 FILE__RELABELTO, &ad);
2919 if (rc)
2920 return rc;
2921
2922 rc = security_validate_transition(isec->sid, newsid, sid,
2923 isec->sclass);
2924 if (rc)
2925 return rc;
2926
2927 return avc_has_perm(newsid,
2928 sbsec->sid,
2929 SECCLASS_FILESYSTEM,
2930 FILESYSTEM__ASSOCIATE,
2931 &ad);
2932 }
2933
2934 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2935 const void *value, size_t size,
2936 int flags)
2937 {
2938 struct inode *inode = dentry->d_inode;
2939 struct inode_security_struct *isec = inode->i_security;
2940 u32 newsid;
2941 int rc;
2942
2943 if (strcmp(name, XATTR_NAME_SELINUX)) {
2944 /* Not an attribute we recognize, so nothing to do. */
2945 return;
2946 }
2947
2948 rc = security_context_to_sid_force(value, size, &newsid);
2949 if (rc) {
2950 printk(KERN_ERR "SELinux: unable to map context to SID"
2951 "for (%s, %lu), rc=%d\n",
2952 inode->i_sb->s_id, inode->i_ino, -rc);
2953 return;
2954 }
2955
2956 isec->sid = newsid;
2957 return;
2958 }
2959
2960 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2961 {
2962 const struct cred *cred = current_cred();
2963
2964 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2965 }
2966
2967 static int selinux_inode_listxattr(struct dentry *dentry)
2968 {
2969 const struct cred *cred = current_cred();
2970
2971 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2972 }
2973
2974 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2975 {
2976 if (strcmp(name, XATTR_NAME_SELINUX))
2977 return selinux_inode_setotherxattr(dentry, name);
2978
2979 /* No one is allowed to remove a SELinux security label.
2980 You can change the label, but all data must be labeled. */
2981 return -EACCES;
2982 }
2983
2984 /*
2985 * Copy the inode security context value to the user.
2986 *
2987 * Permission check is handled by selinux_inode_getxattr hook.
2988 */
2989 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2990 {
2991 u32 size;
2992 int error;
2993 char *context = NULL;
2994 struct inode_security_struct *isec = inode->i_security;
2995
2996 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2997 return -EOPNOTSUPP;
2998
2999 /*
3000 * If the caller has CAP_MAC_ADMIN, then get the raw context
3001 * value even if it is not defined by current policy; otherwise,
3002 * use the in-core value under current policy.
3003 * Use the non-auditing forms of the permission checks since
3004 * getxattr may be called by unprivileged processes commonly
3005 * and lack of permission just means that we fall back to the
3006 * in-core context value, not a denial.
3007 */
3008 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3009 SECURITY_CAP_NOAUDIT);
3010 if (!error)
3011 error = security_sid_to_context_force(isec->sid, &context,
3012 &size);
3013 else
3014 error = security_sid_to_context(isec->sid, &context, &size);
3015 if (error)
3016 return error;
3017 error = size;
3018 if (alloc) {
3019 *buffer = context;
3020 goto out_nofree;
3021 }
3022 kfree(context);
3023 out_nofree:
3024 return error;
3025 }
3026
3027 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3028 const void *value, size_t size, int flags)
3029 {
3030 struct inode_security_struct *isec = inode->i_security;
3031 u32 newsid;
3032 int rc;
3033
3034 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3035 return -EOPNOTSUPP;
3036
3037 if (!value || !size)
3038 return -EACCES;
3039
3040 rc = security_context_to_sid((void *)value, size, &newsid);
3041 if (rc)
3042 return rc;
3043
3044 isec->sid = newsid;
3045 isec->initialized = 1;
3046 return 0;
3047 }
3048
3049 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3050 {
3051 const int len = sizeof(XATTR_NAME_SELINUX);
3052 if (buffer && len <= buffer_size)
3053 memcpy(buffer, XATTR_NAME_SELINUX, len);
3054 return len;
3055 }
3056
3057 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3058 {
3059 struct inode_security_struct *isec = inode->i_security;
3060 *secid = isec->sid;
3061 }
3062
3063 /* file security operations */
3064
3065 static int selinux_revalidate_file_permission(struct file *file, int mask)
3066 {
3067 const struct cred *cred = current_cred();
3068 struct inode *inode = file_inode(file);
3069
3070 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3071 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3072 mask |= MAY_APPEND;
3073
3074 return file_has_perm(cred, file,
3075 file_mask_to_av(inode->i_mode, mask));
3076 }
3077
3078 static int selinux_file_permission(struct file *file, int mask)
3079 {
3080 struct inode *inode = file_inode(file);
3081 struct file_security_struct *fsec = file->f_security;
3082 struct inode_security_struct *isec = inode->i_security;
3083 u32 sid = current_sid();
3084
3085 if (!mask)
3086 /* No permission to check. Existence test. */
3087 return 0;
3088
3089 if (sid == fsec->sid && fsec->isid == isec->sid &&
3090 fsec->pseqno == avc_policy_seqno())
3091 /* No change since file_open check. */
3092 return 0;
3093
3094 return selinux_revalidate_file_permission(file, mask);
3095 }
3096
3097 static int selinux_file_alloc_security(struct file *file)
3098 {
3099 return file_alloc_security(file);
3100 }
3101
3102 static void selinux_file_free_security(struct file *file)
3103 {
3104 file_free_security(file);
3105 }
3106
3107 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3108 unsigned long arg)
3109 {
3110 const struct cred *cred = current_cred();
3111 int error = 0;
3112
3113 switch (cmd) {
3114 case FIONREAD:
3115 /* fall through */
3116 case FIBMAP:
3117 /* fall through */
3118 case FIGETBSZ:
3119 /* fall through */
3120 case FS_IOC_GETFLAGS:
3121 /* fall through */
3122 case FS_IOC_GETVERSION:
3123 error = file_has_perm(cred, file, FILE__GETATTR);
3124 break;
3125
3126 case FS_IOC_SETFLAGS:
3127 /* fall through */
3128 case FS_IOC_SETVERSION:
3129 error = file_has_perm(cred, file, FILE__SETATTR);
3130 break;
3131
3132 /* sys_ioctl() checks */
3133 case FIONBIO:
3134 /* fall through */
3135 case FIOASYNC:
3136 error = file_has_perm(cred, file, 0);
3137 break;
3138
3139 case KDSKBENT:
3140 case KDSKBSENT:
3141 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3142 SECURITY_CAP_AUDIT);
3143 break;
3144
3145 /* default case assumes that the command will go
3146 * to the file's ioctl() function.
3147 */
3148 default:
3149 error = file_has_perm(cred, file, FILE__IOCTL);
3150 }
3151 return error;
3152 }
3153
3154 static int default_noexec;
3155
3156 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3157 {
3158 const struct cred *cred = current_cred();
3159 int rc = 0;
3160
3161 if (default_noexec &&
3162 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3163 /*
3164 * We are making executable an anonymous mapping or a
3165 * private file mapping that will also be writable.
3166 * This has an additional check.
3167 */
3168 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3169 if (rc)
3170 goto error;
3171 }
3172
3173 if (file) {
3174 /* read access is always possible with a mapping */
3175 u32 av = FILE__READ;
3176
3177 /* write access only matters if the mapping is shared */
3178 if (shared && (prot & PROT_WRITE))
3179 av |= FILE__WRITE;
3180
3181 if (prot & PROT_EXEC)
3182 av |= FILE__EXECUTE;
3183
3184 return file_has_perm(cred, file, av);
3185 }
3186
3187 error:
3188 return rc;
3189 }
3190
3191 static int selinux_mmap_addr(unsigned long addr)
3192 {
3193 int rc = 0;
3194 u32 sid = current_sid();
3195
3196 /*
3197 * notice that we are intentionally putting the SELinux check before
3198 * the secondary cap_file_mmap check. This is such a likely attempt
3199 * at bad behaviour/exploit that we always want to get the AVC, even
3200 * if DAC would have also denied the operation.
3201 */
3202 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3203 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3204 MEMPROTECT__MMAP_ZERO, NULL);
3205 if (rc)
3206 return rc;
3207 }
3208
3209 /* do DAC check on address space usage */
3210 return cap_mmap_addr(addr);
3211 }
3212
3213 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3214 unsigned long prot, unsigned long flags)
3215 {
3216 if (selinux_checkreqprot)
3217 prot = reqprot;
3218
3219 return file_map_prot_check(file, prot,
3220 (flags & MAP_TYPE) == MAP_SHARED);
3221 }
3222
3223 static int selinux_file_mprotect(struct vm_area_struct *vma,
3224 unsigned long reqprot,
3225 unsigned long prot)
3226 {
3227 const struct cred *cred = current_cred();
3228
3229 if (selinux_checkreqprot)
3230 prot = reqprot;
3231
3232 if (default_noexec &&
3233 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3234 int rc = 0;
3235 if (vma->vm_start >= vma->vm_mm->start_brk &&
3236 vma->vm_end <= vma->vm_mm->brk) {
3237 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3238 } else if (!vma->vm_file &&
3239 vma->vm_start <= vma->vm_mm->start_stack &&
3240 vma->vm_end >= vma->vm_mm->start_stack) {
3241 rc = current_has_perm(current, PROCESS__EXECSTACK);
3242 } else if (vma->vm_file && vma->anon_vma) {
3243 /*
3244 * We are making executable a file mapping that has
3245 * had some COW done. Since pages might have been
3246 * written, check ability to execute the possibly
3247 * modified content. This typically should only
3248 * occur for text relocations.
3249 */
3250 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3251 }
3252 if (rc)
3253 return rc;
3254 }
3255
3256 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3257 }
3258
3259 static int selinux_file_lock(struct file *file, unsigned int cmd)
3260 {
3261 const struct cred *cred = current_cred();
3262
3263 return file_has_perm(cred, file, FILE__LOCK);
3264 }
3265
3266 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3267 unsigned long arg)
3268 {
3269 const struct cred *cred = current_cred();
3270 int err = 0;
3271
3272 switch (cmd) {
3273 case F_SETFL:
3274 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3275 err = file_has_perm(cred, file, FILE__WRITE);
3276 break;
3277 }
3278 /* fall through */
3279 case F_SETOWN:
3280 case F_SETSIG:
3281 case F_GETFL:
3282 case F_GETOWN:
3283 case F_GETSIG:
3284 case F_GETOWNER_UIDS:
3285 /* Just check FD__USE permission */
3286 err = file_has_perm(cred, file, 0);
3287 break;
3288 case F_GETLK:
3289 case F_SETLK:
3290 case F_SETLKW:
3291 #if BITS_PER_LONG == 32
3292 case F_GETLK64:
3293 case F_SETLK64:
3294 case F_SETLKW64:
3295 #endif
3296 err = file_has_perm(cred, file, FILE__LOCK);
3297 break;
3298 }
3299
3300 return err;
3301 }
3302
3303 static int selinux_file_set_fowner(struct file *file)
3304 {
3305 struct file_security_struct *fsec;
3306
3307 fsec = file->f_security;
3308 fsec->fown_sid = current_sid();
3309
3310 return 0;
3311 }
3312
3313 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3314 struct fown_struct *fown, int signum)
3315 {
3316 struct file *file;
3317 u32 sid = task_sid(tsk);
3318 u32 perm;
3319 struct file_security_struct *fsec;
3320
3321 /* struct fown_struct is never outside the context of a struct file */
3322 file = container_of(fown, struct file, f_owner);
3323
3324 fsec = file->f_security;
3325
3326 if (!signum)
3327 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3328 else
3329 perm = signal_to_av(signum);
3330
3331 return avc_has_perm(fsec->fown_sid, sid,
3332 SECCLASS_PROCESS, perm, NULL);
3333 }
3334
3335 static int selinux_file_receive(struct file *file)
3336 {
3337 const struct cred *cred = current_cred();
3338
3339 return file_has_perm(cred, file, file_to_av(file));
3340 }
3341
3342 static int selinux_file_open(struct file *file, const struct cred *cred)
3343 {
3344 struct file_security_struct *fsec;
3345 struct inode_security_struct *isec;
3346
3347 fsec = file->f_security;
3348 isec = file_inode(file)->i_security;
3349 /*
3350 * Save inode label and policy sequence number
3351 * at open-time so that selinux_file_permission
3352 * can determine whether revalidation is necessary.
3353 * Task label is already saved in the file security
3354 * struct as its SID.
3355 */
3356 fsec->isid = isec->sid;
3357 fsec->pseqno = avc_policy_seqno();
3358 /*
3359 * Since the inode label or policy seqno may have changed
3360 * between the selinux_inode_permission check and the saving
3361 * of state above, recheck that access is still permitted.
3362 * Otherwise, access might never be revalidated against the
3363 * new inode label or new policy.
3364 * This check is not redundant - do not remove.
3365 */
3366 return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3367 }
3368
3369 /* task security operations */
3370
3371 static int selinux_task_create(unsigned long clone_flags)
3372 {
3373 return current_has_perm(current, PROCESS__FORK);
3374 }
3375
3376 /*
3377 * allocate the SELinux part of blank credentials
3378 */
3379 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3380 {
3381 struct task_security_struct *tsec;
3382
3383 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3384 if (!tsec)
3385 return -ENOMEM;
3386
3387 cred->security = tsec;
3388 return 0;
3389 }
3390
3391 /*
3392 * detach and free the LSM part of a set of credentials
3393 */
3394 static void selinux_cred_free(struct cred *cred)
3395 {
3396 struct task_security_struct *tsec = cred->security;
3397
3398 /*
3399 * cred->security == NULL if security_cred_alloc_blank() or
3400 * security_prepare_creds() returned an error.
3401 */
3402 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3403 cred->security = (void *) 0x7UL;
3404 kfree(tsec);
3405 }
3406
3407 /*
3408 * prepare a new set of credentials for modification
3409 */
3410 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3411 gfp_t gfp)
3412 {
3413 const struct task_security_struct *old_tsec;
3414 struct task_security_struct *tsec;
3415
3416 old_tsec = old->security;
3417
3418 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3419 if (!tsec)
3420 return -ENOMEM;
3421
3422 new->security = tsec;
3423 return 0;
3424 }
3425
3426 /*
3427 * transfer the SELinux data to a blank set of creds
3428 */
3429 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3430 {
3431 const struct task_security_struct *old_tsec = old->security;
3432 struct task_security_struct *tsec = new->security;
3433
3434 *tsec = *old_tsec;
3435 }
3436
3437 /*
3438 * set the security data for a kernel service
3439 * - all the creation contexts are set to unlabelled
3440 */
3441 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3442 {
3443 struct task_security_struct *tsec = new->security;
3444 u32 sid = current_sid();
3445 int ret;
3446
3447 ret = avc_has_perm(sid, secid,
3448 SECCLASS_KERNEL_SERVICE,
3449 KERNEL_SERVICE__USE_AS_OVERRIDE,
3450 NULL);
3451 if (ret == 0) {
3452 tsec->sid = secid;
3453 tsec->create_sid = 0;
3454 tsec->keycreate_sid = 0;
3455 tsec->sockcreate_sid = 0;
3456 }
3457 return ret;
3458 }
3459
3460 /*
3461 * set the file creation context in a security record to the same as the
3462 * objective context of the specified inode
3463 */
3464 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3465 {
3466 struct inode_security_struct *isec = inode->i_security;
3467 struct task_security_struct *tsec = new->security;
3468 u32 sid = current_sid();
3469 int ret;
3470
3471 ret = avc_has_perm(sid, isec->sid,
3472 SECCLASS_KERNEL_SERVICE,
3473 KERNEL_SERVICE__CREATE_FILES_AS,
3474 NULL);
3475
3476 if (ret == 0)
3477 tsec->create_sid = isec->sid;
3478 return ret;
3479 }
3480
3481 static int selinux_kernel_module_request(char *kmod_name)
3482 {
3483 u32 sid;
3484 struct common_audit_data ad;
3485
3486 sid = task_sid(current);
3487
3488 ad.type = LSM_AUDIT_DATA_KMOD;
3489 ad.u.kmod_name = kmod_name;
3490
3491 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3492 SYSTEM__MODULE_REQUEST, &ad);
3493 }
3494
3495 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3496 {
3497 return current_has_perm(p, PROCESS__SETPGID);
3498 }
3499
3500 static int selinux_task_getpgid(struct task_struct *p)
3501 {
3502 return current_has_perm(p, PROCESS__GETPGID);
3503 }
3504
3505 static int selinux_task_getsid(struct task_struct *p)
3506 {
3507 return current_has_perm(p, PROCESS__GETSESSION);
3508 }
3509
3510 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3511 {
3512 *secid = task_sid(p);
3513 }
3514
3515 static int selinux_task_setnice(struct task_struct *p, int nice)
3516 {
3517 int rc;
3518
3519 rc = cap_task_setnice(p, nice);
3520 if (rc)
3521 return rc;
3522
3523 return current_has_perm(p, PROCESS__SETSCHED);
3524 }
3525
3526 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3527 {
3528 int rc;
3529
3530 rc = cap_task_setioprio(p, ioprio);
3531 if (rc)
3532 return rc;
3533
3534 return current_has_perm(p, PROCESS__SETSCHED);
3535 }
3536
3537 static int selinux_task_getioprio(struct task_struct *p)
3538 {
3539 return current_has_perm(p, PROCESS__GETSCHED);
3540 }
3541
3542 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3543 struct rlimit *new_rlim)
3544 {
3545 struct rlimit *old_rlim = p->signal->rlim + resource;
3546
3547 /* Control the ability to change the hard limit (whether
3548 lowering or raising it), so that the hard limit can
3549 later be used as a safe reset point for the soft limit
3550 upon context transitions. See selinux_bprm_committing_creds. */
3551 if (old_rlim->rlim_max != new_rlim->rlim_max)
3552 return current_has_perm(p, PROCESS__SETRLIMIT);
3553
3554 return 0;
3555 }
3556
3557 static int selinux_task_setscheduler(struct task_struct *p)
3558 {
3559 int rc;
3560
3561 rc = cap_task_setscheduler(p);
3562 if (rc)
3563 return rc;
3564
3565 return current_has_perm(p, PROCESS__SETSCHED);
3566 }
3567
3568 static int selinux_task_getscheduler(struct task_struct *p)
3569 {
3570 return current_has_perm(p, PROCESS__GETSCHED);
3571 }
3572
3573 static int selinux_task_movememory(struct task_struct *p)
3574 {
3575 return current_has_perm(p, PROCESS__SETSCHED);
3576 }
3577
3578 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3579 int sig, u32 secid)
3580 {
3581 u32 perm;
3582 int rc;
3583
3584 if (!sig)
3585 perm = PROCESS__SIGNULL; /* null signal; existence test */
3586 else
3587 perm = signal_to_av(sig);
3588 if (secid)
3589 rc = avc_has_perm(secid, task_sid(p),
3590 SECCLASS_PROCESS, perm, NULL);
3591 else
3592 rc = current_has_perm(p, perm);
3593 return rc;
3594 }
3595
3596 static int selinux_task_wait(struct task_struct *p)
3597 {
3598 return task_has_perm(p, current, PROCESS__SIGCHLD);
3599 }
3600
3601 static void selinux_task_to_inode(struct task_struct *p,
3602 struct inode *inode)
3603 {
3604 struct inode_security_struct *isec = inode->i_security;
3605 u32 sid = task_sid(p);
3606
3607 isec->sid = sid;
3608 isec->initialized = 1;
3609 }
3610
3611 /* Returns error only if unable to parse addresses */
3612 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3613 struct common_audit_data *ad, u8 *proto)
3614 {
3615 int offset, ihlen, ret = -EINVAL;
3616 struct iphdr _iph, *ih;
3617
3618 offset = skb_network_offset(skb);
3619 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3620 if (ih == NULL)
3621 goto out;
3622
3623 ihlen = ih->ihl * 4;
3624 if (ihlen < sizeof(_iph))
3625 goto out;
3626
3627 ad->u.net->v4info.saddr = ih->saddr;
3628 ad->u.net->v4info.daddr = ih->daddr;
3629 ret = 0;
3630
3631 if (proto)
3632 *proto = ih->protocol;
3633
3634 switch (ih->protocol) {
3635 case IPPROTO_TCP: {
3636 struct tcphdr _tcph, *th;
3637
3638 if (ntohs(ih->frag_off) & IP_OFFSET)
3639 break;
3640
3641 offset += ihlen;
3642 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3643 if (th == NULL)
3644 break;
3645
3646 ad->u.net->sport = th->source;
3647 ad->u.net->dport = th->dest;
3648 break;
3649 }
3650
3651 case IPPROTO_UDP: {
3652 struct udphdr _udph, *uh;
3653
3654 if (ntohs(ih->frag_off) & IP_OFFSET)
3655 break;
3656
3657 offset += ihlen;
3658 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3659 if (uh == NULL)
3660 break;
3661
3662 ad->u.net->sport = uh->source;
3663 ad->u.net->dport = uh->dest;
3664 break;
3665 }
3666
3667 case IPPROTO_DCCP: {
3668 struct dccp_hdr _dccph, *dh;
3669
3670 if (ntohs(ih->frag_off) & IP_OFFSET)
3671 break;
3672
3673 offset += ihlen;
3674 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3675 if (dh == NULL)
3676 break;
3677
3678 ad->u.net->sport = dh->dccph_sport;
3679 ad->u.net->dport = dh->dccph_dport;
3680 break;
3681 }
3682
3683 default:
3684 break;
3685 }
3686 out:
3687 return ret;
3688 }
3689
3690 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3691
3692 /* Returns error only if unable to parse addresses */
3693 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3694 struct common_audit_data *ad, u8 *proto)
3695 {
3696 u8 nexthdr;
3697 int ret = -EINVAL, offset;
3698 struct ipv6hdr _ipv6h, *ip6;
3699 __be16 frag_off;
3700
3701 offset = skb_network_offset(skb);
3702 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3703 if (ip6 == NULL)
3704 goto out;
3705
3706 ad->u.net->v6info.saddr = ip6->saddr;
3707 ad->u.net->v6info.daddr = ip6->daddr;
3708 ret = 0;
3709
3710 nexthdr = ip6->nexthdr;
3711 offset += sizeof(_ipv6h);
3712 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3713 if (offset < 0)
3714 goto out;
3715
3716 if (proto)
3717 *proto = nexthdr;
3718
3719 switch (nexthdr) {
3720 case IPPROTO_TCP: {
3721 struct tcphdr _tcph, *th;
3722
3723 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3724 if (th == NULL)
3725 break;
3726
3727 ad->u.net->sport = th->source;
3728 ad->u.net->dport = th->dest;
3729 break;
3730 }
3731
3732 case IPPROTO_UDP: {
3733 struct udphdr _udph, *uh;
3734
3735 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3736 if (uh == NULL)
3737 break;
3738
3739 ad->u.net->sport = uh->source;
3740 ad->u.net->dport = uh->dest;
3741 break;
3742 }
3743
3744 case IPPROTO_DCCP: {
3745 struct dccp_hdr _dccph, *dh;
3746
3747 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3748 if (dh == NULL)
3749 break;
3750
3751 ad->u.net->sport = dh->dccph_sport;
3752 ad->u.net->dport = dh->dccph_dport;
3753 break;
3754 }
3755
3756 /* includes fragments */
3757 default:
3758 break;
3759 }
3760 out:
3761 return ret;
3762 }
3763
3764 #endif /* IPV6 */
3765
3766 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3767 char **_addrp, int src, u8 *proto)
3768 {
3769 char *addrp;
3770 int ret;
3771
3772 switch (ad->u.net->family) {
3773 case PF_INET:
3774 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3775 if (ret)
3776 goto parse_error;
3777 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3778 &ad->u.net->v4info.daddr);
3779 goto okay;
3780
3781 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3782 case PF_INET6:
3783 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3784 if (ret)
3785 goto parse_error;
3786 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3787 &ad->u.net->v6info.daddr);
3788 goto okay;
3789 #endif /* IPV6 */
3790 default:
3791 addrp = NULL;
3792 goto okay;
3793 }
3794
3795 parse_error:
3796 printk(KERN_WARNING
3797 "SELinux: failure in selinux_parse_skb(),"
3798 " unable to parse packet\n");
3799 return ret;
3800
3801 okay:
3802 if (_addrp)
3803 *_addrp = addrp;
3804 return 0;
3805 }
3806
3807 /**
3808 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3809 * @skb: the packet
3810 * @family: protocol family
3811 * @sid: the packet's peer label SID
3812 *
3813 * Description:
3814 * Check the various different forms of network peer labeling and determine
3815 * the peer label/SID for the packet; most of the magic actually occurs in
3816 * the security server function security_net_peersid_cmp(). The function
3817 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3818 * or -EACCES if @sid is invalid due to inconsistencies with the different
3819 * peer labels.
3820 *
3821 */
3822 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3823 {
3824 int err;
3825 u32 xfrm_sid;
3826 u32 nlbl_sid;
3827 u32 nlbl_type;
3828
3829 selinux_xfrm_skb_sid(skb, &xfrm_sid);
3830 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3831
3832 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3833 if (unlikely(err)) {
3834 printk(KERN_WARNING
3835 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3836 " unable to determine packet's peer label\n");
3837 return -EACCES;
3838 }
3839
3840 return 0;
3841 }
3842
3843 /**
3844 * selinux_conn_sid - Determine the child socket label for a connection
3845 * @sk_sid: the parent socket's SID
3846 * @skb_sid: the packet's SID
3847 * @conn_sid: the resulting connection SID
3848 *
3849 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3850 * combined with the MLS information from @skb_sid in order to create
3851 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3852 * of @sk_sid. Returns zero on success, negative values on failure.
3853 *
3854 */
3855 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3856 {
3857 int err = 0;
3858
3859 if (skb_sid != SECSID_NULL)
3860 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3861 else
3862 *conn_sid = sk_sid;
3863
3864 return err;
3865 }
3866
3867 /* socket security operations */
3868
3869 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3870 u16 secclass, u32 *socksid)
3871 {
3872 if (tsec->sockcreate_sid > SECSID_NULL) {
3873 *socksid = tsec->sockcreate_sid;
3874 return 0;
3875 }
3876
3877 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3878 socksid);
3879 }
3880
3881 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3882 {
3883 struct sk_security_struct *sksec = sk->sk_security;
3884 struct common_audit_data ad;
3885 struct lsm_network_audit net = {0,};
3886 u32 tsid = task_sid(task);
3887
3888 if (sksec->sid == SECINITSID_KERNEL)
3889 return 0;
3890
3891 ad.type = LSM_AUDIT_DATA_NET;
3892 ad.u.net = &net;
3893 ad.u.net->sk = sk;
3894
3895 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3896 }
3897
3898 static int selinux_socket_create(int family, int type,
3899 int protocol, int kern)
3900 {
3901 const struct task_security_struct *tsec = current_security();
3902 u32 newsid;
3903 u16 secclass;
3904 int rc;
3905
3906 if (kern)
3907 return 0;
3908
3909 secclass = socket_type_to_security_class(family, type, protocol);
3910 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3911 if (rc)
3912 return rc;
3913
3914 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3915 }
3916
3917 static int selinux_socket_post_create(struct socket *sock, int family,
3918 int type, int protocol, int kern)
3919 {
3920 const struct task_security_struct *tsec = current_security();
3921 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3922 struct sk_security_struct *sksec;
3923 int err = 0;
3924
3925 isec->sclass = socket_type_to_security_class(family, type, protocol);
3926
3927 if (kern)
3928 isec->sid = SECINITSID_KERNEL;
3929 else {
3930 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3931 if (err)
3932 return err;
3933 }
3934
3935 isec->initialized = 1;
3936
3937 if (sock->sk) {
3938 sksec = sock->sk->sk_security;
3939 sksec->sid = isec->sid;
3940 sksec->sclass = isec->sclass;
3941 err = selinux_netlbl_socket_post_create(sock->sk, family);
3942 }
3943
3944 return err;
3945 }
3946
3947 /* Range of port numbers used to automatically bind.
3948 Need to determine whether we should perform a name_bind
3949 permission check between the socket and the port number. */
3950
3951 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3952 {
3953 struct sock *sk = sock->sk;
3954 u16 family;
3955 int err;
3956
3957 err = sock_has_perm(current, sk, SOCKET__BIND);
3958 if (err)
3959 goto out;
3960
3961 /*
3962 * If PF_INET or PF_INET6, check name_bind permission for the port.
3963 * Multiple address binding for SCTP is not supported yet: we just
3964 * check the first address now.
3965 */
3966 family = sk->sk_family;
3967 if (family == PF_INET || family == PF_INET6) {
3968 char *addrp;
3969 struct sk_security_struct *sksec = sk->sk_security;
3970 struct common_audit_data ad;
3971 struct lsm_network_audit net = {0,};
3972 struct sockaddr_in *addr4 = NULL;
3973 struct sockaddr_in6 *addr6 = NULL;
3974 unsigned short snum;
3975 u32 sid, node_perm;
3976
3977 if (family == PF_INET) {
3978 addr4 = (struct sockaddr_in *)address;
3979 snum = ntohs(addr4->sin_port);
3980 addrp = (char *)&addr4->sin_addr.s_addr;
3981 } else {
3982 addr6 = (struct sockaddr_in6 *)address;
3983 snum = ntohs(addr6->sin6_port);
3984 addrp = (char *)&addr6->sin6_addr.s6_addr;
3985 }
3986
3987 if (snum) {
3988 int low, high;
3989
3990 inet_get_local_port_range(&low, &high);
3991
3992 if (snum < max(PROT_SOCK, low) || snum > high) {
3993 err = sel_netport_sid(sk->sk_protocol,
3994 snum, &sid);
3995 if (err)
3996 goto out;
3997 ad.type = LSM_AUDIT_DATA_NET;
3998 ad.u.net = &net;
3999 ad.u.net->sport = htons(snum);
4000 ad.u.net->family = family;
4001 err = avc_has_perm(sksec->sid, sid,
4002 sksec->sclass,
4003 SOCKET__NAME_BIND, &ad);
4004 if (err)
4005 goto out;
4006 }
4007 }
4008
4009 switch (sksec->sclass) {
4010 case SECCLASS_TCP_SOCKET:
4011 node_perm = TCP_SOCKET__NODE_BIND;
4012 break;
4013
4014 case SECCLASS_UDP_SOCKET:
4015 node_perm = UDP_SOCKET__NODE_BIND;
4016 break;
4017
4018 case SECCLASS_DCCP_SOCKET:
4019 node_perm = DCCP_SOCKET__NODE_BIND;
4020 break;
4021
4022 default:
4023 node_perm = RAWIP_SOCKET__NODE_BIND;
4024 break;
4025 }
4026
4027 err = sel_netnode_sid(addrp, family, &sid);
4028 if (err)
4029 goto out;
4030
4031 ad.type = LSM_AUDIT_DATA_NET;
4032 ad.u.net = &net;
4033 ad.u.net->sport = htons(snum);
4034 ad.u.net->family = family;
4035
4036 if (family == PF_INET)
4037 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4038 else
4039 ad.u.net->v6info.saddr = addr6->sin6_addr;
4040
4041 err = avc_has_perm(sksec->sid, sid,
4042 sksec->sclass, node_perm, &ad);
4043 if (err)
4044 goto out;
4045 }
4046 out:
4047 return err;
4048 }
4049
4050 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4051 {
4052 struct sock *sk = sock->sk;
4053 struct sk_security_struct *sksec = sk->sk_security;
4054 int err;
4055
4056 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4057 if (err)
4058 return err;
4059
4060 /*
4061 * If a TCP or DCCP socket, check name_connect permission for the port.
4062 */
4063 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4064 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4065 struct common_audit_data ad;
4066 struct lsm_network_audit net = {0,};
4067 struct sockaddr_in *addr4 = NULL;
4068 struct sockaddr_in6 *addr6 = NULL;
4069 unsigned short snum;
4070 u32 sid, perm;
4071
4072 if (sk->sk_family == PF_INET) {
4073 addr4 = (struct sockaddr_in *)address;
4074 if (addrlen < sizeof(struct sockaddr_in))
4075 return -EINVAL;
4076 snum = ntohs(addr4->sin_port);
4077 } else {
4078 addr6 = (struct sockaddr_in6 *)address;
4079 if (addrlen < SIN6_LEN_RFC2133)
4080 return -EINVAL;
4081 snum = ntohs(addr6->sin6_port);
4082 }
4083
4084 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4085 if (err)
4086 goto out;
4087
4088 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4089 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4090
4091 ad.type = LSM_AUDIT_DATA_NET;
4092 ad.u.net = &net;
4093 ad.u.net->dport = htons(snum);
4094 ad.u.net->family = sk->sk_family;
4095 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4096 if (err)
4097 goto out;
4098 }
4099
4100 err = selinux_netlbl_socket_connect(sk, address);
4101
4102 out:
4103 return err;
4104 }
4105
4106 static int selinux_socket_listen(struct socket *sock, int backlog)
4107 {
4108 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4109 }
4110
4111 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4112 {
4113 int err;
4114 struct inode_security_struct *isec;
4115 struct inode_security_struct *newisec;
4116
4117 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4118 if (err)
4119 return err;
4120
4121 newisec = SOCK_INODE(newsock)->i_security;
4122
4123 isec = SOCK_INODE(sock)->i_security;
4124 newisec->sclass = isec->sclass;
4125 newisec->sid = isec->sid;
4126 newisec->initialized = 1;
4127
4128 return 0;
4129 }
4130
4131 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4132 int size)
4133 {
4134 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4135 }
4136
4137 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4138 int size, int flags)
4139 {
4140 return sock_has_perm(current, sock->sk, SOCKET__READ);
4141 }
4142
4143 static int selinux_socket_getsockname(struct socket *sock)
4144 {
4145 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4146 }
4147
4148 static int selinux_socket_getpeername(struct socket *sock)
4149 {
4150 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4151 }
4152
4153 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4154 {
4155 int err;
4156
4157 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4158 if (err)
4159 return err;
4160
4161 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4162 }
4163
4164 static int selinux_socket_getsockopt(struct socket *sock, int level,
4165 int optname)
4166 {
4167 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4168 }
4169
4170 static int selinux_socket_shutdown(struct socket *sock, int how)
4171 {
4172 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4173 }
4174
4175 static int selinux_socket_unix_stream_connect(struct sock *sock,
4176 struct sock *other,
4177 struct sock *newsk)
4178 {
4179 struct sk_security_struct *sksec_sock = sock->sk_security;
4180 struct sk_security_struct *sksec_other = other->sk_security;
4181 struct sk_security_struct *sksec_new = newsk->sk_security;
4182 struct common_audit_data ad;
4183 struct lsm_network_audit net = {0,};
4184 int err;
4185
4186 ad.type = LSM_AUDIT_DATA_NET;
4187 ad.u.net = &net;
4188 ad.u.net->sk = other;
4189
4190 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4191 sksec_other->sclass,
4192 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4193 if (err)
4194 return err;
4195
4196 /* server child socket */
4197 sksec_new->peer_sid = sksec_sock->sid;
4198 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4199 &sksec_new->sid);
4200 if (err)
4201 return err;
4202
4203 /* connecting socket */
4204 sksec_sock->peer_sid = sksec_new->sid;
4205
4206 return 0;
4207 }
4208
4209 static int selinux_socket_unix_may_send(struct socket *sock,
4210 struct socket *other)
4211 {
4212 struct sk_security_struct *ssec = sock->sk->sk_security;
4213 struct sk_security_struct *osec = other->sk->sk_security;
4214 struct common_audit_data ad;
4215 struct lsm_network_audit net = {0,};
4216
4217 ad.type = LSM_AUDIT_DATA_NET;
4218 ad.u.net = &net;
4219 ad.u.net->sk = other->sk;
4220
4221 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4222 &ad);
4223 }
4224
4225 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4226 u32 peer_sid,
4227 struct common_audit_data *ad)
4228 {
4229 int err;
4230 u32 if_sid;
4231 u32 node_sid;
4232
4233 err = sel_netif_sid(ifindex, &if_sid);
4234 if (err)
4235 return err;
4236 err = avc_has_perm(peer_sid, if_sid,
4237 SECCLASS_NETIF, NETIF__INGRESS, ad);
4238 if (err)
4239 return err;
4240
4241 err = sel_netnode_sid(addrp, family, &node_sid);
4242 if (err)
4243 return err;
4244 return avc_has_perm(peer_sid, node_sid,
4245 SECCLASS_NODE, NODE__RECVFROM, ad);
4246 }
4247
4248 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4249 u16 family)
4250 {
4251 int err = 0;
4252 struct sk_security_struct *sksec = sk->sk_security;
4253 u32 sk_sid = sksec->sid;
4254 struct common_audit_data ad;
4255 struct lsm_network_audit net = {0,};
4256 char *addrp;
4257
4258 ad.type = LSM_AUDIT_DATA_NET;
4259 ad.u.net = &net;
4260 ad.u.net->netif = skb->skb_iif;
4261 ad.u.net->family = family;
4262 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4263 if (err)
4264 return err;
4265
4266 if (selinux_secmark_enabled()) {
4267 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4268 PACKET__RECV, &ad);
4269 if (err)
4270 return err;
4271 }
4272
4273 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4274 if (err)
4275 return err;
4276 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4277
4278 return err;
4279 }
4280
4281 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4282 {
4283 int err;
4284 struct sk_security_struct *sksec = sk->sk_security;
4285 u16 family = sk->sk_family;
4286 u32 sk_sid = sksec->sid;
4287 struct common_audit_data ad;
4288 struct lsm_network_audit net = {0,};
4289 char *addrp;
4290 u8 secmark_active;
4291 u8 peerlbl_active;
4292
4293 if (family != PF_INET && family != PF_INET6)
4294 return 0;
4295
4296 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4297 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4298 family = PF_INET;
4299
4300 /* If any sort of compatibility mode is enabled then handoff processing
4301 * to the selinux_sock_rcv_skb_compat() function to deal with the
4302 * special handling. We do this in an attempt to keep this function
4303 * as fast and as clean as possible. */
4304 if (!selinux_policycap_netpeer)
4305 return selinux_sock_rcv_skb_compat(sk, skb, family);
4306
4307 secmark_active = selinux_secmark_enabled();
4308 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4309 if (!secmark_active && !peerlbl_active)
4310 return 0;
4311
4312 ad.type = LSM_AUDIT_DATA_NET;
4313 ad.u.net = &net;
4314 ad.u.net->netif = skb->skb_iif;
4315 ad.u.net->family = family;
4316 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4317 if (err)
4318 return err;
4319
4320 if (peerlbl_active) {
4321 u32 peer_sid;
4322
4323 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4324 if (err)
4325 return err;
4326 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4327 peer_sid, &ad);
4328 if (err) {
4329 selinux_netlbl_err(skb, err, 0);
4330 return err;
4331 }
4332 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4333 PEER__RECV, &ad);
4334 if (err) {
4335 selinux_netlbl_err(skb, err, 0);
4336 return err;
4337 }
4338 }
4339
4340 if (secmark_active) {
4341 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4342 PACKET__RECV, &ad);
4343 if (err)
4344 return err;
4345 }
4346
4347 return err;
4348 }
4349
4350 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4351 int __user *optlen, unsigned len)
4352 {
4353 int err = 0;
4354 char *scontext;
4355 u32 scontext_len;
4356 struct sk_security_struct *sksec = sock->sk->sk_security;
4357 u32 peer_sid = SECSID_NULL;
4358
4359 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4360 sksec->sclass == SECCLASS_TCP_SOCKET)
4361 peer_sid = sksec->peer_sid;
4362 if (peer_sid == SECSID_NULL)
4363 return -ENOPROTOOPT;
4364
4365 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4366 if (err)
4367 return err;
4368
4369 if (scontext_len > len) {
4370 err = -ERANGE;
4371 goto out_len;
4372 }
4373
4374 if (copy_to_user(optval, scontext, scontext_len))
4375 err = -EFAULT;
4376
4377 out_len:
4378 if (put_user(scontext_len, optlen))
4379 err = -EFAULT;
4380 kfree(scontext);
4381 return err;
4382 }
4383
4384 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4385 {
4386 u32 peer_secid = SECSID_NULL;
4387 u16 family;
4388
4389 if (skb && skb->protocol == htons(ETH_P_IP))
4390 family = PF_INET;
4391 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4392 family = PF_INET6;
4393 else if (sock)
4394 family = sock->sk->sk_family;
4395 else
4396 goto out;
4397
4398 if (sock && family == PF_UNIX)
4399 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4400 else if (skb)
4401 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4402
4403 out:
4404 *secid = peer_secid;
4405 if (peer_secid == SECSID_NULL)
4406 return -EINVAL;
4407 return 0;
4408 }
4409
4410 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4411 {
4412 struct sk_security_struct *sksec;
4413
4414 sksec = kzalloc(sizeof(*sksec), priority);
4415 if (!sksec)
4416 return -ENOMEM;
4417
4418 sksec->peer_sid = SECINITSID_UNLABELED;
4419 sksec->sid = SECINITSID_UNLABELED;
4420 selinux_netlbl_sk_security_reset(sksec);
4421 sk->sk_security = sksec;
4422
4423 return 0;
4424 }
4425
4426 static void selinux_sk_free_security(struct sock *sk)
4427 {
4428 struct sk_security_struct *sksec = sk->sk_security;
4429
4430 sk->sk_security = NULL;
4431 selinux_netlbl_sk_security_free(sksec);
4432 kfree(sksec);
4433 }
4434
4435 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4436 {
4437 struct sk_security_struct *sksec = sk->sk_security;
4438 struct sk_security_struct *newsksec = newsk->sk_security;
4439
4440 newsksec->sid = sksec->sid;
4441 newsksec->peer_sid = sksec->peer_sid;
4442 newsksec->sclass = sksec->sclass;
4443
4444 selinux_netlbl_sk_security_reset(newsksec);
4445 }
4446
4447 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4448 {
4449 if (!sk)
4450 *secid = SECINITSID_ANY_SOCKET;
4451 else {
4452 struct sk_security_struct *sksec = sk->sk_security;
4453
4454 *secid = sksec->sid;
4455 }
4456 }
4457
4458 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4459 {
4460 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4461 struct sk_security_struct *sksec = sk->sk_security;
4462
4463 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4464 sk->sk_family == PF_UNIX)
4465 isec->sid = sksec->sid;
4466 sksec->sclass = isec->sclass;
4467 }
4468
4469 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4470 struct request_sock *req)
4471 {
4472 struct sk_security_struct *sksec = sk->sk_security;
4473 int err;
4474 u16 family = sk->sk_family;
4475 u32 connsid;
4476 u32 peersid;
4477
4478 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4479 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4480 family = PF_INET;
4481
4482 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4483 if (err)
4484 return err;
4485 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4486 if (err)
4487 return err;
4488 req->secid = connsid;
4489 req->peer_secid = peersid;
4490
4491 return selinux_netlbl_inet_conn_request(req, family);
4492 }
4493
4494 static void selinux_inet_csk_clone(struct sock *newsk,
4495 const struct request_sock *req)
4496 {
4497 struct sk_security_struct *newsksec = newsk->sk_security;
4498
4499 newsksec->sid = req->secid;
4500 newsksec->peer_sid = req->peer_secid;
4501 /* NOTE: Ideally, we should also get the isec->sid for the
4502 new socket in sync, but we don't have the isec available yet.
4503 So we will wait until sock_graft to do it, by which
4504 time it will have been created and available. */
4505
4506 /* We don't need to take any sort of lock here as we are the only
4507 * thread with access to newsksec */
4508 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4509 }
4510
4511 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4512 {
4513 u16 family = sk->sk_family;
4514 struct sk_security_struct *sksec = sk->sk_security;
4515
4516 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4517 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4518 family = PF_INET;
4519
4520 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4521 }
4522
4523 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4524 {
4525 skb_set_owner_w(skb, sk);
4526 }
4527
4528 static int selinux_secmark_relabel_packet(u32 sid)
4529 {
4530 const struct task_security_struct *__tsec;
4531 u32 tsid;
4532
4533 __tsec = current_security();
4534 tsid = __tsec->sid;
4535
4536 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4537 }
4538
4539 static void selinux_secmark_refcount_inc(void)
4540 {
4541 atomic_inc(&selinux_secmark_refcount);
4542 }
4543
4544 static void selinux_secmark_refcount_dec(void)
4545 {
4546 atomic_dec(&selinux_secmark_refcount);
4547 }
4548
4549 static void selinux_req_classify_flow(const struct request_sock *req,
4550 struct flowi *fl)
4551 {
4552 fl->flowi_secid = req->secid;
4553 }
4554
4555 static int selinux_tun_dev_alloc_security(void **security)
4556 {
4557 struct tun_security_struct *tunsec;
4558
4559 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4560 if (!tunsec)
4561 return -ENOMEM;
4562 tunsec->sid = current_sid();
4563
4564 *security = tunsec;
4565 return 0;
4566 }
4567
4568 static void selinux_tun_dev_free_security(void *security)
4569 {
4570 kfree(security);
4571 }
4572
4573 static int selinux_tun_dev_create(void)
4574 {
4575 u32 sid = current_sid();
4576
4577 /* we aren't taking into account the "sockcreate" SID since the socket
4578 * that is being created here is not a socket in the traditional sense,
4579 * instead it is a private sock, accessible only to the kernel, and
4580 * representing a wide range of network traffic spanning multiple
4581 * connections unlike traditional sockets - check the TUN driver to
4582 * get a better understanding of why this socket is special */
4583
4584 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4585 NULL);
4586 }
4587
4588 static int selinux_tun_dev_attach_queue(void *security)
4589 {
4590 struct tun_security_struct *tunsec = security;
4591
4592 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4593 TUN_SOCKET__ATTACH_QUEUE, NULL);
4594 }
4595
4596 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4597 {
4598 struct tun_security_struct *tunsec = security;
4599 struct sk_security_struct *sksec = sk->sk_security;
4600
4601 /* we don't currently perform any NetLabel based labeling here and it
4602 * isn't clear that we would want to do so anyway; while we could apply
4603 * labeling without the support of the TUN user the resulting labeled
4604 * traffic from the other end of the connection would almost certainly
4605 * cause confusion to the TUN user that had no idea network labeling
4606 * protocols were being used */
4607
4608 sksec->sid = tunsec->sid;
4609 sksec->sclass = SECCLASS_TUN_SOCKET;
4610
4611 return 0;
4612 }
4613
4614 static int selinux_tun_dev_open(void *security)
4615 {
4616 struct tun_security_struct *tunsec = security;
4617 u32 sid = current_sid();
4618 int err;
4619
4620 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4621 TUN_SOCKET__RELABELFROM, NULL);
4622 if (err)
4623 return err;
4624 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4625 TUN_SOCKET__RELABELTO, NULL);
4626 if (err)
4627 return err;
4628 tunsec->sid = sid;
4629
4630 return 0;
4631 }
4632
4633 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4634 {
4635 int err = 0;
4636 u32 perm;
4637 struct nlmsghdr *nlh;
4638 struct sk_security_struct *sksec = sk->sk_security;
4639
4640 if (skb->len < NLMSG_HDRLEN) {
4641 err = -EINVAL;
4642 goto out;
4643 }
4644 nlh = nlmsg_hdr(skb);
4645
4646 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4647 if (err) {
4648 if (err == -EINVAL) {
4649 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4650 "SELinux: unrecognized netlink message"
4651 " type=%hu for sclass=%hu\n",
4652 nlh->nlmsg_type, sksec->sclass);
4653 if (!selinux_enforcing || security_get_allow_unknown())
4654 err = 0;
4655 }
4656
4657 /* Ignore */
4658 if (err == -ENOENT)
4659 err = 0;
4660 goto out;
4661 }
4662
4663 err = sock_has_perm(current, sk, perm);
4664 out:
4665 return err;
4666 }
4667
4668 #ifdef CONFIG_NETFILTER
4669
4670 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4671 u16 family)
4672 {
4673 int err;
4674 char *addrp;
4675 u32 peer_sid;
4676 struct common_audit_data ad;
4677 struct lsm_network_audit net = {0,};
4678 u8 secmark_active;
4679 u8 netlbl_active;
4680 u8 peerlbl_active;
4681
4682 if (!selinux_policycap_netpeer)
4683 return NF_ACCEPT;
4684
4685 secmark_active = selinux_secmark_enabled();
4686 netlbl_active = netlbl_enabled();
4687 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4688 if (!secmark_active && !peerlbl_active)
4689 return NF_ACCEPT;
4690
4691 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4692 return NF_DROP;
4693
4694 ad.type = LSM_AUDIT_DATA_NET;
4695 ad.u.net = &net;
4696 ad.u.net->netif = ifindex;
4697 ad.u.net->family = family;
4698 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4699 return NF_DROP;
4700
4701 if (peerlbl_active) {
4702 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4703 peer_sid, &ad);
4704 if (err) {
4705 selinux_netlbl_err(skb, err, 1);
4706 return NF_DROP;
4707 }
4708 }
4709
4710 if (secmark_active)
4711 if (avc_has_perm(peer_sid, skb->secmark,
4712 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4713 return NF_DROP;
4714
4715 if (netlbl_active)
4716 /* we do this in the FORWARD path and not the POST_ROUTING
4717 * path because we want to make sure we apply the necessary
4718 * labeling before IPsec is applied so we can leverage AH
4719 * protection */
4720 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4721 return NF_DROP;
4722
4723 return NF_ACCEPT;
4724 }
4725
4726 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4727 struct sk_buff *skb,
4728 const struct net_device *in,
4729 const struct net_device *out,
4730 int (*okfn)(struct sk_buff *))
4731 {
4732 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4733 }
4734
4735 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4736 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4737 struct sk_buff *skb,
4738 const struct net_device *in,
4739 const struct net_device *out,
4740 int (*okfn)(struct sk_buff *))
4741 {
4742 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4743 }
4744 #endif /* IPV6 */
4745
4746 static unsigned int selinux_ip_output(struct sk_buff *skb,
4747 u16 family)
4748 {
4749 struct sock *sk;
4750 u32 sid;
4751
4752 if (!netlbl_enabled())
4753 return NF_ACCEPT;
4754
4755 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4756 * because we want to make sure we apply the necessary labeling
4757 * before IPsec is applied so we can leverage AH protection */
4758 sk = skb->sk;
4759 if (sk) {
4760 struct sk_security_struct *sksec;
4761
4762 if (sk->sk_state == TCP_LISTEN)
4763 /* if the socket is the listening state then this
4764 * packet is a SYN-ACK packet which means it needs to
4765 * be labeled based on the connection/request_sock and
4766 * not the parent socket. unfortunately, we can't
4767 * lookup the request_sock yet as it isn't queued on
4768 * the parent socket until after the SYN-ACK is sent.
4769 * the "solution" is to simply pass the packet as-is
4770 * as any IP option based labeling should be copied
4771 * from the initial connection request (in the IP
4772 * layer). it is far from ideal, but until we get a
4773 * security label in the packet itself this is the
4774 * best we can do. */
4775 return NF_ACCEPT;
4776
4777 /* standard practice, label using the parent socket */
4778 sksec = sk->sk_security;
4779 sid = sksec->sid;
4780 } else
4781 sid = SECINITSID_KERNEL;
4782 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4783 return NF_DROP;
4784
4785 return NF_ACCEPT;
4786 }
4787
4788 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4789 struct sk_buff *skb,
4790 const struct net_device *in,
4791 const struct net_device *out,
4792 int (*okfn)(struct sk_buff *))
4793 {
4794 return selinux_ip_output(skb, PF_INET);
4795 }
4796
4797 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4798 int ifindex,
4799 u16 family)
4800 {
4801 struct sock *sk = skb->sk;
4802 struct sk_security_struct *sksec;
4803 struct common_audit_data ad;
4804 struct lsm_network_audit net = {0,};
4805 char *addrp;
4806 u8 proto;
4807
4808 if (sk == NULL)
4809 return NF_ACCEPT;
4810 sksec = sk->sk_security;
4811
4812 ad.type = LSM_AUDIT_DATA_NET;
4813 ad.u.net = &net;
4814 ad.u.net->netif = ifindex;
4815 ad.u.net->family = family;
4816 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4817 return NF_DROP;
4818
4819 if (selinux_secmark_enabled())
4820 if (avc_has_perm(sksec->sid, skb->secmark,
4821 SECCLASS_PACKET, PACKET__SEND, &ad))
4822 return NF_DROP_ERR(-ECONNREFUSED);
4823
4824 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4825 return NF_DROP_ERR(-ECONNREFUSED);
4826
4827 return NF_ACCEPT;
4828 }
4829
4830 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4831 u16 family)
4832 {
4833 u32 secmark_perm;
4834 u32 peer_sid;
4835 struct sock *sk;
4836 struct common_audit_data ad;
4837 struct lsm_network_audit net = {0,};
4838 char *addrp;
4839 u8 secmark_active;
4840 u8 peerlbl_active;
4841
4842 /* If any sort of compatibility mode is enabled then handoff processing
4843 * to the selinux_ip_postroute_compat() function to deal with the
4844 * special handling. We do this in an attempt to keep this function
4845 * as fast and as clean as possible. */
4846 if (!selinux_policycap_netpeer)
4847 return selinux_ip_postroute_compat(skb, ifindex, family);
4848
4849 secmark_active = selinux_secmark_enabled();
4850 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4851 if (!secmark_active && !peerlbl_active)
4852 return NF_ACCEPT;
4853
4854 sk = skb->sk;
4855
4856 #ifdef CONFIG_XFRM
4857 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4858 * packet transformation so allow the packet to pass without any checks
4859 * since we'll have another chance to perform access control checks
4860 * when the packet is on it's final way out.
4861 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4862 * is NULL, in this case go ahead and apply access control.
4863 * is NULL, in this case go ahead and apply access control.
4864 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4865 * TCP listening state we cannot wait until the XFRM processing
4866 * is done as we will miss out on the SA label if we do;
4867 * unfortunately, this means more work, but it is only once per
4868 * connection. */
4869 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4870 !(sk != NULL && sk->sk_state == TCP_LISTEN))
4871 return NF_ACCEPT;
4872 #endif
4873
4874 if (sk == NULL) {
4875 /* Without an associated socket the packet is either coming
4876 * from the kernel or it is being forwarded; check the packet
4877 * to determine which and if the packet is being forwarded
4878 * query the packet directly to determine the security label. */
4879 if (skb->skb_iif) {
4880 secmark_perm = PACKET__FORWARD_OUT;
4881 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4882 return NF_DROP;
4883 } else {
4884 secmark_perm = PACKET__SEND;
4885 peer_sid = SECINITSID_KERNEL;
4886 }
4887 } else if (sk->sk_state == TCP_LISTEN) {
4888 /* Locally generated packet but the associated socket is in the
4889 * listening state which means this is a SYN-ACK packet. In
4890 * this particular case the correct security label is assigned
4891 * to the connection/request_sock but unfortunately we can't
4892 * query the request_sock as it isn't queued on the parent
4893 * socket until after the SYN-ACK packet is sent; the only
4894 * viable choice is to regenerate the label like we do in
4895 * selinux_inet_conn_request(). See also selinux_ip_output()
4896 * for similar problems. */
4897 u32 skb_sid;
4898 struct sk_security_struct *sksec = sk->sk_security;
4899 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4900 return NF_DROP;
4901 /* At this point, if the returned skb peerlbl is SECSID_NULL
4902 * and the packet has been through at least one XFRM
4903 * transformation then we must be dealing with the "final"
4904 * form of labeled IPsec packet; since we've already applied
4905 * all of our access controls on this packet we can safely
4906 * pass the packet. */
4907 if (skb_sid == SECSID_NULL) {
4908 switch (family) {
4909 case PF_INET:
4910 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4911 return NF_ACCEPT;
4912 break;
4913 case PF_INET6:
4914 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4915 return NF_ACCEPT;
4916 default:
4917 return NF_DROP_ERR(-ECONNREFUSED);
4918 }
4919 }
4920 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4921 return NF_DROP;
4922 secmark_perm = PACKET__SEND;
4923 } else {
4924 /* Locally generated packet, fetch the security label from the
4925 * associated socket. */
4926 struct sk_security_struct *sksec = sk->sk_security;
4927 peer_sid = sksec->sid;
4928 secmark_perm = PACKET__SEND;
4929 }
4930
4931 ad.type = LSM_AUDIT_DATA_NET;
4932 ad.u.net = &net;
4933 ad.u.net->netif = ifindex;
4934 ad.u.net->family = family;
4935 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4936 return NF_DROP;
4937
4938 if (secmark_active)
4939 if (avc_has_perm(peer_sid, skb->secmark,
4940 SECCLASS_PACKET, secmark_perm, &ad))
4941 return NF_DROP_ERR(-ECONNREFUSED);
4942
4943 if (peerlbl_active) {
4944 u32 if_sid;
4945 u32 node_sid;
4946
4947 if (sel_netif_sid(ifindex, &if_sid))
4948 return NF_DROP;
4949 if (avc_has_perm(peer_sid, if_sid,
4950 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4951 return NF_DROP_ERR(-ECONNREFUSED);
4952
4953 if (sel_netnode_sid(addrp, family, &node_sid))
4954 return NF_DROP;
4955 if (avc_has_perm(peer_sid, node_sid,
4956 SECCLASS_NODE, NODE__SENDTO, &ad))
4957 return NF_DROP_ERR(-ECONNREFUSED);
4958 }
4959
4960 return NF_ACCEPT;
4961 }
4962
4963 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4964 struct sk_buff *skb,
4965 const struct net_device *in,
4966 const struct net_device *out,
4967 int (*okfn)(struct sk_buff *))
4968 {
4969 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4970 }
4971
4972 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4973 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4974 struct sk_buff *skb,
4975 const struct net_device *in,
4976 const struct net_device *out,
4977 int (*okfn)(struct sk_buff *))
4978 {
4979 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4980 }
4981 #endif /* IPV6 */
4982
4983 #endif /* CONFIG_NETFILTER */
4984
4985 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4986 {
4987 int err;
4988
4989 err = cap_netlink_send(sk, skb);
4990 if (err)
4991 return err;
4992
4993 return selinux_nlmsg_perm(sk, skb);
4994 }
4995
4996 static int ipc_alloc_security(struct task_struct *task,
4997 struct kern_ipc_perm *perm,
4998 u16 sclass)
4999 {
5000 struct ipc_security_struct *isec;
5001 u32 sid;
5002
5003 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5004 if (!isec)
5005 return -ENOMEM;
5006
5007 sid = task_sid(task);
5008 isec->sclass = sclass;
5009 isec->sid = sid;
5010 perm->security = isec;
5011
5012 return 0;
5013 }
5014
5015 static void ipc_free_security(struct kern_ipc_perm *perm)
5016 {
5017 struct ipc_security_struct *isec = perm->security;
5018 perm->security = NULL;
5019 kfree(isec);
5020 }
5021
5022 static int msg_msg_alloc_security(struct msg_msg *msg)
5023 {
5024 struct msg_security_struct *msec;
5025
5026 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5027 if (!msec)
5028 return -ENOMEM;
5029
5030 msec->sid = SECINITSID_UNLABELED;
5031 msg->security = msec;
5032
5033 return 0;
5034 }
5035
5036 static void msg_msg_free_security(struct msg_msg *msg)
5037 {
5038 struct msg_security_struct *msec = msg->security;
5039
5040 msg->security = NULL;
5041 kfree(msec);
5042 }
5043
5044 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5045 u32 perms)
5046 {
5047 struct ipc_security_struct *isec;
5048 struct common_audit_data ad;
5049 u32 sid = current_sid();
5050
5051 isec = ipc_perms->security;
5052
5053 ad.type = LSM_AUDIT_DATA_IPC;
5054 ad.u.ipc_id = ipc_perms->key;
5055
5056 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5057 }
5058
5059 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5060 {
5061 return msg_msg_alloc_security(msg);
5062 }
5063
5064 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5065 {
5066 msg_msg_free_security(msg);
5067 }
5068
5069 /* message queue security operations */
5070 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5071 {
5072 struct ipc_security_struct *isec;
5073 struct common_audit_data ad;
5074 u32 sid = current_sid();
5075 int rc;
5076
5077 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5078 if (rc)
5079 return rc;
5080
5081 isec = msq->q_perm.security;
5082
5083 ad.type = LSM_AUDIT_DATA_IPC;
5084 ad.u.ipc_id = msq->q_perm.key;
5085
5086 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5087 MSGQ__CREATE, &ad);
5088 if (rc) {
5089 ipc_free_security(&msq->q_perm);
5090 return rc;
5091 }
5092 return 0;
5093 }
5094
5095 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5096 {
5097 ipc_free_security(&msq->q_perm);
5098 }
5099
5100 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5101 {
5102 struct ipc_security_struct *isec;
5103 struct common_audit_data ad;
5104 u32 sid = current_sid();
5105
5106 isec = msq->q_perm.security;
5107
5108 ad.type = LSM_AUDIT_DATA_IPC;
5109 ad.u.ipc_id = msq->q_perm.key;
5110
5111 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5112 MSGQ__ASSOCIATE, &ad);
5113 }
5114
5115 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5116 {
5117 int err;
5118 int perms;
5119
5120 switch (cmd) {
5121 case IPC_INFO:
5122 case MSG_INFO:
5123 /* No specific object, just general system-wide information. */
5124 return task_has_system(current, SYSTEM__IPC_INFO);
5125 case IPC_STAT:
5126 case MSG_STAT:
5127 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5128 break;
5129 case IPC_SET:
5130 perms = MSGQ__SETATTR;
5131 break;
5132 case IPC_RMID:
5133 perms = MSGQ__DESTROY;
5134 break;
5135 default:
5136 return 0;
5137 }
5138
5139 err = ipc_has_perm(&msq->q_perm, perms);
5140 return err;
5141 }
5142
5143 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5144 {
5145 struct ipc_security_struct *isec;
5146 struct msg_security_struct *msec;
5147 struct common_audit_data ad;
5148 u32 sid = current_sid();
5149 int rc;
5150
5151 isec = msq->q_perm.security;
5152 msec = msg->security;
5153
5154 /*
5155 * First time through, need to assign label to the message
5156 */
5157 if (msec->sid == SECINITSID_UNLABELED) {
5158 /*
5159 * Compute new sid based on current process and
5160 * message queue this message will be stored in
5161 */
5162 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5163 NULL, &msec->sid);
5164 if (rc)
5165 return rc;
5166 }
5167
5168 ad.type = LSM_AUDIT_DATA_IPC;
5169 ad.u.ipc_id = msq->q_perm.key;
5170
5171 /* Can this process write to the queue? */
5172 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5173 MSGQ__WRITE, &ad);
5174 if (!rc)
5175 /* Can this process send the message */
5176 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5177 MSG__SEND, &ad);
5178 if (!rc)
5179 /* Can the message be put in the queue? */
5180 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5181 MSGQ__ENQUEUE, &ad);
5182
5183 return rc;
5184 }
5185
5186 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5187 struct task_struct *target,
5188 long type, int mode)
5189 {
5190 struct ipc_security_struct *isec;
5191 struct msg_security_struct *msec;
5192 struct common_audit_data ad;
5193 u32 sid = task_sid(target);
5194 int rc;
5195
5196 isec = msq->q_perm.security;
5197 msec = msg->security;
5198
5199 ad.type = LSM_AUDIT_DATA_IPC;
5200 ad.u.ipc_id = msq->q_perm.key;
5201
5202 rc = avc_has_perm(sid, isec->sid,
5203 SECCLASS_MSGQ, MSGQ__READ, &ad);
5204 if (!rc)
5205 rc = avc_has_perm(sid, msec->sid,
5206 SECCLASS_MSG, MSG__RECEIVE, &ad);
5207 return rc;
5208 }
5209
5210 /* Shared Memory security operations */
5211 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5212 {
5213 struct ipc_security_struct *isec;
5214 struct common_audit_data ad;
5215 u32 sid = current_sid();
5216 int rc;
5217
5218 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5219 if (rc)
5220 return rc;
5221
5222 isec = shp->shm_perm.security;
5223
5224 ad.type = LSM_AUDIT_DATA_IPC;
5225 ad.u.ipc_id = shp->shm_perm.key;
5226
5227 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5228 SHM__CREATE, &ad);
5229 if (rc) {
5230 ipc_free_security(&shp->shm_perm);
5231 return rc;
5232 }
5233 return 0;
5234 }
5235
5236 static void selinux_shm_free_security(struct shmid_kernel *shp)
5237 {
5238 ipc_free_security(&shp->shm_perm);
5239 }
5240
5241 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5242 {
5243 struct ipc_security_struct *isec;
5244 struct common_audit_data ad;
5245 u32 sid = current_sid();
5246
5247 isec = shp->shm_perm.security;
5248
5249 ad.type = LSM_AUDIT_DATA_IPC;
5250 ad.u.ipc_id = shp->shm_perm.key;
5251
5252 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5253 SHM__ASSOCIATE, &ad);
5254 }
5255
5256 /* Note, at this point, shp is locked down */
5257 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5258 {
5259 int perms;
5260 int err;
5261
5262 switch (cmd) {
5263 case IPC_INFO:
5264 case SHM_INFO:
5265 /* No specific object, just general system-wide information. */
5266 return task_has_system(current, SYSTEM__IPC_INFO);
5267 case IPC_STAT:
5268 case SHM_STAT:
5269 perms = SHM__GETATTR | SHM__ASSOCIATE;
5270 break;
5271 case IPC_SET:
5272 perms = SHM__SETATTR;
5273 break;
5274 case SHM_LOCK:
5275 case SHM_UNLOCK:
5276 perms = SHM__LOCK;
5277 break;
5278 case IPC_RMID:
5279 perms = SHM__DESTROY;
5280 break;
5281 default:
5282 return 0;
5283 }
5284
5285 err = ipc_has_perm(&shp->shm_perm, perms);
5286 return err;
5287 }
5288
5289 static int selinux_shm_shmat(struct shmid_kernel *shp,
5290 char __user *shmaddr, int shmflg)
5291 {
5292 u32 perms;
5293
5294 if (shmflg & SHM_RDONLY)
5295 perms = SHM__READ;
5296 else
5297 perms = SHM__READ | SHM__WRITE;
5298
5299 return ipc_has_perm(&shp->shm_perm, perms);
5300 }
5301
5302 /* Semaphore security operations */
5303 static int selinux_sem_alloc_security(struct sem_array *sma)
5304 {
5305 struct ipc_security_struct *isec;
5306 struct common_audit_data ad;
5307 u32 sid = current_sid();
5308 int rc;
5309
5310 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5311 if (rc)
5312 return rc;
5313
5314 isec = sma->sem_perm.security;
5315
5316 ad.type = LSM_AUDIT_DATA_IPC;
5317 ad.u.ipc_id = sma->sem_perm.key;
5318
5319 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5320 SEM__CREATE, &ad);
5321 if (rc) {
5322 ipc_free_security(&sma->sem_perm);
5323 return rc;
5324 }
5325 return 0;
5326 }
5327
5328 static void selinux_sem_free_security(struct sem_array *sma)
5329 {
5330 ipc_free_security(&sma->sem_perm);
5331 }
5332
5333 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5334 {
5335 struct ipc_security_struct *isec;
5336 struct common_audit_data ad;
5337 u32 sid = current_sid();
5338
5339 isec = sma->sem_perm.security;
5340
5341 ad.type = LSM_AUDIT_DATA_IPC;
5342 ad.u.ipc_id = sma->sem_perm.key;
5343
5344 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5345 SEM__ASSOCIATE, &ad);
5346 }
5347
5348 /* Note, at this point, sma is locked down */
5349 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5350 {
5351 int err;
5352 u32 perms;
5353
5354 switch (cmd) {
5355 case IPC_INFO:
5356 case SEM_INFO:
5357 /* No specific object, just general system-wide information. */
5358 return task_has_system(current, SYSTEM__IPC_INFO);
5359 case GETPID:
5360 case GETNCNT:
5361 case GETZCNT:
5362 perms = SEM__GETATTR;
5363 break;
5364 case GETVAL:
5365 case GETALL:
5366 perms = SEM__READ;
5367 break;
5368 case SETVAL:
5369 case SETALL:
5370 perms = SEM__WRITE;
5371 break;
5372 case IPC_RMID:
5373 perms = SEM__DESTROY;
5374 break;
5375 case IPC_SET:
5376 perms = SEM__SETATTR;
5377 break;
5378 case IPC_STAT:
5379 case SEM_STAT:
5380 perms = SEM__GETATTR | SEM__ASSOCIATE;
5381 break;
5382 default:
5383 return 0;
5384 }
5385
5386 err = ipc_has_perm(&sma->sem_perm, perms);
5387 return err;
5388 }
5389
5390 static int selinux_sem_semop(struct sem_array *sma,
5391 struct sembuf *sops, unsigned nsops, int alter)
5392 {
5393 u32 perms;
5394
5395 if (alter)
5396 perms = SEM__READ | SEM__WRITE;
5397 else
5398 perms = SEM__READ;
5399
5400 return ipc_has_perm(&sma->sem_perm, perms);
5401 }
5402
5403 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5404 {
5405 u32 av = 0;
5406
5407 av = 0;
5408 if (flag & S_IRUGO)
5409 av |= IPC__UNIX_READ;
5410 if (flag & S_IWUGO)
5411 av |= IPC__UNIX_WRITE;
5412
5413 if (av == 0)
5414 return 0;
5415
5416 return ipc_has_perm(ipcp, av);
5417 }
5418
5419 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5420 {
5421 struct ipc_security_struct *isec = ipcp->security;
5422 *secid = isec->sid;
5423 }
5424
5425 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5426 {
5427 if (inode)
5428 inode_doinit_with_dentry(inode, dentry);
5429 }
5430
5431 static int selinux_getprocattr(struct task_struct *p,
5432 char *name, char **value)
5433 {
5434 const struct task_security_struct *__tsec;
5435 u32 sid;
5436 int error;
5437 unsigned len;
5438
5439 if (current != p) {
5440 error = current_has_perm(p, PROCESS__GETATTR);
5441 if (error)
5442 return error;
5443 }
5444
5445 rcu_read_lock();
5446 __tsec = __task_cred(p)->security;
5447
5448 if (!strcmp(name, "current"))
5449 sid = __tsec->sid;
5450 else if (!strcmp(name, "prev"))
5451 sid = __tsec->osid;
5452 else if (!strcmp(name, "exec"))
5453 sid = __tsec->exec_sid;
5454 else if (!strcmp(name, "fscreate"))
5455 sid = __tsec->create_sid;
5456 else if (!strcmp(name, "keycreate"))
5457 sid = __tsec->keycreate_sid;
5458 else if (!strcmp(name, "sockcreate"))
5459 sid = __tsec->sockcreate_sid;
5460 else
5461 goto invalid;
5462 rcu_read_unlock();
5463
5464 if (!sid)
5465 return 0;
5466
5467 error = security_sid_to_context(sid, value, &len);
5468 if (error)
5469 return error;
5470 return len;
5471
5472 invalid:
5473 rcu_read_unlock();
5474 return -EINVAL;
5475 }
5476
5477 static int selinux_setprocattr(struct task_struct *p,
5478 char *name, void *value, size_t size)
5479 {
5480 struct task_security_struct *tsec;
5481 struct task_struct *tracer;
5482 struct cred *new;
5483 u32 sid = 0, ptsid;
5484 int error;
5485 char *str = value;
5486
5487 if (current != p) {
5488 /* SELinux only allows a process to change its own
5489 security attributes. */
5490 return -EACCES;
5491 }
5492
5493 /*
5494 * Basic control over ability to set these attributes at all.
5495 * current == p, but we'll pass them separately in case the
5496 * above restriction is ever removed.
5497 */
5498 if (!strcmp(name, "exec"))
5499 error = current_has_perm(p, PROCESS__SETEXEC);
5500 else if (!strcmp(name, "fscreate"))
5501 error = current_has_perm(p, PROCESS__SETFSCREATE);
5502 else if (!strcmp(name, "keycreate"))
5503 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5504 else if (!strcmp(name, "sockcreate"))
5505 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5506 else if (!strcmp(name, "current"))
5507 error = current_has_perm(p, PROCESS__SETCURRENT);
5508 else
5509 error = -EINVAL;
5510 if (error)
5511 return error;
5512
5513 /* Obtain a SID for the context, if one was specified. */
5514 if (size && str[1] && str[1] != '\n') {
5515 if (str[size-1] == '\n') {
5516 str[size-1] = 0;
5517 size--;
5518 }
5519 error = security_context_to_sid(value, size, &sid);
5520 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5521 if (!capable(CAP_MAC_ADMIN)) {
5522 struct audit_buffer *ab;
5523 size_t audit_size;
5524
5525 /* We strip a nul only if it is at the end, otherwise the
5526 * context contains a nul and we should audit that */
5527 if (str[size - 1] == '\0')
5528 audit_size = size - 1;
5529 else
5530 audit_size = size;
5531 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5532 audit_log_format(ab, "op=fscreate invalid_context=");
5533 audit_log_n_untrustedstring(ab, value, audit_size);
5534 audit_log_end(ab);
5535
5536 return error;
5537 }
5538 error = security_context_to_sid_force(value, size,
5539 &sid);
5540 }
5541 if (error)
5542 return error;
5543 }
5544
5545 new = prepare_creds();
5546 if (!new)
5547 return -ENOMEM;
5548
5549 /* Permission checking based on the specified context is
5550 performed during the actual operation (execve,
5551 open/mkdir/...), when we know the full context of the
5552 operation. See selinux_bprm_set_creds for the execve
5553 checks and may_create for the file creation checks. The
5554 operation will then fail if the context is not permitted. */
5555 tsec = new->security;
5556 if (!strcmp(name, "exec")) {
5557 tsec->exec_sid = sid;
5558 } else if (!strcmp(name, "fscreate")) {
5559 tsec->create_sid = sid;
5560 } else if (!strcmp(name, "keycreate")) {
5561 error = may_create_key(sid, p);
5562 if (error)
5563 goto abort_change;
5564 tsec->keycreate_sid = sid;
5565 } else if (!strcmp(name, "sockcreate")) {
5566 tsec->sockcreate_sid = sid;
5567 } else if (!strcmp(name, "current")) {
5568 error = -EINVAL;
5569 if (sid == 0)
5570 goto abort_change;
5571
5572 /* Only allow single threaded processes to change context */
5573 error = -EPERM;
5574 if (!current_is_single_threaded()) {
5575 error = security_bounded_transition(tsec->sid, sid);
5576 if (error)
5577 goto abort_change;
5578 }
5579
5580 /* Check permissions for the transition. */
5581 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5582 PROCESS__DYNTRANSITION, NULL);
5583 if (error)
5584 goto abort_change;
5585
5586 /* Check for ptracing, and update the task SID if ok.
5587 Otherwise, leave SID unchanged and fail. */
5588 ptsid = 0;
5589 rcu_read_lock();
5590 tracer = ptrace_parent(p);
5591 if (tracer)
5592 ptsid = task_sid(tracer);
5593 rcu_read_unlock();
5594
5595 if (tracer) {
5596 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5597 PROCESS__PTRACE, NULL);
5598 if (error)
5599 goto abort_change;
5600 }
5601
5602 tsec->sid = sid;
5603 } else {
5604 error = -EINVAL;
5605 goto abort_change;
5606 }
5607
5608 commit_creds(new);
5609 return size;
5610
5611 abort_change:
5612 abort_creds(new);
5613 return error;
5614 }
5615
5616 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5617 {
5618 return security_sid_to_context(secid, secdata, seclen);
5619 }
5620
5621 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5622 {
5623 return security_context_to_sid(secdata, seclen, secid);
5624 }
5625
5626 static void selinux_release_secctx(char *secdata, u32 seclen)
5627 {
5628 kfree(secdata);
5629 }
5630
5631 /*
5632 * called with inode->i_mutex locked
5633 */
5634 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5635 {
5636 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5637 }
5638
5639 /*
5640 * called with inode->i_mutex locked
5641 */
5642 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5643 {
5644 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5645 }
5646
5647 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5648 {
5649 int len = 0;
5650 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5651 ctx, true);
5652 if (len < 0)
5653 return len;
5654 *ctxlen = len;
5655 return 0;
5656 }
5657 #ifdef CONFIG_KEYS
5658
5659 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5660 unsigned long flags)
5661 {
5662 const struct task_security_struct *tsec;
5663 struct key_security_struct *ksec;
5664
5665 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5666 if (!ksec)
5667 return -ENOMEM;
5668
5669 tsec = cred->security;
5670 if (tsec->keycreate_sid)
5671 ksec->sid = tsec->keycreate_sid;
5672 else
5673 ksec->sid = tsec->sid;
5674
5675 k->security = ksec;
5676 return 0;
5677 }
5678
5679 static void selinux_key_free(struct key *k)
5680 {
5681 struct key_security_struct *ksec = k->security;
5682
5683 k->security = NULL;
5684 kfree(ksec);
5685 }
5686
5687 static int selinux_key_permission(key_ref_t key_ref,
5688 const struct cred *cred,
5689 key_perm_t perm)
5690 {
5691 struct key *key;
5692 struct key_security_struct *ksec;
5693 u32 sid;
5694
5695 /* if no specific permissions are requested, we skip the
5696 permission check. No serious, additional covert channels
5697 appear to be created. */
5698 if (perm == 0)
5699 return 0;
5700
5701 sid = cred_sid(cred);
5702
5703 key = key_ref_to_ptr(key_ref);
5704 ksec = key->security;
5705
5706 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5707 }
5708
5709 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5710 {
5711 struct key_security_struct *ksec = key->security;
5712 char *context = NULL;
5713 unsigned len;
5714 int rc;
5715
5716 rc = security_sid_to_context(ksec->sid, &context, &len);
5717 if (!rc)
5718 rc = len;
5719 *_buffer = context;
5720 return rc;
5721 }
5722
5723 #endif
5724
5725 static struct security_operations selinux_ops = {
5726 .name = "selinux",
5727
5728 .binder_set_context_mgr = selinux_binder_set_context_mgr,
5729 .binder_transaction = selinux_binder_transaction,
5730 .binder_transfer_binder = selinux_binder_transfer_binder,
5731 .binder_transfer_file = selinux_binder_transfer_file,
5732
5733 .ptrace_access_check = selinux_ptrace_access_check,
5734 .ptrace_traceme = selinux_ptrace_traceme,
5735 .capget = selinux_capget,
5736 .capset = selinux_capset,
5737 .capable = selinux_capable,
5738 .quotactl = selinux_quotactl,
5739 .quota_on = selinux_quota_on,
5740 .syslog = selinux_syslog,
5741 .vm_enough_memory = selinux_vm_enough_memory,
5742
5743 .netlink_send = selinux_netlink_send,
5744
5745 .bprm_set_creds = selinux_bprm_set_creds,
5746 .bprm_committing_creds = selinux_bprm_committing_creds,
5747 .bprm_committed_creds = selinux_bprm_committed_creds,
5748 .bprm_secureexec = selinux_bprm_secureexec,
5749
5750 .sb_alloc_security = selinux_sb_alloc_security,
5751 .sb_free_security = selinux_sb_free_security,
5752 .sb_copy_data = selinux_sb_copy_data,
5753 .sb_remount = selinux_sb_remount,
5754 .sb_kern_mount = selinux_sb_kern_mount,
5755 .sb_show_options = selinux_sb_show_options,
5756 .sb_statfs = selinux_sb_statfs,
5757 .sb_mount = selinux_mount,
5758 .sb_umount = selinux_umount,
5759 .sb_set_mnt_opts = selinux_set_mnt_opts,
5760 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5761 .sb_parse_opts_str = selinux_parse_opts_str,
5762
5763
5764 .inode_alloc_security = selinux_inode_alloc_security,
5765 .inode_free_security = selinux_inode_free_security,
5766 .inode_init_security = selinux_inode_init_security,
5767 .inode_create = selinux_inode_create,
5768 .inode_link = selinux_inode_link,
5769 .inode_unlink = selinux_inode_unlink,
5770 .inode_symlink = selinux_inode_symlink,
5771 .inode_mkdir = selinux_inode_mkdir,
5772 .inode_rmdir = selinux_inode_rmdir,
5773 .inode_mknod = selinux_inode_mknod,
5774 .inode_rename = selinux_inode_rename,
5775 .inode_readlink = selinux_inode_readlink,
5776 .inode_follow_link = selinux_inode_follow_link,
5777 .inode_permission = selinux_inode_permission,
5778 .inode_setattr = selinux_inode_setattr,
5779 .inode_getattr = selinux_inode_getattr,
5780 .inode_setxattr = selinux_inode_setxattr,
5781 .inode_post_setxattr = selinux_inode_post_setxattr,
5782 .inode_getxattr = selinux_inode_getxattr,
5783 .inode_listxattr = selinux_inode_listxattr,
5784 .inode_removexattr = selinux_inode_removexattr,
5785 .inode_getsecurity = selinux_inode_getsecurity,
5786 .inode_setsecurity = selinux_inode_setsecurity,
5787 .inode_listsecurity = selinux_inode_listsecurity,
5788 .inode_getsecid = selinux_inode_getsecid,
5789
5790 .file_permission = selinux_file_permission,
5791 .file_alloc_security = selinux_file_alloc_security,
5792 .file_free_security = selinux_file_free_security,
5793 .file_ioctl = selinux_file_ioctl,
5794 .mmap_file = selinux_mmap_file,
5795 .mmap_addr = selinux_mmap_addr,
5796 .file_mprotect = selinux_file_mprotect,
5797 .file_lock = selinux_file_lock,
5798 .file_fcntl = selinux_file_fcntl,
5799 .file_set_fowner = selinux_file_set_fowner,
5800 .file_send_sigiotask = selinux_file_send_sigiotask,
5801 .file_receive = selinux_file_receive,
5802
5803 .file_open = selinux_file_open,
5804
5805 .task_create = selinux_task_create,
5806 .cred_alloc_blank = selinux_cred_alloc_blank,
5807 .cred_free = selinux_cred_free,
5808 .cred_prepare = selinux_cred_prepare,
5809 .cred_transfer = selinux_cred_transfer,
5810 .kernel_act_as = selinux_kernel_act_as,
5811 .kernel_create_files_as = selinux_kernel_create_files_as,
5812 .kernel_module_request = selinux_kernel_module_request,
5813 .task_setpgid = selinux_task_setpgid,
5814 .task_getpgid = selinux_task_getpgid,
5815 .task_getsid = selinux_task_getsid,
5816 .task_getsecid = selinux_task_getsecid,
5817 .task_setnice = selinux_task_setnice,
5818 .task_setioprio = selinux_task_setioprio,
5819 .task_getioprio = selinux_task_getioprio,
5820 .task_setrlimit = selinux_task_setrlimit,
5821 .task_setscheduler = selinux_task_setscheduler,
5822 .task_getscheduler = selinux_task_getscheduler,
5823 .task_movememory = selinux_task_movememory,
5824 .task_kill = selinux_task_kill,
5825 .task_wait = selinux_task_wait,
5826 .task_to_inode = selinux_task_to_inode,
5827
5828 .ipc_permission = selinux_ipc_permission,
5829 .ipc_getsecid = selinux_ipc_getsecid,
5830
5831 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5832 .msg_msg_free_security = selinux_msg_msg_free_security,
5833
5834 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5835 .msg_queue_free_security = selinux_msg_queue_free_security,
5836 .msg_queue_associate = selinux_msg_queue_associate,
5837 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5838 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5839 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5840
5841 .shm_alloc_security = selinux_shm_alloc_security,
5842 .shm_free_security = selinux_shm_free_security,
5843 .shm_associate = selinux_shm_associate,
5844 .shm_shmctl = selinux_shm_shmctl,
5845 .shm_shmat = selinux_shm_shmat,
5846
5847 .sem_alloc_security = selinux_sem_alloc_security,
5848 .sem_free_security = selinux_sem_free_security,
5849 .sem_associate = selinux_sem_associate,
5850 .sem_semctl = selinux_sem_semctl,
5851 .sem_semop = selinux_sem_semop,
5852
5853 .d_instantiate = selinux_d_instantiate,
5854
5855 .getprocattr = selinux_getprocattr,
5856 .setprocattr = selinux_setprocattr,
5857
5858 .secid_to_secctx = selinux_secid_to_secctx,
5859 .secctx_to_secid = selinux_secctx_to_secid,
5860 .release_secctx = selinux_release_secctx,
5861 .inode_notifysecctx = selinux_inode_notifysecctx,
5862 .inode_setsecctx = selinux_inode_setsecctx,
5863 .inode_getsecctx = selinux_inode_getsecctx,
5864
5865 .unix_stream_connect = selinux_socket_unix_stream_connect,
5866 .unix_may_send = selinux_socket_unix_may_send,
5867
5868 .socket_create = selinux_socket_create,
5869 .socket_post_create = selinux_socket_post_create,
5870 .socket_bind = selinux_socket_bind,
5871 .socket_connect = selinux_socket_connect,
5872 .socket_listen = selinux_socket_listen,
5873 .socket_accept = selinux_socket_accept,
5874 .socket_sendmsg = selinux_socket_sendmsg,
5875 .socket_recvmsg = selinux_socket_recvmsg,
5876 .socket_getsockname = selinux_socket_getsockname,
5877 .socket_getpeername = selinux_socket_getpeername,
5878 .socket_getsockopt = selinux_socket_getsockopt,
5879 .socket_setsockopt = selinux_socket_setsockopt,
5880 .socket_shutdown = selinux_socket_shutdown,
5881 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5882 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5883 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5884 .sk_alloc_security = selinux_sk_alloc_security,
5885 .sk_free_security = selinux_sk_free_security,
5886 .sk_clone_security = selinux_sk_clone_security,
5887 .sk_getsecid = selinux_sk_getsecid,
5888 .sock_graft = selinux_sock_graft,
5889 .inet_conn_request = selinux_inet_conn_request,
5890 .inet_csk_clone = selinux_inet_csk_clone,
5891 .inet_conn_established = selinux_inet_conn_established,
5892 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5893 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5894 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5895 .req_classify_flow = selinux_req_classify_flow,
5896 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5897 .tun_dev_free_security = selinux_tun_dev_free_security,
5898 .tun_dev_create = selinux_tun_dev_create,
5899 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5900 .tun_dev_attach = selinux_tun_dev_attach,
5901 .tun_dev_open = selinux_tun_dev_open,
5902 .skb_owned_by = selinux_skb_owned_by,
5903
5904 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5905 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5906 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5907 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5908 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5909 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5910 .xfrm_state_free_security = selinux_xfrm_state_free,
5911 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5912 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5913 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5914 .xfrm_decode_session = selinux_xfrm_decode_session,
5915 #endif
5916
5917 #ifdef CONFIG_KEYS
5918 .key_alloc = selinux_key_alloc,
5919 .key_free = selinux_key_free,
5920 .key_permission = selinux_key_permission,
5921 .key_getsecurity = selinux_key_getsecurity,
5922 #endif
5923
5924 #ifdef CONFIG_AUDIT
5925 .audit_rule_init = selinux_audit_rule_init,
5926 .audit_rule_known = selinux_audit_rule_known,
5927 .audit_rule_match = selinux_audit_rule_match,
5928 .audit_rule_free = selinux_audit_rule_free,
5929 #endif
5930 };
5931
5932 static __init int selinux_init(void)
5933 {
5934 if (!security_module_enable(&selinux_ops)) {
5935 selinux_enabled = 0;
5936 return 0;
5937 }
5938
5939 if (!selinux_enabled) {
5940 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5941 return 0;
5942 }
5943
5944 printk(KERN_INFO "SELinux: Initializing.\n");
5945
5946 /* Set the security state for the initial task. */
5947 cred_init_security();
5948
5949 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5950
5951 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5952 sizeof(struct inode_security_struct),
5953 0, SLAB_PANIC, NULL);
5954 avc_init();
5955
5956 if (register_security(&selinux_ops))
5957 panic("SELinux: Unable to register with kernel.\n");
5958
5959 if (selinux_enforcing)
5960 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5961 else
5962 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5963
5964 return 0;
5965 }
5966
5967 static void delayed_superblock_init(struct super_block *sb, void *unused)
5968 {
5969 superblock_doinit(sb, NULL);
5970 }
5971
5972 void selinux_complete_init(void)
5973 {
5974 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5975
5976 /* Set up any superblocks initialized prior to the policy load. */
5977 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5978 iterate_supers(delayed_superblock_init, NULL);
5979 }
5980
5981 /* SELinux requires early initialization in order to label
5982 all processes and objects when they are created. */
5983 security_initcall(selinux_init);
5984
5985 #if defined(CONFIG_NETFILTER)
5986
5987 static struct nf_hook_ops selinux_ipv4_ops[] = {
5988 {
5989 .hook = selinux_ipv4_postroute,
5990 .owner = THIS_MODULE,
5991 .pf = NFPROTO_IPV4,
5992 .hooknum = NF_INET_POST_ROUTING,
5993 .priority = NF_IP_PRI_SELINUX_LAST,
5994 },
5995 {
5996 .hook = selinux_ipv4_forward,
5997 .owner = THIS_MODULE,
5998 .pf = NFPROTO_IPV4,
5999 .hooknum = NF_INET_FORWARD,
6000 .priority = NF_IP_PRI_SELINUX_FIRST,
6001 },
6002 {
6003 .hook = selinux_ipv4_output,
6004 .owner = THIS_MODULE,
6005 .pf = NFPROTO_IPV4,
6006 .hooknum = NF_INET_LOCAL_OUT,
6007 .priority = NF_IP_PRI_SELINUX_FIRST,
6008 }
6009 };
6010
6011 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6012
6013 static struct nf_hook_ops selinux_ipv6_ops[] = {
6014 {
6015 .hook = selinux_ipv6_postroute,
6016 .owner = THIS_MODULE,
6017 .pf = NFPROTO_IPV6,
6018 .hooknum = NF_INET_POST_ROUTING,
6019 .priority = NF_IP6_PRI_SELINUX_LAST,
6020 },
6021 {
6022 .hook = selinux_ipv6_forward,
6023 .owner = THIS_MODULE,
6024 .pf = NFPROTO_IPV6,
6025 .hooknum = NF_INET_FORWARD,
6026 .priority = NF_IP6_PRI_SELINUX_FIRST,
6027 }
6028 };
6029
6030 #endif /* IPV6 */
6031
6032 static int __init selinux_nf_ip_init(void)
6033 {
6034 int err = 0;
6035
6036 if (!selinux_enabled)
6037 goto out;
6038
6039 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6040
6041 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6042 if (err)
6043 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6044
6045 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6046 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6047 if (err)
6048 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6049 #endif /* IPV6 */
6050
6051 out:
6052 return err;
6053 }
6054
6055 __initcall(selinux_nf_ip_init);
6056
6057 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6058 static void selinux_nf_ip_exit(void)
6059 {
6060 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6061
6062 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6063 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6064 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6065 #endif /* IPV6 */
6066 }
6067 #endif
6068
6069 #else /* CONFIG_NETFILTER */
6070
6071 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6072 #define selinux_nf_ip_exit()
6073 #endif
6074
6075 #endif /* CONFIG_NETFILTER */
6076
6077 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6078 static int selinux_disabled;
6079
6080 int selinux_disable(void)
6081 {
6082 if (ss_initialized) {
6083 /* Not permitted after initial policy load. */
6084 return -EINVAL;
6085 }
6086
6087 if (selinux_disabled) {
6088 /* Only do this once. */
6089 return -EINVAL;
6090 }
6091
6092 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6093
6094 selinux_disabled = 1;
6095 selinux_enabled = 0;
6096
6097 reset_security_ops();
6098
6099 /* Try to destroy the avc node cache */
6100 avc_disable();
6101
6102 /* Unregister netfilter hooks. */
6103 selinux_nf_ip_exit();
6104
6105 /* Unregister selinuxfs. */
6106 exit_sel_fs();
6107
6108 return 0;
6109 }
6110 #endif
kernel source for telekom puls (alcatel/mediatek)