projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
drivers: power: report battery voltage in AOSP compatible format
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 // [ SEC_SELINUX_PORTING COMMON
89 #include <linux/delay.h>
90 // ] SEC_SELINUX_PORTING COMMON
91
92 #include "avc.h"
93 #include "objsec.h"
94 #include "netif.h"
95 #include "netnode.h"
96 #include "netport.h"
97 #include "xfrm.h"
98 #include "netlabel.h"
99 #include "audit.h"
100 #include "avc_ss.h"
101
102 #define NUM_SEL_MNT_OPTS 5
103
104 extern struct security_operations *security_ops;
105
106 /* SECMARK reference count */
107 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
108
109 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
110 int selinux_enforcing;
111
112 static int __init enforcing_setup(char *str)
113 {
114 unsigned long enforcing;
115 if (!strict_strtoul(str, 0, &enforcing))
116 selinux_enforcing = enforcing ? 1 : 0;
117
118 return 1;
119 }
120 __setup("enforcing=", enforcing_setup);
121 #endif
122
123 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
124 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
125
126 static int __init selinux_enabled_setup(char *str)
127 {
128 unsigned long enabled;
129 if (!strict_strtoul(str, 0, &enabled))
130 selinux_enabled = enabled ? 1 : 0;
131
132 return 1;
133 }
134 __setup("selinux=", selinux_enabled_setup);
135 #else
136 int selinux_enabled = 1;
137 #endif
138
139 static struct kmem_cache *sel_inode_cache;
140
141 /**
142 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
143 *
144 * Description:
145 * This function checks the SECMARK reference counter to see if any SECMARK
146 * targets are currently configured, if the reference counter is greater than
147 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
148 * enabled, false (0) if SECMARK is disabled.
149 *
150 */
151 static int selinux_secmark_enabled(void)
152 {
153 return (atomic_read(&selinux_secmark_refcount) > 0);
154 }
155
156 /*
157 * initialise the security for the init task
158 */
159 static void cred_init_security(void)
160 {
161 struct cred *cred = (struct cred *) current->real_cred;
162 struct task_security_struct *tsec;
163
164 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
165 if (!tsec)
166 panic("SELinux: Failed to initialize initial task.\n");
167
168 tsec->osid = tsec->sid = SECINITSID_KERNEL;
169 cred->security = tsec;
170 }
171
172 /*
173 * get the security ID of a set of credentials
174 */
175 static inline u32 cred_sid(const struct cred *cred)
176 {
177 const struct task_security_struct *tsec;
178
179 tsec = cred->security;
180 return tsec->sid;
181 }
182
183 /*
184 * get the objective security ID of a task
185 */
186 static inline u32 task_sid(const struct task_struct *task)
187 {
188 u32 sid;
189
190 rcu_read_lock();
191 sid = cred_sid(__task_cred(task));
192 rcu_read_unlock();
193 return sid;
194 }
195
196 /*
197 * get the subjective security ID of the current task
198 */
199 static inline u32 current_sid(void)
200 {
201 const struct task_security_struct *tsec = current_security();
202
203 return tsec->sid;
204 }
205
206 /* Allocate and free functions for each kind of security blob. */
207
208 static int inode_alloc_security(struct inode *inode)
209 {
210 struct inode_security_struct *isec;
211 u32 sid = current_sid();
212
213 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
214 if (!isec)
215 return -ENOMEM;
216
217 mutex_init(&isec->lock);
218 INIT_LIST_HEAD(&isec->list);
219 isec->inode = inode;
220 isec->sid = SECINITSID_UNLABELED;
221 isec->sclass = SECCLASS_FILE;
222 isec->task_sid = sid;
223 inode->i_security = isec;
224
225 return 0;
226 }
227
228 static void inode_free_rcu(struct rcu_head *head)
229 {
230 struct inode_security_struct *isec;
231
232 isec = container_of(head, struct inode_security_struct, rcu);
233 kmem_cache_free(sel_inode_cache, isec);
234 }
235
236 static void inode_free_security(struct inode *inode)
237 {
238 struct inode_security_struct *isec = inode->i_security;
239 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
240
241 spin_lock(&sbsec->isec_lock);
242 if (!list_empty(&isec->list))
243 list_del_init(&isec->list);
244 spin_unlock(&sbsec->isec_lock);
245
246 /*
247 * The inode may still be referenced in a path walk and
248 * a call to selinux_inode_permission() can be made
249 * after inode_free_security() is called. Ideally, the VFS
250 * wouldn't do this, but fixing that is a much harder
251 * job. For now, simply free the i_security via RCU, and
252 * leave the current inode->i_security pointer intact.
253 * The inode will be freed after the RCU grace period too.
254 */
255 call_rcu(&isec->rcu, inode_free_rcu);
256 }
257
258 static int file_alloc_security(struct file *file)
259 {
260 struct file_security_struct *fsec;
261 u32 sid = current_sid();
262
263 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
264 if (!fsec)
265 return -ENOMEM;
266
267 fsec->sid = sid;
268 fsec->fown_sid = sid;
269 file->f_security = fsec;
270
271 return 0;
272 }
273
274 static void file_free_security(struct file *file)
275 {
276 struct file_security_struct *fsec = file->f_security;
277 file->f_security = NULL;
278 kfree(fsec);
279 }
280
281 static int superblock_alloc_security(struct super_block *sb)
282 {
283 struct superblock_security_struct *sbsec;
284
285 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
286 if (!sbsec)
287 return -ENOMEM;
288
289 mutex_init(&sbsec->lock);
290 INIT_LIST_HEAD(&sbsec->isec_head);
291 spin_lock_init(&sbsec->isec_lock);
292 sbsec->sb = sb;
293 sbsec->sid = SECINITSID_UNLABELED;
294 sbsec->def_sid = SECINITSID_FILE;
295 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
296 sb->s_security = sbsec;
297
298 return 0;
299 }
300
301 static void superblock_free_security(struct super_block *sb)
302 {
303 struct superblock_security_struct *sbsec = sb->s_security;
304 sb->s_security = NULL;
305 kfree(sbsec);
306 }
307
308 /* The file system's label must be initialized prior to use. */
309
310 static const char *labeling_behaviors[6] = {
311 "uses xattr",
312 "uses transition SIDs",
313 "uses task SIDs",
314 "uses genfs_contexts",
315 "not configured for labeling",
316 "uses mountpoint labeling",
317 };
318
319 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
320
321 static inline int inode_doinit(struct inode *inode)
322 {
323 return inode_doinit_with_dentry(inode, NULL);
324 }
325
326 enum {
327 Opt_error = -1,
328 Opt_context = 1,
329 Opt_fscontext = 2,
330 Opt_defcontext = 3,
331 Opt_rootcontext = 4,
332 Opt_labelsupport = 5,
333 };
334
335 static const match_table_t tokens = {
336 {Opt_context, CONTEXT_STR "%s"},
337 {Opt_fscontext, FSCONTEXT_STR "%s"},
338 {Opt_defcontext, DEFCONTEXT_STR "%s"},
339 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
340 {Opt_labelsupport, LABELSUPP_STR},
341 {Opt_error, NULL},
342 };
343
344 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
345
346 static int may_context_mount_sb_relabel(u32 sid,
347 struct superblock_security_struct *sbsec,
348 const struct cred *cred)
349 {
350 const struct task_security_struct *tsec = cred->security;
351 int rc;
352
353 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__RELABELFROM, NULL);
355 if (rc)
356 return rc;
357
358 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
359 FILESYSTEM__RELABELTO, NULL);
360 return rc;
361 }
362
363 static int may_context_mount_inode_relabel(u32 sid,
364 struct superblock_security_struct *sbsec,
365 const struct cred *cred)
366 {
367 const struct task_security_struct *tsec = cred->security;
368 int rc;
369 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
370 FILESYSTEM__RELABELFROM, NULL);
371 if (rc)
372 return rc;
373
374 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
375 FILESYSTEM__ASSOCIATE, NULL);
376 return rc;
377 }
378
379 static int sb_finish_set_opts(struct super_block *sb)
380 {
381 struct superblock_security_struct *sbsec = sb->s_security;
382 struct dentry *root = sb->s_root;
383 struct inode *root_inode = root->d_inode;
384 int rc = 0;
385
386 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
387 /* Make sure that the xattr handler exists and that no
388 error other than -ENODATA is returned by getxattr on
389 the root directory. -ENODATA is ok, as this may be
390 the first boot of the SELinux kernel before we have
391 assigned xattr values to the filesystem. */
392 if (!root_inode->i_op->getxattr) {
393 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
394 "xattr support\n", sb->s_id, sb->s_type->name);
395 rc = -EOPNOTSUPP;
396 goto out;
397 }
398 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
399 if (rc < 0 && rc != -ENODATA) {
400 if (rc == -EOPNOTSUPP)
401 printk(KERN_WARNING "SELinux: (dev %s, type "
402 "%s) has no security xattr handler\n",
403 sb->s_id, sb->s_type->name);
404 else
405 printk(KERN_WARNING "SELinux: (dev %s, type "
406 "%s) getxattr errno %d\n", sb->s_id,
407 sb->s_type->name, -rc);
408 goto out;
409 }
410 }
411
412 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
413
414 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
415 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
416 sb->s_id, sb->s_type->name);
417 else
418 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
419 sb->s_id, sb->s_type->name,
420 labeling_behaviors[sbsec->behavior-1]);
421
422 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
423 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
424 sbsec->behavior == SECURITY_FS_USE_NONE ||
425 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
426 sbsec->flags &= ~SE_SBLABELSUPP;
427
428 /* Special handling. Is genfs but also has in-core setxattr handler*/
429 if (!strcmp(sb->s_type->name, "sysfs") ||
430 !strcmp(sb->s_type->name, "pstore") ||
431 !strcmp(sb->s_type->name, "debugfs") ||
432 !strcmp(sb->s_type->name, "tmpfs") ||
433 !strcmp(sb->s_type->name, "rootfs"))
434 sbsec->flags |= SE_SBLABELSUPP;
435
436 /* Initialize the root inode. */
437 rc = inode_doinit_with_dentry(root_inode, root);
438
439 /* Initialize any other inodes associated with the superblock, e.g.
440 inodes created prior to initial policy load or inodes created
441 during get_sb by a pseudo filesystem that directly
442 populates itself. */
443 spin_lock(&sbsec->isec_lock);
444 next_inode:
445 if (!list_empty(&sbsec->isec_head)) {
446 struct inode_security_struct *isec =
447 list_entry(sbsec->isec_head.next,
448 struct inode_security_struct, list);
449 struct inode *inode = isec->inode;
450 list_del_init(&isec->list);
451 spin_unlock(&sbsec->isec_lock);
452 inode = igrab(inode);
453 if (inode) {
454 if (!IS_PRIVATE(inode))
455 inode_doinit(inode);
456 iput(inode);
457 }
458 spin_lock(&sbsec->isec_lock);
459 goto next_inode;
460 }
461 spin_unlock(&sbsec->isec_lock);
462 out:
463 return rc;
464 }
465
466 /*
467 * This function should allow an FS to ask what it's mount security
468 * options were so it can use those later for submounts, displaying
469 * mount options, or whatever.
470 */
471 static int selinux_get_mnt_opts(const struct super_block *sb,
472 struct security_mnt_opts *opts)
473 {
474 int rc = 0, i;
475 struct superblock_security_struct *sbsec = sb->s_security;
476 char *context = NULL;
477 u32 len;
478 char tmp;
479
480 security_init_mnt_opts(opts);
481
482 if (!(sbsec->flags & SE_SBINITIALIZED))
483 return -EINVAL;
484
485 if (!ss_initialized)
486 return -EINVAL;
487
488 tmp = sbsec->flags & SE_MNTMASK;
489 /* count the number of mount options for this sb */
490 for (i = 0; i < 8; i++) {
491 if (tmp & 0x01)
492 opts->num_mnt_opts++;
493 tmp >>= 1;
494 }
495 /* Check if the Label support flag is set */
496 if (sbsec->flags & SE_SBLABELSUPP)
497 opts->num_mnt_opts++;
498
499 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
500 if (!opts->mnt_opts) {
501 rc = -ENOMEM;
502 goto out_free;
503 }
504
505 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
506 if (!opts->mnt_opts_flags) {
507 rc = -ENOMEM;
508 goto out_free;
509 }
510
511 i = 0;
512 if (sbsec->flags & FSCONTEXT_MNT) {
513 rc = security_sid_to_context(sbsec->sid, &context, &len);
514 if (rc)
515 goto out_free;
516 opts->mnt_opts[i] = context;
517 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
518 }
519 if (sbsec->flags & CONTEXT_MNT) {
520 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
521 if (rc)
522 goto out_free;
523 opts->mnt_opts[i] = context;
524 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
525 }
526 if (sbsec->flags & DEFCONTEXT_MNT) {
527 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
528 if (rc)
529 goto out_free;
530 opts->mnt_opts[i] = context;
531 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
532 }
533 if (sbsec->flags & ROOTCONTEXT_MNT) {
534 struct inode *root = sbsec->sb->s_root->d_inode;
535 struct inode_security_struct *isec = root->i_security;
536
537 rc = security_sid_to_context(isec->sid, &context, &len);
538 if (rc)
539 goto out_free;
540 opts->mnt_opts[i] = context;
541 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
542 }
543 if (sbsec->flags & SE_SBLABELSUPP) {
544 opts->mnt_opts[i] = NULL;
545 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
546 }
547
548 BUG_ON(i != opts->num_mnt_opts);
549
550 return 0;
551
552 out_free:
553 security_free_mnt_opts(opts);
554 return rc;
555 }
556
557 static int bad_option(struct superblock_security_struct *sbsec, char flag,
558 u32 old_sid, u32 new_sid)
559 {
560 char mnt_flags = sbsec->flags & SE_MNTMASK;
561
562 /* check if the old mount command had the same options */
563 if (sbsec->flags & SE_SBINITIALIZED)
564 if (!(sbsec->flags & flag) ||
565 (old_sid != new_sid))
566 return 1;
567
568 /* check if we were passed the same options twice,
569 * aka someone passed context=a,context=b
570 */
571 if (!(sbsec->flags & SE_SBINITIALIZED))
572 if (mnt_flags & flag)
573 return 1;
574 return 0;
575 }
576
577 /*
578 * Allow filesystems with binary mount data to explicitly set mount point
579 * labeling information.
580 */
581 static int selinux_set_mnt_opts(struct super_block *sb,
582 struct security_mnt_opts *opts)
583 {
584 const struct cred *cred = current_cred();
585 int rc = 0, i;
586 struct superblock_security_struct *sbsec = sb->s_security;
587 const char *name = sb->s_type->name;
588 struct inode *inode = sbsec->sb->s_root->d_inode;
589 struct inode_security_struct *root_isec = inode->i_security;
590 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
591 u32 defcontext_sid = 0;
592 char **mount_options = opts->mnt_opts;
593 int *flags = opts->mnt_opts_flags;
594 int num_opts = opts->num_mnt_opts;
595
596 mutex_lock(&sbsec->lock);
597
598 if (!ss_initialized) {
599 if (!num_opts) {
600 /* Defer initialization until selinux_complete_init,
601 after the initial policy is loaded and the security
602 server is ready to handle calls. */
603 goto out;
604 }
605 rc = -EINVAL;
606 printk(KERN_WARNING "SELinux: Unable to set superblock options "
607 "before the security server is initialized\n");
608 goto out;
609 }
610
611 /*
612 * Binary mount data FS will come through this function twice. Once
613 * from an explicit call and once from the generic calls from the vfs.
614 * Since the generic VFS calls will not contain any security mount data
615 * we need to skip the double mount verification.
616 *
617 * This does open a hole in which we will not notice if the first
618 * mount using this sb set explict options and a second mount using
619 * this sb does not set any security options. (The first options
620 * will be used for both mounts)
621 */
622 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
623 && (num_opts == 0))
624 goto out;
625
626 /*
627 * parse the mount options, check if they are valid sids.
628 * also check if someone is trying to mount the same sb more
629 * than once with different security options.
630 */
631 for (i = 0; i < num_opts; i++) {
632 u32 sid;
633
634 if (flags[i] == SE_SBLABELSUPP)
635 continue;
636 rc = security_context_to_sid(mount_options[i],
637 strlen(mount_options[i]), &sid);
638 if (rc) {
639 printk(KERN_WARNING "SELinux: security_context_to_sid"
640 "(%s) failed for (dev %s, type %s) errno=%d\n",
641 mount_options[i], sb->s_id, name, rc);
642 goto out;
643 }
644 switch (flags[i]) {
645 case FSCONTEXT_MNT:
646 fscontext_sid = sid;
647
648 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
649 fscontext_sid))
650 goto out_double_mount;
651
652 sbsec->flags |= FSCONTEXT_MNT;
653 break;
654 case CONTEXT_MNT:
655 context_sid = sid;
656
657 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
658 context_sid))
659 goto out_double_mount;
660
661 sbsec->flags |= CONTEXT_MNT;
662 break;
663 case ROOTCONTEXT_MNT:
664 rootcontext_sid = sid;
665
666 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
667 rootcontext_sid))
668 goto out_double_mount;
669
670 sbsec->flags |= ROOTCONTEXT_MNT;
671
672 break;
673 case DEFCONTEXT_MNT:
674 defcontext_sid = sid;
675
676 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
677 defcontext_sid))
678 goto out_double_mount;
679
680 sbsec->flags |= DEFCONTEXT_MNT;
681
682 break;
683 default:
684 rc = -EINVAL;
685 goto out;
686 }
687 }
688
689 if (sbsec->flags & SE_SBINITIALIZED) {
690 /* previously mounted with options, but not on this attempt? */
691 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
692 goto out_double_mount;
693 rc = 0;
694 goto out;
695 }
696
697 if (strcmp(sb->s_type->name, "proc") == 0)
698 sbsec->flags |= SE_SBPROC;
699
700 /* Determine the labeling behavior to use for this filesystem type. */
701 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
702 if (rc) {
703 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
704 __func__, sb->s_type->name, rc);
705 goto out;
706 }
707
708 /* sets the context of the superblock for the fs being mounted. */
709 if (fscontext_sid) {
710 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
711 if (rc)
712 goto out;
713
714 sbsec->sid = fscontext_sid;
715 }
716
717 /*
718 * Switch to using mount point labeling behavior.
719 * sets the label used on all file below the mountpoint, and will set
720 * the superblock context if not already set.
721 */
722 if (context_sid) {
723 if (!fscontext_sid) {
724 rc = may_context_mount_sb_relabel(context_sid, sbsec,
725 cred);
726 if (rc)
727 goto out;
728 sbsec->sid = context_sid;
729 } else {
730 rc = may_context_mount_inode_relabel(context_sid, sbsec,
731 cred);
732 if (rc)
733 goto out;
734 }
735 if (!rootcontext_sid)
736 rootcontext_sid = context_sid;
737
738 sbsec->mntpoint_sid = context_sid;
739 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
740 }
741
742 if (rootcontext_sid) {
743 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
744 cred);
745 if (rc)
746 goto out;
747
748 root_isec->sid = rootcontext_sid;
749 root_isec->initialized = 1;
750 }
751
752 if (defcontext_sid) {
753 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
754 rc = -EINVAL;
755 printk(KERN_WARNING "SELinux: defcontext option is "
756 "invalid for this filesystem type\n");
757 goto out;
758 }
759
760 if (defcontext_sid != sbsec->def_sid) {
761 rc = may_context_mount_inode_relabel(defcontext_sid,
762 sbsec, cred);
763 if (rc)
764 goto out;
765 }
766
767 sbsec->def_sid = defcontext_sid;
768 }
769
770 rc = sb_finish_set_opts(sb);
771 out:
772 mutex_unlock(&sbsec->lock);
773 return rc;
774 out_double_mount:
775 rc = -EINVAL;
776 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
777 "security settings for (dev %s, type %s)\n", sb->s_id, name);
778 goto out;
779 }
780
781 static int selinux_cmp_sb_context(const struct super_block *oldsb,
782 const struct super_block *newsb)
783 {
784 struct superblock_security_struct *old = oldsb->s_security;
785 struct superblock_security_struct *new = newsb->s_security;
786 char oldflags = old->flags & SE_MNTMASK;
787 char newflags = new->flags & SE_MNTMASK;
788
789 if (oldflags != newflags)
790 goto mismatch;
791 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
792 goto mismatch;
793 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
794 goto mismatch;
795 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
796 goto mismatch;
797 if (oldflags & ROOTCONTEXT_MNT) {
798 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
799 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
800 if (oldroot->sid != newroot->sid)
801 goto mismatch;
802 }
803 return 0;
804 mismatch:
805 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
806 "different security settings for (dev %s, "
807 "type %s)\n", newsb->s_id, newsb->s_type->name);
808 return -EBUSY;
809 }
810
811 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
812 struct super_block *newsb)
813 {
814 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
815 struct superblock_security_struct *newsbsec = newsb->s_security;
816
817 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
818 int set_context = (oldsbsec->flags & CONTEXT_MNT);
819 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
820
821 /*
822 * if the parent was able to be mounted it clearly had no special lsm
823 * mount options. thus we can safely deal with this superblock later
824 */
825 if (!ss_initialized)
826 return 0;
827
828 /* how can we clone if the old one wasn't set up?? */
829 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
830
831 /* if fs is reusing a sb, make sure that the contexts match */
832 if (newsbsec->flags & SE_SBINITIALIZED)
833 return selinux_cmp_sb_context(oldsb, newsb);
834
835 mutex_lock(&newsbsec->lock);
836
837 newsbsec->flags = oldsbsec->flags;
838
839 newsbsec->sid = oldsbsec->sid;
840 newsbsec->def_sid = oldsbsec->def_sid;
841 newsbsec->behavior = oldsbsec->behavior;
842
843 if (set_context) {
844 u32 sid = oldsbsec->mntpoint_sid;
845
846 if (!set_fscontext)
847 newsbsec->sid = sid;
848 if (!set_rootcontext) {
849 struct inode *newinode = newsb->s_root->d_inode;
850 struct inode_security_struct *newisec = newinode->i_security;
851 newisec->sid = sid;
852 }
853 newsbsec->mntpoint_sid = sid;
854 }
855 if (set_rootcontext) {
856 const struct inode *oldinode = oldsb->s_root->d_inode;
857 const struct inode_security_struct *oldisec = oldinode->i_security;
858 struct inode *newinode = newsb->s_root->d_inode;
859 struct inode_security_struct *newisec = newinode->i_security;
860
861 newisec->sid = oldisec->sid;
862 }
863
864 sb_finish_set_opts(newsb);
865 mutex_unlock(&newsbsec->lock);
866 return 0;
867 }
868
869 static int selinux_parse_opts_str(char *options,
870 struct security_mnt_opts *opts)
871 {
872 char *p;
873 char *context = NULL, *defcontext = NULL;
874 char *fscontext = NULL, *rootcontext = NULL;
875 int rc, num_mnt_opts = 0;
876 opts->num_mnt_opts = 0;
877
878 /* Standard string-based options. */
879 while ((p = strsep(&options, "|")) != NULL) {
880 int token;
881 substring_t args[MAX_OPT_ARGS];
882
883 if (!*p)
884 continue;
885
886 token = match_token(p, tokens, args);
887
888 switch (token) {
889 case Opt_context:
890 if (context || defcontext) {
891 rc = -EINVAL;
892 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
893 goto out_err;
894 }
895 context = match_strdup(&args[0]);
896 if (!context) {
897 rc = -ENOMEM;
898 goto out_err;
899 }
900 break;
901
902 case Opt_fscontext:
903 if (fscontext) {
904 rc = -EINVAL;
905 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
906 goto out_err;
907 }
908 fscontext = match_strdup(&args[0]);
909 if (!fscontext) {
910 rc = -ENOMEM;
911 goto out_err;
912 }
913 break;
914
915 case Opt_rootcontext:
916 if (rootcontext) {
917 rc = -EINVAL;
918 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
919 goto out_err;
920 }
921 rootcontext = match_strdup(&args[0]);
922 if (!rootcontext) {
923 rc = -ENOMEM;
924 goto out_err;
925 }
926 break;
927
928 case Opt_defcontext:
929 if (context || defcontext) {
930 rc = -EINVAL;
931 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
932 goto out_err;
933 }
934 defcontext = match_strdup(&args[0]);
935 if (!defcontext) {
936 rc = -ENOMEM;
937 goto out_err;
938 }
939 break;
940 case Opt_labelsupport:
941 break;
942 default:
943 rc = -EINVAL;
944 printk(KERN_WARNING "SELinux: unknown mount option\n");
945 goto out_err;
946
947 }
948 }
949
950 rc = -ENOMEM;
951 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
952 if (!opts->mnt_opts)
953 goto out_err;
954
955 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
956 if (!opts->mnt_opts_flags) {
957 kfree(opts->mnt_opts);
958 goto out_err;
959 }
960
961 if (fscontext) {
962 opts->mnt_opts[num_mnt_opts] = fscontext;
963 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
964 }
965 if (context) {
966 opts->mnt_opts[num_mnt_opts] = context;
967 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
968 }
969 if (rootcontext) {
970 opts->mnt_opts[num_mnt_opts] = rootcontext;
971 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
972 }
973 if (defcontext) {
974 opts->mnt_opts[num_mnt_opts] = defcontext;
975 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
976 }
977
978 opts->num_mnt_opts = num_mnt_opts;
979 return 0;
980
981 out_err:
982 kfree(context);
983 kfree(defcontext);
984 kfree(fscontext);
985 kfree(rootcontext);
986 return rc;
987 }
988 /*
989 * string mount options parsing and call set the sbsec
990 */
991 static int superblock_doinit(struct super_block *sb, void *data)
992 {
993 int rc = 0;
994 char *options = data;
995 struct security_mnt_opts opts;
996
997 security_init_mnt_opts(&opts);
998
999 if (!data)
1000 goto out;
1001
1002 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1003
1004 rc = selinux_parse_opts_str(options, &opts);
1005 if (rc)
1006 goto out_err;
1007
1008 out:
1009 rc = selinux_set_mnt_opts(sb, &opts);
1010
1011 out_err:
1012 security_free_mnt_opts(&opts);
1013 return rc;
1014 }
1015
1016 static void selinux_write_opts(struct seq_file *m,
1017 struct security_mnt_opts *opts)
1018 {
1019 int i;
1020 char *prefix;
1021
1022 for (i = 0; i < opts->num_mnt_opts; i++) {
1023 char *has_comma;
1024
1025 if (opts->mnt_opts[i])
1026 has_comma = strchr(opts->mnt_opts[i], ',');
1027 else
1028 has_comma = NULL;
1029
1030 switch (opts->mnt_opts_flags[i]) {
1031 case CONTEXT_MNT:
1032 prefix = CONTEXT_STR;
1033 break;
1034 case FSCONTEXT_MNT:
1035 prefix = FSCONTEXT_STR;
1036 break;
1037 case ROOTCONTEXT_MNT:
1038 prefix = ROOTCONTEXT_STR;
1039 break;
1040 case DEFCONTEXT_MNT:
1041 prefix = DEFCONTEXT_STR;
1042 break;
1043 case SE_SBLABELSUPP:
1044 seq_putc(m, ',');
1045 seq_puts(m, LABELSUPP_STR);
1046 continue;
1047 default:
1048 BUG();
1049 return;
1050 };
1051 /* we need a comma before each option */
1052 seq_putc(m, ',');
1053 seq_puts(m, prefix);
1054 if (has_comma)
1055 seq_putc(m, '\"');
1056 seq_puts(m, opts->mnt_opts[i]);
1057 if (has_comma)
1058 seq_putc(m, '\"');
1059 }
1060 }
1061
1062 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1063 {
1064 struct security_mnt_opts opts;
1065 int rc;
1066
1067 rc = selinux_get_mnt_opts(sb, &opts);
1068 if (rc) {
1069 /* before policy load we may get EINVAL, don't show anything */
1070 if (rc == -EINVAL)
1071 rc = 0;
1072 return rc;
1073 }
1074
1075 selinux_write_opts(m, &opts);
1076
1077 security_free_mnt_opts(&opts);
1078
1079 return rc;
1080 }
1081
1082 static inline u16 inode_mode_to_security_class(umode_t mode)
1083 {
1084 switch (mode & S_IFMT) {
1085 case S_IFSOCK:
1086 return SECCLASS_SOCK_FILE;
1087 case S_IFLNK:
1088 return SECCLASS_LNK_FILE;
1089 case S_IFREG:
1090 return SECCLASS_FILE;
1091 case S_IFBLK:
1092 return SECCLASS_BLK_FILE;
1093 case S_IFDIR:
1094 return SECCLASS_DIR;
1095 case S_IFCHR:
1096 return SECCLASS_CHR_FILE;
1097 case S_IFIFO:
1098 return SECCLASS_FIFO_FILE;
1099
1100 }
1101
1102 return SECCLASS_FILE;
1103 }
1104
1105 static inline int default_protocol_stream(int protocol)
1106 {
1107 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1108 }
1109
1110 static inline int default_protocol_dgram(int protocol)
1111 {
1112 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1113 }
1114
1115 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1116 {
1117 switch (family) {
1118 case PF_UNIX:
1119 switch (type) {
1120 case SOCK_STREAM:
1121 case SOCK_SEQPACKET:
1122 return SECCLASS_UNIX_STREAM_SOCKET;
1123 case SOCK_DGRAM:
1124 return SECCLASS_UNIX_DGRAM_SOCKET;
1125 }
1126 break;
1127 case PF_INET:
1128 case PF_INET6:
1129 switch (type) {
1130 case SOCK_STREAM:
1131 if (default_protocol_stream(protocol))
1132 return SECCLASS_TCP_SOCKET;
1133 else
1134 return SECCLASS_RAWIP_SOCKET;
1135 case SOCK_DGRAM:
1136 if (default_protocol_dgram(protocol))
1137 return SECCLASS_UDP_SOCKET;
1138 else
1139 return SECCLASS_RAWIP_SOCKET;
1140 case SOCK_DCCP:
1141 return SECCLASS_DCCP_SOCKET;
1142 default:
1143 return SECCLASS_RAWIP_SOCKET;
1144 }
1145 break;
1146 case PF_NETLINK:
1147 switch (protocol) {
1148 case NETLINK_ROUTE:
1149 return SECCLASS_NETLINK_ROUTE_SOCKET;
1150 case NETLINK_FIREWALL:
1151 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1152 case NETLINK_SOCK_DIAG:
1153 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1154 case NETLINK_NFLOG:
1155 return SECCLASS_NETLINK_NFLOG_SOCKET;
1156 case NETLINK_XFRM:
1157 return SECCLASS_NETLINK_XFRM_SOCKET;
1158 case NETLINK_SELINUX:
1159 return SECCLASS_NETLINK_SELINUX_SOCKET;
1160 case NETLINK_AUDIT:
1161 return SECCLASS_NETLINK_AUDIT_SOCKET;
1162 case NETLINK_IP6_FW:
1163 return SECCLASS_NETLINK_IP6FW_SOCKET;
1164 case NETLINK_DNRTMSG:
1165 return SECCLASS_NETLINK_DNRT_SOCKET;
1166 case NETLINK_KOBJECT_UEVENT:
1167 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1168 default:
1169 return SECCLASS_NETLINK_SOCKET;
1170 }
1171 case PF_PACKET:
1172 return SECCLASS_PACKET_SOCKET;
1173 case PF_KEY:
1174 return SECCLASS_KEY_SOCKET;
1175 case PF_APPLETALK:
1176 return SECCLASS_APPLETALK_SOCKET;
1177 }
1178
1179 return SECCLASS_SOCKET;
1180 }
1181
1182 #ifdef CONFIG_PROC_FS
1183 static int selinux_proc_get_sid(struct dentry *dentry,
1184 u16 tclass,
1185 u32 *sid)
1186 {
1187 int rc;
1188 char *buffer, *path;
1189
1190 buffer = (char *)__get_free_page(GFP_KERNEL);
1191 if (!buffer)
1192 return -ENOMEM;
1193
1194 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1195 if (IS_ERR(path))
1196 rc = PTR_ERR(path);
1197 else {
1198 /* each process gets a /proc/PID/ entry. Strip off the
1199 * PID part to get a valid selinux labeling.
1200 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1201 while (path[1] >= '0' && path[1] <= '9') {
1202 path[1] = '/';
1203 path++;
1204 }
1205 rc = security_genfs_sid("proc", path, tclass, sid);
1206 }
1207 free_page((unsigned long)buffer);
1208 return rc;
1209 }
1210 #else
1211 static int selinux_proc_get_sid(struct dentry *dentry,
1212 u16 tclass,
1213 u32 *sid)
1214 {
1215 return -EINVAL;
1216 }
1217 #endif
1218
1219 /* The inode's security attributes must be initialized before first use. */
1220 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1221 {
1222 struct superblock_security_struct *sbsec = NULL;
1223 struct inode_security_struct *isec = inode->i_security;
1224 u32 sid;
1225 struct dentry *dentry;
1226 #define INITCONTEXTLEN 255
1227 char *context = NULL;
1228 unsigned len = 0;
1229 int rc = 0;
1230
1231 if (isec->initialized)
1232 goto out;
1233
1234 mutex_lock(&isec->lock);
1235 if (isec->initialized)
1236 goto out_unlock;
1237
1238 sbsec = inode->i_sb->s_security;
1239 /* To prevent Null pointer exception */
1240 if (!sbsec) {
1241 printk(KERN_ERR "[SELinux] sbsec is NULL, inode->i_sb->s_security is already freed. \n");
1242 rc = -EINVAL;
1243 goto out_unlock;
1244 }
1245
1246 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1247 /* Defer initialization until selinux_complete_init,
1248 after the initial policy is loaded and the security
1249 server is ready to handle calls. */
1250 spin_lock(&sbsec->isec_lock);
1251 if (list_empty(&isec->list))
1252 list_add(&isec->list, &sbsec->isec_head);
1253 spin_unlock(&sbsec->isec_lock);
1254 goto out_unlock;
1255 }
1256
1257 switch (sbsec->behavior) {
1258 case SECURITY_FS_USE_XATTR:
1259 if (!inode->i_op->getxattr) {
1260 isec->sid = sbsec->def_sid;
1261 break;
1262 }
1263
1264 /* Need a dentry, since the xattr API requires one.
1265 Life would be simpler if we could just pass the inode. */
1266 if (opt_dentry) {
1267 /* Called from d_instantiate or d_splice_alias. */
1268 dentry = dget(opt_dentry);
1269 } else {
1270 /* Called from selinux_complete_init, try to find a dentry. */
1271 dentry = d_find_alias(inode);
1272 }
1273 if (!dentry) {
1274 /*
1275 * this is can be hit on boot when a file is accessed
1276 * before the policy is loaded. When we load policy we
1277 * may find inodes that have no dentry on the
1278 * sbsec->isec_head list. No reason to complain as these
1279 * will get fixed up the next time we go through
1280 * inode_doinit with a dentry, before these inodes could
1281 * be used again by userspace.
1282 */
1283 goto out_unlock;
1284 }
1285
1286 len = INITCONTEXTLEN;
1287 context = kmalloc(len+1, GFP_NOFS);
1288 if (!context) {
1289 rc = -ENOMEM;
1290 dput(dentry);
1291 goto out_unlock;
1292 }
1293 context[len] = '\0';
1294 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1295 context, len);
1296 if (rc == -ERANGE) {
1297 kfree(context);
1298
1299 /* Need a larger buffer. Query for the right size. */
1300 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1301 NULL, 0);
1302 if (rc < 0) {
1303 dput(dentry);
1304 goto out_unlock;
1305 }
1306 len = rc;
1307 context = kmalloc(len+1, GFP_NOFS);
1308 if (!context) {
1309 rc = -ENOMEM;
1310 dput(dentry);
1311 goto out_unlock;
1312 }
1313 context[len] = '\0';
1314 rc = inode->i_op->getxattr(dentry,
1315 XATTR_NAME_SELINUX,
1316 context, len);
1317 }
1318 dput(dentry);
1319 if (rc < 0) {
1320 if (rc != -ENODATA) {
1321 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1322 "%d for dev=%s ino=%ld\n", __func__,
1323 -rc, inode->i_sb->s_id, inode->i_ino);
1324 kfree(context);
1325 goto out_unlock;
1326 }
1327 /* Map ENODATA to the default file SID */
1328 sid = sbsec->def_sid;
1329 rc = 0;
1330 } else {
1331 rc = security_context_to_sid_default(context, rc, &sid,
1332 sbsec->def_sid,
1333 GFP_NOFS);
1334 if (rc) {
1335 char *dev = inode->i_sb->s_id;
1336 unsigned long ino = inode->i_ino;
1337
1338 if (rc == -EINVAL) {
1339 if (printk_ratelimit())
1340 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1341 "context=%s. This indicates you may need to relabel the inode or the "
1342 "filesystem in question.\n", ino, dev, context);
1343 } else {
1344 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1345 "returned %d for dev=%s ino=%ld\n",
1346 __func__, context, -rc, dev, ino);
1347 }
1348 kfree(context);
1349 /* Leave with the unlabeled SID */
1350 rc = 0;
1351 break;
1352 }
1353 }
1354 kfree(context);
1355 isec->sid = sid;
1356 break;
1357 case SECURITY_FS_USE_TASK:
1358 isec->sid = isec->task_sid;
1359 break;
1360 case SECURITY_FS_USE_TRANS:
1361 /* Default to the fs SID. */
1362 isec->sid = sbsec->sid;
1363
1364 /* Try to obtain a transition SID. */
1365 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1366 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1367 isec->sclass, NULL, &sid);
1368 if (rc)
1369 goto out_unlock;
1370 isec->sid = sid;
1371 break;
1372 case SECURITY_FS_USE_MNTPOINT:
1373 isec->sid = sbsec->mntpoint_sid;
1374 break;
1375 default:
1376 /* Default to the fs superblock SID. */
1377 isec->sid = sbsec->sid;
1378
1379 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1380 /* We must have a dentry to determine the label on
1381 * procfs inodes */
1382 if (opt_dentry)
1383 /* Called from d_instantiate or
1384 * d_splice_alias. */
1385 dentry = dget(opt_dentry);
1386 else
1387 /* Called from selinux_complete_init, try to
1388 * find a dentry. */
1389 dentry = d_find_alias(inode);
1390 /*
1391 * This can be hit on boot when a file is accessed
1392 * before the policy is loaded. When we load policy we
1393 * may find inodes that have no dentry on the
1394 * sbsec->isec_head list. No reason to complain as
1395 * these will get fixed up the next time we go through
1396 * inode_doinit() with a dentry, before these inodes
1397 * could be used again by userspace.
1398 */
1399 if (!dentry)
1400 goto out_unlock;
1401 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1402 rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1403 dput(dentry);
1404 if (rc)
1405 goto out_unlock;
1406 isec->sid = sid;
1407 }
1408 break;
1409 }
1410
1411 isec->initialized = 1;
1412
1413 out_unlock:
1414 mutex_unlock(&isec->lock);
1415 out:
1416 if (isec->sclass == SECCLASS_FILE)
1417 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1418 return rc;
1419 }
1420
1421 /* Convert a Linux signal to an access vector. */
1422 static inline u32 signal_to_av(int sig)
1423 {
1424 u32 perm = 0;
1425
1426 switch (sig) {
1427 case SIGCHLD:
1428 /* Commonly granted from child to parent. */
1429 perm = PROCESS__SIGCHLD;
1430 break;
1431 case SIGKILL:
1432 /* Cannot be caught or ignored */
1433 perm = PROCESS__SIGKILL;
1434 break;
1435 case SIGSTOP:
1436 /* Cannot be caught or ignored */
1437 perm = PROCESS__SIGSTOP;
1438 break;
1439 default:
1440 /* All other signals. */
1441 perm = PROCESS__SIGNAL;
1442 break;
1443 }
1444
1445 return perm;
1446 }
1447
1448 /*
1449 * Check permission between a pair of credentials
1450 * fork check, ptrace check, etc.
1451 */
1452 static int cred_has_perm(const struct cred *actor,
1453 const struct cred *target,
1454 u32 perms)
1455 {
1456 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1457
1458 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1459 }
1460
1461 /*
1462 * Check permission between a pair of tasks, e.g. signal checks,
1463 * fork check, ptrace check, etc.
1464 * tsk1 is the actor and tsk2 is the target
1465 * - this uses the default subjective creds of tsk1
1466 */
1467 static int task_has_perm(const struct task_struct *tsk1,
1468 const struct task_struct *tsk2,
1469 u32 perms)
1470 {
1471 const struct task_security_struct *__tsec1, *__tsec2;
1472 u32 sid1, sid2;
1473
1474 rcu_read_lock();
1475
1476 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1477 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1478
1479 rcu_read_unlock();
1480 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1481 }
1482
1483 /*
1484 * Check permission between current and another task, e.g. signal checks,
1485 * fork check, ptrace check, etc.
1486 * current is the actor and tsk2 is the target
1487 * - this uses current's subjective creds
1488 */
1489 static int current_has_perm(const struct task_struct *tsk,
1490 u32 perms)
1491 {
1492 u32 sid, tsid;
1493
1494 sid = current_sid();
1495 tsid = task_sid(tsk);
1496 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1497 }
1498
1499 #if CAP_LAST_CAP > 63
1500 #error Fix SELinux to handle capabilities > 63.
1501 #endif
1502
1503 /* Check whether a task is allowed to use a capability. */
1504 static int cred_has_capability(const struct cred *cred,
1505 int cap, int audit)
1506 {
1507 struct common_audit_data ad;
1508 struct av_decision avd;
1509 u16 sclass;
1510 u32 sid = cred_sid(cred);
1511 u32 av = CAP_TO_MASK(cap);
1512 int rc;
1513
1514 ad.type = LSM_AUDIT_DATA_CAP;
1515 ad.u.cap = cap;
1516
1517 switch (CAP_TO_INDEX(cap)) {
1518 case 0:
1519 sclass = SECCLASS_CAPABILITY;
1520 break;
1521 case 1:
1522 sclass = SECCLASS_CAPABILITY2;
1523 break;
1524 default:
1525 printk(KERN_ERR
1526 "SELinux: out of range capability %d\n", cap);
1527 BUG();
1528 return -EINVAL;
1529 }
1530
1531 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1532 if (audit == SECURITY_CAP_AUDIT) {
1533 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1534 if (rc2)
1535 return rc2;
1536 }
1537 return rc;
1538 }
1539
1540 /* Check whether a task is allowed to use a system operation. */
1541 static int task_has_system(struct task_struct *tsk,
1542 u32 perms)
1543 {
1544 u32 sid = task_sid(tsk);
1545
1546 return avc_has_perm(sid, SECINITSID_KERNEL,
1547 SECCLASS_SYSTEM, perms, NULL);
1548 }
1549
1550 /* Check whether a task has a particular permission to an inode.
1551 The 'adp' parameter is optional and allows other audit
1552 data to be passed (e.g. the dentry). */
1553 static int inode_has_perm(const struct cred *cred,
1554 struct inode *inode,
1555 u32 perms,
1556 struct common_audit_data *adp,
1557 unsigned flags)
1558 {
1559 struct inode_security_struct *isec;
1560 u32 sid;
1561
1562 validate_creds(cred);
1563
1564 if (unlikely(IS_PRIVATE(inode)))
1565 return 0;
1566
1567 sid = cred_sid(cred);
1568 isec = inode->i_security;
1569
1570 if (unlikely(!isec)){
1571 printk(KERN_CRIT "[SELinux] isec is NULL, inode->i_security is already freed. \n");
1572 return -EINVAL;
1573 }
1574
1575 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1576 }
1577
1578 /* Same as inode_has_perm, but pass explicit audit data containing
1579 the dentry to help the auditing code to more easily generate the
1580 pathname if needed. */
1581 static inline int dentry_has_perm(const struct cred *cred,
1582 struct dentry *dentry,
1583 u32 av)
1584 {
1585 struct inode *inode = dentry->d_inode;
1586 struct common_audit_data ad;
1587
1588 ad.type = LSM_AUDIT_DATA_DENTRY;
1589 ad.u.dentry = dentry;
1590 return inode_has_perm(cred, inode, av, &ad, 0);
1591 }
1592
1593 /* Same as inode_has_perm, but pass explicit audit data containing
1594 the path to help the auditing code to more easily generate the
1595 pathname if needed. */
1596 static inline int path_has_perm(const struct cred *cred,
1597 struct path *path,
1598 u32 av)
1599 {
1600 struct inode *inode = path->dentry->d_inode;
1601 struct common_audit_data ad;
1602
1603 ad.type = LSM_AUDIT_DATA_PATH;
1604 ad.u.path = *path;
1605 return inode_has_perm(cred, inode, av, &ad, 0);
1606 }
1607
1608 /* Check whether a task can use an open file descriptor to
1609 access an inode in a given way. Check access to the
1610 descriptor itself, and then use dentry_has_perm to
1611 check a particular permission to the file.
1612 Access to the descriptor is implicitly granted if it
1613 has the same SID as the process. If av is zero, then
1614 access to the file is not checked, e.g. for cases
1615 where only the descriptor is affected like seek. */
1616 static int file_has_perm(const struct cred *cred,
1617 struct file *file,
1618 u32 av)
1619 {
1620 struct file_security_struct *fsec = file->f_security;
1621 struct inode *inode = file_inode(file);
1622 struct common_audit_data ad;
1623 u32 sid = cred_sid(cred);
1624 int rc;
1625
1626 ad.type = LSM_AUDIT_DATA_PATH;
1627 ad.u.path = file->f_path;
1628
1629 if (sid != fsec->sid) {
1630 rc = avc_has_perm(sid, fsec->sid,
1631 SECCLASS_FD,
1632 FD__USE,
1633 &ad);
1634 if (rc)
1635 goto out;
1636 }
1637
1638 /* av is zero if only checking access to the descriptor. */
1639 rc = 0;
1640 if (av)
1641 rc = inode_has_perm(cred, inode, av, &ad, 0);
1642
1643 out:
1644 return rc;
1645 }
1646
1647 /* Check whether a task can create a file. */
1648 static int may_create(struct inode *dir,
1649 struct dentry *dentry,
1650 u16 tclass)
1651 {
1652 const struct task_security_struct *tsec = current_security();
1653 struct inode_security_struct *dsec;
1654 struct superblock_security_struct *sbsec;
1655 u32 sid, newsid;
1656 struct common_audit_data ad;
1657 int rc;
1658
1659 dsec = dir->i_security;
1660 sbsec = dir->i_sb->s_security;
1661
1662 sid = tsec->sid;
1663 newsid = tsec->create_sid;
1664
1665 ad.type = LSM_AUDIT_DATA_DENTRY;
1666 ad.u.dentry = dentry;
1667
1668 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1669 DIR__ADD_NAME | DIR__SEARCH,
1670 &ad);
1671 if (rc)
1672 return rc;
1673
1674 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1675 rc = security_transition_sid(sid, dsec->sid, tclass,
1676 &dentry->d_name, &newsid);
1677 if (rc)
1678 return rc;
1679 }
1680
1681 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1682 if (rc)
1683 return rc;
1684
1685 return avc_has_perm(newsid, sbsec->sid,
1686 SECCLASS_FILESYSTEM,
1687 FILESYSTEM__ASSOCIATE, &ad);
1688 }
1689
1690 /* Check whether a task can create a key. */
1691 static int may_create_key(u32 ksid,
1692 struct task_struct *ctx)
1693 {
1694 u32 sid = task_sid(ctx);
1695
1696 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1697 }
1698
1699 #define MAY_LINK 0
1700 #define MAY_UNLINK 1
1701 #define MAY_RMDIR 2
1702
1703 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1704 static int may_link(struct inode *dir,
1705 struct dentry *dentry,
1706 int kind)
1707
1708 {
1709 struct inode_security_struct *dsec, *isec;
1710 struct common_audit_data ad;
1711 u32 sid = current_sid();
1712 u32 av;
1713 int rc;
1714
1715 dsec = dir->i_security;
1716 isec = dentry->d_inode->i_security;
1717
1718 ad.type = LSM_AUDIT_DATA_DENTRY;
1719 ad.u.dentry = dentry;
1720
1721 av = DIR__SEARCH;
1722 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1723 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1724 if (rc)
1725 return rc;
1726
1727 switch (kind) {
1728 case MAY_LINK:
1729 av = FILE__LINK;
1730 break;
1731 case MAY_UNLINK:
1732 av = FILE__UNLINK;
1733 break;
1734 case MAY_RMDIR:
1735 av = DIR__RMDIR;
1736 break;
1737 default:
1738 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1739 __func__, kind);
1740 return 0;
1741 }
1742
1743 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1744 return rc;
1745 }
1746
1747 static inline int may_rename(struct inode *old_dir,
1748 struct dentry *old_dentry,
1749 struct inode *new_dir,
1750 struct dentry *new_dentry)
1751 {
1752 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1753 struct common_audit_data ad;
1754 u32 sid = current_sid();
1755 u32 av;
1756 int old_is_dir, new_is_dir;
1757 int rc;
1758
1759 old_dsec = old_dir->i_security;
1760 old_isec = old_dentry->d_inode->i_security;
1761 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1762 new_dsec = new_dir->i_security;
1763
1764 ad.type = LSM_AUDIT_DATA_DENTRY;
1765
1766 ad.u.dentry = old_dentry;
1767 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1768 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1769 if (rc)
1770 return rc;
1771 rc = avc_has_perm(sid, old_isec->sid,
1772 old_isec->sclass, FILE__RENAME, &ad);
1773 if (rc)
1774 return rc;
1775 if (old_is_dir && new_dir != old_dir) {
1776 rc = avc_has_perm(sid, old_isec->sid,
1777 old_isec->sclass, DIR__REPARENT, &ad);
1778 if (rc)
1779 return rc;
1780 }
1781
1782 ad.u.dentry = new_dentry;
1783 av = DIR__ADD_NAME | DIR__SEARCH;
1784 if (new_dentry->d_inode)
1785 av |= DIR__REMOVE_NAME;
1786 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1787 if (rc)
1788 return rc;
1789 if (new_dentry->d_inode) {
1790 new_isec = new_dentry->d_inode->i_security;
1791 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1792 rc = avc_has_perm(sid, new_isec->sid,
1793 new_isec->sclass,
1794 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1795 if (rc)
1796 return rc;
1797 }
1798
1799 return 0;
1800 }
1801
1802 /* Check whether a task can perform a filesystem operation. */
1803 static int superblock_has_perm(const struct cred *cred,
1804 struct super_block *sb,
1805 u32 perms,
1806 struct common_audit_data *ad)
1807 {
1808 struct superblock_security_struct *sbsec;
1809 u32 sid = cred_sid(cred);
1810
1811 sbsec = sb->s_security;
1812 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1813 }
1814
1815 /* Convert a Linux mode and permission mask to an access vector. */
1816 static inline u32 file_mask_to_av(int mode, int mask)
1817 {
1818 u32 av = 0;
1819
1820 if (!S_ISDIR(mode)) {
1821 if (mask & MAY_EXEC)
1822 av |= FILE__EXECUTE;
1823 if (mask & MAY_READ)
1824 av |= FILE__READ;
1825
1826 if (mask & MAY_APPEND)
1827 av |= FILE__APPEND;
1828 else if (mask & MAY_WRITE)
1829 av |= FILE__WRITE;
1830
1831 } else {
1832 if (mask & MAY_EXEC)
1833 av |= DIR__SEARCH;
1834 if (mask & MAY_WRITE)
1835 av |= DIR__WRITE;
1836 if (mask & MAY_READ)
1837 av |= DIR__READ;
1838 }
1839
1840 return av;
1841 }
1842
1843 /* Convert a Linux file to an access vector. */
1844 static inline u32 file_to_av(struct file *file)
1845 {
1846 u32 av = 0;
1847
1848 if (file->f_mode & FMODE_READ)
1849 av |= FILE__READ;
1850 if (file->f_mode & FMODE_WRITE) {
1851 if (file->f_flags & O_APPEND)
1852 av |= FILE__APPEND;
1853 else
1854 av |= FILE__WRITE;
1855 }
1856 if (!av) {
1857 /*
1858 * Special file opened with flags 3 for ioctl-only use.
1859 */
1860 av = FILE__IOCTL;
1861 }
1862
1863 return av;
1864 }
1865
1866 /*
1867 * Convert a file to an access vector and include the correct open
1868 * open permission.
1869 */
1870 static inline u32 open_file_to_av(struct file *file)
1871 {
1872 u32 av = file_to_av(file);
1873
1874 if (selinux_policycap_openperm)
1875 av |= FILE__OPEN;
1876
1877 return av;
1878 }
1879
1880 /* Hook functions begin here. */
1881
1882 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1883 {
1884 u32 mysid = current_sid();
1885 u32 mgrsid = task_sid(mgr);
1886
1887 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL);
1888 }
1889
1890 static int selinux_binder_transaction(struct task_struct *from, struct task_struct *to)
1891 {
1892 u32 mysid = current_sid();
1893 u32 fromsid = task_sid(from);
1894 u32 tosid = task_sid(to);
1895 int rc;
1896
1897 if (mysid != fromsid) {
1898 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, BINDER__IMPERSONATE, NULL);
1899 if (rc)
1900 return rc;
1901 }
1902
1903 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, NULL);
1904 }
1905
1906 static int selinux_binder_transfer_binder(struct task_struct *from, struct task_struct *to)
1907 {
1908 u32 fromsid = task_sid(from);
1909 u32 tosid = task_sid(to);
1910
1911 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, NULL);
1912 }
1913
1914 static int selinux_binder_transfer_file(struct task_struct *from, struct task_struct *to, struct file *file)
1915 {
1916 u32 sid = task_sid(to);
1917 struct file_security_struct *fsec = file->f_security;
1918 struct inode *inode = file->f_path.dentry->d_inode;
1919 struct inode_security_struct *isec = inode->i_security;
1920 struct common_audit_data ad;
1921 struct selinux_audit_data sad = {0,};
1922 int rc;
1923
1924 ad.type = LSM_AUDIT_DATA_PATH;
1925 ad.u.path = file->f_path;
1926 ad.selinux_audit_data = &sad;
1927
1928 if (sid != fsec->sid) {
1929 rc = avc_has_perm(sid, fsec->sid,
1930 SECCLASS_FD,
1931 FD__USE,
1932 &ad);
1933 if (rc)
1934 return rc;
1935 }
1936
1937 if (unlikely(IS_PRIVATE(inode)))
1938 return 0;
1939
1940 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1941 &ad);
1942 }
1943
1944 static int selinux_ptrace_access_check(struct task_struct *child,
1945 unsigned int mode)
1946 {
1947 int rc;
1948
1949 rc = cap_ptrace_access_check(child, mode);
1950 if (rc)
1951 return rc;
1952
1953 if (mode & PTRACE_MODE_READ) {
1954 u32 sid = current_sid();
1955 u32 csid = task_sid(child);
1956 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1957 }
1958
1959 return current_has_perm(child, PROCESS__PTRACE);
1960 }
1961
1962 static int selinux_ptrace_traceme(struct task_struct *parent)
1963 {
1964 int rc;
1965
1966 rc = cap_ptrace_traceme(parent);
1967 if (rc)
1968 return rc;
1969
1970 return task_has_perm(parent, current, PROCESS__PTRACE);
1971 }
1972
1973 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1974 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1975 {
1976 int error;
1977
1978 error = current_has_perm(target, PROCESS__GETCAP);
1979 if (error)
1980 return error;
1981
1982 return cap_capget(target, effective, inheritable, permitted);
1983 }
1984
1985 static int selinux_capset(struct cred *new, const struct cred *old,
1986 const kernel_cap_t *effective,
1987 const kernel_cap_t *inheritable,
1988 const kernel_cap_t *permitted)
1989 {
1990 int error;
1991
1992 error = cap_capset(new, old,
1993 effective, inheritable, permitted);
1994 if (error)
1995 return error;
1996
1997 return cred_has_perm(old, new, PROCESS__SETCAP);
1998 }
1999
2000 /*
2001 * (This comment used to live with the selinux_task_setuid hook,
2002 * which was removed).
2003 *
2004 * Since setuid only affects the current process, and since the SELinux
2005 * controls are not based on the Linux identity attributes, SELinux does not
2006 * need to control this operation. However, SELinux does control the use of
2007 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2008 */
2009
2010 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2011 int cap, int audit)
2012 {
2013 int rc;
2014
2015 rc = cap_capable(cred, ns, cap, audit);
2016 if (rc)
2017 return rc;
2018
2019 return cred_has_capability(cred, cap, audit);
2020 }
2021
2022 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2023 {
2024 const struct cred *cred = current_cred();
2025 int rc = 0;
2026
2027 if (!sb)
2028 return 0;
2029
2030 switch (cmds) {
2031 case Q_SYNC:
2032 case Q_QUOTAON:
2033 case Q_QUOTAOFF:
2034 case Q_SETINFO:
2035 case Q_SETQUOTA:
2036 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2037 break;
2038 case Q_GETFMT:
2039 case Q_GETINFO:
2040 case Q_GETQUOTA:
2041 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2042 break;
2043 default:
2044 rc = 0; /* let the kernel handle invalid cmds */
2045 break;
2046 }
2047 return rc;
2048 }
2049
2050 static int selinux_quota_on(struct dentry *dentry)
2051 {
2052 const struct cred *cred = current_cred();
2053
2054 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2055 }
2056
2057 static int selinux_syslog(int type)
2058 {
2059 int rc;
2060
2061 switch (type) {
2062 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2063 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2064 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2065 break;
2066 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2067 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2068 /* Set level of messages printed to console */
2069 case SYSLOG_ACTION_CONSOLE_LEVEL:
2070 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2071 break;
2072 case SYSLOG_ACTION_CLOSE: /* Close log */
2073 case SYSLOG_ACTION_OPEN: /* Open log */
2074 case SYSLOG_ACTION_READ: /* Read from log */
2075 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2076 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2077 default:
2078 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2079 break;
2080 }
2081 return rc;
2082 }
2083
2084 /*
2085 * Check that a process has enough memory to allocate a new virtual
2086 * mapping. 0 means there is enough memory for the allocation to
2087 * succeed and -ENOMEM implies there is not.
2088 *
2089 * Do not audit the selinux permission check, as this is applied to all
2090 * processes that allocate mappings.
2091 */
2092 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2093 {
2094 int rc, cap_sys_admin = 0;
2095
2096 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2097 SECURITY_CAP_NOAUDIT);
2098 if (rc == 0)
2099 cap_sys_admin = 1;
2100
2101 return __vm_enough_memory(mm, pages, cap_sys_admin);
2102 }
2103
2104 /* binprm security operations */
2105
2106 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2107 {
2108 const struct task_security_struct *old_tsec;
2109 struct task_security_struct *new_tsec;
2110 struct inode_security_struct *isec;
2111 struct common_audit_data ad;
2112 struct inode *inode = file_inode(bprm->file);
2113 int rc;
2114
2115 rc = cap_bprm_set_creds(bprm);
2116 if (rc)
2117 return rc;
2118
2119 /* SELinux context only depends on initial program or script and not
2120 * the script interpreter */
2121 if (bprm->cred_prepared)
2122 return 0;
2123
2124 old_tsec = current_security();
2125 new_tsec = bprm->cred->security;
2126 isec = inode->i_security;
2127
2128 /* Default to the current task SID. */
2129 new_tsec->sid = old_tsec->sid;
2130 new_tsec->osid = old_tsec->sid;
2131
2132 /* Reset fs, key, and sock SIDs on execve. */
2133 new_tsec->create_sid = 0;
2134 new_tsec->keycreate_sid = 0;
2135 new_tsec->sockcreate_sid = 0;
2136
2137 if (old_tsec->exec_sid) {
2138 new_tsec->sid = old_tsec->exec_sid;
2139 /* Reset exec SID on execve. */
2140 new_tsec->exec_sid = 0;
2141
2142 /*
2143 * Minimize confusion: if no_new_privs and a transition is
2144 * explicitly requested, then fail the exec.
2145 */
2146 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2147 return -EPERM;
2148 } else {
2149 /* Check for a default transition on this program. */
2150 rc = security_transition_sid(old_tsec->sid, isec->sid,
2151 SECCLASS_PROCESS, NULL,
2152 &new_tsec->sid);
2153 if (rc)
2154 return rc;
2155 }
2156
2157 ad.type = LSM_AUDIT_DATA_PATH;
2158 ad.u.path = bprm->file->f_path;
2159
2160 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2161 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2162 new_tsec->sid = old_tsec->sid;
2163
2164 if (new_tsec->sid == old_tsec->sid) {
2165 rc = avc_has_perm(old_tsec->sid, isec->sid,
2166 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2167 if (rc)
2168 return rc;
2169 } else {
2170 /* Check permissions for the transition. */
2171 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2172 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2173 if (rc)
2174 return rc;
2175
2176 rc = avc_has_perm(new_tsec->sid, isec->sid,
2177 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2178 if (rc)
2179 return rc;
2180
2181 /* Check for shared state */
2182 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2183 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2184 SECCLASS_PROCESS, PROCESS__SHARE,
2185 NULL);
2186 if (rc)
2187 return -EPERM;
2188 }
2189
2190 /* Make sure that anyone attempting to ptrace over a task that
2191 * changes its SID has the appropriate permit */
2192 if (bprm->unsafe &
2193 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2194 struct task_struct *tracer;
2195 struct task_security_struct *sec;
2196 u32 ptsid = 0;
2197
2198 rcu_read_lock();
2199 tracer = ptrace_parent(current);
2200 if (likely(tracer != NULL)) {
2201 sec = __task_cred(tracer)->security;
2202 ptsid = sec->sid;
2203 }
2204 rcu_read_unlock();
2205
2206 if (ptsid != 0) {
2207 rc = avc_has_perm(ptsid, new_tsec->sid,
2208 SECCLASS_PROCESS,
2209 PROCESS__PTRACE, NULL);
2210 if (rc)
2211 return -EPERM;
2212 }
2213 }
2214
2215 /* Clear any possibly unsafe personality bits on exec: */
2216 bprm->per_clear |= PER_CLEAR_ON_SETID;
2217 }
2218
2219 return 0;
2220 }
2221
2222 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2223 {
2224 const struct task_security_struct *tsec = current_security();
2225 u32 sid, osid;
2226 int atsecure = 0;
2227
2228 sid = tsec->sid;
2229 osid = tsec->osid;
2230
2231 if (osid != sid) {
2232 /* Enable secure mode for SIDs transitions unless
2233 the noatsecure permission is granted between
2234 the two SIDs, i.e. ahp returns 0. */
2235 atsecure = avc_has_perm(osid, sid,
2236 SECCLASS_PROCESS,
2237 PROCESS__NOATSECURE, NULL);
2238 }
2239
2240 return (atsecure || cap_bprm_secureexec(bprm));
2241 }
2242
2243 static int match_file(const void *p, struct file *file, unsigned fd)
2244 {
2245 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2246 }
2247
2248 /* Derived from fs/exec.c:flush_old_files. */
2249 static inline void flush_unauthorized_files(const struct cred *cred,
2250 struct files_struct *files)
2251 {
2252 struct file *file, *devnull = NULL;
2253 struct tty_struct *tty;
2254 int drop_tty = 0;
2255 unsigned n;
2256
2257 tty = get_current_tty();
2258 if (tty) {
2259 spin_lock(&tty_files_lock);
2260 if (!list_empty(&tty->tty_files)) {
2261 struct tty_file_private *file_priv;
2262
2263 /* Revalidate access to controlling tty.
2264 Use path_has_perm on the tty path directly rather
2265 than using file_has_perm, as this particular open
2266 file may belong to another process and we are only
2267 interested in the inode-based check here. */
2268 file_priv = list_first_entry(&tty->tty_files,
2269 struct tty_file_private, list);
2270 file = file_priv->file;
2271 if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2272 drop_tty = 1;
2273 }
2274 spin_unlock(&tty_files_lock);
2275 tty_kref_put(tty);
2276 }
2277 /* Reset controlling tty. */
2278 if (drop_tty)
2279 no_tty();
2280
2281 /* Revalidate access to inherited open files. */
2282 n = iterate_fd(files, 0, match_file, cred);
2283 if (!n) /* none found? */
2284 return;
2285
2286 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2287 if (IS_ERR(devnull))
2288 devnull = NULL;
2289 /* replace all the matching ones with this */
2290 do {
2291 replace_fd(n - 1, devnull, 0);
2292 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2293 if (devnull)
2294 fput(devnull);
2295 }
2296
2297 /*
2298 * Prepare a process for imminent new credential changes due to exec
2299 */
2300 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2301 {
2302 struct task_security_struct *new_tsec;
2303 struct rlimit *rlim, *initrlim;
2304 int rc, i;
2305
2306 new_tsec = bprm->cred->security;
2307 if (new_tsec->sid == new_tsec->osid)
2308 return;
2309
2310 /* Close files for which the new task SID is not authorized. */
2311 flush_unauthorized_files(bprm->cred, current->files);
2312
2313 /* Always clear parent death signal on SID transitions. */
2314 current->pdeath_signal = 0;
2315
2316 /* Check whether the new SID can inherit resource limits from the old
2317 * SID. If not, reset all soft limits to the lower of the current
2318 * task's hard limit and the init task's soft limit.
2319 *
2320 * Note that the setting of hard limits (even to lower them) can be
2321 * controlled by the setrlimit check. The inclusion of the init task's
2322 * soft limit into the computation is to avoid resetting soft limits
2323 * higher than the default soft limit for cases where the default is
2324 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2325 */
2326 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2327 PROCESS__RLIMITINH, NULL);
2328 if (rc) {
2329 /* protect against do_prlimit() */
2330 task_lock(current);
2331 for (i = 0; i < RLIM_NLIMITS; i++) {
2332 rlim = current->signal->rlim + i;
2333 initrlim = init_task.signal->rlim + i;
2334 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2335 }
2336 task_unlock(current);
2337 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2338 }
2339 }
2340
2341 /*
2342 * Clean up the process immediately after the installation of new credentials
2343 * due to exec
2344 */
2345 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2346 {
2347 const struct task_security_struct *tsec = current_security();
2348 struct itimerval itimer;
2349 u32 osid, sid;
2350 int rc, i;
2351
2352 osid = tsec->osid;
2353 sid = tsec->sid;
2354
2355 if (sid == osid)
2356 return;
2357
2358 /* Check whether the new SID can inherit signal state from the old SID.
2359 * If not, clear itimers to avoid subsequent signal generation and
2360 * flush and unblock signals.
2361 *
2362 * This must occur _after_ the task SID has been updated so that any
2363 * kill done after the flush will be checked against the new SID.
2364 */
2365 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2366 if (rc) {
2367 memset(&itimer, 0, sizeof itimer);
2368 for (i = 0; i < 3; i++)
2369 do_setitimer(i, &itimer, NULL);
2370 spin_lock_irq(&current->sighand->siglock);
2371 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2372 __flush_signals(current);
2373 flush_signal_handlers(current, 1);
2374 sigemptyset(&current->blocked);
2375 }
2376 spin_unlock_irq(&current->sighand->siglock);
2377 }
2378
2379 /* Wake up the parent if it is waiting so that it can recheck
2380 * wait permission to the new task SID. */
2381 read_lock(&tasklist_lock);
2382 __wake_up_parent(current, current->real_parent);
2383 read_unlock(&tasklist_lock);
2384 }
2385
2386 /* superblock security operations */
2387
2388 static int selinux_sb_alloc_security(struct super_block *sb)
2389 {
2390 return superblock_alloc_security(sb);
2391 }
2392
2393 static void selinux_sb_free_security(struct super_block *sb)
2394 {
2395 superblock_free_security(sb);
2396 }
2397
2398 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2399 {
2400 if (plen > olen)
2401 return 0;
2402
2403 return !memcmp(prefix, option, plen);
2404 }
2405
2406 static inline int selinux_option(char *option, int len)
2407 {
2408 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2409 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2410 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2411 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2412 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2413 }
2414
2415 static inline void take_option(char **to, char *from, int *first, int len)
2416 {
2417 if (!*first) {
2418 **to = ',';
2419 *to += 1;
2420 } else
2421 *first = 0;
2422 memcpy(*to, from, len);
2423 *to += len;
2424 }
2425
2426 static inline void take_selinux_option(char **to, char *from, int *first,
2427 int len)
2428 {
2429 int current_size = 0;
2430
2431 if (!*first) {
2432 **to = '|';
2433 *to += 1;
2434 } else
2435 *first = 0;
2436
2437 while (current_size < len) {
2438 if (*from != '"') {
2439 **to = *from;
2440 *to += 1;
2441 }
2442 from += 1;
2443 current_size += 1;
2444 }
2445 }
2446
2447 static int selinux_sb_copy_data(char *orig, char *copy)
2448 {
2449 int fnosec, fsec, rc = 0;
2450 char *in_save, *in_curr, *in_end;
2451 char *sec_curr, *nosec_save, *nosec;
2452 int open_quote = 0;
2453
2454 in_curr = orig;
2455 sec_curr = copy;
2456
2457 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2458 if (!nosec) {
2459 rc = -ENOMEM;
2460 goto out;
2461 }
2462
2463 nosec_save = nosec;
2464 fnosec = fsec = 1;
2465 in_save = in_end = orig;
2466
2467 do {
2468 if (*in_end == '"')
2469 open_quote = !open_quote;
2470 if ((*in_end == ',' && open_quote == 0) ||
2471 *in_end == '\0') {
2472 int len = in_end - in_curr;
2473
2474 if (selinux_option(in_curr, len))
2475 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2476 else
2477 take_option(&nosec, in_curr, &fnosec, len);
2478
2479 in_curr = in_end + 1;
2480 }
2481 } while (*in_end++);
2482
2483 strcpy(in_save, nosec_save);
2484 free_page((unsigned long)nosec_save);
2485 out:
2486 return rc;
2487 }
2488
2489 static int selinux_sb_remount(struct super_block *sb, void *data)
2490 {
2491 int rc, i, *flags;
2492 struct security_mnt_opts opts;
2493 char *secdata, **mount_options;
2494 struct superblock_security_struct *sbsec = sb->s_security;
2495
2496 if (!(sbsec->flags & SE_SBINITIALIZED))
2497 return 0;
2498
2499 if (!data)
2500 return 0;
2501
2502 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2503 return 0;
2504
2505 security_init_mnt_opts(&opts);
2506 secdata = alloc_secdata();
2507 if (!secdata)
2508 return -ENOMEM;
2509 rc = selinux_sb_copy_data(data, secdata);
2510 if (rc)
2511 goto out_free_secdata;
2512
2513 rc = selinux_parse_opts_str(secdata, &opts);
2514 if (rc)
2515 goto out_free_secdata;
2516
2517 mount_options = opts.mnt_opts;
2518 flags = opts.mnt_opts_flags;
2519
2520 for (i = 0; i < opts.num_mnt_opts; i++) {
2521 u32 sid;
2522 size_t len;
2523
2524 if (flags[i] == SE_SBLABELSUPP)
2525 continue;
2526 len = strlen(mount_options[i]);
2527 rc = security_context_to_sid(mount_options[i], len, &sid);
2528 if (rc) {
2529 printk(KERN_WARNING "SELinux: security_context_to_sid"
2530 "(%s) failed for (dev %s, type %s) errno=%d\n",
2531 mount_options[i], sb->s_id, sb->s_type->name, rc);
2532 goto out_free_opts;
2533 }
2534 rc = -EINVAL;
2535 switch (flags[i]) {
2536 case FSCONTEXT_MNT:
2537 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2538 goto out_bad_option;
2539 break;
2540 case CONTEXT_MNT:
2541 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2542 goto out_bad_option;
2543 break;
2544 case ROOTCONTEXT_MNT: {
2545 struct inode_security_struct *root_isec;
2546 root_isec = sb->s_root->d_inode->i_security;
2547
2548 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2549 goto out_bad_option;
2550 break;
2551 }
2552 case DEFCONTEXT_MNT:
2553 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2554 goto out_bad_option;
2555 break;
2556 default:
2557 goto out_free_opts;
2558 }
2559 }
2560
2561 rc = 0;
2562 out_free_opts:
2563 security_free_mnt_opts(&opts);
2564 out_free_secdata:
2565 free_secdata(secdata);
2566 return rc;
2567 out_bad_option:
2568 printk(KERN_WARNING "SELinux: unable to change security options "
2569 "during remount (dev %s, type=%s)\n", sb->s_id,
2570 sb->s_type->name);
2571 goto out_free_opts;
2572 }
2573
2574 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2575 {
2576 const struct cred *cred = current_cred();
2577 struct common_audit_data ad;
2578 int rc;
2579
2580 rc = superblock_doinit(sb, data);
2581 if (rc)
2582 return rc;
2583
2584 /* Allow all mounts performed by the kernel */
2585 if (flags & MS_KERNMOUNT)
2586 return 0;
2587
2588 ad.type = LSM_AUDIT_DATA_DENTRY;
2589 ad.u.dentry = sb->s_root;
2590 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2591 }
2592
2593 static int selinux_sb_statfs(struct dentry *dentry)
2594 {
2595 const struct cred *cred = current_cred();
2596 struct common_audit_data ad;
2597
2598 ad.type = LSM_AUDIT_DATA_DENTRY;
2599 ad.u.dentry = dentry->d_sb->s_root;
2600 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2601 }
2602
2603 static int selinux_mount(const char *dev_name,
2604 struct path *path,
2605 const char *type,
2606 unsigned long flags,
2607 void *data)
2608 {
2609 const struct cred *cred = current_cred();
2610 if (flags & MS_REMOUNT)
2611 return superblock_has_perm(cred, path->dentry->d_sb,
2612 FILESYSTEM__REMOUNT, NULL);
2613 else
2614 return path_has_perm(cred, path, FILE__MOUNTON);
2615 }
2616
2617 static int selinux_umount(struct vfsmount *mnt, int flags)
2618 {
2619 const struct cred *cred = current_cred();
2620
2621 return superblock_has_perm(cred, mnt->mnt_sb,
2622 FILESYSTEM__UNMOUNT, NULL);
2623 }
2624
2625 /* inode security operations */
2626
2627 static int selinux_inode_alloc_security(struct inode *inode)
2628 {
2629 return inode_alloc_security(inode);
2630 }
2631
2632 static void selinux_inode_free_security(struct inode *inode)
2633 {
2634 inode_free_security(inode);
2635 }
2636
2637 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2638 const struct qstr *qstr, char **name,
2639 void **value, size_t *len)
2640 {
2641 const struct task_security_struct *tsec = current_security();
2642 struct inode_security_struct *dsec;
2643 struct superblock_security_struct *sbsec;
2644 u32 sid, newsid, clen;
2645 int rc;
2646 char *namep = NULL, *context;
2647
2648 dsec = dir->i_security;
2649 sbsec = dir->i_sb->s_security;
2650
2651 sid = tsec->sid;
2652 newsid = tsec->create_sid;
2653
2654 if ((sbsec->flags & SE_SBINITIALIZED) &&
2655 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2656 newsid = sbsec->mntpoint_sid;
2657 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2658 rc = security_transition_sid(sid, dsec->sid,
2659 inode_mode_to_security_class(inode->i_mode),
2660 qstr, &newsid);
2661 if (rc) {
2662 printk(KERN_WARNING "%s: "
2663 "security_transition_sid failed, rc=%d (dev=%s "
2664 "ino=%ld)\n",
2665 __func__,
2666 -rc, inode->i_sb->s_id, inode->i_ino);
2667 return rc;
2668 }
2669 }
2670
2671 /* Possibly defer initialization to selinux_complete_init. */
2672 if (sbsec->flags & SE_SBINITIALIZED) {
2673 struct inode_security_struct *isec = inode->i_security;
2674 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2675 isec->sid = newsid;
2676 isec->initialized = 1;
2677 }
2678
2679 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2680 return -EOPNOTSUPP;
2681
2682 if (name) {
2683 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2684 if (!namep)
2685 return -ENOMEM;
2686 *name = namep;
2687 }
2688
2689 if (value && len) {
2690 rc = security_sid_to_context_force(newsid, &context, &clen);
2691 if (rc) {
2692 kfree(namep);
2693 return rc;
2694 }
2695 *value = context;
2696 *len = clen;
2697 }
2698
2699 return 0;
2700 }
2701
2702 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2703 {
2704 return may_create(dir, dentry, SECCLASS_FILE);
2705 }
2706
2707 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2708 {
2709 return may_link(dir, old_dentry, MAY_LINK);
2710 }
2711
2712 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2713 {
2714 return may_link(dir, dentry, MAY_UNLINK);
2715 }
2716
2717 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2718 {
2719 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2720 }
2721
2722 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2723 {
2724 return may_create(dir, dentry, SECCLASS_DIR);
2725 }
2726
2727 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2728 {
2729 return may_link(dir, dentry, MAY_RMDIR);
2730 }
2731
2732 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2733 {
2734 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2735 }
2736
2737 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2738 struct inode *new_inode, struct dentry *new_dentry)
2739 {
2740 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2741 }
2742
2743 static int selinux_inode_readlink(struct dentry *dentry)
2744 {
2745 const struct cred *cred = current_cred();
2746
2747 return dentry_has_perm(cred, dentry, FILE__READ);
2748 }
2749
2750 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2751 {
2752 const struct cred *cred = current_cred();
2753
2754 return dentry_has_perm(cred, dentry, FILE__READ);
2755 }
2756
2757 static noinline int audit_inode_permission(struct inode *inode,
2758 u32 perms, u32 audited, u32 denied,
2759 int result,
2760 unsigned flags)
2761 {
2762 struct common_audit_data ad;
2763 struct inode_security_struct *isec = inode->i_security;
2764 int rc;
2765
2766 ad.type = LSM_AUDIT_DATA_INODE;
2767 ad.u.inode = inode;
2768
2769 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2770 audited, denied, result, &ad, flags);
2771 if (rc)
2772 return rc;
2773 return 0;
2774 }
2775
2776 static int selinux_inode_permission(struct inode *inode, int mask)
2777 {
2778 const struct cred *cred = current_cred();
2779 u32 perms;
2780 bool from_access;
2781 unsigned flags = mask & MAY_NOT_BLOCK;
2782 struct inode_security_struct *isec;
2783 u32 sid;
2784 struct av_decision avd;
2785 int rc, rc2;
2786 u32 audited, denied;
2787
2788 from_access = mask & MAY_ACCESS;
2789 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2790
2791 /* No permission to check. Existence test. */
2792 if (!mask)
2793 return 0;
2794
2795 validate_creds(cred);
2796
2797 if (unlikely(IS_PRIVATE(inode)))
2798 return 0;
2799
2800 perms = file_mask_to_av(inode->i_mode, mask);
2801
2802 sid = cred_sid(cred);
2803 isec = inode->i_security;
2804
2805 // [ SEC_SELINUX_PORTING COMMON
2806 /* skip sid == 1(kernel), it means first boot time */
2807 if(isec->initialized != 1 && sid != 1) {
2808 int count = 5;
2809
2810 while(count-- > 0) {
2811 printk(KERN_ERR "SELinux : inode->i_security is not initialized. waiting...(%d/5)\n", 5-count);
2812 udelay(500);
2813 if(isec->initialized == 1) {
2814 printk(KERN_ERR "SELinux : inode->i_security is INITIALIZED.\n");
2815 break;
2816 }
2817 }
2818 if(isec->initialized != 1) {
2819 printk(KERN_ERR "SELinux : inode->i_security is not initialized. not fixed.\n");
2820 }
2821 }
2822 // ] SEC_SELINUX_PORTING COMMON
2823
2824 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2825 audited = avc_audit_required(perms, &avd, rc,
2826 from_access ? FILE__AUDIT_ACCESS : 0,
2827 &denied);
2828 if (likely(!audited))
2829 return rc;
2830
2831 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2832 if (rc2)
2833 return rc2;
2834 return rc;
2835 }
2836
2837 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2838 {
2839 const struct cred *cred = current_cred();
2840 unsigned int ia_valid = iattr->ia_valid;
2841 __u32 av = FILE__WRITE;
2842
2843 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2844 if (ia_valid & ATTR_FORCE) {
2845 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2846 ATTR_FORCE);
2847 if (!ia_valid)
2848 return 0;
2849 }
2850
2851 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2852 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2853 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2854
2855 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2856 && !(ia_valid & ATTR_FILE))
2857 av |= FILE__OPEN;
2858
2859 return dentry_has_perm(cred, dentry, av);
2860 }
2861
2862 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2863 {
2864 const struct cred *cred = current_cred();
2865 struct path path;
2866
2867 path.dentry = dentry;
2868 path.mnt = mnt;
2869
2870 return path_has_perm(cred, &path, FILE__GETATTR);
2871 }
2872
2873 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2874 {
2875 const struct cred *cred = current_cred();
2876
2877 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2878 sizeof XATTR_SECURITY_PREFIX - 1)) {
2879 if (!strcmp(name, XATTR_NAME_CAPS)) {
2880 if (!capable(CAP_SETFCAP))
2881 return -EPERM;
2882 } else if (!capable(CAP_SYS_ADMIN)) {
2883 /* A different attribute in the security namespace.
2884 Restrict to administrator. */
2885 return -EPERM;
2886 }
2887 }
2888
2889 /* Not an attribute we recognize, so just check the
2890 ordinary setattr permission. */
2891 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2892 }
2893
2894 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2895 const void *value, size_t size, int flags)
2896 {
2897 struct inode *inode = dentry->d_inode;
2898 struct inode_security_struct *isec = inode->i_security;
2899 struct superblock_security_struct *sbsec;
2900 struct common_audit_data ad;
2901 u32 newsid, sid = current_sid();
2902 int rc = 0;
2903
2904 if (strcmp(name, XATTR_NAME_SELINUX))
2905 return selinux_inode_setotherxattr(dentry, name);
2906
2907 sbsec = inode->i_sb->s_security;
2908 if (!(sbsec->flags & SE_SBLABELSUPP))
2909 return -EOPNOTSUPP;
2910
2911 if (!inode_owner_or_capable(inode))
2912 return -EPERM;
2913
2914 ad.type = LSM_AUDIT_DATA_DENTRY;
2915 ad.u.dentry = dentry;
2916
2917 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2918 FILE__RELABELFROM, &ad);
2919 if (rc)
2920 return rc;
2921
2922 rc = security_context_to_sid(value, size, &newsid);
2923 if (rc == -EINVAL) {
2924 if (!capable(CAP_MAC_ADMIN)) {
2925 struct audit_buffer *ab;
2926 size_t audit_size;
2927 const char *str;
2928
2929 /* We strip a nul only if it is at the end, otherwise the
2930 * context contains a nul and we should audit that */
2931 if (value) {
2932 str = value;
2933 if (str[size - 1] == '\0')
2934 audit_size = size - 1;
2935 else
2936 audit_size = size;
2937 } else {
2938 str = "";
2939 audit_size = 0;
2940 }
2941 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2942 audit_log_format(ab, "op=setxattr invalid_context=");
2943 audit_log_n_untrustedstring(ab, value, audit_size);
2944 audit_log_end(ab);
2945
2946 return rc;
2947 }
2948 rc = security_context_to_sid_force(value, size, &newsid);
2949 }
2950 if (rc)
2951 return rc;
2952
2953 rc = avc_has_perm(sid, newsid, isec->sclass,
2954 FILE__RELABELTO, &ad);
2955 if (rc)
2956 return rc;
2957
2958 rc = security_validate_transition(isec->sid, newsid, sid,
2959 isec->sclass);
2960 if (rc)
2961 return rc;
2962
2963 return avc_has_perm(newsid,
2964 sbsec->sid,
2965 SECCLASS_FILESYSTEM,
2966 FILESYSTEM__ASSOCIATE,
2967 &ad);
2968 }
2969
2970 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2971 const void *value, size_t size,
2972 int flags)
2973 {
2974 struct inode *inode = dentry->d_inode;
2975 struct inode_security_struct *isec = inode->i_security;
2976 u32 newsid;
2977 int rc;
2978
2979 if (strcmp(name, XATTR_NAME_SELINUX)) {
2980 /* Not an attribute we recognize, so nothing to do. */
2981 return;
2982 }
2983
2984 rc = security_context_to_sid_force(value, size, &newsid);
2985 if (rc) {
2986 printk(KERN_ERR "SELinux: unable to map context to SID"
2987 "for (%s, %lu), rc=%d\n",
2988 inode->i_sb->s_id, inode->i_ino, -rc);
2989 return;
2990 }
2991
2992 isec->sid = newsid;
2993 return;
2994 }
2995
2996 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2997 {
2998 const struct cred *cred = current_cred();
2999
3000 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3001 }
3002
3003 static int selinux_inode_listxattr(struct dentry *dentry)
3004 {
3005 const struct cred *cred = current_cred();
3006
3007 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3008 }
3009
3010 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3011 {
3012 if (strcmp(name, XATTR_NAME_SELINUX))
3013 return selinux_inode_setotherxattr(dentry, name);
3014
3015 /* No one is allowed to remove a SELinux security label.
3016 You can change the label, but all data must be labeled. */
3017 return -EACCES;
3018 }
3019
3020 /*
3021 * Copy the inode security context value to the user.
3022 *
3023 * Permission check is handled by selinux_inode_getxattr hook.
3024 */
3025 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3026 {
3027 u32 size;
3028 int error;
3029 char *context = NULL;
3030 struct inode_security_struct *isec = inode->i_security;
3031
3032 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3033 return -EOPNOTSUPP;
3034
3035 /*
3036 * If the caller has CAP_MAC_ADMIN, then get the raw context
3037 * value even if it is not defined by current policy; otherwise,
3038 * use the in-core value under current policy.
3039 * Use the non-auditing forms of the permission checks since
3040 * getxattr may be called by unprivileged processes commonly
3041 * and lack of permission just means that we fall back to the
3042 * in-core context value, not a denial.
3043 */
3044 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3045 SECURITY_CAP_NOAUDIT);
3046 if (!error)
3047 error = security_sid_to_context_force(isec->sid, &context,
3048 &size);
3049 else
3050 error = security_sid_to_context(isec->sid, &context, &size);
3051 if (error)
3052 return error;
3053 error = size;
3054 if (alloc) {
3055 *buffer = context;
3056 goto out_nofree;
3057 }
3058 kfree(context);
3059 out_nofree:
3060 return error;
3061 }
3062
3063 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3064 const void *value, size_t size, int flags)
3065 {
3066 struct inode_security_struct *isec = inode->i_security;
3067 u32 newsid;
3068 int rc;
3069
3070 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3071 return -EOPNOTSUPP;
3072
3073 if (!value || !size)
3074 return -EACCES;
3075
3076 rc = security_context_to_sid((void *)value, size, &newsid);
3077 if (rc)
3078 return rc;
3079
3080 isec->sid = newsid;
3081 isec->initialized = 1;
3082 return 0;
3083 }
3084
3085 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3086 {
3087 const int len = sizeof(XATTR_NAME_SELINUX);
3088
3089 if (buffer && len <= buffer_size)
3090 memcpy(buffer, XATTR_NAME_SELINUX, len);
3091 return len;
3092 }
3093
3094 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3095 {
3096 struct inode_security_struct *isec = inode->i_security;
3097 *secid = isec->sid;
3098 }
3099
3100 /* file security operations */
3101
3102 static int selinux_revalidate_file_permission(struct file *file, int mask)
3103 {
3104 const struct cred *cred = current_cred();
3105 struct inode *inode = file_inode(file);
3106
3107 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3108 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3109 mask |= MAY_APPEND;
3110
3111 return file_has_perm(cred, file,
3112 file_mask_to_av(inode->i_mode, mask));
3113 }
3114
3115 static int selinux_file_permission(struct file *file, int mask)
3116 {
3117 struct inode *inode = file_inode(file);
3118 struct file_security_struct *fsec = file->f_security;
3119 struct inode_security_struct *isec = inode->i_security;
3120 u32 sid = current_sid();
3121
3122 if (!mask)
3123 /* No permission to check. Existence test. */
3124 return 0;
3125
3126 if (sid == fsec->sid && fsec->isid == isec->sid &&
3127 fsec->pseqno == avc_policy_seqno())
3128 /* No change since file_open check. */
3129 return 0;
3130
3131 return selinux_revalidate_file_permission(file, mask);
3132 }
3133
3134 static int selinux_file_alloc_security(struct file *file)
3135 {
3136 return file_alloc_security(file);
3137 }
3138
3139 static void selinux_file_free_security(struct file *file)
3140 {
3141 file_free_security(file);
3142 }
3143
3144 /*
3145 * Check whether a task has the ioctl permission and cmd
3146 * operation to an inode.
3147 */
3148 int ioctl_has_perm(const struct cred *cred, struct file *file,
3149 u32 requested, u16 cmd)
3150 {
3151 struct common_audit_data ad;
3152 struct file_security_struct *fsec = file->f_security;
3153 struct inode *inode = file_inode(file);
3154 struct inode_security_struct *isec = inode->i_security;
3155 struct lsm_ioctlop_audit ioctl;
3156 u32 ssid = cred_sid(cred);
3157 int rc;
3158 u8 driver = cmd >> 8;
3159 u8 xperm = cmd & 0xff;
3160
3161 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3162 ad.u.op = &ioctl;
3163 ad.u.op->cmd = cmd;
3164 ad.u.op->path = file->f_path;
3165
3166 if (ssid != fsec->sid) {
3167 rc = avc_has_perm(ssid, fsec->sid,
3168 SECCLASS_FD,
3169 FD__USE,
3170 &ad);
3171 if (rc)
3172 goto out;
3173 }
3174
3175 if (unlikely(IS_PRIVATE(inode)))
3176 return 0;
3177
3178 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3179 requested, driver, xperm, &ad);
3180 out:
3181 return rc;
3182 }
3183
3184 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3185 unsigned long arg)
3186 {
3187 const struct cred *cred = current_cred();
3188 int error = 0;
3189
3190 switch (cmd) {
3191 case FIONREAD:
3192 /* fall through */
3193 case FIBMAP:
3194 /* fall through */
3195 case FIGETBSZ:
3196 /* fall through */
3197 case FS_IOC_GETFLAGS:
3198 /* fall through */
3199 case FS_IOC_GETVERSION:
3200 error = file_has_perm(cred, file, FILE__GETATTR);
3201 break;
3202
3203 case FS_IOC_SETFLAGS:
3204 /* fall through */
3205 case FS_IOC_SETVERSION:
3206 error = file_has_perm(cred, file, FILE__SETATTR);
3207 break;
3208
3209 /* sys_ioctl() checks */
3210 case FIONBIO:
3211 /* fall through */
3212 case FIOASYNC:
3213 error = file_has_perm(cred, file, 0);
3214 break;
3215
3216 case KDSKBENT:
3217 case KDSKBSENT:
3218 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3219 SECURITY_CAP_AUDIT);
3220 break;
3221
3222 /* default case assumes that the command will go
3223 * to the file's ioctl() function.
3224 */
3225 default:
3226 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3227 }
3228 return error;
3229 }
3230
3231 static int default_noexec;
3232
3233 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3234 {
3235 const struct cred *cred = current_cred();
3236 int rc = 0;
3237
3238 if (default_noexec &&
3239 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3240 /*
3241 * We are making executable an anonymous mapping or a
3242 * private file mapping that will also be writable.
3243 * This has an additional check.
3244 */
3245 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3246 if (rc)
3247 goto error;
3248 }
3249
3250 if (file) {
3251 /* read access is always possible with a mapping */
3252 u32 av = FILE__READ;
3253
3254 /* write access only matters if the mapping is shared */
3255 if (shared && (prot & PROT_WRITE))
3256 av |= FILE__WRITE;
3257
3258 if (prot & PROT_EXEC)
3259 av |= FILE__EXECUTE;
3260
3261 return file_has_perm(cred, file, av);
3262 }
3263
3264 error:
3265 return rc;
3266 }
3267
3268 static int selinux_mmap_addr(unsigned long addr)
3269 {
3270 int rc = 0;
3271 u32 sid = current_sid();
3272
3273 /*
3274 * notice that we are intentionally putting the SELinux check before
3275 * the secondary cap_file_mmap check. This is such a likely attempt
3276 * at bad behaviour/exploit that we always want to get the AVC, even
3277 * if DAC would have also denied the operation.
3278 */
3279 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3280 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3281 MEMPROTECT__MMAP_ZERO, NULL);
3282 if (rc)
3283 return rc;
3284 }
3285
3286 /* do DAC check on address space usage */
3287 return cap_mmap_addr(addr);
3288 }
3289
3290 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3291 unsigned long prot, unsigned long flags)
3292 {
3293 if (selinux_checkreqprot)
3294 prot = reqprot;
3295
3296 return file_map_prot_check(file, prot,
3297 (flags & MAP_TYPE) == MAP_SHARED);
3298 }
3299
3300 static int selinux_file_mprotect(struct vm_area_struct *vma,
3301 unsigned long reqprot,
3302 unsigned long prot)
3303 {
3304 const struct cred *cred = current_cred();
3305
3306 if (selinux_checkreqprot)
3307 prot = reqprot;
3308
3309 if (default_noexec &&
3310 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3311 int rc = 0;
3312 if (vma->vm_start >= vma->vm_mm->start_brk &&
3313 vma->vm_end <= vma->vm_mm->brk) {
3314 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3315 } else if (!vma->vm_file &&
3316 vma->vm_start <= vma->vm_mm->start_stack &&
3317 vma->vm_end >= vma->vm_mm->start_stack) {
3318 rc = current_has_perm(current, PROCESS__EXECSTACK);
3319 } else if (vma->vm_file && vma->anon_vma) {
3320 /*
3321 * We are making executable a file mapping that has
3322 * had some COW done. Since pages might have been
3323 * written, check ability to execute the possibly
3324 * modified content. This typically should only
3325 * occur for text relocations.
3326 */
3327 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3328 }
3329 if (rc)
3330 return rc;
3331 }
3332
3333 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3334 }
3335
3336 static int selinux_file_lock(struct file *file, unsigned int cmd)
3337 {
3338 const struct cred *cred = current_cred();
3339
3340 return file_has_perm(cred, file, FILE__LOCK);
3341 }
3342
3343 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3344 unsigned long arg)
3345 {
3346 const struct cred *cred = current_cred();
3347 int err = 0;
3348
3349 switch (cmd) {
3350 case F_SETFL:
3351 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3352 err = file_has_perm(cred, file, FILE__WRITE);
3353 break;
3354 }
3355 /* fall through */
3356 case F_SETOWN:
3357 case F_SETSIG:
3358 case F_GETFL:
3359 case F_GETOWN:
3360 case F_GETSIG:
3361 case F_GETOWNER_UIDS:
3362 /* Just check FD__USE permission */
3363 err = file_has_perm(cred, file, 0);
3364 break;
3365 case F_GETLK:
3366 case F_SETLK:
3367 case F_SETLKW:
3368 #if BITS_PER_LONG == 32
3369 case F_GETLK64:
3370 case F_SETLK64:
3371 case F_SETLKW64:
3372 #endif
3373 err = file_has_perm(cred, file, FILE__LOCK);
3374 break;
3375 }
3376
3377 return err;
3378 }
3379
3380 static int selinux_file_set_fowner(struct file *file)
3381 {
3382 struct file_security_struct *fsec;
3383
3384 fsec = file->f_security;
3385 fsec->fown_sid = current_sid();
3386
3387 return 0;
3388 }
3389
3390 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3391 struct fown_struct *fown, int signum)
3392 {
3393 struct file *file;
3394 u32 sid = task_sid(tsk);
3395 u32 perm;
3396 struct file_security_struct *fsec;
3397
3398 /* struct fown_struct is never outside the context of a struct file */
3399 file = container_of(fown, struct file, f_owner);
3400
3401 fsec = file->f_security;
3402
3403 if (!signum)
3404 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3405 else
3406 perm = signal_to_av(signum);
3407
3408 return avc_has_perm(fsec->fown_sid, sid,
3409 SECCLASS_PROCESS, perm, NULL);
3410 }
3411
3412 static int selinux_file_receive(struct file *file)
3413 {
3414 const struct cred *cred = current_cred();
3415
3416 return file_has_perm(cred, file, file_to_av(file));
3417 }
3418
3419 static int selinux_file_open(struct file *file, const struct cred *cred)
3420 {
3421 struct file_security_struct *fsec;
3422 struct inode_security_struct *isec;
3423
3424 fsec = file->f_security;
3425 isec = file_inode(file)->i_security;
3426 /*
3427 * Save inode label and policy sequence number
3428 * at open-time so that selinux_file_permission
3429 * can determine whether revalidation is necessary.
3430 * Task label is already saved in the file security
3431 * struct as its SID.
3432 */
3433 fsec->isid = isec->sid;
3434 fsec->pseqno = avc_policy_seqno();
3435 /*
3436 * Since the inode label or policy seqno may have changed
3437 * between the selinux_inode_permission check and the saving
3438 * of state above, recheck that access is still permitted.
3439 * Otherwise, access might never be revalidated against the
3440 * new inode label or new policy.
3441 * This check is not redundant - do not remove.
3442 */
3443 return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3444 }
3445
3446 /* task security operations */
3447
3448 static int selinux_task_create(unsigned long clone_flags)
3449 {
3450 return current_has_perm(current, PROCESS__FORK);
3451 }
3452
3453 /*
3454 * allocate the SELinux part of blank credentials
3455 */
3456 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3457 {
3458 struct task_security_struct *tsec;
3459
3460 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3461 if (!tsec)
3462 return -ENOMEM;
3463
3464 cred->security = tsec;
3465 return 0;
3466 }
3467
3468 /*
3469 * detach and free the LSM part of a set of credentials
3470 */
3471 static void selinux_cred_free(struct cred *cred)
3472 {
3473 struct task_security_struct *tsec = cred->security;
3474
3475 /*
3476 * cred->security == NULL if security_cred_alloc_blank() or
3477 * security_prepare_creds() returned an error.
3478 */
3479 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3480 cred->security = (void *) 0x7UL;
3481 kfree(tsec);
3482 }
3483
3484 /*
3485 * prepare a new set of credentials for modification
3486 */
3487 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3488 gfp_t gfp)
3489 {
3490 const struct task_security_struct *old_tsec;
3491 struct task_security_struct *tsec;
3492
3493 old_tsec = old->security;
3494
3495 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3496 if (!tsec)
3497 return -ENOMEM;
3498
3499 new->security = tsec;
3500 return 0;
3501 }
3502
3503 /*
3504 * transfer the SELinux data to a blank set of creds
3505 */
3506 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3507 {
3508 const struct task_security_struct *old_tsec = old->security;
3509 struct task_security_struct *tsec = new->security;
3510
3511 *tsec = *old_tsec;
3512 }
3513
3514 /*
3515 * set the security data for a kernel service
3516 * - all the creation contexts are set to unlabelled
3517 */
3518 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3519 {
3520 struct task_security_struct *tsec = new->security;
3521 u32 sid = current_sid();
3522 int ret;
3523
3524 ret = avc_has_perm(sid, secid,
3525 SECCLASS_KERNEL_SERVICE,
3526 KERNEL_SERVICE__USE_AS_OVERRIDE,
3527 NULL);
3528 if (ret == 0) {
3529 tsec->sid = secid;
3530 tsec->create_sid = 0;
3531 tsec->keycreate_sid = 0;
3532 tsec->sockcreate_sid = 0;
3533 }
3534 return ret;
3535 }
3536
3537 /*
3538 * set the file creation context in a security record to the same as the
3539 * objective context of the specified inode
3540 */
3541 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3542 {
3543 struct inode_security_struct *isec = inode->i_security;
3544 struct task_security_struct *tsec = new->security;
3545 u32 sid = current_sid();
3546 int ret;
3547
3548 ret = avc_has_perm(sid, isec->sid,
3549 SECCLASS_KERNEL_SERVICE,
3550 KERNEL_SERVICE__CREATE_FILES_AS,
3551 NULL);
3552
3553 if (ret == 0)
3554 tsec->create_sid = isec->sid;
3555 return ret;
3556 }
3557
3558 static int selinux_kernel_module_request(char *kmod_name)
3559 {
3560 u32 sid;
3561 struct common_audit_data ad;
3562
3563 sid = task_sid(current);
3564
3565 ad.type = LSM_AUDIT_DATA_KMOD;
3566 ad.u.kmod_name = kmod_name;
3567
3568 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3569 SYSTEM__MODULE_REQUEST, &ad);
3570 }
3571
3572 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3573 {
3574 return current_has_perm(p, PROCESS__SETPGID);
3575 }
3576
3577 static int selinux_task_getpgid(struct task_struct *p)
3578 {
3579 return current_has_perm(p, PROCESS__GETPGID);
3580 }
3581
3582 static int selinux_task_getsid(struct task_struct *p)
3583 {
3584 return current_has_perm(p, PROCESS__GETSESSION);
3585 }
3586
3587 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3588 {
3589 *secid = task_sid(p);
3590 }
3591
3592 static int selinux_task_setnice(struct task_struct *p, int nice)
3593 {
3594 int rc;
3595
3596 rc = cap_task_setnice(p, nice);
3597 if (rc)
3598 return rc;
3599
3600 return current_has_perm(p, PROCESS__SETSCHED);
3601 }
3602
3603 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3604 {
3605 int rc;
3606 rc = cap_task_setioprio(p, ioprio);
3607 if (rc)
3608 return rc;
3609
3610 return current_has_perm(p, PROCESS__SETSCHED);
3611 }
3612
3613 static int selinux_task_getioprio(struct task_struct *p)
3614 {
3615 return current_has_perm(p, PROCESS__GETSCHED);
3616 }
3617
3618 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3619 struct rlimit *new_rlim)
3620 {
3621 struct rlimit *old_rlim = p->signal->rlim + resource;
3622
3623 /* Control the ability to change the hard limit (whether
3624 lowering or raising it), so that the hard limit can
3625 later be used as a safe reset point for the soft limit
3626 upon context transitions. See selinux_bprm_committing_creds. */
3627 if (old_rlim->rlim_max != new_rlim->rlim_max)
3628 return current_has_perm(p, PROCESS__SETRLIMIT);
3629
3630 return 0;
3631 }
3632
3633 static int selinux_task_setscheduler(struct task_struct *p)
3634 {
3635 int rc;
3636
3637 rc = cap_task_setscheduler(p);
3638 if (rc)
3639 return rc;
3640
3641 return current_has_perm(p, PROCESS__SETSCHED);
3642 }
3643
3644 static int selinux_task_getscheduler(struct task_struct *p)
3645 {
3646 return current_has_perm(p, PROCESS__GETSCHED);
3647 }
3648
3649 static int selinux_task_movememory(struct task_struct *p)
3650 {
3651 return current_has_perm(p, PROCESS__SETSCHED);
3652 }
3653
3654 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3655 int sig, u32 secid)
3656 {
3657 u32 perm;
3658 int rc;
3659
3660 if (!sig)
3661 perm = PROCESS__SIGNULL; /* null signal; existence test */
3662 else
3663 perm = signal_to_av(sig);
3664 if (secid)
3665 rc = avc_has_perm(secid, task_sid(p),
3666 SECCLASS_PROCESS, perm, NULL);
3667 else
3668 rc = current_has_perm(p, perm);
3669 return rc;
3670 }
3671
3672 static int selinux_task_wait(struct task_struct *p)
3673 {
3674 return task_has_perm(p, current, PROCESS__SIGCHLD);
3675 }
3676
3677 static void selinux_task_to_inode(struct task_struct *p,
3678 struct inode *inode)
3679 {
3680 struct inode_security_struct *isec = inode->i_security;
3681 u32 sid = task_sid(p);
3682
3683 isec->sid = sid;
3684 isec->initialized = 1;
3685 }
3686
3687 /* Returns error only if unable to parse addresses */
3688 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3689 struct common_audit_data *ad, u8 *proto)
3690 {
3691 int offset, ihlen, ret = -EINVAL;
3692 struct iphdr _iph, *ih;
3693
3694 offset = skb_network_offset(skb);
3695 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3696 if (ih == NULL)
3697 goto out;
3698
3699 ihlen = ih->ihl * 4;
3700 if (ihlen < sizeof(_iph))
3701 goto out;
3702
3703 ad->u.net->v4info.saddr = ih->saddr;
3704 ad->u.net->v4info.daddr = ih->daddr;
3705 ret = 0;
3706
3707 if (proto)
3708 *proto = ih->protocol;
3709
3710 switch (ih->protocol) {
3711 case IPPROTO_TCP: {
3712 struct tcphdr _tcph, *th;
3713
3714 if (ntohs(ih->frag_off) & IP_OFFSET)
3715 break;
3716
3717 offset += ihlen;
3718 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3719 if (th == NULL)
3720 break;
3721
3722 ad->u.net->sport = th->source;
3723 ad->u.net->dport = th->dest;
3724 break;
3725 }
3726
3727 case IPPROTO_UDP: {
3728 struct udphdr _udph, *uh;
3729
3730 if (ntohs(ih->frag_off) & IP_OFFSET)
3731 break;
3732
3733 offset += ihlen;
3734 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3735 if (uh == NULL)
3736 break;
3737
3738 ad->u.net->sport = uh->source;
3739 ad->u.net->dport = uh->dest;
3740 break;
3741 }
3742
3743 case IPPROTO_DCCP: {
3744 struct dccp_hdr _dccph, *dh;
3745
3746 if (ntohs(ih->frag_off) & IP_OFFSET)
3747 break;
3748
3749 offset += ihlen;
3750 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3751 if (dh == NULL)
3752 break;
3753
3754 ad->u.net->sport = dh->dccph_sport;
3755 ad->u.net->dport = dh->dccph_dport;
3756 break;
3757 }
3758
3759 default:
3760 break;
3761 }
3762 out:
3763 return ret;
3764 }
3765
3766 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3767
3768 /* Returns error only if unable to parse addresses */
3769 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3770 struct common_audit_data *ad, u8 *proto)
3771 {
3772 u8 nexthdr;
3773 int ret = -EINVAL, offset;
3774 struct ipv6hdr _ipv6h, *ip6;
3775 __be16 frag_off;
3776
3777 offset = skb_network_offset(skb);
3778 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3779 if (ip6 == NULL)
3780 goto out;
3781
3782 ad->u.net->v6info.saddr = ip6->saddr;
3783 ad->u.net->v6info.daddr = ip6->daddr;
3784 ret = 0;
3785
3786 nexthdr = ip6->nexthdr;
3787 offset += sizeof(_ipv6h);
3788 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3789 if (offset < 0)
3790 goto out;
3791
3792 if (proto)
3793 *proto = nexthdr;
3794
3795 switch (nexthdr) {
3796 case IPPROTO_TCP: {
3797 struct tcphdr _tcph, *th;
3798
3799 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3800 if (th == NULL)
3801 break;
3802
3803 ad->u.net->sport = th->source;
3804 ad->u.net->dport = th->dest;
3805 break;
3806 }
3807
3808 case IPPROTO_UDP: {
3809 struct udphdr _udph, *uh;
3810
3811 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3812 if (uh == NULL)
3813 break;
3814
3815 ad->u.net->sport = uh->source;
3816 ad->u.net->dport = uh->dest;
3817 break;
3818 }
3819
3820 case IPPROTO_DCCP: {
3821 struct dccp_hdr _dccph, *dh;
3822
3823 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3824 if (dh == NULL)
3825 break;
3826
3827 ad->u.net->sport = dh->dccph_sport;
3828 ad->u.net->dport = dh->dccph_dport;
3829 break;
3830 }
3831
3832 /* includes fragments */
3833 default:
3834 break;
3835 }
3836 out:
3837 return ret;
3838 }
3839
3840 #endif /* IPV6 */
3841
3842 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3843 char **_addrp, int src, u8 *proto)
3844 {
3845 char *addrp;
3846 int ret;
3847
3848 switch (ad->u.net->family) {
3849 case PF_INET:
3850 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3851 if (ret)
3852 goto parse_error;
3853 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3854 &ad->u.net->v4info.daddr);
3855 goto okay;
3856
3857 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3858 case PF_INET6:
3859 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3860 if (ret)
3861 goto parse_error;
3862 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3863 &ad->u.net->v6info.daddr);
3864 goto okay;
3865 #endif /* IPV6 */
3866 default:
3867 addrp = NULL;
3868 goto okay;
3869 }
3870
3871 parse_error:
3872 printk(KERN_WARNING
3873 "SELinux: failure in selinux_parse_skb(),"
3874 " unable to parse packet\n");
3875 return ret;
3876
3877 okay:
3878 if (_addrp)
3879 *_addrp = addrp;
3880 return 0;
3881 }
3882
3883 /**
3884 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3885 * @skb: the packet
3886 * @family: protocol family
3887 * @sid: the packet's peer label SID
3888 *
3889 * Description:
3890 * Check the various different forms of network peer labeling and determine
3891 * the peer label/SID for the packet; most of the magic actually occurs in
3892 * the security server function security_net_peersid_cmp(). The function
3893 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3894 * or -EACCES if @sid is invalid due to inconsistencies with the different
3895 * peer labels.
3896 *
3897 */
3898 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3899 {
3900 int err;
3901 u32 xfrm_sid;
3902 u32 nlbl_sid;
3903 u32 nlbl_type;
3904
3905 selinux_xfrm_skb_sid(skb, &xfrm_sid);
3906 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3907
3908 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3909 if (unlikely(err)) {
3910 printk(KERN_WARNING
3911 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3912 " unable to determine packet's peer label\n");
3913 return -EACCES;
3914 }
3915
3916 return 0;
3917 }
3918
3919 /**
3920 * selinux_conn_sid - Determine the child socket label for a connection
3921 * @sk_sid: the parent socket's SID
3922 * @skb_sid: the packet's SID
3923 * @conn_sid: the resulting connection SID
3924 *
3925 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3926 * combined with the MLS information from @skb_sid in order to create
3927 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3928 * of @sk_sid. Returns zero on success, negative values on failure.
3929 *
3930 */
3931 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3932 {
3933 int err = 0;
3934
3935 if (skb_sid != SECSID_NULL)
3936 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3937 else
3938 *conn_sid = sk_sid;
3939
3940 return err;
3941 }
3942
3943 /* socket security operations */
3944
3945 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3946 u16 secclass, u32 *socksid)
3947 {
3948 if (tsec->sockcreate_sid > SECSID_NULL) {
3949 *socksid = tsec->sockcreate_sid;
3950 return 0;
3951 }
3952
3953 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3954 socksid);
3955 }
3956
3957 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3958 {
3959 struct sk_security_struct *sksec = sk->sk_security;
3960 struct common_audit_data ad;
3961 struct lsm_network_audit net = {0,};
3962 u32 tsid = task_sid(task);
3963
3964 if (unlikely(!sksec)){
3965 printk(KERN_CRIT "[SELinux] sksec is NULL, socket is already freed. \n");
3966 return -EINVAL;
3967 }
3968
3969 if (sksec->sid == SECINITSID_KERNEL)
3970 return 0;
3971
3972 ad.type = LSM_AUDIT_DATA_NET;
3973 ad.u.net = &net;
3974 ad.u.net->sk = sk;
3975
3976 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3977 }
3978
3979 static int selinux_socket_create(int family, int type,
3980 int protocol, int kern)
3981 {
3982 const struct task_security_struct *tsec = current_security();
3983 u32 newsid;
3984 u16 secclass;
3985 int rc;
3986
3987 if (kern)
3988 return 0;
3989
3990 secclass = socket_type_to_security_class(family, type, protocol);
3991 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3992 if (rc)
3993 return rc;
3994
3995 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3996 }
3997
3998 static int selinux_socket_post_create(struct socket *sock, int family,
3999 int type, int protocol, int kern)
4000 {
4001 const struct task_security_struct *tsec = current_security();
4002 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4003 struct sk_security_struct *sksec;
4004 int err = 0;
4005
4006 isec->sclass = socket_type_to_security_class(family, type, protocol);
4007
4008 if (kern)
4009 isec->sid = SECINITSID_KERNEL;
4010 else {
4011 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4012 if (err)
4013 return err;
4014 }
4015
4016 isec->initialized = 1;
4017
4018 if (sock->sk) {
4019 sksec = sock->sk->sk_security;
4020 sksec->sid = isec->sid;
4021 sksec->sclass = isec->sclass;
4022 err = selinux_netlbl_socket_post_create(sock->sk, family);
4023 }
4024
4025 return err;
4026 }
4027
4028 /* Range of port numbers used to automatically bind.
4029 Need to determine whether we should perform a name_bind
4030 permission check between the socket and the port number. */
4031
4032 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4033 {
4034 struct sock *sk = sock->sk;
4035 u16 family;
4036 int err;
4037
4038 err = sock_has_perm(current, sk, SOCKET__BIND);
4039 if (err)
4040 goto out;
4041
4042 /*
4043 * If PF_INET or PF_INET6, check name_bind permission for the port.
4044 * Multiple address binding for SCTP is not supported yet: we just
4045 * check the first address now.
4046 */
4047 family = sk->sk_family;
4048 if (family == PF_INET || family == PF_INET6) {
4049 char *addrp;
4050 struct sk_security_struct *sksec = sk->sk_security;
4051 struct common_audit_data ad;
4052 struct lsm_network_audit net = {0,};
4053 struct sockaddr_in *addr4 = NULL;
4054 struct sockaddr_in6 *addr6 = NULL;
4055 unsigned short snum;
4056 u32 sid, node_perm;
4057
4058 if (family == PF_INET) {
4059 addr4 = (struct sockaddr_in *)address;
4060 snum = ntohs(addr4->sin_port);
4061 addrp = (char *)&addr4->sin_addr.s_addr;
4062 } else {
4063 addr6 = (struct sockaddr_in6 *)address;
4064 snum = ntohs(addr6->sin6_port);
4065 addrp = (char *)&addr6->sin6_addr.s6_addr;
4066 }
4067
4068 if (snum) {
4069 int low, high;
4070
4071 inet_get_local_port_range(&low, &high);
4072
4073 if (snum < max(PROT_SOCK, low) || snum > high) {
4074 err = sel_netport_sid(sk->sk_protocol,
4075 snum, &sid);
4076 if (err)
4077 goto out;
4078 ad.type = LSM_AUDIT_DATA_NET;
4079 ad.u.net = &net;
4080 ad.u.net->sport = htons(snum);
4081 ad.u.net->family = family;
4082 err = avc_has_perm(sksec->sid, sid,
4083 sksec->sclass,
4084 SOCKET__NAME_BIND, &ad);
4085 if (err)
4086 goto out;
4087 }
4088 }
4089
4090 switch (sksec->sclass) {
4091 case SECCLASS_TCP_SOCKET:
4092 node_perm = TCP_SOCKET__NODE_BIND;
4093 break;
4094
4095 case SECCLASS_UDP_SOCKET:
4096 node_perm = UDP_SOCKET__NODE_BIND;
4097 break;
4098
4099 case SECCLASS_DCCP_SOCKET:
4100 node_perm = DCCP_SOCKET__NODE_BIND;
4101 break;
4102
4103 default:
4104 node_perm = RAWIP_SOCKET__NODE_BIND;
4105 break;
4106 }
4107
4108 err = sel_netnode_sid(addrp, family, &sid);
4109 if (err)
4110 goto out;
4111
4112 ad.type = LSM_AUDIT_DATA_NET;
4113 ad.u.net = &net;
4114 ad.u.net->sport = htons(snum);
4115 ad.u.net->family = family;
4116
4117 if (family == PF_INET)
4118 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4119 else
4120 ad.u.net->v6info.saddr = addr6->sin6_addr;
4121
4122 err = avc_has_perm(sksec->sid, sid,
4123 sksec->sclass, node_perm, &ad);
4124 if (err)
4125 goto out;
4126 }
4127 out:
4128 return err;
4129 }
4130
4131 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4132 {
4133 struct sock *sk = sock->sk;
4134 struct sk_security_struct *sksec = sk->sk_security;
4135 int err;
4136
4137 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4138 if (err)
4139 return err;
4140
4141 /*
4142 * If a TCP or DCCP socket, check name_connect permission for the port.
4143 */
4144 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4145 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4146 struct common_audit_data ad;
4147 struct lsm_network_audit net = {0,};
4148 struct sockaddr_in *addr4 = NULL;
4149 struct sockaddr_in6 *addr6 = NULL;
4150 unsigned short snum;
4151 u32 sid, perm;
4152
4153 if (sk->sk_family == PF_INET) {
4154 addr4 = (struct sockaddr_in *)address;
4155 if (addrlen < sizeof(struct sockaddr_in))
4156 return -EINVAL;
4157 snum = ntohs(addr4->sin_port);
4158 } else {
4159 addr6 = (struct sockaddr_in6 *)address;
4160 if (addrlen < SIN6_LEN_RFC2133)
4161 return -EINVAL;
4162 snum = ntohs(addr6->sin6_port);
4163 }
4164
4165 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4166 if (err)
4167 goto out;
4168
4169 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4170 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4171
4172 ad.type = LSM_AUDIT_DATA_NET;
4173 ad.u.net = &net;
4174 ad.u.net->dport = htons(snum);
4175 ad.u.net->family = sk->sk_family;
4176 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4177 if (err)
4178 goto out;
4179 }
4180
4181 err = selinux_netlbl_socket_connect(sk, address);
4182
4183 out:
4184 return err;
4185 }
4186
4187 static int selinux_socket_listen(struct socket *sock, int backlog)
4188 {
4189 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4190 }
4191
4192 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4193 {
4194 int err;
4195 struct inode_security_struct *isec;
4196 struct inode_security_struct *newisec;
4197
4198 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4199 if (err)
4200 return err;
4201
4202 newisec = SOCK_INODE(newsock)->i_security;
4203
4204 isec = SOCK_INODE(sock)->i_security;
4205 newisec->sclass = isec->sclass;
4206 newisec->sid = isec->sid;
4207 newisec->initialized = 1;
4208
4209 return 0;
4210 }
4211
4212 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4213 int size)
4214 {
4215 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4216 }
4217
4218 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4219 int size, int flags)
4220 {
4221 return sock_has_perm(current, sock->sk, SOCKET__READ);
4222 }
4223
4224 static int selinux_socket_getsockname(struct socket *sock)
4225 {
4226 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4227 }
4228
4229 static int selinux_socket_getpeername(struct socket *sock)
4230 {
4231 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4232 }
4233
4234 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4235 {
4236 int err;
4237
4238 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4239 if (err)
4240 return err;
4241
4242 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4243 }
4244
4245 static int selinux_socket_getsockopt(struct socket *sock, int level,
4246 int optname)
4247 {
4248 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4249 }
4250
4251 static int selinux_socket_shutdown(struct socket *sock, int how)
4252 {
4253 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4254 }
4255
4256 static int selinux_socket_unix_stream_connect(struct sock *sock,
4257 struct sock *other,
4258 struct sock *newsk)
4259 {
4260 struct sk_security_struct *sksec_sock = sock->sk_security;
4261 struct sk_security_struct *sksec_other = other->sk_security;
4262 struct sk_security_struct *sksec_new = newsk->sk_security;
4263 struct common_audit_data ad;
4264 struct lsm_network_audit net = {0,};
4265 int err;
4266
4267 ad.type = LSM_AUDIT_DATA_NET;
4268 ad.u.net = &net;
4269 ad.u.net->sk = other;
4270
4271 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4272 sksec_other->sclass,
4273 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4274 if (err)
4275 return err;
4276
4277 /* server child socket */
4278 sksec_new->peer_sid = sksec_sock->sid;
4279 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4280 &sksec_new->sid);
4281 if (err)
4282 return err;
4283
4284 /* connecting socket */
4285 sksec_sock->peer_sid = sksec_new->sid;
4286
4287 return 0;
4288 }
4289
4290 static int selinux_socket_unix_may_send(struct socket *sock,
4291 struct socket *other)
4292 {
4293 struct sk_security_struct *ssec = sock->sk->sk_security;
4294 struct sk_security_struct *osec = other->sk->sk_security;
4295 struct common_audit_data ad;
4296 struct lsm_network_audit net = {0,};
4297
4298 ad.type = LSM_AUDIT_DATA_NET;
4299 ad.u.net = &net;
4300 ad.u.net->sk = other->sk;
4301
4302 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4303 &ad);
4304 }
4305
4306 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4307 u32 peer_sid,
4308 struct common_audit_data *ad)
4309 {
4310 int err;
4311 u32 if_sid;
4312 u32 node_sid;
4313
4314 err = sel_netif_sid(ifindex, &if_sid);
4315 if (err)
4316 return err;
4317 err = avc_has_perm(peer_sid, if_sid,
4318 SECCLASS_NETIF, NETIF__INGRESS, ad);
4319 if (err)
4320 return err;
4321
4322 err = sel_netnode_sid(addrp, family, &node_sid);
4323 if (err)
4324 return err;
4325 return avc_has_perm(peer_sid, node_sid,
4326 SECCLASS_NODE, NODE__RECVFROM, ad);
4327 }
4328
4329 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4330 u16 family)
4331 {
4332 int err = 0;
4333 struct sk_security_struct *sksec = sk->sk_security;
4334 u32 sk_sid = sksec->sid;
4335 struct common_audit_data ad;
4336 struct lsm_network_audit net = {0,};
4337 char *addrp;
4338
4339 ad.type = LSM_AUDIT_DATA_NET;
4340 ad.u.net = &net;
4341 ad.u.net->netif = skb->skb_iif;
4342 ad.u.net->family = family;
4343 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4344 if (err)
4345 return err;
4346
4347 if (selinux_secmark_enabled()) {
4348 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4349 PACKET__RECV, &ad);
4350 if (err)
4351 return err;
4352 }
4353
4354 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4355 if (err)
4356 return err;
4357 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4358
4359 return err;
4360 }
4361
4362 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4363 {
4364 int err;
4365 struct sk_security_struct *sksec = sk->sk_security;
4366 u16 family = sk->sk_family;
4367 u32 sk_sid = sksec->sid;
4368 struct common_audit_data ad;
4369 struct lsm_network_audit net = {0,};
4370 char *addrp;
4371 u8 secmark_active;
4372 u8 peerlbl_active;
4373
4374 if (family != PF_INET && family != PF_INET6)
4375 return 0;
4376
4377 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4378 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4379 family = PF_INET;
4380
4381 /* If any sort of compatibility mode is enabled then handoff processing
4382 * to the selinux_sock_rcv_skb_compat() function to deal with the
4383 * special handling. We do this in an attempt to keep this function
4384 * as fast and as clean as possible. */
4385 if (!selinux_policycap_netpeer)
4386 return selinux_sock_rcv_skb_compat(sk, skb, family);
4387
4388 secmark_active = selinux_secmark_enabled();
4389 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4390 if (!secmark_active && !peerlbl_active)
4391 return 0;
4392
4393 ad.type = LSM_AUDIT_DATA_NET;
4394 ad.u.net = &net;
4395 ad.u.net->netif = skb->skb_iif;
4396 ad.u.net->family = family;
4397 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4398 if (err)
4399 return err;
4400
4401 if (peerlbl_active) {
4402 u32 peer_sid;
4403
4404 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4405 if (err)
4406 return err;
4407 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4408 peer_sid, &ad);
4409 if (err) {
4410 selinux_netlbl_err(skb, err, 0);
4411 return err;
4412 }
4413 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4414 PEER__RECV, &ad);
4415 if (err) {
4416 selinux_netlbl_err(skb, err, 0);
4417 return err;
4418 }
4419 }
4420
4421 if (secmark_active) {
4422 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4423 PACKET__RECV, &ad);
4424 if (err)
4425 return err;
4426 }
4427
4428 return err;
4429 }
4430
4431 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4432 int __user *optlen, unsigned len)
4433 {
4434 int err = 0;
4435 char *scontext;
4436 u32 scontext_len;
4437 struct sk_security_struct *sksec = sock->sk->sk_security;
4438 u32 peer_sid = SECSID_NULL;
4439
4440 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4441 sksec->sclass == SECCLASS_TCP_SOCKET)
4442 peer_sid = sksec->peer_sid;
4443 if (peer_sid == SECSID_NULL)
4444 return -ENOPROTOOPT;
4445
4446 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4447 if (err)
4448 return err;
4449
4450 if (scontext_len > len) {
4451 err = -ERANGE;
4452 goto out_len;
4453 }
4454
4455 if (copy_to_user(optval, scontext, scontext_len))
4456 err = -EFAULT;
4457
4458 out_len:
4459 if (put_user(scontext_len, optlen))
4460 err = -EFAULT;
4461 kfree(scontext);
4462 return err;
4463 }
4464
4465 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4466 {
4467 u32 peer_secid = SECSID_NULL;
4468 u16 family;
4469
4470 if (skb && skb->protocol == htons(ETH_P_IP))
4471 family = PF_INET;
4472 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4473 family = PF_INET6;
4474 else if (sock)
4475 family = sock->sk->sk_family;
4476 else
4477 goto out;
4478
4479 if (sock && family == PF_UNIX)
4480 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4481 else if (skb)
4482 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4483
4484 out:
4485 *secid = peer_secid;
4486 if (peer_secid == SECSID_NULL)
4487 return -EINVAL;
4488 return 0;
4489 }
4490
4491 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4492 {
4493 struct sk_security_struct *sksec;
4494
4495 sksec = kzalloc(sizeof(*sksec), priority);
4496 if (!sksec)
4497 return -ENOMEM;
4498
4499 sksec->peer_sid = SECINITSID_UNLABELED;
4500 sksec->sid = SECINITSID_UNLABELED;
4501 selinux_netlbl_sk_security_reset(sksec);
4502 sk->sk_security = sksec;
4503
4504 return 0;
4505 }
4506
4507 static void selinux_sk_free_security(struct sock *sk)
4508 {
4509 struct sk_security_struct *sksec = sk->sk_security;
4510
4511 sk->sk_security = NULL;
4512 selinux_netlbl_sk_security_free(sksec);
4513 kfree(sksec);
4514 }
4515
4516 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4517 {
4518 struct sk_security_struct *sksec = sk->sk_security;
4519 struct sk_security_struct *newsksec = newsk->sk_security;
4520
4521 newsksec->sid = sksec->sid;
4522 newsksec->peer_sid = sksec->peer_sid;
4523 newsksec->sclass = sksec->sclass;
4524
4525 selinux_netlbl_sk_security_reset(newsksec);
4526 }
4527
4528 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4529 {
4530 if (!sk)
4531 *secid = SECINITSID_ANY_SOCKET;
4532 else {
4533 struct sk_security_struct *sksec = sk->sk_security;
4534
4535 *secid = sksec->sid;
4536 }
4537 }
4538
4539 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4540 {
4541 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4542 struct sk_security_struct *sksec = sk->sk_security;
4543
4544 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4545 sk->sk_family == PF_UNIX)
4546 isec->sid = sksec->sid;
4547 sksec->sclass = isec->sclass;
4548 }
4549
4550 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4551 struct request_sock *req)
4552 {
4553 struct sk_security_struct *sksec = sk->sk_security;
4554 int err;
4555 u16 family = sk->sk_family;
4556 u32 connsid;
4557 u32 peersid;
4558
4559 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4560 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4561 family = PF_INET;
4562
4563 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4564 if (err)
4565 return err;
4566 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4567 if (err)
4568 return err;
4569 req->secid = connsid;
4570 req->peer_secid = peersid;
4571
4572 return selinux_netlbl_inet_conn_request(req, family);
4573 }
4574
4575 static void selinux_inet_csk_clone(struct sock *newsk,
4576 const struct request_sock *req)
4577 {
4578 struct sk_security_struct *newsksec = newsk->sk_security;
4579
4580 newsksec->sid = req->secid;
4581 newsksec->peer_sid = req->peer_secid;
4582 /* NOTE: Ideally, we should also get the isec->sid for the
4583 new socket in sync, but we don't have the isec available yet.
4584 So we will wait until sock_graft to do it, by which
4585 time it will have been created and available. */
4586
4587 /* We don't need to take any sort of lock here as we are the only
4588 * thread with access to newsksec */
4589 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4590 }
4591
4592 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4593 {
4594 u16 family = sk->sk_family;
4595 struct sk_security_struct *sksec = sk->sk_security;
4596
4597 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4598 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4599 family = PF_INET;
4600
4601 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4602 }
4603
4604 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4605 {
4606 skb_set_owner_w(skb, sk);
4607 }
4608
4609 static int selinux_secmark_relabel_packet(u32 sid)
4610 {
4611 const struct task_security_struct *__tsec;
4612 u32 tsid;
4613
4614 __tsec = current_security();
4615 tsid = __tsec->sid;
4616
4617 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4618 }
4619
4620 static void selinux_secmark_refcount_inc(void)
4621 {
4622 atomic_inc(&selinux_secmark_refcount);
4623 }
4624
4625 static void selinux_secmark_refcount_dec(void)
4626 {
4627 atomic_dec(&selinux_secmark_refcount);
4628 }
4629
4630 static void selinux_req_classify_flow(const struct request_sock *req,
4631 struct flowi *fl)
4632 {
4633 fl->flowi_secid = req->secid;
4634 }
4635
4636 static int selinux_tun_dev_alloc_security(void **security)
4637 {
4638 struct tun_security_struct *tunsec;
4639
4640 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4641 if (!tunsec)
4642 return -ENOMEM;
4643 tunsec->sid = current_sid();
4644
4645 *security = tunsec;
4646 return 0;
4647 }
4648
4649 static void selinux_tun_dev_free_security(void *security)
4650 {
4651 kfree(security);
4652 }
4653
4654 static int selinux_tun_dev_create(void)
4655 {
4656 u32 sid = current_sid();
4657
4658 /* we aren't taking into account the "sockcreate" SID since the socket
4659 * that is being created here is not a socket in the traditional sense,
4660 * instead it is a private sock, accessible only to the kernel, and
4661 * representing a wide range of network traffic spanning multiple
4662 * connections unlike traditional sockets - check the TUN driver to
4663 * get a better understanding of why this socket is special */
4664
4665 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4666 NULL);
4667 }
4668
4669 static int selinux_tun_dev_attach_queue(void *security)
4670 {
4671 struct tun_security_struct *tunsec = security;
4672
4673 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4674 TUN_SOCKET__ATTACH_QUEUE, NULL);
4675 }
4676
4677 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4678 {
4679 struct tun_security_struct *tunsec = security;
4680 struct sk_security_struct *sksec = sk->sk_security;
4681
4682 /* we don't currently perform any NetLabel based labeling here and it
4683 * isn't clear that we would want to do so anyway; while we could apply
4684 * labeling without the support of the TUN user the resulting labeled
4685 * traffic from the other end of the connection would almost certainly
4686 * cause confusion to the TUN user that had no idea network labeling
4687 * protocols were being used */
4688
4689 sksec->sid = tunsec->sid;
4690 sksec->sclass = SECCLASS_TUN_SOCKET;
4691
4692 return 0;
4693 }
4694
4695 static int selinux_tun_dev_open(void *security)
4696 {
4697 struct tun_security_struct *tunsec = security;
4698 u32 sid = current_sid();
4699 int err;
4700
4701 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4702 TUN_SOCKET__RELABELFROM, NULL);
4703 if (err)
4704 return err;
4705 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4706 TUN_SOCKET__RELABELTO, NULL);
4707 if (err)
4708 return err;
4709 tunsec->sid = sid;
4710
4711 return 0;
4712 }
4713
4714 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4715 {
4716 int err = 0;
4717 u32 perm;
4718 struct nlmsghdr *nlh;
4719 struct sk_security_struct *sksec = sk->sk_security;
4720
4721 if (skb->len < NLMSG_HDRLEN) {
4722 err = -EINVAL;
4723 goto out;
4724 }
4725 nlh = nlmsg_hdr(skb);
4726
4727 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4728 if (err) {
4729 if (err == -EINVAL) {
4730 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4731 "SELinux: unrecognized netlink message"
4732 " type=%hu for sclass=%hu\n",
4733 nlh->nlmsg_type, sksec->sclass);
4734 if (!selinux_enforcing || security_get_allow_unknown())
4735 err = 0;
4736 }
4737
4738 /* Ignore */
4739 if (err == -ENOENT)
4740 err = 0;
4741 goto out;
4742 }
4743
4744 err = sock_has_perm(current, sk, perm);
4745 out:
4746 return err;
4747 }
4748
4749 #ifdef CONFIG_NETFILTER
4750
4751 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4752 u16 family)
4753 {
4754 int err;
4755 char *addrp;
4756 u32 peer_sid;
4757 struct common_audit_data ad;
4758 struct lsm_network_audit net = {0,};
4759 u8 secmark_active;
4760 u8 netlbl_active;
4761 u8 peerlbl_active;
4762
4763 if (!selinux_policycap_netpeer)
4764 return NF_ACCEPT;
4765
4766 secmark_active = selinux_secmark_enabled();
4767 netlbl_active = netlbl_enabled();
4768 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4769 if (!secmark_active && !peerlbl_active)
4770 return NF_ACCEPT;
4771
4772 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4773 return NF_DROP;
4774
4775 ad.type = LSM_AUDIT_DATA_NET;
4776 ad.u.net = &net;
4777 ad.u.net->netif = ifindex;
4778 ad.u.net->family = family;
4779 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4780 return NF_DROP;
4781
4782 if (peerlbl_active) {
4783 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4784 peer_sid, &ad);
4785 if (err) {
4786 selinux_netlbl_err(skb, err, 1);
4787 return NF_DROP;
4788 }
4789 }
4790
4791 if (secmark_active)
4792 if (avc_has_perm(peer_sid, skb->secmark,
4793 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4794 return NF_DROP;
4795
4796 if (netlbl_active)
4797 /* we do this in the FORWARD path and not the POST_ROUTING
4798 * path because we want to make sure we apply the necessary
4799 * labeling before IPsec is applied so we can leverage AH
4800 * protection */
4801 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4802 return NF_DROP;
4803
4804 return NF_ACCEPT;
4805 }
4806
4807 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4808 struct sk_buff *skb,
4809 const struct net_device *in,
4810 const struct net_device *out,
4811 int (*okfn)(struct sk_buff *))
4812 {
4813 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4814 }
4815
4816 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4817 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4818 struct sk_buff *skb,
4819 const struct net_device *in,
4820 const struct net_device *out,
4821 int (*okfn)(struct sk_buff *))
4822 {
4823 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4824 }
4825 #endif /* IPV6 */
4826
4827 static unsigned int selinux_ip_output(struct sk_buff *skb,
4828 u16 family)
4829 {
4830 struct sock *sk;
4831 u32 sid;
4832
4833 if (!netlbl_enabled())
4834 return NF_ACCEPT;
4835
4836 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4837 * because we want to make sure we apply the necessary labeling
4838 * before IPsec is applied so we can leverage AH protection */
4839 sk = skb->sk;
4840 if (sk) {
4841 struct sk_security_struct *sksec;
4842
4843 if (sk->sk_state == TCP_LISTEN)
4844 /* if the socket is the listening state then this
4845 * packet is a SYN-ACK packet which means it needs to
4846 * be labeled based on the connection/request_sock and
4847 * not the parent socket. unfortunately, we can't
4848 * lookup the request_sock yet as it isn't queued on
4849 * the parent socket until after the SYN-ACK is sent.
4850 * the "solution" is to simply pass the packet as-is
4851 * as any IP option based labeling should be copied
4852 * from the initial connection request (in the IP
4853 * layer). it is far from ideal, but until we get a
4854 * security label in the packet itself this is the
4855 * best we can do. */
4856 return NF_ACCEPT;
4857
4858 /* standard practice, label using the parent socket */
4859 sksec = sk->sk_security;
4860 sid = sksec->sid;
4861 } else
4862 sid = SECINITSID_KERNEL;
4863 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4864 return NF_DROP;
4865
4866 return NF_ACCEPT;
4867 }
4868
4869 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4870 struct sk_buff *skb,
4871 const struct net_device *in,
4872 const struct net_device *out,
4873 int (*okfn)(struct sk_buff *))
4874 {
4875 return selinux_ip_output(skb, PF_INET);
4876 }
4877
4878 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4879 int ifindex,
4880 u16 family)
4881 {
4882 struct sock *sk = skb->sk;
4883 struct sk_security_struct *sksec;
4884 struct common_audit_data ad;
4885 struct lsm_network_audit net = {0,};
4886 char *addrp;
4887 u8 proto;
4888
4889 if (sk == NULL)
4890 return NF_ACCEPT;
4891 sksec = sk->sk_security;
4892
4893 ad.type = LSM_AUDIT_DATA_NET;
4894 ad.u.net = &net;
4895 ad.u.net->netif = ifindex;
4896 ad.u.net->family = family;
4897 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4898 return NF_DROP;
4899
4900 if (selinux_secmark_enabled())
4901 if (avc_has_perm(sksec->sid, skb->secmark,
4902 SECCLASS_PACKET, PACKET__SEND, &ad))
4903 return NF_DROP_ERR(-ECONNREFUSED);
4904
4905 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4906 return NF_DROP_ERR(-ECONNREFUSED);
4907
4908 return NF_ACCEPT;
4909 }
4910
4911 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4912 u16 family)
4913 {
4914 u32 secmark_perm;
4915 u32 peer_sid;
4916 struct sock *sk;
4917 struct common_audit_data ad;
4918 struct lsm_network_audit net = {0,};
4919 char *addrp;
4920 u8 secmark_active;
4921 u8 peerlbl_active;
4922
4923 /* If any sort of compatibility mode is enabled then handoff processing
4924 * to the selinux_ip_postroute_compat() function to deal with the
4925 * special handling. We do this in an attempt to keep this function
4926 * as fast and as clean as possible. */
4927 if (!selinux_policycap_netpeer)
4928 return selinux_ip_postroute_compat(skb, ifindex, family);
4929
4930 secmark_active = selinux_secmark_enabled();
4931 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4932 if (!secmark_active && !peerlbl_active)
4933 return NF_ACCEPT;
4934
4935 sk = skb->sk;
4936
4937 #ifdef CONFIG_XFRM
4938 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4939 * packet transformation so allow the packet to pass without any checks
4940 * since we'll have another chance to perform access control checks
4941 * when the packet is on it's final way out.
4942 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4943 * is NULL, in this case go ahead and apply access control.
4944 * is NULL, in this case go ahead and apply access control.
4945 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4946 * TCP listening state we cannot wait until the XFRM processing
4947 * is done as we will miss out on the SA label if we do;
4948 * unfortunately, this means more work, but it is only once per
4949 * connection. */
4950 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4951 !(sk != NULL && sk->sk_state == TCP_LISTEN))
4952 return NF_ACCEPT;
4953 #endif
4954
4955 if (sk == NULL) {
4956 /* Without an associated socket the packet is either coming
4957 * from the kernel or it is being forwarded; check the packet
4958 * to determine which and if the packet is being forwarded
4959 * query the packet directly to determine the security label. */
4960 if (skb->skb_iif) {
4961 secmark_perm = PACKET__FORWARD_OUT;
4962 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4963 return NF_DROP;
4964 } else {
4965 secmark_perm = PACKET__SEND;
4966 peer_sid = SECINITSID_KERNEL;
4967 }
4968 } else if (sk->sk_state == TCP_LISTEN) {
4969 /* Locally generated packet but the associated socket is in the
4970 * listening state which means this is a SYN-ACK packet. In
4971 * this particular case the correct security label is assigned
4972 * to the connection/request_sock but unfortunately we can't
4973 * query the request_sock as it isn't queued on the parent
4974 * socket until after the SYN-ACK packet is sent; the only
4975 * viable choice is to regenerate the label like we do in
4976 * selinux_inet_conn_request(). See also selinux_ip_output()
4977 * for similar problems. */
4978 u32 skb_sid;
4979 struct sk_security_struct *sksec = sk->sk_security;
4980 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4981 return NF_DROP;
4982 /* At this point, if the returned skb peerlbl is SECSID_NULL
4983 * and the packet has been through at least one XFRM
4984 * transformation then we must be dealing with the "final"
4985 * form of labeled IPsec packet; since we've already applied
4986 * all of our access controls on this packet we can safely
4987 * pass the packet. */
4988 if (skb_sid == SECSID_NULL) {
4989 switch (family) {
4990 case PF_INET:
4991 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4992 return NF_ACCEPT;
4993 break;
4994 case PF_INET6:
4995 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4996 return NF_ACCEPT;
4997 default:
4998 return NF_DROP_ERR(-ECONNREFUSED);
4999 }
5000 }
5001 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5002 return NF_DROP;
5003 secmark_perm = PACKET__SEND;
5004 } else {
5005 /* Locally generated packet, fetch the security label from the
5006 * associated socket. */
5007 struct sk_security_struct *sksec = sk->sk_security;
5008 peer_sid = sksec->sid;
5009 secmark_perm = PACKET__SEND;
5010 }
5011
5012 ad.type = LSM_AUDIT_DATA_NET;
5013 ad.u.net = &net;
5014 ad.u.net->netif = ifindex;
5015 ad.u.net->family = family;
5016 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5017 return NF_DROP;
5018
5019 if (secmark_active)
5020 if (avc_has_perm(peer_sid, skb->secmark,
5021 SECCLASS_PACKET, secmark_perm, &ad))
5022 return NF_DROP_ERR(-ECONNREFUSED);
5023
5024 if (peerlbl_active) {
5025 u32 if_sid;
5026 u32 node_sid;
5027
5028 if (sel_netif_sid(ifindex, &if_sid))
5029 return NF_DROP;
5030 if (avc_has_perm(peer_sid, if_sid,
5031 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5032 return NF_DROP_ERR(-ECONNREFUSED);
5033
5034 if (sel_netnode_sid(addrp, family, &node_sid))
5035 return NF_DROP;
5036 if (avc_has_perm(peer_sid, node_sid,
5037 SECCLASS_NODE, NODE__SENDTO, &ad))
5038 return NF_DROP_ERR(-ECONNREFUSED);
5039 }
5040
5041 return NF_ACCEPT;
5042 }
5043
5044 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
5045 struct sk_buff *skb,
5046 const struct net_device *in,
5047 const struct net_device *out,
5048 int (*okfn)(struct sk_buff *))
5049 {
5050 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
5051 }
5052
5053 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5054 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
5055 struct sk_buff *skb,
5056 const struct net_device *in,
5057 const struct net_device *out,
5058 int (*okfn)(struct sk_buff *))
5059 {
5060 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
5061 }
5062 #endif /* IPV6 */
5063
5064 #endif /* CONFIG_NETFILTER */
5065
5066 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5067 {
5068 int err;
5069
5070 err = cap_netlink_send(sk, skb);
5071 if (err)
5072 return err;
5073
5074 return selinux_nlmsg_perm(sk, skb);
5075 }
5076
5077 static int ipc_alloc_security(struct task_struct *task,
5078 struct kern_ipc_perm *perm,
5079 u16 sclass)
5080 {
5081 struct ipc_security_struct *isec;
5082 u32 sid;
5083
5084 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5085 if (!isec)
5086 return -ENOMEM;
5087
5088 sid = task_sid(task);
5089 isec->sclass = sclass;
5090 isec->sid = sid;
5091 perm->security = isec;
5092
5093 return 0;
5094 }
5095
5096 static void ipc_free_security(struct kern_ipc_perm *perm)
5097 {
5098 struct ipc_security_struct *isec = perm->security;
5099 perm->security = NULL;
5100 kfree(isec);
5101 }
5102
5103 static int msg_msg_alloc_security(struct msg_msg *msg)
5104 {
5105 struct msg_security_struct *msec;
5106
5107 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5108 if (!msec)
5109 return -ENOMEM;
5110
5111 msec->sid = SECINITSID_UNLABELED;
5112 msg->security = msec;
5113
5114 return 0;
5115 }
5116
5117 static void msg_msg_free_security(struct msg_msg *msg)
5118 {
5119 struct msg_security_struct *msec = msg->security;
5120
5121 msg->security = NULL;
5122 kfree(msec);
5123 }
5124
5125 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5126 u32 perms)
5127 {
5128 struct ipc_security_struct *isec;
5129 struct common_audit_data ad;
5130 u32 sid = current_sid();
5131
5132 isec = ipc_perms->security;
5133
5134 ad.type = LSM_AUDIT_DATA_IPC;
5135 ad.u.ipc_id = ipc_perms->key;
5136
5137 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5138 }
5139
5140 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5141 {
5142 return msg_msg_alloc_security(msg);
5143 }
5144
5145 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5146 {
5147 msg_msg_free_security(msg);
5148 }
5149
5150 /* message queue security operations */
5151 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5152 {
5153 struct ipc_security_struct *isec;
5154 struct common_audit_data ad;
5155 u32 sid = current_sid();
5156 int rc;
5157
5158 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5159 if (rc)
5160 return rc;
5161
5162 isec = msq->q_perm.security;
5163
5164 ad.type = LSM_AUDIT_DATA_IPC;
5165 ad.u.ipc_id = msq->q_perm.key;
5166
5167 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5168 MSGQ__CREATE, &ad);
5169 if (rc) {
5170 ipc_free_security(&msq->q_perm);
5171 return rc;
5172 }
5173 return 0;
5174 }
5175
5176 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5177 {
5178 ipc_free_security(&msq->q_perm);
5179 }
5180
5181 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5182 {
5183 struct ipc_security_struct *isec;
5184 struct common_audit_data ad;
5185 u32 sid = current_sid();
5186
5187 isec = msq->q_perm.security;
5188
5189 ad.type = LSM_AUDIT_DATA_IPC;
5190 ad.u.ipc_id = msq->q_perm.key;
5191
5192 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5193 MSGQ__ASSOCIATE, &ad);
5194 }
5195
5196 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5197 {
5198 int err;
5199 int perms;
5200
5201 switch (cmd) {
5202 case IPC_INFO:
5203 case MSG_INFO:
5204 /* No specific object, just general system-wide information. */
5205 return task_has_system(current, SYSTEM__IPC_INFO);
5206 case IPC_STAT:
5207 case MSG_STAT:
5208 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5209 break;
5210 case IPC_SET:
5211 perms = MSGQ__SETATTR;
5212 break;
5213 case IPC_RMID:
5214 perms = MSGQ__DESTROY;
5215 break;
5216 default:
5217 return 0;
5218 }
5219
5220 err = ipc_has_perm(&msq->q_perm, perms);
5221 return err;
5222 }
5223
5224 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5225 {
5226 struct ipc_security_struct *isec;
5227 struct msg_security_struct *msec;
5228 struct common_audit_data ad;
5229 u32 sid = current_sid();
5230 int rc;
5231
5232 isec = msq->q_perm.security;
5233 msec = msg->security;
5234
5235 /*
5236 * First time through, need to assign label to the message
5237 */
5238 if (msec->sid == SECINITSID_UNLABELED) {
5239 /*
5240 * Compute new sid based on current process and
5241 * message queue this message will be stored in
5242 */
5243 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5244 NULL, &msec->sid);
5245 if (rc)
5246 return rc;
5247 }
5248
5249 ad.type = LSM_AUDIT_DATA_IPC;
5250 ad.u.ipc_id = msq->q_perm.key;
5251
5252 /* Can this process write to the queue? */
5253 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5254 MSGQ__WRITE, &ad);
5255 if (!rc)
5256 /* Can this process send the message */
5257 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5258 MSG__SEND, &ad);
5259 if (!rc)
5260 /* Can the message be put in the queue? */
5261 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5262 MSGQ__ENQUEUE, &ad);
5263
5264 return rc;
5265 }
5266
5267 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5268 struct task_struct *target,
5269 long type, int mode)
5270 {
5271 struct ipc_security_struct *isec;
5272 struct msg_security_struct *msec;
5273 struct common_audit_data ad;
5274 u32 sid = task_sid(target);
5275 int rc;
5276
5277 isec = msq->q_perm.security;
5278 msec = msg->security;
5279
5280 ad.type = LSM_AUDIT_DATA_IPC;
5281 ad.u.ipc_id = msq->q_perm.key;
5282
5283 rc = avc_has_perm(sid, isec->sid,
5284 SECCLASS_MSGQ, MSGQ__READ, &ad);
5285 if (!rc)
5286 rc = avc_has_perm(sid, msec->sid,
5287 SECCLASS_MSG, MSG__RECEIVE, &ad);
5288 return rc;
5289 }
5290
5291 /* Shared Memory security operations */
5292 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5293 {
5294 struct ipc_security_struct *isec;
5295 struct common_audit_data ad;
5296 u32 sid = current_sid();
5297 int rc;
5298
5299 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5300 if (rc)
5301 return rc;
5302
5303 isec = shp->shm_perm.security;
5304
5305 ad.type = LSM_AUDIT_DATA_IPC;
5306 ad.u.ipc_id = shp->shm_perm.key;
5307
5308 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5309 SHM__CREATE, &ad);
5310 if (rc) {
5311 ipc_free_security(&shp->shm_perm);
5312 return rc;
5313 }
5314 return 0;
5315 }
5316
5317 static void selinux_shm_free_security(struct shmid_kernel *shp)
5318 {
5319 ipc_free_security(&shp->shm_perm);
5320 }
5321
5322 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5323 {
5324 struct ipc_security_struct *isec;
5325 struct common_audit_data ad;
5326 u32 sid = current_sid();
5327
5328 isec = shp->shm_perm.security;
5329
5330 ad.type = LSM_AUDIT_DATA_IPC;
5331 ad.u.ipc_id = shp->shm_perm.key;
5332
5333 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5334 SHM__ASSOCIATE, &ad);
5335 }
5336
5337 /* Note, at this point, shp is locked down */
5338 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5339 {
5340 int perms;
5341 int err;
5342
5343 switch (cmd) {
5344 case IPC_INFO:
5345 case SHM_INFO:
5346 /* No specific object, just general system-wide information. */
5347 return task_has_system(current, SYSTEM__IPC_INFO);
5348 case IPC_STAT:
5349 case SHM_STAT:
5350 perms = SHM__GETATTR | SHM__ASSOCIATE;
5351 break;
5352 case IPC_SET:
5353 perms = SHM__SETATTR;
5354 break;
5355 case SHM_LOCK:
5356 case SHM_UNLOCK:
5357 perms = SHM__LOCK;
5358 break;
5359 case IPC_RMID:
5360 perms = SHM__DESTROY;
5361 break;
5362 default:
5363 return 0;
5364 }
5365
5366 err = ipc_has_perm(&shp->shm_perm, perms);
5367 return err;
5368 }
5369
5370 static int selinux_shm_shmat(struct shmid_kernel *shp,
5371 char __user *shmaddr, int shmflg)
5372 {
5373 u32 perms;
5374
5375 if (shmflg & SHM_RDONLY)
5376 perms = SHM__READ;
5377 else
5378 perms = SHM__READ | SHM__WRITE;
5379
5380 return ipc_has_perm(&shp->shm_perm, perms);
5381 }
5382
5383 /* Semaphore security operations */
5384 static int selinux_sem_alloc_security(struct sem_array *sma)
5385 {
5386 struct ipc_security_struct *isec;
5387 struct common_audit_data ad;
5388 u32 sid = current_sid();
5389 int rc;
5390
5391 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5392 if (rc)
5393 return rc;
5394
5395 isec = sma->sem_perm.security;
5396
5397 ad.type = LSM_AUDIT_DATA_IPC;
5398 ad.u.ipc_id = sma->sem_perm.key;
5399
5400 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5401 SEM__CREATE, &ad);
5402 if (rc) {
5403 ipc_free_security(&sma->sem_perm);
5404 return rc;
5405 }
5406 return 0;
5407 }
5408
5409 static void selinux_sem_free_security(struct sem_array *sma)
5410 {
5411 ipc_free_security(&sma->sem_perm);
5412 }
5413
5414 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5415 {
5416 struct ipc_security_struct *isec;
5417 struct common_audit_data ad;
5418 u32 sid = current_sid();
5419
5420 isec = sma->sem_perm.security;
5421
5422 ad.type = LSM_AUDIT_DATA_IPC;
5423 ad.u.ipc_id = sma->sem_perm.key;
5424
5425 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5426 SEM__ASSOCIATE, &ad);
5427 }
5428
5429 /* Note, at this point, sma is locked down */
5430 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5431 {
5432 int err;
5433 u32 perms;
5434
5435 switch (cmd) {
5436 case IPC_INFO:
5437 case SEM_INFO:
5438 /* No specific object, just general system-wide information. */
5439 return task_has_system(current, SYSTEM__IPC_INFO);
5440 case GETPID:
5441 case GETNCNT:
5442 case GETZCNT:
5443 perms = SEM__GETATTR;
5444 break;
5445 case GETVAL:
5446 case GETALL:
5447 perms = SEM__READ;
5448 break;
5449 case SETVAL:
5450 case SETALL:
5451 perms = SEM__WRITE;
5452 break;
5453 case IPC_RMID:
5454 perms = SEM__DESTROY;
5455 break;
5456 case IPC_SET:
5457 perms = SEM__SETATTR;
5458 break;
5459 case IPC_STAT:
5460 case SEM_STAT:
5461 perms = SEM__GETATTR | SEM__ASSOCIATE;
5462 break;
5463 default:
5464 return 0;
5465 }
5466
5467 err = ipc_has_perm(&sma->sem_perm, perms);
5468 return err;
5469 }
5470
5471 static int selinux_sem_semop(struct sem_array *sma,
5472 struct sembuf *sops, unsigned nsops, int alter)
5473 {
5474 u32 perms;
5475
5476 if (alter)
5477 perms = SEM__READ | SEM__WRITE;
5478 else
5479 perms = SEM__READ;
5480
5481 return ipc_has_perm(&sma->sem_perm, perms);
5482 }
5483
5484 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5485 {
5486 u32 av = 0;
5487
5488 av = 0;
5489 if (flag & S_IRUGO)
5490 av |= IPC__UNIX_READ;
5491 if (flag & S_IWUGO)
5492 av |= IPC__UNIX_WRITE;
5493
5494 if (av == 0)
5495 return 0;
5496
5497 return ipc_has_perm(ipcp, av);
5498 }
5499
5500 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5501 {
5502 struct ipc_security_struct *isec = ipcp->security;
5503 *secid = isec->sid;
5504 }
5505
5506 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5507 {
5508 if (inode)
5509 inode_doinit_with_dentry(inode, dentry);
5510 }
5511
5512 static int selinux_getprocattr(struct task_struct *p,
5513 char *name, char **value)
5514 {
5515 const struct task_security_struct *__tsec;
5516 u32 sid;
5517 int error;
5518 unsigned len;
5519
5520 if (current != p) {
5521 error = current_has_perm(p, PROCESS__GETATTR);
5522 if (error)
5523 return error;
5524 }
5525
5526 rcu_read_lock();
5527 __tsec = __task_cred(p)->security;
5528
5529 if (!strcmp(name, "current"))
5530 sid = __tsec->sid;
5531 else if (!strcmp(name, "prev"))
5532 sid = __tsec->osid;
5533 else if (!strcmp(name, "exec"))
5534 sid = __tsec->exec_sid;
5535 else if (!strcmp(name, "fscreate"))
5536 sid = __tsec->create_sid;
5537 else if (!strcmp(name, "keycreate"))
5538 sid = __tsec->keycreate_sid;
5539 else if (!strcmp(name, "sockcreate"))
5540 sid = __tsec->sockcreate_sid;
5541 else
5542 goto invalid;
5543 rcu_read_unlock();
5544
5545 if (!sid)
5546 return 0;
5547
5548 error = security_sid_to_context(sid, value, &len);
5549 if (error)
5550 return error;
5551 return len;
5552
5553 invalid:
5554 rcu_read_unlock();
5555 return -EINVAL;
5556 }
5557
5558 static int selinux_setprocattr(struct task_struct *p,
5559 char *name, void *value, size_t size)
5560 {
5561 struct task_security_struct *tsec;
5562 struct task_struct *tracer;
5563 struct cred *new;
5564 u32 sid = 0, ptsid;
5565 int error;
5566 char *str = value;
5567
5568 if (current != p) {
5569 /* SELinux only allows a process to change its own
5570 security attributes. */
5571 return -EACCES;
5572 }
5573
5574 /*
5575 * Basic control over ability to set these attributes at all.
5576 * current == p, but we'll pass them separately in case the
5577 * above restriction is ever removed.
5578 */
5579 if (!strcmp(name, "exec"))
5580 error = current_has_perm(p, PROCESS__SETEXEC);
5581 else if (!strcmp(name, "fscreate"))
5582 error = current_has_perm(p, PROCESS__SETFSCREATE);
5583 else if (!strcmp(name, "keycreate"))
5584 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5585 else if (!strcmp(name, "sockcreate"))
5586 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5587 else if (!strcmp(name, "current"))
5588 error = current_has_perm(p, PROCESS__SETCURRENT);
5589 else
5590 error = -EINVAL;
5591 if (error)
5592 return error;
5593
5594 /* Obtain a SID for the context, if one was specified. */
5595 if (size && str[0] && str[0] != '\n') {
5596 if (str[size-1] == '\n') {
5597 str[size-1] = 0;
5598 size--;
5599 }
5600 error = security_context_to_sid(value, size, &sid);
5601 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5602 if (!capable(CAP_MAC_ADMIN)) {
5603 struct audit_buffer *ab;
5604 size_t audit_size;
5605
5606 /* We strip a nul only if it is at the end, otherwise the
5607 * context contains a nul and we should audit that */
5608 if (str[size - 1] == '\0')
5609 audit_size = size - 1;
5610 else
5611 audit_size = size;
5612 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5613 audit_log_format(ab, "op=fscreate invalid_context=");
5614 audit_log_n_untrustedstring(ab, value, audit_size);
5615 audit_log_end(ab);
5616
5617 return error;
5618 }
5619 error = security_context_to_sid_force(value, size,
5620 &sid);
5621 }
5622 if (error)
5623 return error;
5624 }
5625
5626 new = prepare_creds();
5627 if (!new)
5628 return -ENOMEM;
5629
5630 /* Permission checking based on the specified context is
5631 performed during the actual operation (execve,
5632 open/mkdir/...), when we know the full context of the
5633 operation. See selinux_bprm_set_creds for the execve
5634 checks and may_create for the file creation checks. The
5635 operation will then fail if the context is not permitted. */
5636 tsec = new->security;
5637 if (!strcmp(name, "exec")) {
5638 tsec->exec_sid = sid;
5639 } else if (!strcmp(name, "fscreate")) {
5640 tsec->create_sid = sid;
5641 } else if (!strcmp(name, "keycreate")) {
5642 error = may_create_key(sid, p);
5643 if (error)
5644 goto abort_change;
5645 tsec->keycreate_sid = sid;
5646 } else if (!strcmp(name, "sockcreate")) {
5647 tsec->sockcreate_sid = sid;
5648 } else if (!strcmp(name, "current")) {
5649 error = -EINVAL;
5650 if (sid == 0)
5651 goto abort_change;
5652
5653 /* Only allow single threaded processes to change context */
5654 error = -EPERM;
5655 if (!current_is_single_threaded()) {
5656 error = security_bounded_transition(tsec->sid, sid);
5657 if (error)
5658 goto abort_change;
5659 }
5660
5661 /* Check permissions for the transition. */
5662 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5663 PROCESS__DYNTRANSITION, NULL);
5664 if (error)
5665 goto abort_change;
5666
5667 /* Check for ptracing, and update the task SID if ok.
5668 Otherwise, leave SID unchanged and fail. */
5669 ptsid = 0;
5670 rcu_read_lock();
5671 tracer = ptrace_parent(p);
5672 if (tracer)
5673 ptsid = task_sid(tracer);
5674 rcu_read_unlock();
5675
5676 if (tracer) {
5677 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5678 PROCESS__PTRACE, NULL);
5679 if (error)
5680 goto abort_change;
5681 }
5682
5683 tsec->sid = sid;
5684 } else {
5685 error = -EINVAL;
5686 goto abort_change;
5687 }
5688
5689 commit_creds(new);
5690 return size;
5691
5692 abort_change:
5693 abort_creds(new);
5694 return error;
5695 }
5696
5697 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5698 {
5699 return security_sid_to_context(secid, secdata, seclen);
5700 }
5701
5702 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5703 {
5704 return security_context_to_sid(secdata, seclen, secid);
5705 }
5706
5707 static void selinux_release_secctx(char *secdata, u32 seclen)
5708 {
5709 kfree(secdata);
5710 }
5711
5712 /*
5713 * called with inode->i_mutex locked
5714 */
5715 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5716 {
5717 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5718 }
5719
5720 /*
5721 * called with inode->i_mutex locked
5722 */
5723 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5724 {
5725 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5726 }
5727
5728 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5729 {
5730 int len = 0;
5731
5732 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5733 ctx, true);
5734 if (len < 0)
5735 return len;
5736 *ctxlen = len;
5737 return 0;
5738 }
5739 #ifdef CONFIG_KEYS
5740
5741 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5742 unsigned long flags)
5743 {
5744 const struct task_security_struct *tsec;
5745 struct key_security_struct *ksec;
5746
5747 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5748 if (!ksec)
5749 return -ENOMEM;
5750
5751 tsec = cred->security;
5752 if (tsec->keycreate_sid)
5753 ksec->sid = tsec->keycreate_sid;
5754 else
5755 ksec->sid = tsec->sid;
5756
5757 k->security = ksec;
5758 return 0;
5759 }
5760
5761 static void selinux_key_free(struct key *k)
5762 {
5763 struct key_security_struct *ksec = k->security;
5764
5765 k->security = NULL;
5766 kfree(ksec);
5767 }
5768
5769 static int selinux_key_permission(key_ref_t key_ref,
5770 const struct cred *cred,
5771 key_perm_t perm)
5772 {
5773 struct key *key;
5774 struct key_security_struct *ksec;
5775 u32 sid;
5776
5777 /* if no specific permissions are requested, we skip the
5778 permission check. No serious, additional covert channels
5779 appear to be created. */
5780 if (perm == 0)
5781 return 0;
5782
5783 sid = cred_sid(cred);
5784
5785 key = key_ref_to_ptr(key_ref);
5786 ksec = key->security;
5787
5788 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5789 }
5790
5791 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5792 {
5793 struct key_security_struct *ksec = key->security;
5794 char *context = NULL;
5795 unsigned len;
5796 int rc;
5797
5798 rc = security_sid_to_context(ksec->sid, &context, &len);
5799 if (!rc)
5800 rc = len;
5801 *_buffer = context;
5802 return rc;
5803 }
5804
5805 #endif
5806
5807 static struct security_operations selinux_ops = {
5808 .name = "selinux",
5809
5810 .binder_set_context_mgr = selinux_binder_set_context_mgr,
5811 .binder_transaction = selinux_binder_transaction,
5812 .binder_transfer_binder = selinux_binder_transfer_binder,
5813 .binder_transfer_file = selinux_binder_transfer_file,
5814
5815 .ptrace_access_check = selinux_ptrace_access_check,
5816 .ptrace_traceme = selinux_ptrace_traceme,
5817 .capget = selinux_capget,
5818 .capset = selinux_capset,
5819 .capable = selinux_capable,
5820 .quotactl = selinux_quotactl,
5821 .quota_on = selinux_quota_on,
5822 .syslog = selinux_syslog,
5823 .vm_enough_memory = selinux_vm_enough_memory,
5824
5825 .netlink_send = selinux_netlink_send,
5826
5827 .bprm_set_creds = selinux_bprm_set_creds,
5828 .bprm_committing_creds = selinux_bprm_committing_creds,
5829 .bprm_committed_creds = selinux_bprm_committed_creds,
5830 .bprm_secureexec = selinux_bprm_secureexec,
5831
5832 .sb_alloc_security = selinux_sb_alloc_security,
5833 .sb_free_security = selinux_sb_free_security,
5834 .sb_copy_data = selinux_sb_copy_data,
5835 .sb_remount = selinux_sb_remount,
5836 .sb_kern_mount = selinux_sb_kern_mount,
5837 .sb_show_options = selinux_sb_show_options,
5838 .sb_statfs = selinux_sb_statfs,
5839 .sb_mount = selinux_mount,
5840 .sb_umount = selinux_umount,
5841 .sb_set_mnt_opts = selinux_set_mnt_opts,
5842 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5843 .sb_parse_opts_str = selinux_parse_opts_str,
5844
5845
5846 .inode_alloc_security = selinux_inode_alloc_security,
5847 .inode_free_security = selinux_inode_free_security,
5848 .inode_init_security = selinux_inode_init_security,
5849 .inode_create = selinux_inode_create,
5850 .inode_link = selinux_inode_link,
5851 .inode_unlink = selinux_inode_unlink,
5852 .inode_symlink = selinux_inode_symlink,
5853 .inode_mkdir = selinux_inode_mkdir,
5854 .inode_rmdir = selinux_inode_rmdir,
5855 .inode_mknod = selinux_inode_mknod,
5856 .inode_rename = selinux_inode_rename,
5857 .inode_readlink = selinux_inode_readlink,
5858 .inode_follow_link = selinux_inode_follow_link,
5859 .inode_permission = selinux_inode_permission,
5860 .inode_setattr = selinux_inode_setattr,
5861 .inode_getattr = selinux_inode_getattr,
5862 .inode_setxattr = selinux_inode_setxattr,
5863 .inode_post_setxattr = selinux_inode_post_setxattr,
5864 .inode_getxattr = selinux_inode_getxattr,
5865 .inode_listxattr = selinux_inode_listxattr,
5866 .inode_removexattr = selinux_inode_removexattr,
5867 .inode_getsecurity = selinux_inode_getsecurity,
5868 .inode_setsecurity = selinux_inode_setsecurity,
5869 .inode_listsecurity = selinux_inode_listsecurity,
5870 .inode_getsecid = selinux_inode_getsecid,
5871
5872 .file_permission = selinux_file_permission,
5873 .file_alloc_security = selinux_file_alloc_security,
5874 .file_free_security = selinux_file_free_security,
5875 .file_ioctl = selinux_file_ioctl,
5876 .mmap_file = selinux_mmap_file,
5877 .mmap_addr = selinux_mmap_addr,
5878 .file_mprotect = selinux_file_mprotect,
5879 .file_lock = selinux_file_lock,
5880 .file_fcntl = selinux_file_fcntl,
5881 .file_set_fowner = selinux_file_set_fowner,
5882 .file_send_sigiotask = selinux_file_send_sigiotask,
5883 .file_receive = selinux_file_receive,
5884
5885 .file_open = selinux_file_open,
5886
5887 .task_create = selinux_task_create,
5888 .cred_alloc_blank = selinux_cred_alloc_blank,
5889 .cred_free = selinux_cred_free,
5890 .cred_prepare = selinux_cred_prepare,
5891 .cred_transfer = selinux_cred_transfer,
5892 .kernel_act_as = selinux_kernel_act_as,
5893 .kernel_create_files_as = selinux_kernel_create_files_as,
5894 .kernel_module_request = selinux_kernel_module_request,
5895 .task_setpgid = selinux_task_setpgid,
5896 .task_getpgid = selinux_task_getpgid,
5897 .task_getsid = selinux_task_getsid,
5898 .task_getsecid = selinux_task_getsecid,
5899 .task_setnice = selinux_task_setnice,
5900 .task_setioprio = selinux_task_setioprio,
5901 .task_getioprio = selinux_task_getioprio,
5902 .task_setrlimit = selinux_task_setrlimit,
5903 .task_setscheduler = selinux_task_setscheduler,
5904 .task_getscheduler = selinux_task_getscheduler,
5905 .task_movememory = selinux_task_movememory,
5906 .task_kill = selinux_task_kill,
5907 .task_wait = selinux_task_wait,
5908 .task_to_inode = selinux_task_to_inode,
5909
5910 .ipc_permission = selinux_ipc_permission,
5911 .ipc_getsecid = selinux_ipc_getsecid,
5912
5913 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5914 .msg_msg_free_security = selinux_msg_msg_free_security,
5915
5916 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5917 .msg_queue_free_security = selinux_msg_queue_free_security,
5918 .msg_queue_associate = selinux_msg_queue_associate,
5919 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5920 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5921 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5922
5923 .shm_alloc_security = selinux_shm_alloc_security,
5924 .shm_free_security = selinux_shm_free_security,
5925 .shm_associate = selinux_shm_associate,
5926 .shm_shmctl = selinux_shm_shmctl,
5927 .shm_shmat = selinux_shm_shmat,
5928
5929 .sem_alloc_security = selinux_sem_alloc_security,
5930 .sem_free_security = selinux_sem_free_security,
5931 .sem_associate = selinux_sem_associate,
5932 .sem_semctl = selinux_sem_semctl,
5933 .sem_semop = selinux_sem_semop,
5934
5935 .d_instantiate = selinux_d_instantiate,
5936
5937 .getprocattr = selinux_getprocattr,
5938 .setprocattr = selinux_setprocattr,
5939
5940 .secid_to_secctx = selinux_secid_to_secctx,
5941 .secctx_to_secid = selinux_secctx_to_secid,
5942 .release_secctx = selinux_release_secctx,
5943 .inode_notifysecctx = selinux_inode_notifysecctx,
5944 .inode_setsecctx = selinux_inode_setsecctx,
5945 .inode_getsecctx = selinux_inode_getsecctx,
5946
5947 .unix_stream_connect = selinux_socket_unix_stream_connect,
5948 .unix_may_send = selinux_socket_unix_may_send,
5949
5950 .socket_create = selinux_socket_create,
5951 .socket_post_create = selinux_socket_post_create,
5952 .socket_bind = selinux_socket_bind,
5953 .socket_connect = selinux_socket_connect,
5954 .socket_listen = selinux_socket_listen,
5955 .socket_accept = selinux_socket_accept,
5956 .socket_sendmsg = selinux_socket_sendmsg,
5957 .socket_recvmsg = selinux_socket_recvmsg,
5958 .socket_getsockname = selinux_socket_getsockname,
5959 .socket_getpeername = selinux_socket_getpeername,
5960 .socket_getsockopt = selinux_socket_getsockopt,
5961 .socket_setsockopt = selinux_socket_setsockopt,
5962 .socket_shutdown = selinux_socket_shutdown,
5963 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5964 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5965 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5966 .sk_alloc_security = selinux_sk_alloc_security,
5967 .sk_free_security = selinux_sk_free_security,
5968 .sk_clone_security = selinux_sk_clone_security,
5969 .sk_getsecid = selinux_sk_getsecid,
5970 .sock_graft = selinux_sock_graft,
5971 .inet_conn_request = selinux_inet_conn_request,
5972 .inet_csk_clone = selinux_inet_csk_clone,
5973 .inet_conn_established = selinux_inet_conn_established,
5974 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5975 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5976 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5977 .req_classify_flow = selinux_req_classify_flow,
5978 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5979 .tun_dev_free_security = selinux_tun_dev_free_security,
5980 .tun_dev_create = selinux_tun_dev_create,
5981 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5982 .tun_dev_attach = selinux_tun_dev_attach,
5983 .tun_dev_open = selinux_tun_dev_open,
5984 .skb_owned_by = selinux_skb_owned_by,
5985
5986 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5987 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5988 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5989 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5990 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5991 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5992 .xfrm_state_free_security = selinux_xfrm_state_free,
5993 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5994 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5995 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5996 .xfrm_decode_session = selinux_xfrm_decode_session,
5997 #endif
5998
5999 #ifdef CONFIG_KEYS
6000 .key_alloc = selinux_key_alloc,
6001 .key_free = selinux_key_free,
6002 .key_permission = selinux_key_permission,
6003 .key_getsecurity = selinux_key_getsecurity,
6004 #endif
6005
6006 #ifdef CONFIG_AUDIT
6007 .audit_rule_init = selinux_audit_rule_init,
6008 .audit_rule_known = selinux_audit_rule_known,
6009 .audit_rule_match = selinux_audit_rule_match,
6010 .audit_rule_free = selinux_audit_rule_free,
6011 #endif
6012 };
6013
6014 static __init int selinux_init(void)
6015 {
6016 if (!security_module_enable(&selinux_ops)) {
6017 selinux_enabled = 0;
6018 return 0;
6019 }
6020
6021 if (!selinux_enabled) {
6022 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6023 return 0;
6024 }
6025
6026 printk(KERN_INFO "SELinux: Initializing.\n");
6027
6028 /* Set the security state for the initial task. */
6029 cred_init_security();
6030
6031 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6032
6033 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6034 sizeof(struct inode_security_struct),
6035 0, SLAB_PANIC, NULL);
6036 avc_init();
6037
6038 if (register_security(&selinux_ops))
6039 panic("SELinux: Unable to register with kernel.\n");
6040
6041 if (selinux_enforcing)
6042 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6043 else
6044 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6045
6046 return 0;
6047 }
6048
6049 static void delayed_superblock_init(struct super_block *sb, void *unused)
6050 {
6051 superblock_doinit(sb, NULL);
6052 }
6053
6054 void selinux_complete_init(void)
6055 {
6056 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6057
6058 /* Set up any superblocks initialized prior to the policy load. */
6059 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6060 iterate_supers(delayed_superblock_init, NULL);
6061 }
6062
6063 /* SELinux requires early initialization in order to label
6064 all processes and objects when they are created. */
6065 security_initcall(selinux_init);
6066
6067 #if defined(CONFIG_NETFILTER)
6068
6069 static struct nf_hook_ops selinux_ipv4_ops[] = {
6070 {
6071 .hook = selinux_ipv4_postroute,
6072 .owner = THIS_MODULE,
6073 .pf = NFPROTO_IPV4,
6074 .hooknum = NF_INET_POST_ROUTING,
6075 .priority = NF_IP_PRI_SELINUX_LAST,
6076 },
6077 {
6078 .hook = selinux_ipv4_forward,
6079 .owner = THIS_MODULE,
6080 .pf = NFPROTO_IPV4,
6081 .hooknum = NF_INET_FORWARD,
6082 .priority = NF_IP_PRI_SELINUX_FIRST,
6083 },
6084 {
6085 .hook = selinux_ipv4_output,
6086 .owner = THIS_MODULE,
6087 .pf = NFPROTO_IPV4,
6088 .hooknum = NF_INET_LOCAL_OUT,
6089 .priority = NF_IP_PRI_SELINUX_FIRST,
6090 }
6091 };
6092
6093 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6094
6095 static struct nf_hook_ops selinux_ipv6_ops[] = {
6096 {
6097 .hook = selinux_ipv6_postroute,
6098 .owner = THIS_MODULE,
6099 .pf = NFPROTO_IPV6,
6100 .hooknum = NF_INET_POST_ROUTING,
6101 .priority = NF_IP6_PRI_SELINUX_LAST,
6102 },
6103 {
6104 .hook = selinux_ipv6_forward,
6105 .owner = THIS_MODULE,
6106 .pf = NFPROTO_IPV6,
6107 .hooknum = NF_INET_FORWARD,
6108 .priority = NF_IP6_PRI_SELINUX_FIRST,
6109 }
6110 };
6111
6112 #endif /* IPV6 */
6113
6114 static int __init selinux_nf_ip_init(void)
6115 {
6116 int err = 0;
6117 if (!selinux_enabled)
6118 goto out;
6119
6120 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6121
6122 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6123 if (err)
6124 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6125
6126 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6127 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6128 if (err)
6129 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6130 #endif /* IPV6 */
6131
6132 out:
6133 return err;
6134 }
6135
6136 __initcall(selinux_nf_ip_init);
6137
6138 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6139 static void selinux_nf_ip_exit(void)
6140 {
6141 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6142
6143 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6144 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6145 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6146 #endif /* IPV6 */
6147 }
6148 #endif
6149
6150 #else /* CONFIG_NETFILTER */
6151
6152 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6153 #define selinux_nf_ip_exit()
6154 #endif
6155
6156 #endif /* CONFIG_NETFILTER */
6157
6158 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6159 static int selinux_disabled;
6160
6161 int selinux_disable(void)
6162 {
6163 if (ss_initialized) {
6164 /* Not permitted after initial policy load. */
6165 return -EINVAL;
6166 }
6167
6168 if (selinux_disabled) {
6169 /* Only do this once. */
6170 return -EINVAL;
6171 }
6172
6173 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6174
6175 selinux_disabled = 1;
6176 selinux_enabled = 0;
6177
6178 reset_security_ops();
6179
6180 /* Try to destroy the avc node cache */
6181 avc_disable();
6182
6183 /* Unregister netfilter hooks. */
6184 selinux_nf_ip_exit();
6185
6186 /* Unregister selinuxfs. */
6187 exit_sel_fs();
6188
6189 return 0;
6190 }
6191 #endif
kernel source for telekom puls (alcatel/mediatek)