projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge with master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6.git
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
19 */
20
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
32 #include <linux/mm.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
45 #include <linux/kd.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
49 #include <net/icmp.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
66 #include <net/ipv6.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
72
73 #include "avc.h"
74 #include "objsec.h"
75 #include "netif.h"
76
77 #define XATTR_SELINUX_SUFFIX "selinux"
78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
79
80 extern unsigned int policydb_loaded_version;
81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
82
83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
84 int selinux_enforcing = 0;
85
86 static int __init enforcing_setup(char *str)
87 {
88 selinux_enforcing = simple_strtol(str,NULL,0);
89 return 1;
90 }
91 __setup("enforcing=", enforcing_setup);
92 #endif
93
94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
96
97 static int __init selinux_enabled_setup(char *str)
98 {
99 selinux_enabled = simple_strtol(str, NULL, 0);
100 return 1;
101 }
102 __setup("selinux=", selinux_enabled_setup);
103 #endif
104
105 /* Original (dummy) security module. */
106 static struct security_operations *original_ops = NULL;
107
108 /* Minimal support for a secondary security module,
109 just to allow the use of the dummy or capability modules.
110 The owlsm module can alternatively be used as a secondary
111 module as long as CONFIG_OWLSM_FD is not enabled. */
112 static struct security_operations *secondary_ops = NULL;
113
114 /* Lists of inode and superblock security structures initialized
115 before the policy was loaded. */
116 static LIST_HEAD(superblock_security_head);
117 static DEFINE_SPINLOCK(sb_security_lock);
118
119 /* Allocate and free functions for each kind of security blob. */
120
121 static int task_alloc_security(struct task_struct *task)
122 {
123 struct task_security_struct *tsec;
124
125 tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
126 if (!tsec)
127 return -ENOMEM;
128
129 memset(tsec, 0, sizeof(struct task_security_struct));
130 tsec->magic = SELINUX_MAGIC;
131 tsec->task = task;
132 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
133 task->security = tsec;
134
135 return 0;
136 }
137
138 static void task_free_security(struct task_struct *task)
139 {
140 struct task_security_struct *tsec = task->security;
141
142 if (!tsec || tsec->magic != SELINUX_MAGIC)
143 return;
144
145 task->security = NULL;
146 kfree(tsec);
147 }
148
149 static int inode_alloc_security(struct inode *inode)
150 {
151 struct task_security_struct *tsec = current->security;
152 struct inode_security_struct *isec;
153
154 isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
155 if (!isec)
156 return -ENOMEM;
157
158 memset(isec, 0, sizeof(struct inode_security_struct));
159 init_MUTEX(&isec->sem);
160 INIT_LIST_HEAD(&isec->list);
161 isec->magic = SELINUX_MAGIC;
162 isec->inode = inode;
163 isec->sid = SECINITSID_UNLABELED;
164 isec->sclass = SECCLASS_FILE;
165 if (tsec && tsec->magic == SELINUX_MAGIC)
166 isec->task_sid = tsec->sid;
167 else
168 isec->task_sid = SECINITSID_UNLABELED;
169 inode->i_security = isec;
170
171 return 0;
172 }
173
174 static void inode_free_security(struct inode *inode)
175 {
176 struct inode_security_struct *isec = inode->i_security;
177 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
178
179 if (!isec || isec->magic != SELINUX_MAGIC)
180 return;
181
182 spin_lock(&sbsec->isec_lock);
183 if (!list_empty(&isec->list))
184 list_del_init(&isec->list);
185 spin_unlock(&sbsec->isec_lock);
186
187 inode->i_security = NULL;
188 kfree(isec);
189 }
190
191 static int file_alloc_security(struct file *file)
192 {
193 struct task_security_struct *tsec = current->security;
194 struct file_security_struct *fsec;
195
196 fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
197 if (!fsec)
198 return -ENOMEM;
199
200 memset(fsec, 0, sizeof(struct file_security_struct));
201 fsec->magic = SELINUX_MAGIC;
202 fsec->file = file;
203 if (tsec && tsec->magic == SELINUX_MAGIC) {
204 fsec->sid = tsec->sid;
205 fsec->fown_sid = tsec->sid;
206 } else {
207 fsec->sid = SECINITSID_UNLABELED;
208 fsec->fown_sid = SECINITSID_UNLABELED;
209 }
210 file->f_security = fsec;
211
212 return 0;
213 }
214
215 static void file_free_security(struct file *file)
216 {
217 struct file_security_struct *fsec = file->f_security;
218
219 if (!fsec || fsec->magic != SELINUX_MAGIC)
220 return;
221
222 file->f_security = NULL;
223 kfree(fsec);
224 }
225
226 static int superblock_alloc_security(struct super_block *sb)
227 {
228 struct superblock_security_struct *sbsec;
229
230 sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
231 if (!sbsec)
232 return -ENOMEM;
233
234 memset(sbsec, 0, sizeof(struct superblock_security_struct));
235 init_MUTEX(&sbsec->sem);
236 INIT_LIST_HEAD(&sbsec->list);
237 INIT_LIST_HEAD(&sbsec->isec_head);
238 spin_lock_init(&sbsec->isec_lock);
239 sbsec->magic = SELINUX_MAGIC;
240 sbsec->sb = sb;
241 sbsec->sid = SECINITSID_UNLABELED;
242 sbsec->def_sid = SECINITSID_FILE;
243 sb->s_security = sbsec;
244
245 return 0;
246 }
247
248 static void superblock_free_security(struct super_block *sb)
249 {
250 struct superblock_security_struct *sbsec = sb->s_security;
251
252 if (!sbsec || sbsec->magic != SELINUX_MAGIC)
253 return;
254
255 spin_lock(&sb_security_lock);
256 if (!list_empty(&sbsec->list))
257 list_del_init(&sbsec->list);
258 spin_unlock(&sb_security_lock);
259
260 sb->s_security = NULL;
261 kfree(sbsec);
262 }
263
264 #ifdef CONFIG_SECURITY_NETWORK
265 static int sk_alloc_security(struct sock *sk, int family, int priority)
266 {
267 struct sk_security_struct *ssec;
268
269 if (family != PF_UNIX)
270 return 0;
271
272 ssec = kmalloc(sizeof(*ssec), priority);
273 if (!ssec)
274 return -ENOMEM;
275
276 memset(ssec, 0, sizeof(*ssec));
277 ssec->magic = SELINUX_MAGIC;
278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
281
282 return 0;
283 }
284
285 static void sk_free_security(struct sock *sk)
286 {
287 struct sk_security_struct *ssec = sk->sk_security;
288
289 if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
290 return;
291
292 sk->sk_security = NULL;
293 kfree(ssec);
294 }
295 #endif /* CONFIG_SECURITY_NETWORK */
296
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316 return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 4,
323 };
324
325 static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
329 };
330
331 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
332
333 static int try_context_mount(struct super_block *sb, void *data)
334 {
335 char *context = NULL, *defcontext = NULL;
336 const char *name;
337 u32 sid;
338 int alloc = 0, rc = 0, seen = 0;
339 struct task_security_struct *tsec = current->security;
340 struct superblock_security_struct *sbsec = sb->s_security;
341
342 if (!data)
343 goto out;
344
345 name = sb->s_type->name;
346
347 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
348
349 /* NFS we understand. */
350 if (!strcmp(name, "nfs")) {
351 struct nfs_mount_data *d = data;
352
353 if (d->version < NFS_MOUNT_VERSION)
354 goto out;
355
356 if (d->context[0]) {
357 context = d->context;
358 seen |= Opt_context;
359 }
360 } else
361 goto out;
362
363 } else {
364 /* Standard string-based options. */
365 char *p, *options = data;
366
367 while ((p = strsep(&options, ",")) != NULL) {
368 int token;
369 substring_t args[MAX_OPT_ARGS];
370
371 if (!*p)
372 continue;
373
374 token = match_token(p, tokens, args);
375
376 switch (token) {
377 case Opt_context:
378 if (seen) {
379 rc = -EINVAL;
380 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
381 goto out_free;
382 }
383 context = match_strdup(&args[0]);
384 if (!context) {
385 rc = -ENOMEM;
386 goto out_free;
387 }
388 if (!alloc)
389 alloc = 1;
390 seen |= Opt_context;
391 break;
392
393 case Opt_fscontext:
394 if (seen & (Opt_context|Opt_fscontext)) {
395 rc = -EINVAL;
396 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
397 goto out_free;
398 }
399 context = match_strdup(&args[0]);
400 if (!context) {
401 rc = -ENOMEM;
402 goto out_free;
403 }
404 if (!alloc)
405 alloc = 1;
406 seen |= Opt_fscontext;
407 break;
408
409 case Opt_defcontext:
410 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
411 rc = -EINVAL;
412 printk(KERN_WARNING "SELinux: "
413 "defcontext option is invalid "
414 "for this filesystem type\n");
415 goto out_free;
416 }
417 if (seen & (Opt_context|Opt_defcontext)) {
418 rc = -EINVAL;
419 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
420 goto out_free;
421 }
422 defcontext = match_strdup(&args[0]);
423 if (!defcontext) {
424 rc = -ENOMEM;
425 goto out_free;
426 }
427 if (!alloc)
428 alloc = 1;
429 seen |= Opt_defcontext;
430 break;
431
432 default:
433 rc = -EINVAL;
434 printk(KERN_WARNING "SELinux: unknown mount "
435 "option\n");
436 goto out_free;
437
438 }
439 }
440 }
441
442 if (!seen)
443 goto out;
444
445 if (context) {
446 rc = security_context_to_sid(context, strlen(context), &sid);
447 if (rc) {
448 printk(KERN_WARNING "SELinux: security_context_to_sid"
449 "(%s) failed for (dev %s, type %s) errno=%d\n",
450 context, sb->s_id, name, rc);
451 goto out_free;
452 }
453
454 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
455 FILESYSTEM__RELABELFROM, NULL);
456 if (rc)
457 goto out_free;
458
459 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
460 FILESYSTEM__RELABELTO, NULL);
461 if (rc)
462 goto out_free;
463
464 sbsec->sid = sid;
465
466 if (seen & Opt_context)
467 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
468 }
469
470 if (defcontext) {
471 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
472 if (rc) {
473 printk(KERN_WARNING "SELinux: security_context_to_sid"
474 "(%s) failed for (dev %s, type %s) errno=%d\n",
475 defcontext, sb->s_id, name, rc);
476 goto out_free;
477 }
478
479 if (sid == sbsec->def_sid)
480 goto out_free;
481
482 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
483 FILESYSTEM__RELABELFROM, NULL);
484 if (rc)
485 goto out_free;
486
487 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
488 FILESYSTEM__ASSOCIATE, NULL);
489 if (rc)
490 goto out_free;
491
492 sbsec->def_sid = sid;
493 }
494
495 out_free:
496 if (alloc) {
497 kfree(context);
498 kfree(defcontext);
499 }
500 out:
501 return rc;
502 }
503
504 static int superblock_doinit(struct super_block *sb, void *data)
505 {
506 struct superblock_security_struct *sbsec = sb->s_security;
507 struct dentry *root = sb->s_root;
508 struct inode *inode = root->d_inode;
509 int rc = 0;
510
511 down(&sbsec->sem);
512 if (sbsec->initialized)
513 goto out;
514
515 if (!ss_initialized) {
516 /* Defer initialization until selinux_complete_init,
517 after the initial policy is loaded and the security
518 server is ready to handle calls. */
519 spin_lock(&sb_security_lock);
520 if (list_empty(&sbsec->list))
521 list_add(&sbsec->list, &superblock_security_head);
522 spin_unlock(&sb_security_lock);
523 goto out;
524 }
525
526 /* Determine the labeling behavior to use for this filesystem type. */
527 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
528 if (rc) {
529 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
530 __FUNCTION__, sb->s_type->name, rc);
531 goto out;
532 }
533
534 rc = try_context_mount(sb, data);
535 if (rc)
536 goto out;
537
538 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
539 /* Make sure that the xattr handler exists and that no
540 error other than -ENODATA is returned by getxattr on
541 the root directory. -ENODATA is ok, as this may be
542 the first boot of the SELinux kernel before we have
543 assigned xattr values to the filesystem. */
544 if (!inode->i_op->getxattr) {
545 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
546 "xattr support\n", sb->s_id, sb->s_type->name);
547 rc = -EOPNOTSUPP;
548 goto out;
549 }
550 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
551 if (rc < 0 && rc != -ENODATA) {
552 if (rc == -EOPNOTSUPP)
553 printk(KERN_WARNING "SELinux: (dev %s, type "
554 "%s) has no security xattr handler\n",
555 sb->s_id, sb->s_type->name);
556 else
557 printk(KERN_WARNING "SELinux: (dev %s, type "
558 "%s) getxattr errno %d\n", sb->s_id,
559 sb->s_type->name, -rc);
560 goto out;
561 }
562 }
563
564 if (strcmp(sb->s_type->name, "proc") == 0)
565 sbsec->proc = 1;
566
567 sbsec->initialized = 1;
568
569 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
570 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
571 sb->s_id, sb->s_type->name);
572 }
573 else {
574 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
575 sb->s_id, sb->s_type->name,
576 labeling_behaviors[sbsec->behavior-1]);
577 }
578
579 /* Initialize the root inode. */
580 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
581
582 /* Initialize any other inodes associated with the superblock, e.g.
583 inodes created prior to initial policy load or inodes created
584 during get_sb by a pseudo filesystem that directly
585 populates itself. */
586 spin_lock(&sbsec->isec_lock);
587 next_inode:
588 if (!list_empty(&sbsec->isec_head)) {
589 struct inode_security_struct *isec =
590 list_entry(sbsec->isec_head.next,
591 struct inode_security_struct, list);
592 struct inode *inode = isec->inode;
593 spin_unlock(&sbsec->isec_lock);
594 inode = igrab(inode);
595 if (inode) {
596 if (!IS_PRIVATE (inode))
597 inode_doinit(inode);
598 iput(inode);
599 }
600 spin_lock(&sbsec->isec_lock);
601 list_del_init(&isec->list);
602 goto next_inode;
603 }
604 spin_unlock(&sbsec->isec_lock);
605 out:
606 up(&sbsec->sem);
607 return rc;
608 }
609
610 static inline u16 inode_mode_to_security_class(umode_t mode)
611 {
612 switch (mode & S_IFMT) {
613 case S_IFSOCK:
614 return SECCLASS_SOCK_FILE;
615 case S_IFLNK:
616 return SECCLASS_LNK_FILE;
617 case S_IFREG:
618 return SECCLASS_FILE;
619 case S_IFBLK:
620 return SECCLASS_BLK_FILE;
621 case S_IFDIR:
622 return SECCLASS_DIR;
623 case S_IFCHR:
624 return SECCLASS_CHR_FILE;
625 case S_IFIFO:
626 return SECCLASS_FIFO_FILE;
627
628 }
629
630 return SECCLASS_FILE;
631 }
632
633 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
634 {
635 switch (family) {
636 case PF_UNIX:
637 switch (type) {
638 case SOCK_STREAM:
639 case SOCK_SEQPACKET:
640 return SECCLASS_UNIX_STREAM_SOCKET;
641 case SOCK_DGRAM:
642 return SECCLASS_UNIX_DGRAM_SOCKET;
643 }
644 break;
645 case PF_INET:
646 case PF_INET6:
647 switch (type) {
648 case SOCK_STREAM:
649 return SECCLASS_TCP_SOCKET;
650 case SOCK_DGRAM:
651 return SECCLASS_UDP_SOCKET;
652 case SOCK_RAW:
653 return SECCLASS_RAWIP_SOCKET;
654 }
655 break;
656 case PF_NETLINK:
657 switch (protocol) {
658 case NETLINK_ROUTE:
659 return SECCLASS_NETLINK_ROUTE_SOCKET;
660 case NETLINK_FIREWALL:
661 return SECCLASS_NETLINK_FIREWALL_SOCKET;
662 case NETLINK_TCPDIAG:
663 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
664 case NETLINK_NFLOG:
665 return SECCLASS_NETLINK_NFLOG_SOCKET;
666 case NETLINK_XFRM:
667 return SECCLASS_NETLINK_XFRM_SOCKET;
668 case NETLINK_SELINUX:
669 return SECCLASS_NETLINK_SELINUX_SOCKET;
670 case NETLINK_AUDIT:
671 return SECCLASS_NETLINK_AUDIT_SOCKET;
672 case NETLINK_IP6_FW:
673 return SECCLASS_NETLINK_IP6FW_SOCKET;
674 case NETLINK_DNRTMSG:
675 return SECCLASS_NETLINK_DNRT_SOCKET;
676 case NETLINK_KOBJECT_UEVENT:
677 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
678 default:
679 return SECCLASS_NETLINK_SOCKET;
680 }
681 case PF_PACKET:
682 return SECCLASS_PACKET_SOCKET;
683 case PF_KEY:
684 return SECCLASS_KEY_SOCKET;
685 }
686
687 return SECCLASS_SOCKET;
688 }
689
690 #ifdef CONFIG_PROC_FS
691 static int selinux_proc_get_sid(struct proc_dir_entry *de,
692 u16 tclass,
693 u32 *sid)
694 {
695 int buflen, rc;
696 char *buffer, *path, *end;
697
698 buffer = (char*)__get_free_page(GFP_KERNEL);
699 if (!buffer)
700 return -ENOMEM;
701
702 buflen = PAGE_SIZE;
703 end = buffer+buflen;
704 *--end = '\0';
705 buflen--;
706 path = end-1;
707 *path = '/';
708 while (de && de != de->parent) {
709 buflen -= de->namelen + 1;
710 if (buflen < 0)
711 break;
712 end -= de->namelen;
713 memcpy(end, de->name, de->namelen);
714 *--end = '/';
715 path = end;
716 de = de->parent;
717 }
718 rc = security_genfs_sid("proc", path, tclass, sid);
719 free_page((unsigned long)buffer);
720 return rc;
721 }
722 #else
723 static int selinux_proc_get_sid(struct proc_dir_entry *de,
724 u16 tclass,
725 u32 *sid)
726 {
727 return -EINVAL;
728 }
729 #endif
730
731 /* The inode's security attributes must be initialized before first use. */
732 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
733 {
734 struct superblock_security_struct *sbsec = NULL;
735 struct inode_security_struct *isec = inode->i_security;
736 u32 sid;
737 struct dentry *dentry;
738 #define INITCONTEXTLEN 255
739 char *context = NULL;
740 unsigned len = 0;
741 int rc = 0;
742 int hold_sem = 0;
743
744 if (isec->initialized)
745 goto out;
746
747 down(&isec->sem);
748 hold_sem = 1;
749 if (isec->initialized)
750 goto out;
751
752 sbsec = inode->i_sb->s_security;
753 if (!sbsec->initialized) {
754 /* Defer initialization until selinux_complete_init,
755 after the initial policy is loaded and the security
756 server is ready to handle calls. */
757 spin_lock(&sbsec->isec_lock);
758 if (list_empty(&isec->list))
759 list_add(&isec->list, &sbsec->isec_head);
760 spin_unlock(&sbsec->isec_lock);
761 goto out;
762 }
763
764 switch (sbsec->behavior) {
765 case SECURITY_FS_USE_XATTR:
766 if (!inode->i_op->getxattr) {
767 isec->sid = sbsec->def_sid;
768 break;
769 }
770
771 /* Need a dentry, since the xattr API requires one.
772 Life would be simpler if we could just pass the inode. */
773 if (opt_dentry) {
774 /* Called from d_instantiate or d_splice_alias. */
775 dentry = dget(opt_dentry);
776 } else {
777 /* Called from selinux_complete_init, try to find a dentry. */
778 dentry = d_find_alias(inode);
779 }
780 if (!dentry) {
781 printk(KERN_WARNING "%s: no dentry for dev=%s "
782 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
783 inode->i_ino);
784 goto out;
785 }
786
787 len = INITCONTEXTLEN;
788 context = kmalloc(len, GFP_KERNEL);
789 if (!context) {
790 rc = -ENOMEM;
791 dput(dentry);
792 goto out;
793 }
794 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
795 context, len);
796 if (rc == -ERANGE) {
797 /* Need a larger buffer. Query for the right size. */
798 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
799 NULL, 0);
800 if (rc < 0) {
801 dput(dentry);
802 goto out;
803 }
804 kfree(context);
805 len = rc;
806 context = kmalloc(len, GFP_KERNEL);
807 if (!context) {
808 rc = -ENOMEM;
809 dput(dentry);
810 goto out;
811 }
812 rc = inode->i_op->getxattr(dentry,
813 XATTR_NAME_SELINUX,
814 context, len);
815 }
816 dput(dentry);
817 if (rc < 0) {
818 if (rc != -ENODATA) {
819 printk(KERN_WARNING "%s: getxattr returned "
820 "%d for dev=%s ino=%ld\n", __FUNCTION__,
821 -rc, inode->i_sb->s_id, inode->i_ino);
822 kfree(context);
823 goto out;
824 }
825 /* Map ENODATA to the default file SID */
826 sid = sbsec->def_sid;
827 rc = 0;
828 } else {
829 rc = security_context_to_sid_default(context, rc, &sid,
830 sbsec->def_sid);
831 if (rc) {
832 printk(KERN_WARNING "%s: context_to_sid(%s) "
833 "returned %d for dev=%s ino=%ld\n",
834 __FUNCTION__, context, -rc,
835 inode->i_sb->s_id, inode->i_ino);
836 kfree(context);
837 /* Leave with the unlabeled SID */
838 rc = 0;
839 break;
840 }
841 }
842 kfree(context);
843 isec->sid = sid;
844 break;
845 case SECURITY_FS_USE_TASK:
846 isec->sid = isec->task_sid;
847 break;
848 case SECURITY_FS_USE_TRANS:
849 /* Default to the fs SID. */
850 isec->sid = sbsec->sid;
851
852 /* Try to obtain a transition SID. */
853 isec->sclass = inode_mode_to_security_class(inode->i_mode);
854 rc = security_transition_sid(isec->task_sid,
855 sbsec->sid,
856 isec->sclass,
857 &sid);
858 if (rc)
859 goto out;
860 isec->sid = sid;
861 break;
862 default:
863 /* Default to the fs SID. */
864 isec->sid = sbsec->sid;
865
866 if (sbsec->proc) {
867 struct proc_inode *proci = PROC_I(inode);
868 if (proci->pde) {
869 isec->sclass = inode_mode_to_security_class(inode->i_mode);
870 rc = selinux_proc_get_sid(proci->pde,
871 isec->sclass,
872 &sid);
873 if (rc)
874 goto out;
875 isec->sid = sid;
876 }
877 }
878 break;
879 }
880
881 isec->initialized = 1;
882
883 out:
884 if (isec->sclass == SECCLASS_FILE)
885 isec->sclass = inode_mode_to_security_class(inode->i_mode);
886
887 if (hold_sem)
888 up(&isec->sem);
889 return rc;
890 }
891
892 /* Convert a Linux signal to an access vector. */
893 static inline u32 signal_to_av(int sig)
894 {
895 u32 perm = 0;
896
897 switch (sig) {
898 case SIGCHLD:
899 /* Commonly granted from child to parent. */
900 perm = PROCESS__SIGCHLD;
901 break;
902 case SIGKILL:
903 /* Cannot be caught or ignored */
904 perm = PROCESS__SIGKILL;
905 break;
906 case SIGSTOP:
907 /* Cannot be caught or ignored */
908 perm = PROCESS__SIGSTOP;
909 break;
910 default:
911 /* All other signals. */
912 perm = PROCESS__SIGNAL;
913 break;
914 }
915
916 return perm;
917 }
918
919 /* Check permission betweeen a pair of tasks, e.g. signal checks,
920 fork check, ptrace check, etc. */
921 static int task_has_perm(struct task_struct *tsk1,
922 struct task_struct *tsk2,
923 u32 perms)
924 {
925 struct task_security_struct *tsec1, *tsec2;
926
927 tsec1 = tsk1->security;
928 tsec2 = tsk2->security;
929 return avc_has_perm(tsec1->sid, tsec2->sid,
930 SECCLASS_PROCESS, perms, NULL);
931 }
932
933 /* Check whether a task is allowed to use a capability. */
934 static int task_has_capability(struct task_struct *tsk,
935 int cap)
936 {
937 struct task_security_struct *tsec;
938 struct avc_audit_data ad;
939
940 tsec = tsk->security;
941
942 AVC_AUDIT_DATA_INIT(&ad,CAP);
943 ad.tsk = tsk;
944 ad.u.cap = cap;
945
946 return avc_has_perm(tsec->sid, tsec->sid,
947 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
948 }
949
950 /* Check whether a task is allowed to use a system operation. */
951 static int task_has_system(struct task_struct *tsk,
952 u32 perms)
953 {
954 struct task_security_struct *tsec;
955
956 tsec = tsk->security;
957
958 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
959 SECCLASS_SYSTEM, perms, NULL);
960 }
961
962 /* Check whether a task has a particular permission to an inode.
963 The 'adp' parameter is optional and allows other audit
964 data to be passed (e.g. the dentry). */
965 static int inode_has_perm(struct task_struct *tsk,
966 struct inode *inode,
967 u32 perms,
968 struct avc_audit_data *adp)
969 {
970 struct task_security_struct *tsec;
971 struct inode_security_struct *isec;
972 struct avc_audit_data ad;
973
974 tsec = tsk->security;
975 isec = inode->i_security;
976
977 if (!adp) {
978 adp = &ad;
979 AVC_AUDIT_DATA_INIT(&ad, FS);
980 ad.u.fs.inode = inode;
981 }
982
983 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
984 }
985
986 /* Same as inode_has_perm, but pass explicit audit data containing
987 the dentry to help the auditing code to more easily generate the
988 pathname if needed. */
989 static inline int dentry_has_perm(struct task_struct *tsk,
990 struct vfsmount *mnt,
991 struct dentry *dentry,
992 u32 av)
993 {
994 struct inode *inode = dentry->d_inode;
995 struct avc_audit_data ad;
996 AVC_AUDIT_DATA_INIT(&ad,FS);
997 ad.u.fs.mnt = mnt;
998 ad.u.fs.dentry = dentry;
999 return inode_has_perm(tsk, inode, av, &ad);
1000 }
1001
1002 /* Check whether a task can use an open file descriptor to
1003 access an inode in a given way. Check access to the
1004 descriptor itself, and then use dentry_has_perm to
1005 check a particular permission to the file.
1006 Access to the descriptor is implicitly granted if it
1007 has the same SID as the process. If av is zero, then
1008 access to the file is not checked, e.g. for cases
1009 where only the descriptor is affected like seek. */
1010 static inline int file_has_perm(struct task_struct *tsk,
1011 struct file *file,
1012 u32 av)
1013 {
1014 struct task_security_struct *tsec = tsk->security;
1015 struct file_security_struct *fsec = file->f_security;
1016 struct vfsmount *mnt = file->f_vfsmnt;
1017 struct dentry *dentry = file->f_dentry;
1018 struct inode *inode = dentry->d_inode;
1019 struct avc_audit_data ad;
1020 int rc;
1021
1022 AVC_AUDIT_DATA_INIT(&ad, FS);
1023 ad.u.fs.mnt = mnt;
1024 ad.u.fs.dentry = dentry;
1025
1026 if (tsec->sid != fsec->sid) {
1027 rc = avc_has_perm(tsec->sid, fsec->sid,
1028 SECCLASS_FD,
1029 FD__USE,
1030 &ad);
1031 if (rc)
1032 return rc;
1033 }
1034
1035 /* av is zero if only checking access to the descriptor. */
1036 if (av)
1037 return inode_has_perm(tsk, inode, av, &ad);
1038
1039 return 0;
1040 }
1041
1042 /* Check whether a task can create a file. */
1043 static int may_create(struct inode *dir,
1044 struct dentry *dentry,
1045 u16 tclass)
1046 {
1047 struct task_security_struct *tsec;
1048 struct inode_security_struct *dsec;
1049 struct superblock_security_struct *sbsec;
1050 u32 newsid;
1051 struct avc_audit_data ad;
1052 int rc;
1053
1054 tsec = current->security;
1055 dsec = dir->i_security;
1056 sbsec = dir->i_sb->s_security;
1057
1058 AVC_AUDIT_DATA_INIT(&ad, FS);
1059 ad.u.fs.dentry = dentry;
1060
1061 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1062 DIR__ADD_NAME | DIR__SEARCH,
1063 &ad);
1064 if (rc)
1065 return rc;
1066
1067 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1068 newsid = tsec->create_sid;
1069 } else {
1070 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1071 &newsid);
1072 if (rc)
1073 return rc;
1074 }
1075
1076 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1077 if (rc)
1078 return rc;
1079
1080 return avc_has_perm(newsid, sbsec->sid,
1081 SECCLASS_FILESYSTEM,
1082 FILESYSTEM__ASSOCIATE, &ad);
1083 }
1084
1085 #define MAY_LINK 0
1086 #define MAY_UNLINK 1
1087 #define MAY_RMDIR 2
1088
1089 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1090 static int may_link(struct inode *dir,
1091 struct dentry *dentry,
1092 int kind)
1093
1094 {
1095 struct task_security_struct *tsec;
1096 struct inode_security_struct *dsec, *isec;
1097 struct avc_audit_data ad;
1098 u32 av;
1099 int rc;
1100
1101 tsec = current->security;
1102 dsec = dir->i_security;
1103 isec = dentry->d_inode->i_security;
1104
1105 AVC_AUDIT_DATA_INIT(&ad, FS);
1106 ad.u.fs.dentry = dentry;
1107
1108 av = DIR__SEARCH;
1109 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1110 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1111 if (rc)
1112 return rc;
1113
1114 switch (kind) {
1115 case MAY_LINK:
1116 av = FILE__LINK;
1117 break;
1118 case MAY_UNLINK:
1119 av = FILE__UNLINK;
1120 break;
1121 case MAY_RMDIR:
1122 av = DIR__RMDIR;
1123 break;
1124 default:
1125 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1126 return 0;
1127 }
1128
1129 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1130 return rc;
1131 }
1132
1133 static inline int may_rename(struct inode *old_dir,
1134 struct dentry *old_dentry,
1135 struct inode *new_dir,
1136 struct dentry *new_dentry)
1137 {
1138 struct task_security_struct *tsec;
1139 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1140 struct avc_audit_data ad;
1141 u32 av;
1142 int old_is_dir, new_is_dir;
1143 int rc;
1144
1145 tsec = current->security;
1146 old_dsec = old_dir->i_security;
1147 old_isec = old_dentry->d_inode->i_security;
1148 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1149 new_dsec = new_dir->i_security;
1150
1151 AVC_AUDIT_DATA_INIT(&ad, FS);
1152
1153 ad.u.fs.dentry = old_dentry;
1154 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1155 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1156 if (rc)
1157 return rc;
1158 rc = avc_has_perm(tsec->sid, old_isec->sid,
1159 old_isec->sclass, FILE__RENAME, &ad);
1160 if (rc)
1161 return rc;
1162 if (old_is_dir && new_dir != old_dir) {
1163 rc = avc_has_perm(tsec->sid, old_isec->sid,
1164 old_isec->sclass, DIR__REPARENT, &ad);
1165 if (rc)
1166 return rc;
1167 }
1168
1169 ad.u.fs.dentry = new_dentry;
1170 av = DIR__ADD_NAME | DIR__SEARCH;
1171 if (new_dentry->d_inode)
1172 av |= DIR__REMOVE_NAME;
1173 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1174 if (rc)
1175 return rc;
1176 if (new_dentry->d_inode) {
1177 new_isec = new_dentry->d_inode->i_security;
1178 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1179 rc = avc_has_perm(tsec->sid, new_isec->sid,
1180 new_isec->sclass,
1181 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1182 if (rc)
1183 return rc;
1184 }
1185
1186 return 0;
1187 }
1188
1189 /* Check whether a task can perform a filesystem operation. */
1190 static int superblock_has_perm(struct task_struct *tsk,
1191 struct super_block *sb,
1192 u32 perms,
1193 struct avc_audit_data *ad)
1194 {
1195 struct task_security_struct *tsec;
1196 struct superblock_security_struct *sbsec;
1197
1198 tsec = tsk->security;
1199 sbsec = sb->s_security;
1200 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1201 perms, ad);
1202 }
1203
1204 /* Convert a Linux mode and permission mask to an access vector. */
1205 static inline u32 file_mask_to_av(int mode, int mask)
1206 {
1207 u32 av = 0;
1208
1209 if ((mode & S_IFMT) != S_IFDIR) {
1210 if (mask & MAY_EXEC)
1211 av |= FILE__EXECUTE;
1212 if (mask & MAY_READ)
1213 av |= FILE__READ;
1214
1215 if (mask & MAY_APPEND)
1216 av |= FILE__APPEND;
1217 else if (mask & MAY_WRITE)
1218 av |= FILE__WRITE;
1219
1220 } else {
1221 if (mask & MAY_EXEC)
1222 av |= DIR__SEARCH;
1223 if (mask & MAY_WRITE)
1224 av |= DIR__WRITE;
1225 if (mask & MAY_READ)
1226 av |= DIR__READ;
1227 }
1228
1229 return av;
1230 }
1231
1232 /* Convert a Linux file to an access vector. */
1233 static inline u32 file_to_av(struct file *file)
1234 {
1235 u32 av = 0;
1236
1237 if (file->f_mode & FMODE_READ)
1238 av |= FILE__READ;
1239 if (file->f_mode & FMODE_WRITE) {
1240 if (file->f_flags & O_APPEND)
1241 av |= FILE__APPEND;
1242 else
1243 av |= FILE__WRITE;
1244 }
1245
1246 return av;
1247 }
1248
1249 /* Set an inode's SID to a specified value. */
1250 static int inode_security_set_sid(struct inode *inode, u32 sid)
1251 {
1252 struct inode_security_struct *isec = inode->i_security;
1253 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1254
1255 if (!sbsec->initialized) {
1256 /* Defer initialization to selinux_complete_init. */
1257 return 0;
1258 }
1259
1260 down(&isec->sem);
1261 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1262 isec->sid = sid;
1263 isec->initialized = 1;
1264 up(&isec->sem);
1265 return 0;
1266 }
1267
1268 /* Set the security attributes on a newly created file. */
1269 static int post_create(struct inode *dir,
1270 struct dentry *dentry)
1271 {
1272
1273 struct task_security_struct *tsec;
1274 struct inode *inode;
1275 struct inode_security_struct *dsec;
1276 struct superblock_security_struct *sbsec;
1277 u32 newsid;
1278 char *context;
1279 unsigned int len;
1280 int rc;
1281
1282 tsec = current->security;
1283 dsec = dir->i_security;
1284 sbsec = dir->i_sb->s_security;
1285
1286 inode = dentry->d_inode;
1287 if (!inode) {
1288 /* Some file system types (e.g. NFS) may not instantiate
1289 a dentry for all create operations (e.g. symlink),
1290 so we have to check to see if the inode is non-NULL. */
1291 printk(KERN_WARNING "post_create: no inode, dir (dev=%s, "
1292 "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1293 return 0;
1294 }
1295
1296 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1297 newsid = tsec->create_sid;
1298 } else {
1299 rc = security_transition_sid(tsec->sid, dsec->sid,
1300 inode_mode_to_security_class(inode->i_mode),
1301 &newsid);
1302 if (rc) {
1303 printk(KERN_WARNING "post_create: "
1304 "security_transition_sid failed, rc=%d (dev=%s "
1305 "ino=%ld)\n",
1306 -rc, inode->i_sb->s_id, inode->i_ino);
1307 return rc;
1308 }
1309 }
1310
1311 rc = inode_security_set_sid(inode, newsid);
1312 if (rc) {
1313 printk(KERN_WARNING "post_create: inode_security_set_sid "
1314 "failed, rc=%d (dev=%s ino=%ld)\n",
1315 -rc, inode->i_sb->s_id, inode->i_ino);
1316 return rc;
1317 }
1318
1319 if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1320 inode->i_op->setxattr) {
1321 /* Use extended attributes. */
1322 rc = security_sid_to_context(newsid, &context, &len);
1323 if (rc) {
1324 printk(KERN_WARNING "post_create: sid_to_context "
1325 "failed, rc=%d (dev=%s ino=%ld)\n",
1326 -rc, inode->i_sb->s_id, inode->i_ino);
1327 return rc;
1328 }
1329 down(&inode->i_sem);
1330 rc = inode->i_op->setxattr(dentry,
1331 XATTR_NAME_SELINUX,
1332 context, len, 0);
1333 up(&inode->i_sem);
1334 kfree(context);
1335 if (rc < 0) {
1336 printk(KERN_WARNING "post_create: setxattr failed, "
1337 "rc=%d (dev=%s ino=%ld)\n",
1338 -rc, inode->i_sb->s_id, inode->i_ino);
1339 return rc;
1340 }
1341 }
1342
1343 return 0;
1344 }
1345
1346
1347 /* Hook functions begin here. */
1348
1349 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1350 {
1351 struct task_security_struct *psec = parent->security;
1352 struct task_security_struct *csec = child->security;
1353 int rc;
1354
1355 rc = secondary_ops->ptrace(parent,child);
1356 if (rc)
1357 return rc;
1358
1359 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1360 /* Save the SID of the tracing process for later use in apply_creds. */
1361 if (!rc)
1362 csec->ptrace_sid = psec->sid;
1363 return rc;
1364 }
1365
1366 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1367 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1368 {
1369 int error;
1370
1371 error = task_has_perm(current, target, PROCESS__GETCAP);
1372 if (error)
1373 return error;
1374
1375 return secondary_ops->capget(target, effective, inheritable, permitted);
1376 }
1377
1378 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1379 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1380 {
1381 int error;
1382
1383 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1384 if (error)
1385 return error;
1386
1387 return task_has_perm(current, target, PROCESS__SETCAP);
1388 }
1389
1390 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1391 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1392 {
1393 secondary_ops->capset_set(target, effective, inheritable, permitted);
1394 }
1395
1396 static int selinux_capable(struct task_struct *tsk, int cap)
1397 {
1398 int rc;
1399
1400 rc = secondary_ops->capable(tsk, cap);
1401 if (rc)
1402 return rc;
1403
1404 return task_has_capability(tsk,cap);
1405 }
1406
1407 static int selinux_sysctl(ctl_table *table, int op)
1408 {
1409 int error = 0;
1410 u32 av;
1411 struct task_security_struct *tsec;
1412 u32 tsid;
1413 int rc;
1414
1415 rc = secondary_ops->sysctl(table, op);
1416 if (rc)
1417 return rc;
1418
1419 tsec = current->security;
1420
1421 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1422 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1423 if (rc) {
1424 /* Default to the well-defined sysctl SID. */
1425 tsid = SECINITSID_SYSCTL;
1426 }
1427
1428 /* The op values are "defined" in sysctl.c, thereby creating
1429 * a bad coupling between this module and sysctl.c */
1430 if(op == 001) {
1431 error = avc_has_perm(tsec->sid, tsid,
1432 SECCLASS_DIR, DIR__SEARCH, NULL);
1433 } else {
1434 av = 0;
1435 if (op & 004)
1436 av |= FILE__READ;
1437 if (op & 002)
1438 av |= FILE__WRITE;
1439 if (av)
1440 error = avc_has_perm(tsec->sid, tsid,
1441 SECCLASS_FILE, av, NULL);
1442 }
1443
1444 return error;
1445 }
1446
1447 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1448 {
1449 int rc = 0;
1450
1451 if (!sb)
1452 return 0;
1453
1454 switch (cmds) {
1455 case Q_SYNC:
1456 case Q_QUOTAON:
1457 case Q_QUOTAOFF:
1458 case Q_SETINFO:
1459 case Q_SETQUOTA:
1460 rc = superblock_has_perm(current,
1461 sb,
1462 FILESYSTEM__QUOTAMOD, NULL);
1463 break;
1464 case Q_GETFMT:
1465 case Q_GETINFO:
1466 case Q_GETQUOTA:
1467 rc = superblock_has_perm(current,
1468 sb,
1469 FILESYSTEM__QUOTAGET, NULL);
1470 break;
1471 default:
1472 rc = 0; /* let the kernel handle invalid cmds */
1473 break;
1474 }
1475 return rc;
1476 }
1477
1478 static int selinux_quota_on(struct dentry *dentry)
1479 {
1480 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1481 }
1482
1483 static int selinux_syslog(int type)
1484 {
1485 int rc;
1486
1487 rc = secondary_ops->syslog(type);
1488 if (rc)
1489 return rc;
1490
1491 switch (type) {
1492 case 3: /* Read last kernel messages */
1493 case 10: /* Return size of the log buffer */
1494 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1495 break;
1496 case 6: /* Disable logging to console */
1497 case 7: /* Enable logging to console */
1498 case 8: /* Set level of messages printed to console */
1499 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1500 break;
1501 case 0: /* Close log */
1502 case 1: /* Open log */
1503 case 2: /* Read from log */
1504 case 4: /* Read/clear last kernel messages */
1505 case 5: /* Clear ring buffer */
1506 default:
1507 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1508 break;
1509 }
1510 return rc;
1511 }
1512
1513 /*
1514 * Check that a process has enough memory to allocate a new virtual
1515 * mapping. 0 means there is enough memory for the allocation to
1516 * succeed and -ENOMEM implies there is not.
1517 *
1518 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1519 * if the capability is granted, but __vm_enough_memory requires 1 if
1520 * the capability is granted.
1521 *
1522 * Do not audit the selinux permission check, as this is applied to all
1523 * processes that allocate mappings.
1524 */
1525 static int selinux_vm_enough_memory(long pages)
1526 {
1527 int rc, cap_sys_admin = 0;
1528 struct task_security_struct *tsec = current->security;
1529
1530 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1531 if (rc == 0)
1532 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1533 SECCLASS_CAPABILITY,
1534 CAP_TO_MASK(CAP_SYS_ADMIN),
1535 NULL);
1536
1537 if (rc == 0)
1538 cap_sys_admin = 1;
1539
1540 return __vm_enough_memory(pages, cap_sys_admin);
1541 }
1542
1543 /* binprm security operations */
1544
1545 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1546 {
1547 struct bprm_security_struct *bsec;
1548
1549 bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1550 if (!bsec)
1551 return -ENOMEM;
1552
1553 memset(bsec, 0, sizeof *bsec);
1554 bsec->magic = SELINUX_MAGIC;
1555 bsec->bprm = bprm;
1556 bsec->sid = SECINITSID_UNLABELED;
1557 bsec->set = 0;
1558
1559 bprm->security = bsec;
1560 return 0;
1561 }
1562
1563 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1564 {
1565 struct task_security_struct *tsec;
1566 struct inode *inode = bprm->file->f_dentry->d_inode;
1567 struct inode_security_struct *isec;
1568 struct bprm_security_struct *bsec;
1569 u32 newsid;
1570 struct avc_audit_data ad;
1571 int rc;
1572
1573 rc = secondary_ops->bprm_set_security(bprm);
1574 if (rc)
1575 return rc;
1576
1577 bsec = bprm->security;
1578
1579 if (bsec->set)
1580 return 0;
1581
1582 tsec = current->security;
1583 isec = inode->i_security;
1584
1585 /* Default to the current task SID. */
1586 bsec->sid = tsec->sid;
1587
1588 /* Reset create SID on execve. */
1589 tsec->create_sid = 0;
1590
1591 if (tsec->exec_sid) {
1592 newsid = tsec->exec_sid;
1593 /* Reset exec SID on execve. */
1594 tsec->exec_sid = 0;
1595 } else {
1596 /* Check for a default transition on this program. */
1597 rc = security_transition_sid(tsec->sid, isec->sid,
1598 SECCLASS_PROCESS, &newsid);
1599 if (rc)
1600 return rc;
1601 }
1602
1603 AVC_AUDIT_DATA_INIT(&ad, FS);
1604 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1605 ad.u.fs.dentry = bprm->file->f_dentry;
1606
1607 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1608 newsid = tsec->sid;
1609
1610 if (tsec->sid == newsid) {
1611 rc = avc_has_perm(tsec->sid, isec->sid,
1612 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1613 if (rc)
1614 return rc;
1615 } else {
1616 /* Check permissions for the transition. */
1617 rc = avc_has_perm(tsec->sid, newsid,
1618 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1619 if (rc)
1620 return rc;
1621
1622 rc = avc_has_perm(newsid, isec->sid,
1623 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1624 if (rc)
1625 return rc;
1626
1627 /* Clear any possibly unsafe personality bits on exec: */
1628 current->personality &= ~PER_CLEAR_ON_SETID;
1629
1630 /* Set the security field to the new SID. */
1631 bsec->sid = newsid;
1632 }
1633
1634 bsec->set = 1;
1635 return 0;
1636 }
1637
1638 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1639 {
1640 return secondary_ops->bprm_check_security(bprm);
1641 }
1642
1643
1644 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1645 {
1646 struct task_security_struct *tsec = current->security;
1647 int atsecure = 0;
1648
1649 if (tsec->osid != tsec->sid) {
1650 /* Enable secure mode for SIDs transitions unless
1651 the noatsecure permission is granted between
1652 the two SIDs, i.e. ahp returns 0. */
1653 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1654 SECCLASS_PROCESS,
1655 PROCESS__NOATSECURE, NULL);
1656 }
1657
1658 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1659 }
1660
1661 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1662 {
1663 kfree(bprm->security);
1664 bprm->security = NULL;
1665 }
1666
1667 extern struct vfsmount *selinuxfs_mount;
1668 extern struct dentry *selinux_null;
1669
1670 /* Derived from fs/exec.c:flush_old_files. */
1671 static inline void flush_unauthorized_files(struct files_struct * files)
1672 {
1673 struct avc_audit_data ad;
1674 struct file *file, *devnull = NULL;
1675 struct tty_struct *tty = current->signal->tty;
1676 long j = -1;
1677
1678 if (tty) {
1679 file_list_lock();
1680 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1681 if (file) {
1682 /* Revalidate access to controlling tty.
1683 Use inode_has_perm on the tty inode directly rather
1684 than using file_has_perm, as this particular open
1685 file may belong to another process and we are only
1686 interested in the inode-based check here. */
1687 struct inode *inode = file->f_dentry->d_inode;
1688 if (inode_has_perm(current, inode,
1689 FILE__READ | FILE__WRITE, NULL)) {
1690 /* Reset controlling tty. */
1691 current->signal->tty = NULL;
1692 current->signal->tty_old_pgrp = 0;
1693 }
1694 }
1695 file_list_unlock();
1696 }
1697
1698 /* Revalidate access to inherited open files. */
1699
1700 AVC_AUDIT_DATA_INIT(&ad,FS);
1701
1702 spin_lock(&files->file_lock);
1703 for (;;) {
1704 unsigned long set, i;
1705 int fd;
1706
1707 j++;
1708 i = j * __NFDBITS;
1709 if (i >= files->max_fds || i >= files->max_fdset)
1710 break;
1711 set = files->open_fds->fds_bits[j];
1712 if (!set)
1713 continue;
1714 spin_unlock(&files->file_lock);
1715 for ( ; set ; i++,set >>= 1) {
1716 if (set & 1) {
1717 file = fget(i);
1718 if (!file)
1719 continue;
1720 if (file_has_perm(current,
1721 file,
1722 file_to_av(file))) {
1723 sys_close(i);
1724 fd = get_unused_fd();
1725 if (fd != i) {
1726 if (fd >= 0)
1727 put_unused_fd(fd);
1728 fput(file);
1729 continue;
1730 }
1731 if (devnull) {
1732 atomic_inc(&devnull->f_count);
1733 } else {
1734 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1735 if (!devnull) {
1736 put_unused_fd(fd);
1737 fput(file);
1738 continue;
1739 }
1740 }
1741 fd_install(fd, devnull);
1742 }
1743 fput(file);
1744 }
1745 }
1746 spin_lock(&files->file_lock);
1747
1748 }
1749 spin_unlock(&files->file_lock);
1750 }
1751
1752 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1753 {
1754 struct task_security_struct *tsec;
1755 struct bprm_security_struct *bsec;
1756 u32 sid;
1757 int rc;
1758
1759 secondary_ops->bprm_apply_creds(bprm, unsafe);
1760
1761 tsec = current->security;
1762
1763 bsec = bprm->security;
1764 sid = bsec->sid;
1765
1766 tsec->osid = tsec->sid;
1767 bsec->unsafe = 0;
1768 if (tsec->sid != sid) {
1769 /* Check for shared state. If not ok, leave SID
1770 unchanged and kill. */
1771 if (unsafe & LSM_UNSAFE_SHARE) {
1772 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1773 PROCESS__SHARE, NULL);
1774 if (rc) {
1775 bsec->unsafe = 1;
1776 return;
1777 }
1778 }
1779
1780 /* Check for ptracing, and update the task SID if ok.
1781 Otherwise, leave SID unchanged and kill. */
1782 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1783 rc = avc_has_perm(tsec->ptrace_sid, sid,
1784 SECCLASS_PROCESS, PROCESS__PTRACE,
1785 NULL);
1786 if (rc) {
1787 bsec->unsafe = 1;
1788 return;
1789 }
1790 }
1791 tsec->sid = sid;
1792 }
1793 }
1794
1795 /*
1796 * called after apply_creds without the task lock held
1797 */
1798 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1799 {
1800 struct task_security_struct *tsec;
1801 struct rlimit *rlim, *initrlim;
1802 struct itimerval itimer;
1803 struct bprm_security_struct *bsec;
1804 int rc, i;
1805
1806 tsec = current->security;
1807 bsec = bprm->security;
1808
1809 if (bsec->unsafe) {
1810 force_sig_specific(SIGKILL, current);
1811 return;
1812 }
1813 if (tsec->osid == tsec->sid)
1814 return;
1815
1816 /* Close files for which the new task SID is not authorized. */
1817 flush_unauthorized_files(current->files);
1818
1819 /* Check whether the new SID can inherit signal state
1820 from the old SID. If not, clear itimers to avoid
1821 subsequent signal generation and flush and unblock
1822 signals. This must occur _after_ the task SID has
1823 been updated so that any kill done after the flush
1824 will be checked against the new SID. */
1825 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1826 PROCESS__SIGINH, NULL);
1827 if (rc) {
1828 memset(&itimer, 0, sizeof itimer);
1829 for (i = 0; i < 3; i++)
1830 do_setitimer(i, &itimer, NULL);
1831 flush_signals(current);
1832 spin_lock_irq(&current->sighand->siglock);
1833 flush_signal_handlers(current, 1);
1834 sigemptyset(&current->blocked);
1835 recalc_sigpending();
1836 spin_unlock_irq(&current->sighand->siglock);
1837 }
1838
1839 /* Check whether the new SID can inherit resource limits
1840 from the old SID. If not, reset all soft limits to
1841 the lower of the current task's hard limit and the init
1842 task's soft limit. Note that the setting of hard limits
1843 (even to lower them) can be controlled by the setrlimit
1844 check. The inclusion of the init task's soft limit into
1845 the computation is to avoid resetting soft limits higher
1846 than the default soft limit for cases where the default
1847 is lower than the hard limit, e.g. RLIMIT_CORE or
1848 RLIMIT_STACK.*/
1849 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1850 PROCESS__RLIMITINH, NULL);
1851 if (rc) {
1852 for (i = 0; i < RLIM_NLIMITS; i++) {
1853 rlim = current->signal->rlim + i;
1854 initrlim = init_task.signal->rlim+i;
1855 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1856 }
1857 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1858 /*
1859 * This will cause RLIMIT_CPU calculations
1860 * to be refigured.
1861 */
1862 current->it_prof_expires = jiffies_to_cputime(1);
1863 }
1864 }
1865
1866 /* Wake up the parent if it is waiting so that it can
1867 recheck wait permission to the new task SID. */
1868 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1869 }
1870
1871 /* superblock security operations */
1872
1873 static int selinux_sb_alloc_security(struct super_block *sb)
1874 {
1875 return superblock_alloc_security(sb);
1876 }
1877
1878 static void selinux_sb_free_security(struct super_block *sb)
1879 {
1880 superblock_free_security(sb);
1881 }
1882
1883 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1884 {
1885 if (plen > olen)
1886 return 0;
1887
1888 return !memcmp(prefix, option, plen);
1889 }
1890
1891 static inline int selinux_option(char *option, int len)
1892 {
1893 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1894 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1895 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1896 }
1897
1898 static inline void take_option(char **to, char *from, int *first, int len)
1899 {
1900 if (!*first) {
1901 **to = ',';
1902 *to += 1;
1903 }
1904 else
1905 *first = 0;
1906 memcpy(*to, from, len);
1907 *to += len;
1908 }
1909
1910 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1911 {
1912 int fnosec, fsec, rc = 0;
1913 char *in_save, *in_curr, *in_end;
1914 char *sec_curr, *nosec_save, *nosec;
1915
1916 in_curr = orig;
1917 sec_curr = copy;
1918
1919 /* Binary mount data: just copy */
1920 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1921 copy_page(sec_curr, in_curr);
1922 goto out;
1923 }
1924
1925 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1926 if (!nosec) {
1927 rc = -ENOMEM;
1928 goto out;
1929 }
1930
1931 nosec_save = nosec;
1932 fnosec = fsec = 1;
1933 in_save = in_end = orig;
1934
1935 do {
1936 if (*in_end == ',' || *in_end == '\0') {
1937 int len = in_end - in_curr;
1938
1939 if (selinux_option(in_curr, len))
1940 take_option(&sec_curr, in_curr, &fsec, len);
1941 else
1942 take_option(&nosec, in_curr, &fnosec, len);
1943
1944 in_curr = in_end + 1;
1945 }
1946 } while (*in_end++);
1947
1948 strcpy(in_save, nosec_save);
1949 free_page((unsigned long)nosec_save);
1950 out:
1951 return rc;
1952 }
1953
1954 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1955 {
1956 struct avc_audit_data ad;
1957 int rc;
1958
1959 rc = superblock_doinit(sb, data);
1960 if (rc)
1961 return rc;
1962
1963 AVC_AUDIT_DATA_INIT(&ad,FS);
1964 ad.u.fs.dentry = sb->s_root;
1965 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1966 }
1967
1968 static int selinux_sb_statfs(struct super_block *sb)
1969 {
1970 struct avc_audit_data ad;
1971
1972 AVC_AUDIT_DATA_INIT(&ad,FS);
1973 ad.u.fs.dentry = sb->s_root;
1974 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1975 }
1976
1977 static int selinux_mount(char * dev_name,
1978 struct nameidata *nd,
1979 char * type,
1980 unsigned long flags,
1981 void * data)
1982 {
1983 int rc;
1984
1985 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1986 if (rc)
1987 return rc;
1988
1989 if (flags & MS_REMOUNT)
1990 return superblock_has_perm(current, nd->mnt->mnt_sb,
1991 FILESYSTEM__REMOUNT, NULL);
1992 else
1993 return dentry_has_perm(current, nd->mnt, nd->dentry,
1994 FILE__MOUNTON);
1995 }
1996
1997 static int selinux_umount(struct vfsmount *mnt, int flags)
1998 {
1999 int rc;
2000
2001 rc = secondary_ops->sb_umount(mnt, flags);
2002 if (rc)
2003 return rc;
2004
2005 return superblock_has_perm(current,mnt->mnt_sb,
2006 FILESYSTEM__UNMOUNT,NULL);
2007 }
2008
2009 /* inode security operations */
2010
2011 static int selinux_inode_alloc_security(struct inode *inode)
2012 {
2013 return inode_alloc_security(inode);
2014 }
2015
2016 static void selinux_inode_free_security(struct inode *inode)
2017 {
2018 inode_free_security(inode);
2019 }
2020
2021 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2022 {
2023 return may_create(dir, dentry, SECCLASS_FILE);
2024 }
2025
2026 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2027 {
2028 post_create(dir, dentry);
2029 }
2030
2031 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2032 {
2033 int rc;
2034
2035 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2036 if (rc)
2037 return rc;
2038 return may_link(dir, old_dentry, MAY_LINK);
2039 }
2040
2041 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2042 {
2043 return;
2044 }
2045
2046 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2047 {
2048 int rc;
2049
2050 rc = secondary_ops->inode_unlink(dir, dentry);
2051 if (rc)
2052 return rc;
2053 return may_link(dir, dentry, MAY_UNLINK);
2054 }
2055
2056 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2057 {
2058 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2059 }
2060
2061 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2062 {
2063 post_create(dir, dentry);
2064 }
2065
2066 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2067 {
2068 return may_create(dir, dentry, SECCLASS_DIR);
2069 }
2070
2071 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2072 {
2073 post_create(dir, dentry);
2074 }
2075
2076 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2077 {
2078 return may_link(dir, dentry, MAY_RMDIR);
2079 }
2080
2081 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2082 {
2083 int rc;
2084
2085 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2086 if (rc)
2087 return rc;
2088
2089 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2090 }
2091
2092 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2093 {
2094 post_create(dir, dentry);
2095 }
2096
2097 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2098 struct inode *new_inode, struct dentry *new_dentry)
2099 {
2100 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2101 }
2102
2103 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2104 struct inode *new_inode, struct dentry *new_dentry)
2105 {
2106 return;
2107 }
2108
2109 static int selinux_inode_readlink(struct dentry *dentry)
2110 {
2111 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2112 }
2113
2114 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2115 {
2116 int rc;
2117
2118 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2119 if (rc)
2120 return rc;
2121 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2122 }
2123
2124 static int selinux_inode_permission(struct inode *inode, int mask,
2125 struct nameidata *nd)
2126 {
2127 int rc;
2128
2129 rc = secondary_ops->inode_permission(inode, mask, nd);
2130 if (rc)
2131 return rc;
2132
2133 if (!mask) {
2134 /* No permission to check. Existence test. */
2135 return 0;
2136 }
2137
2138 return inode_has_perm(current, inode,
2139 file_mask_to_av(inode->i_mode, mask), NULL);
2140 }
2141
2142 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2143 {
2144 int rc;
2145
2146 rc = secondary_ops->inode_setattr(dentry, iattr);
2147 if (rc)
2148 return rc;
2149
2150 if (iattr->ia_valid & ATTR_FORCE)
2151 return 0;
2152
2153 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2154 ATTR_ATIME_SET | ATTR_MTIME_SET))
2155 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2156
2157 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2158 }
2159
2160 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2161 {
2162 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2163 }
2164
2165 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2166 {
2167 struct task_security_struct *tsec = current->security;
2168 struct inode *inode = dentry->d_inode;
2169 struct inode_security_struct *isec = inode->i_security;
2170 struct superblock_security_struct *sbsec;
2171 struct avc_audit_data ad;
2172 u32 newsid;
2173 int rc = 0;
2174
2175 if (strcmp(name, XATTR_NAME_SELINUX)) {
2176 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2177 sizeof XATTR_SECURITY_PREFIX - 1) &&
2178 !capable(CAP_SYS_ADMIN)) {
2179 /* A different attribute in the security namespace.
2180 Restrict to administrator. */
2181 return -EPERM;
2182 }
2183
2184 /* Not an attribute we recognize, so just check the
2185 ordinary setattr permission. */
2186 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2187 }
2188
2189 sbsec = inode->i_sb->s_security;
2190 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2191 return -EOPNOTSUPP;
2192
2193 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2194 return -EPERM;
2195
2196 AVC_AUDIT_DATA_INIT(&ad,FS);
2197 ad.u.fs.dentry = dentry;
2198
2199 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2200 FILE__RELABELFROM, &ad);
2201 if (rc)
2202 return rc;
2203
2204 rc = security_context_to_sid(value, size, &newsid);
2205 if (rc)
2206 return rc;
2207
2208 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2209 FILE__RELABELTO, &ad);
2210 if (rc)
2211 return rc;
2212
2213 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2214 isec->sclass);
2215 if (rc)
2216 return rc;
2217
2218 return avc_has_perm(newsid,
2219 sbsec->sid,
2220 SECCLASS_FILESYSTEM,
2221 FILESYSTEM__ASSOCIATE,
2222 &ad);
2223 }
2224
2225 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2226 void *value, size_t size, int flags)
2227 {
2228 struct inode *inode = dentry->d_inode;
2229 struct inode_security_struct *isec = inode->i_security;
2230 u32 newsid;
2231 int rc;
2232
2233 if (strcmp(name, XATTR_NAME_SELINUX)) {
2234 /* Not an attribute we recognize, so nothing to do. */
2235 return;
2236 }
2237
2238 rc = security_context_to_sid(value, size, &newsid);
2239 if (rc) {
2240 printk(KERN_WARNING "%s: unable to obtain SID for context "
2241 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2242 return;
2243 }
2244
2245 isec->sid = newsid;
2246 return;
2247 }
2248
2249 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2250 {
2251 struct inode *inode = dentry->d_inode;
2252 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2253
2254 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2255 return -EOPNOTSUPP;
2256
2257 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2258 }
2259
2260 static int selinux_inode_listxattr (struct dentry *dentry)
2261 {
2262 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2263 }
2264
2265 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2266 {
2267 if (strcmp(name, XATTR_NAME_SELINUX)) {
2268 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2269 sizeof XATTR_SECURITY_PREFIX - 1) &&
2270 !capable(CAP_SYS_ADMIN)) {
2271 /* A different attribute in the security namespace.
2272 Restrict to administrator. */
2273 return -EPERM;
2274 }
2275
2276 /* Not an attribute we recognize, so just check the
2277 ordinary setattr permission. Might want a separate
2278 permission for removexattr. */
2279 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2280 }
2281
2282 /* No one is allowed to remove a SELinux security label.
2283 You can change the label, but all data must be labeled. */
2284 return -EACCES;
2285 }
2286
2287 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2288 {
2289 struct inode_security_struct *isec = inode->i_security;
2290 char *context;
2291 unsigned len;
2292 int rc;
2293
2294 /* Permission check handled by selinux_inode_getxattr hook.*/
2295
2296 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2297 return -EOPNOTSUPP;
2298
2299 rc = security_sid_to_context(isec->sid, &context, &len);
2300 if (rc)
2301 return rc;
2302
2303 if (!buffer || !size) {
2304 kfree(context);
2305 return len;
2306 }
2307 if (size < len) {
2308 kfree(context);
2309 return -ERANGE;
2310 }
2311 memcpy(buffer, context, len);
2312 kfree(context);
2313 return len;
2314 }
2315
2316 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2317 const void *value, size_t size, int flags)
2318 {
2319 struct inode_security_struct *isec = inode->i_security;
2320 u32 newsid;
2321 int rc;
2322
2323 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2324 return -EOPNOTSUPP;
2325
2326 if (!value || !size)
2327 return -EACCES;
2328
2329 rc = security_context_to_sid((void*)value, size, &newsid);
2330 if (rc)
2331 return rc;
2332
2333 isec->sid = newsid;
2334 return 0;
2335 }
2336
2337 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2338 {
2339 const int len = sizeof(XATTR_NAME_SELINUX);
2340 if (buffer && len <= buffer_size)
2341 memcpy(buffer, XATTR_NAME_SELINUX, len);
2342 return len;
2343 }
2344
2345 /* file security operations */
2346
2347 static int selinux_file_permission(struct file *file, int mask)
2348 {
2349 struct inode *inode = file->f_dentry->d_inode;
2350
2351 if (!mask) {
2352 /* No permission to check. Existence test. */
2353 return 0;
2354 }
2355
2356 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2357 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2358 mask |= MAY_APPEND;
2359
2360 return file_has_perm(current, file,
2361 file_mask_to_av(inode->i_mode, mask));
2362 }
2363
2364 static int selinux_file_alloc_security(struct file *file)
2365 {
2366 return file_alloc_security(file);
2367 }
2368
2369 static void selinux_file_free_security(struct file *file)
2370 {
2371 file_free_security(file);
2372 }
2373
2374 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2375 unsigned long arg)
2376 {
2377 int error = 0;
2378
2379 switch (cmd) {
2380 case FIONREAD:
2381 /* fall through */
2382 case FIBMAP:
2383 /* fall through */
2384 case FIGETBSZ:
2385 /* fall through */
2386 case EXT2_IOC_GETFLAGS:
2387 /* fall through */
2388 case EXT2_IOC_GETVERSION:
2389 error = file_has_perm(current, file, FILE__GETATTR);
2390 break;
2391
2392 case EXT2_IOC_SETFLAGS:
2393 /* fall through */
2394 case EXT2_IOC_SETVERSION:
2395 error = file_has_perm(current, file, FILE__SETATTR);
2396 break;
2397
2398 /* sys_ioctl() checks */
2399 case FIONBIO:
2400 /* fall through */
2401 case FIOASYNC:
2402 error = file_has_perm(current, file, 0);
2403 break;
2404
2405 case KDSKBENT:
2406 case KDSKBSENT:
2407 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2408 break;
2409
2410 /* default case assumes that the command will go
2411 * to the file's ioctl() function.
2412 */
2413 default:
2414 error = file_has_perm(current, file, FILE__IOCTL);
2415
2416 }
2417 return error;
2418 }
2419
2420 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2421 {
2422 #ifndef CONFIG_PPC32
2423 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2424 /*
2425 * We are making executable an anonymous mapping or a
2426 * private file mapping that will also be writable.
2427 * This has an additional check.
2428 */
2429 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2430 if (rc)
2431 return rc;
2432 }
2433 #endif
2434
2435 if (file) {
2436 /* read access is always possible with a mapping */
2437 u32 av = FILE__READ;
2438
2439 /* write access only matters if the mapping is shared */
2440 if (shared && (prot & PROT_WRITE))
2441 av |= FILE__WRITE;
2442
2443 if (prot & PROT_EXEC)
2444 av |= FILE__EXECUTE;
2445
2446 return file_has_perm(current, file, av);
2447 }
2448 return 0;
2449 }
2450
2451 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2452 unsigned long prot, unsigned long flags)
2453 {
2454 int rc;
2455
2456 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2457 if (rc)
2458 return rc;
2459
2460 if (selinux_checkreqprot)
2461 prot = reqprot;
2462
2463 return file_map_prot_check(file, prot,
2464 (flags & MAP_TYPE) == MAP_SHARED);
2465 }
2466
2467 static int selinux_file_mprotect(struct vm_area_struct *vma,
2468 unsigned long reqprot,
2469 unsigned long prot)
2470 {
2471 int rc;
2472
2473 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2474 if (rc)
2475 return rc;
2476
2477 if (selinux_checkreqprot)
2478 prot = reqprot;
2479
2480 #ifndef CONFIG_PPC32
2481 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2482 (vma->vm_start >= vma->vm_mm->start_brk &&
2483 vma->vm_end <= vma->vm_mm->brk)) {
2484 /*
2485 * We are making an executable mapping in the brk region.
2486 * This has an additional execheap check.
2487 */
2488 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2489 if (rc)
2490 return rc;
2491 }
2492 if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2493 /*
2494 * We are making executable a file mapping that has
2495 * had some COW done. Since pages might have been written,
2496 * check ability to execute the possibly modified content.
2497 * This typically should only occur for text relocations.
2498 */
2499 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2500 if (rc)
2501 return rc;
2502 }
2503 if (!vma->vm_file && (prot & PROT_EXEC) &&
2504 vma->vm_start <= vma->vm_mm->start_stack &&
2505 vma->vm_end >= vma->vm_mm->start_stack) {
2506 /* Attempt to make the process stack executable.
2507 * This has an additional execstack check.
2508 */
2509 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2510 if (rc)
2511 return rc;
2512 }
2513 #endif
2514
2515 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2516 }
2517
2518 static int selinux_file_lock(struct file *file, unsigned int cmd)
2519 {
2520 return file_has_perm(current, file, FILE__LOCK);
2521 }
2522
2523 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2524 unsigned long arg)
2525 {
2526 int err = 0;
2527
2528 switch (cmd) {
2529 case F_SETFL:
2530 if (!file->f_dentry || !file->f_dentry->d_inode) {
2531 err = -EINVAL;
2532 break;
2533 }
2534
2535 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2536 err = file_has_perm(current, file,FILE__WRITE);
2537 break;
2538 }
2539 /* fall through */
2540 case F_SETOWN:
2541 case F_SETSIG:
2542 case F_GETFL:
2543 case F_GETOWN:
2544 case F_GETSIG:
2545 /* Just check FD__USE permission */
2546 err = file_has_perm(current, file, 0);
2547 break;
2548 case F_GETLK:
2549 case F_SETLK:
2550 case F_SETLKW:
2551 #if BITS_PER_LONG == 32
2552 case F_GETLK64:
2553 case F_SETLK64:
2554 case F_SETLKW64:
2555 #endif
2556 if (!file->f_dentry || !file->f_dentry->d_inode) {
2557 err = -EINVAL;
2558 break;
2559 }
2560 err = file_has_perm(current, file, FILE__LOCK);
2561 break;
2562 }
2563
2564 return err;
2565 }
2566
2567 static int selinux_file_set_fowner(struct file *file)
2568 {
2569 struct task_security_struct *tsec;
2570 struct file_security_struct *fsec;
2571
2572 tsec = current->security;
2573 fsec = file->f_security;
2574 fsec->fown_sid = tsec->sid;
2575
2576 return 0;
2577 }
2578
2579 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2580 struct fown_struct *fown, int signum)
2581 {
2582 struct file *file;
2583 u32 perm;
2584 struct task_security_struct *tsec;
2585 struct file_security_struct *fsec;
2586
2587 /* struct fown_struct is never outside the context of a struct file */
2588 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2589
2590 tsec = tsk->security;
2591 fsec = file->f_security;
2592
2593 if (!signum)
2594 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2595 else
2596 perm = signal_to_av(signum);
2597
2598 return avc_has_perm(fsec->fown_sid, tsec->sid,
2599 SECCLASS_PROCESS, perm, NULL);
2600 }
2601
2602 static int selinux_file_receive(struct file *file)
2603 {
2604 return file_has_perm(current, file, file_to_av(file));
2605 }
2606
2607 /* task security operations */
2608
2609 static int selinux_task_create(unsigned long clone_flags)
2610 {
2611 int rc;
2612
2613 rc = secondary_ops->task_create(clone_flags);
2614 if (rc)
2615 return rc;
2616
2617 return task_has_perm(current, current, PROCESS__FORK);
2618 }
2619
2620 static int selinux_task_alloc_security(struct task_struct *tsk)
2621 {
2622 struct task_security_struct *tsec1, *tsec2;
2623 int rc;
2624
2625 tsec1 = current->security;
2626
2627 rc = task_alloc_security(tsk);
2628 if (rc)
2629 return rc;
2630 tsec2 = tsk->security;
2631
2632 tsec2->osid = tsec1->osid;
2633 tsec2->sid = tsec1->sid;
2634
2635 /* Retain the exec and create SIDs across fork */
2636 tsec2->exec_sid = tsec1->exec_sid;
2637 tsec2->create_sid = tsec1->create_sid;
2638
2639 /* Retain ptracer SID across fork, if any.
2640 This will be reset by the ptrace hook upon any
2641 subsequent ptrace_attach operations. */
2642 tsec2->ptrace_sid = tsec1->ptrace_sid;
2643
2644 return 0;
2645 }
2646
2647 static void selinux_task_free_security(struct task_struct *tsk)
2648 {
2649 task_free_security(tsk);
2650 }
2651
2652 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2653 {
2654 /* Since setuid only affects the current process, and
2655 since the SELinux controls are not based on the Linux
2656 identity attributes, SELinux does not need to control
2657 this operation. However, SELinux does control the use
2658 of the CAP_SETUID and CAP_SETGID capabilities using the
2659 capable hook. */
2660 return 0;
2661 }
2662
2663 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2664 {
2665 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2666 }
2667
2668 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2669 {
2670 /* See the comment for setuid above. */
2671 return 0;
2672 }
2673
2674 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2675 {
2676 return task_has_perm(current, p, PROCESS__SETPGID);
2677 }
2678
2679 static int selinux_task_getpgid(struct task_struct *p)
2680 {
2681 return task_has_perm(current, p, PROCESS__GETPGID);
2682 }
2683
2684 static int selinux_task_getsid(struct task_struct *p)
2685 {
2686 return task_has_perm(current, p, PROCESS__GETSESSION);
2687 }
2688
2689 static int selinux_task_setgroups(struct group_info *group_info)
2690 {
2691 /* See the comment for setuid above. */
2692 return 0;
2693 }
2694
2695 static int selinux_task_setnice(struct task_struct *p, int nice)
2696 {
2697 int rc;
2698
2699 rc = secondary_ops->task_setnice(p, nice);
2700 if (rc)
2701 return rc;
2702
2703 return task_has_perm(current,p, PROCESS__SETSCHED);
2704 }
2705
2706 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2707 {
2708 struct rlimit *old_rlim = current->signal->rlim + resource;
2709 int rc;
2710
2711 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2712 if (rc)
2713 return rc;
2714
2715 /* Control the ability to change the hard limit (whether
2716 lowering or raising it), so that the hard limit can
2717 later be used as a safe reset point for the soft limit
2718 upon context transitions. See selinux_bprm_apply_creds. */
2719 if (old_rlim->rlim_max != new_rlim->rlim_max)
2720 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2721
2722 return 0;
2723 }
2724
2725 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2726 {
2727 return task_has_perm(current, p, PROCESS__SETSCHED);
2728 }
2729
2730 static int selinux_task_getscheduler(struct task_struct *p)
2731 {
2732 return task_has_perm(current, p, PROCESS__GETSCHED);
2733 }
2734
2735 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2736 {
2737 u32 perm;
2738 int rc;
2739
2740 rc = secondary_ops->task_kill(p, info, sig);
2741 if (rc)
2742 return rc;
2743
2744 if (info && ((unsigned long)info == 1 ||
2745 (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2746 return 0;
2747
2748 if (!sig)
2749 perm = PROCESS__SIGNULL; /* null signal; existence test */
2750 else
2751 perm = signal_to_av(sig);
2752
2753 return task_has_perm(current, p, perm);
2754 }
2755
2756 static int selinux_task_prctl(int option,
2757 unsigned long arg2,
2758 unsigned long arg3,
2759 unsigned long arg4,
2760 unsigned long arg5)
2761 {
2762 /* The current prctl operations do not appear to require
2763 any SELinux controls since they merely observe or modify
2764 the state of the current process. */
2765 return 0;
2766 }
2767
2768 static int selinux_task_wait(struct task_struct *p)
2769 {
2770 u32 perm;
2771
2772 perm = signal_to_av(p->exit_signal);
2773
2774 return task_has_perm(p, current, perm);
2775 }
2776
2777 static void selinux_task_reparent_to_init(struct task_struct *p)
2778 {
2779 struct task_security_struct *tsec;
2780
2781 secondary_ops->task_reparent_to_init(p);
2782
2783 tsec = p->security;
2784 tsec->osid = tsec->sid;
2785 tsec->sid = SECINITSID_KERNEL;
2786 return;
2787 }
2788
2789 static void selinux_task_to_inode(struct task_struct *p,
2790 struct inode *inode)
2791 {
2792 struct task_security_struct *tsec = p->security;
2793 struct inode_security_struct *isec = inode->i_security;
2794
2795 isec->sid = tsec->sid;
2796 isec->initialized = 1;
2797 return;
2798 }
2799
2800 #ifdef CONFIG_SECURITY_NETWORK
2801
2802 /* Returns error only if unable to parse addresses */
2803 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2804 {
2805 int offset, ihlen, ret = -EINVAL;
2806 struct iphdr _iph, *ih;
2807
2808 offset = skb->nh.raw - skb->data;
2809 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2810 if (ih == NULL)
2811 goto out;
2812
2813 ihlen = ih->ihl * 4;
2814 if (ihlen < sizeof(_iph))
2815 goto out;
2816
2817 ad->u.net.v4info.saddr = ih->saddr;
2818 ad->u.net.v4info.daddr = ih->daddr;
2819 ret = 0;
2820
2821 switch (ih->protocol) {
2822 case IPPROTO_TCP: {
2823 struct tcphdr _tcph, *th;
2824
2825 if (ntohs(ih->frag_off) & IP_OFFSET)
2826 break;
2827
2828 offset += ihlen;
2829 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2830 if (th == NULL)
2831 break;
2832
2833 ad->u.net.sport = th->source;
2834 ad->u.net.dport = th->dest;
2835 break;
2836 }
2837
2838 case IPPROTO_UDP: {
2839 struct udphdr _udph, *uh;
2840
2841 if (ntohs(ih->frag_off) & IP_OFFSET)
2842 break;
2843
2844 offset += ihlen;
2845 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2846 if (uh == NULL)
2847 break;
2848
2849 ad->u.net.sport = uh->source;
2850 ad->u.net.dport = uh->dest;
2851 break;
2852 }
2853
2854 default:
2855 break;
2856 }
2857 out:
2858 return ret;
2859 }
2860
2861 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2862
2863 /* Returns error only if unable to parse addresses */
2864 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2865 {
2866 u8 nexthdr;
2867 int ret = -EINVAL, offset;
2868 struct ipv6hdr _ipv6h, *ip6;
2869
2870 offset = skb->nh.raw - skb->data;
2871 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2872 if (ip6 == NULL)
2873 goto out;
2874
2875 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2876 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2877 ret = 0;
2878
2879 nexthdr = ip6->nexthdr;
2880 offset += sizeof(_ipv6h);
2881 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2882 if (offset < 0)
2883 goto out;
2884
2885 switch (nexthdr) {
2886 case IPPROTO_TCP: {
2887 struct tcphdr _tcph, *th;
2888
2889 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2890 if (th == NULL)
2891 break;
2892
2893 ad->u.net.sport = th->source;
2894 ad->u.net.dport = th->dest;
2895 break;
2896 }
2897
2898 case IPPROTO_UDP: {
2899 struct udphdr _udph, *uh;
2900
2901 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2902 if (uh == NULL)
2903 break;
2904
2905 ad->u.net.sport = uh->source;
2906 ad->u.net.dport = uh->dest;
2907 break;
2908 }
2909
2910 /* includes fragments */
2911 default:
2912 break;
2913 }
2914 out:
2915 return ret;
2916 }
2917
2918 #endif /* IPV6 */
2919
2920 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2921 char **addrp, int *len, int src)
2922 {
2923 int ret = 0;
2924
2925 switch (ad->u.net.family) {
2926 case PF_INET:
2927 ret = selinux_parse_skb_ipv4(skb, ad);
2928 if (ret || !addrp)
2929 break;
2930 *len = 4;
2931 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2932 &ad->u.net.v4info.daddr);
2933 break;
2934
2935 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2936 case PF_INET6:
2937 ret = selinux_parse_skb_ipv6(skb, ad);
2938 if (ret || !addrp)
2939 break;
2940 *len = 16;
2941 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2942 &ad->u.net.v6info.daddr);
2943 break;
2944 #endif /* IPV6 */
2945 default:
2946 break;
2947 }
2948
2949 return ret;
2950 }
2951
2952 /* socket security operations */
2953 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2954 u32 perms)
2955 {
2956 struct inode_security_struct *isec;
2957 struct task_security_struct *tsec;
2958 struct avc_audit_data ad;
2959 int err = 0;
2960
2961 tsec = task->security;
2962 isec = SOCK_INODE(sock)->i_security;
2963
2964 if (isec->sid == SECINITSID_KERNEL)
2965 goto out;
2966
2967 AVC_AUDIT_DATA_INIT(&ad,NET);
2968 ad.u.net.sk = sock->sk;
2969 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2970
2971 out:
2972 return err;
2973 }
2974
2975 static int selinux_socket_create(int family, int type,
2976 int protocol, int kern)
2977 {
2978 int err = 0;
2979 struct task_security_struct *tsec;
2980
2981 if (kern)
2982 goto out;
2983
2984 tsec = current->security;
2985 err = avc_has_perm(tsec->sid, tsec->sid,
2986 socket_type_to_security_class(family, type,
2987 protocol), SOCKET__CREATE, NULL);
2988
2989 out:
2990 return err;
2991 }
2992
2993 static void selinux_socket_post_create(struct socket *sock, int family,
2994 int type, int protocol, int kern)
2995 {
2996 struct inode_security_struct *isec;
2997 struct task_security_struct *tsec;
2998
2999 isec = SOCK_INODE(sock)->i_security;
3000
3001 tsec = current->security;
3002 isec->sclass = socket_type_to_security_class(family, type, protocol);
3003 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3004 isec->initialized = 1;
3005
3006 return;
3007 }
3008
3009 /* Range of port numbers used to automatically bind.
3010 Need to determine whether we should perform a name_bind
3011 permission check between the socket and the port number. */
3012 #define ip_local_port_range_0 sysctl_local_port_range[0]
3013 #define ip_local_port_range_1 sysctl_local_port_range[1]
3014
3015 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3016 {
3017 u16 family;
3018 int err;
3019
3020 err = socket_has_perm(current, sock, SOCKET__BIND);
3021 if (err)
3022 goto out;
3023
3024 /*
3025 * If PF_INET or PF_INET6, check name_bind permission for the port.
3026 */
3027 family = sock->sk->sk_family;
3028 if (family == PF_INET || family == PF_INET6) {
3029 char *addrp;
3030 struct inode_security_struct *isec;
3031 struct task_security_struct *tsec;
3032 struct avc_audit_data ad;
3033 struct sockaddr_in *addr4 = NULL;
3034 struct sockaddr_in6 *addr6 = NULL;
3035 unsigned short snum;
3036 struct sock *sk = sock->sk;
3037 u32 sid, node_perm, addrlen;
3038
3039 tsec = current->security;
3040 isec = SOCK_INODE(sock)->i_security;
3041
3042 if (family == PF_INET) {
3043 addr4 = (struct sockaddr_in *)address;
3044 snum = ntohs(addr4->sin_port);
3045 addrlen = sizeof(addr4->sin_addr.s_addr);
3046 addrp = (char *)&addr4->sin_addr.s_addr;
3047 } else {
3048 addr6 = (struct sockaddr_in6 *)address;
3049 snum = ntohs(addr6->sin6_port);
3050 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3051 addrp = (char *)&addr6->sin6_addr.s6_addr;
3052 }
3053
3054 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3055 snum > ip_local_port_range_1)) {
3056 err = security_port_sid(sk->sk_family, sk->sk_type,
3057 sk->sk_protocol, snum, &sid);
3058 if (err)
3059 goto out;
3060 AVC_AUDIT_DATA_INIT(&ad,NET);
3061 ad.u.net.sport = htons(snum);
3062 ad.u.net.family = family;
3063 err = avc_has_perm(isec->sid, sid,
3064 isec->sclass,
3065 SOCKET__NAME_BIND, &ad);
3066 if (err)
3067 goto out;
3068 }
3069
3070 switch(sk->sk_protocol) {
3071 case IPPROTO_TCP:
3072 node_perm = TCP_SOCKET__NODE_BIND;
3073 break;
3074
3075 case IPPROTO_UDP:
3076 node_perm = UDP_SOCKET__NODE_BIND;
3077 break;
3078
3079 default:
3080 node_perm = RAWIP_SOCKET__NODE_BIND;
3081 break;
3082 }
3083
3084 err = security_node_sid(family, addrp, addrlen, &sid);
3085 if (err)
3086 goto out;
3087
3088 AVC_AUDIT_DATA_INIT(&ad,NET);
3089 ad.u.net.sport = htons(snum);
3090 ad.u.net.family = family;
3091
3092 if (family == PF_INET)
3093 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3094 else
3095 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3096
3097 err = avc_has_perm(isec->sid, sid,
3098 isec->sclass, node_perm, &ad);
3099 if (err)
3100 goto out;
3101 }
3102 out:
3103 return err;
3104 }
3105
3106 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3107 {
3108 struct inode_security_struct *isec;
3109 int err;
3110
3111 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3112 if (err)
3113 return err;
3114
3115 /*
3116 * If a TCP socket, check name_connect permission for the port.
3117 */
3118 isec = SOCK_INODE(sock)->i_security;
3119 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3120 struct sock *sk = sock->sk;
3121 struct avc_audit_data ad;
3122 struct sockaddr_in *addr4 = NULL;
3123 struct sockaddr_in6 *addr6 = NULL;
3124 unsigned short snum;
3125 u32 sid;
3126
3127 if (sk->sk_family == PF_INET) {
3128 addr4 = (struct sockaddr_in *)address;
3129 if (addrlen < sizeof(struct sockaddr_in))
3130 return -EINVAL;
3131 snum = ntohs(addr4->sin_port);
3132 } else {
3133 addr6 = (struct sockaddr_in6 *)address;
3134 if (addrlen < SIN6_LEN_RFC2133)
3135 return -EINVAL;
3136 snum = ntohs(addr6->sin6_port);
3137 }
3138
3139 err = security_port_sid(sk->sk_family, sk->sk_type,
3140 sk->sk_protocol, snum, &sid);
3141 if (err)
3142 goto out;
3143
3144 AVC_AUDIT_DATA_INIT(&ad,NET);
3145 ad.u.net.dport = htons(snum);
3146 ad.u.net.family = sk->sk_family;
3147 err = avc_has_perm(isec->sid, sid, isec->sclass,
3148 TCP_SOCKET__NAME_CONNECT, &ad);
3149 if (err)
3150 goto out;
3151 }
3152
3153 out:
3154 return err;
3155 }
3156
3157 static int selinux_socket_listen(struct socket *sock, int backlog)
3158 {
3159 return socket_has_perm(current, sock, SOCKET__LISTEN);
3160 }
3161
3162 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3163 {
3164 int err;
3165 struct inode_security_struct *isec;
3166 struct inode_security_struct *newisec;
3167
3168 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3169 if (err)
3170 return err;
3171
3172 newisec = SOCK_INODE(newsock)->i_security;
3173
3174 isec = SOCK_INODE(sock)->i_security;
3175 newisec->sclass = isec->sclass;
3176 newisec->sid = isec->sid;
3177 newisec->initialized = 1;
3178
3179 return 0;
3180 }
3181
3182 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3183 int size)
3184 {
3185 return socket_has_perm(current, sock, SOCKET__WRITE);
3186 }
3187
3188 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3189 int size, int flags)
3190 {
3191 return socket_has_perm(current, sock, SOCKET__READ);
3192 }
3193
3194 static int selinux_socket_getsockname(struct socket *sock)
3195 {
3196 return socket_has_perm(current, sock, SOCKET__GETATTR);
3197 }
3198
3199 static int selinux_socket_getpeername(struct socket *sock)
3200 {
3201 return socket_has_perm(current, sock, SOCKET__GETATTR);
3202 }
3203
3204 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3205 {
3206 return socket_has_perm(current, sock, SOCKET__SETOPT);
3207 }
3208
3209 static int selinux_socket_getsockopt(struct socket *sock, int level,
3210 int optname)
3211 {
3212 return socket_has_perm(current, sock, SOCKET__GETOPT);
3213 }
3214
3215 static int selinux_socket_shutdown(struct socket *sock, int how)
3216 {
3217 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3218 }
3219
3220 static int selinux_socket_unix_stream_connect(struct socket *sock,
3221 struct socket *other,
3222 struct sock *newsk)
3223 {
3224 struct sk_security_struct *ssec;
3225 struct inode_security_struct *isec;
3226 struct inode_security_struct *other_isec;
3227 struct avc_audit_data ad;
3228 int err;
3229
3230 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3231 if (err)
3232 return err;
3233
3234 isec = SOCK_INODE(sock)->i_security;
3235 other_isec = SOCK_INODE(other)->i_security;
3236
3237 AVC_AUDIT_DATA_INIT(&ad,NET);
3238 ad.u.net.sk = other->sk;
3239
3240 err = avc_has_perm(isec->sid, other_isec->sid,
3241 isec->sclass,
3242 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3243 if (err)
3244 return err;
3245
3246 /* connecting socket */
3247 ssec = sock->sk->sk_security;
3248 ssec->peer_sid = other_isec->sid;
3249
3250 /* server child socket */
3251 ssec = newsk->sk_security;
3252 ssec->peer_sid = isec->sid;
3253
3254 return 0;
3255 }
3256
3257 static int selinux_socket_unix_may_send(struct socket *sock,
3258 struct socket *other)
3259 {
3260 struct inode_security_struct *isec;
3261 struct inode_security_struct *other_isec;
3262 struct avc_audit_data ad;
3263 int err;
3264
3265 isec = SOCK_INODE(sock)->i_security;
3266 other_isec = SOCK_INODE(other)->i_security;
3267
3268 AVC_AUDIT_DATA_INIT(&ad,NET);
3269 ad.u.net.sk = other->sk;
3270
3271 err = avc_has_perm(isec->sid, other_isec->sid,
3272 isec->sclass, SOCKET__SENDTO, &ad);
3273 if (err)
3274 return err;
3275
3276 return 0;
3277 }
3278
3279 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3280 {
3281 u16 family;
3282 char *addrp;
3283 int len, err = 0;
3284 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3285 u32 sock_sid = 0;
3286 u16 sock_class = 0;
3287 struct socket *sock;
3288 struct net_device *dev;
3289 struct avc_audit_data ad;
3290
3291 family = sk->sk_family;
3292 if (family != PF_INET && family != PF_INET6)
3293 goto out;
3294
3295 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3296 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3297 family = PF_INET;
3298
3299 read_lock_bh(&sk->sk_callback_lock);
3300 sock = sk->sk_socket;
3301 if (sock) {
3302 struct inode *inode;
3303 inode = SOCK_INODE(sock);
3304 if (inode) {
3305 struct inode_security_struct *isec;
3306 isec = inode->i_security;
3307 sock_sid = isec->sid;
3308 sock_class = isec->sclass;
3309 }
3310 }
3311 read_unlock_bh(&sk->sk_callback_lock);
3312 if (!sock_sid)
3313 goto out;
3314
3315 dev = skb->dev;
3316 if (!dev)
3317 goto out;
3318
3319 err = sel_netif_sids(dev, &if_sid, NULL);
3320 if (err)
3321 goto out;
3322
3323 switch (sock_class) {
3324 case SECCLASS_UDP_SOCKET:
3325 netif_perm = NETIF__UDP_RECV;
3326 node_perm = NODE__UDP_RECV;
3327 recv_perm = UDP_SOCKET__RECV_MSG;
3328 break;
3329
3330 case SECCLASS_TCP_SOCKET:
3331 netif_perm = NETIF__TCP_RECV;
3332 node_perm = NODE__TCP_RECV;
3333 recv_perm = TCP_SOCKET__RECV_MSG;
3334 break;
3335
3336 default:
3337 netif_perm = NETIF__RAWIP_RECV;
3338 node_perm = NODE__RAWIP_RECV;
3339 break;
3340 }
3341
3342 AVC_AUDIT_DATA_INIT(&ad, NET);
3343 ad.u.net.netif = dev->name;
3344 ad.u.net.family = family;
3345
3346 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3347 if (err)
3348 goto out;
3349
3350 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3351 if (err)
3352 goto out;
3353
3354 /* Fixme: this lookup is inefficient */
3355 err = security_node_sid(family, addrp, len, &node_sid);
3356 if (err)
3357 goto out;
3358
3359 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3360 if (err)
3361 goto out;
3362
3363 if (recv_perm) {
3364 u32 port_sid;
3365
3366 /* Fixme: make this more efficient */
3367 err = security_port_sid(sk->sk_family, sk->sk_type,
3368 sk->sk_protocol, ntohs(ad.u.net.sport),
3369 &port_sid);
3370 if (err)
3371 goto out;
3372
3373 err = avc_has_perm(sock_sid, port_sid,
3374 sock_class, recv_perm, &ad);
3375 }
3376 out:
3377 return err;
3378 }
3379
3380 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3381 int __user *optlen, unsigned len)
3382 {
3383 int err = 0;
3384 char *scontext;
3385 u32 scontext_len;
3386 struct sk_security_struct *ssec;
3387 struct inode_security_struct *isec;
3388
3389 isec = SOCK_INODE(sock)->i_security;
3390 if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3391 err = -ENOPROTOOPT;
3392 goto out;
3393 }
3394
3395 ssec = sock->sk->sk_security;
3396
3397 err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3398 if (err)
3399 goto out;
3400
3401 if (scontext_len > len) {
3402 err = -ERANGE;
3403 goto out_len;
3404 }
3405
3406 if (copy_to_user(optval, scontext, scontext_len))
3407 err = -EFAULT;
3408
3409 out_len:
3410 if (put_user(scontext_len, optlen))
3411 err = -EFAULT;
3412
3413 kfree(scontext);
3414 out:
3415 return err;
3416 }
3417
3418 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3419 {
3420 return sk_alloc_security(sk, family, priority);
3421 }
3422
3423 static void selinux_sk_free_security(struct sock *sk)
3424 {
3425 sk_free_security(sk);
3426 }
3427
3428 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3429 {
3430 int err = 0;
3431 u32 perm;
3432 struct nlmsghdr *nlh;
3433 struct socket *sock = sk->sk_socket;
3434 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3435
3436 if (skb->len < NLMSG_SPACE(0)) {
3437 err = -EINVAL;
3438 goto out;
3439 }
3440 nlh = (struct nlmsghdr *)skb->data;
3441
3442 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3443 if (err) {
3444 if (err == -EINVAL) {
3445 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3446 "SELinux: unrecognized netlink message"
3447 " type=%hu for sclass=%hu\n",
3448 nlh->nlmsg_type, isec->sclass);
3449 if (!selinux_enforcing)
3450 err = 0;
3451 }
3452
3453 /* Ignore */
3454 if (err == -ENOENT)
3455 err = 0;
3456 goto out;
3457 }
3458
3459 err = socket_has_perm(current, sock, perm);
3460 out:
3461 return err;
3462 }
3463
3464 #ifdef CONFIG_NETFILTER
3465
3466 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3467 struct sk_buff **pskb,
3468 const struct net_device *in,
3469 const struct net_device *out,
3470 int (*okfn)(struct sk_buff *),
3471 u16 family)
3472 {
3473 char *addrp;
3474 int len, err = NF_ACCEPT;
3475 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3476 struct sock *sk;
3477 struct socket *sock;
3478 struct inode *inode;
3479 struct sk_buff *skb = *pskb;
3480 struct inode_security_struct *isec;
3481 struct avc_audit_data ad;
3482 struct net_device *dev = (struct net_device *)out;
3483
3484 sk = skb->sk;
3485 if (!sk)
3486 goto out;
3487
3488 sock = sk->sk_socket;
3489 if (!sock)
3490 goto out;
3491
3492 inode = SOCK_INODE(sock);
3493 if (!inode)
3494 goto out;
3495
3496 err = sel_netif_sids(dev, &if_sid, NULL);
3497 if (err)
3498 goto out;
3499
3500 isec = inode->i_security;
3501
3502 switch (isec->sclass) {
3503 case SECCLASS_UDP_SOCKET:
3504 netif_perm = NETIF__UDP_SEND;
3505 node_perm = NODE__UDP_SEND;
3506 send_perm = UDP_SOCKET__SEND_MSG;
3507 break;
3508
3509 case SECCLASS_TCP_SOCKET:
3510 netif_perm = NETIF__TCP_SEND;
3511 node_perm = NODE__TCP_SEND;
3512 send_perm = TCP_SOCKET__SEND_MSG;
3513 break;
3514
3515 default:
3516 netif_perm = NETIF__RAWIP_SEND;
3517 node_perm = NODE__RAWIP_SEND;
3518 break;
3519 }
3520
3521
3522 AVC_AUDIT_DATA_INIT(&ad, NET);
3523 ad.u.net.netif = dev->name;
3524 ad.u.net.family = family;
3525
3526 err = selinux_parse_skb(skb, &ad, &addrp,
3527 &len, 0) ? NF_DROP : NF_ACCEPT;
3528 if (err != NF_ACCEPT)
3529 goto out;
3530
3531 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3532 netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3533 if (err != NF_ACCEPT)
3534 goto out;
3535
3536 /* Fixme: this lookup is inefficient */
3537 err = security_node_sid(family, addrp, len,
3538 &node_sid) ? NF_DROP : NF_ACCEPT;
3539 if (err != NF_ACCEPT)
3540 goto out;
3541
3542 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3543 node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3544 if (err != NF_ACCEPT)
3545 goto out;
3546
3547 if (send_perm) {
3548 u32 port_sid;
3549
3550 /* Fixme: make this more efficient */
3551 err = security_port_sid(sk->sk_family,
3552 sk->sk_type,
3553 sk->sk_protocol,
3554 ntohs(ad.u.net.dport),
3555 &port_sid) ? NF_DROP : NF_ACCEPT;
3556 if (err != NF_ACCEPT)
3557 goto out;
3558
3559 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3560 send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3561 }
3562
3563 out:
3564 return err;
3565 }
3566
3567 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3568 struct sk_buff **pskb,
3569 const struct net_device *in,
3570 const struct net_device *out,
3571 int (*okfn)(struct sk_buff *))
3572 {
3573 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3574 }
3575
3576 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3577
3578 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3579 struct sk_buff **pskb,
3580 const struct net_device *in,
3581 const struct net_device *out,
3582 int (*okfn)(struct sk_buff *))
3583 {
3584 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3585 }
3586
3587 #endif /* IPV6 */
3588
3589 #endif /* CONFIG_NETFILTER */
3590
3591 #else
3592
3593 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3594 {
3595 return 0;
3596 }
3597
3598 #endif /* CONFIG_SECURITY_NETWORK */
3599
3600 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3601 {
3602 struct task_security_struct *tsec;
3603 struct av_decision avd;
3604 int err;
3605
3606 err = secondary_ops->netlink_send(sk, skb);
3607 if (err)
3608 return err;
3609
3610 tsec = current->security;
3611
3612 avd.allowed = 0;
3613 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3614 SECCLASS_CAPABILITY, ~0, &avd);
3615 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3616
3617 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3618 err = selinux_nlmsg_perm(sk, skb);
3619
3620 return err;
3621 }
3622
3623 static int selinux_netlink_recv(struct sk_buff *skb)
3624 {
3625 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3626 return -EPERM;
3627 return 0;
3628 }
3629
3630 static int ipc_alloc_security(struct task_struct *task,
3631 struct kern_ipc_perm *perm,
3632 u16 sclass)
3633 {
3634 struct task_security_struct *tsec = task->security;
3635 struct ipc_security_struct *isec;
3636
3637 isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3638 if (!isec)
3639 return -ENOMEM;
3640
3641 memset(isec, 0, sizeof(struct ipc_security_struct));
3642 isec->magic = SELINUX_MAGIC;
3643 isec->sclass = sclass;
3644 isec->ipc_perm = perm;
3645 if (tsec) {
3646 isec->sid = tsec->sid;
3647 } else {
3648 isec->sid = SECINITSID_UNLABELED;
3649 }
3650 perm->security = isec;
3651
3652 return 0;
3653 }
3654
3655 static void ipc_free_security(struct kern_ipc_perm *perm)
3656 {
3657 struct ipc_security_struct *isec = perm->security;
3658 if (!isec || isec->magic != SELINUX_MAGIC)
3659 return;
3660
3661 perm->security = NULL;
3662 kfree(isec);
3663 }
3664
3665 static int msg_msg_alloc_security(struct msg_msg *msg)
3666 {
3667 struct msg_security_struct *msec;
3668
3669 msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3670 if (!msec)
3671 return -ENOMEM;
3672
3673 memset(msec, 0, sizeof(struct msg_security_struct));
3674 msec->magic = SELINUX_MAGIC;
3675 msec->msg = msg;
3676 msec->sid = SECINITSID_UNLABELED;
3677 msg->security = msec;
3678
3679 return 0;
3680 }
3681
3682 static void msg_msg_free_security(struct msg_msg *msg)
3683 {
3684 struct msg_security_struct *msec = msg->security;
3685 if (!msec || msec->magic != SELINUX_MAGIC)
3686 return;
3687
3688 msg->security = NULL;
3689 kfree(msec);
3690 }
3691
3692 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3693 u32 perms)
3694 {
3695 struct task_security_struct *tsec;
3696 struct ipc_security_struct *isec;
3697 struct avc_audit_data ad;
3698
3699 tsec = current->security;
3700 isec = ipc_perms->security;
3701
3702 AVC_AUDIT_DATA_INIT(&ad, IPC);
3703 ad.u.ipc_id = ipc_perms->key;
3704
3705 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3706 }
3707
3708 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3709 {
3710 return msg_msg_alloc_security(msg);
3711 }
3712
3713 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3714 {
3715 msg_msg_free_security(msg);
3716 }
3717
3718 /* message queue security operations */
3719 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3720 {
3721 struct task_security_struct *tsec;
3722 struct ipc_security_struct *isec;
3723 struct avc_audit_data ad;
3724 int rc;
3725
3726 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3727 if (rc)
3728 return rc;
3729
3730 tsec = current->security;
3731 isec = msq->q_perm.security;
3732
3733 AVC_AUDIT_DATA_INIT(&ad, IPC);
3734 ad.u.ipc_id = msq->q_perm.key;
3735
3736 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3737 MSGQ__CREATE, &ad);
3738 if (rc) {
3739 ipc_free_security(&msq->q_perm);
3740 return rc;
3741 }
3742 return 0;
3743 }
3744
3745 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3746 {
3747 ipc_free_security(&msq->q_perm);
3748 }
3749
3750 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3751 {
3752 struct task_security_struct *tsec;
3753 struct ipc_security_struct *isec;
3754 struct avc_audit_data ad;
3755
3756 tsec = current->security;
3757 isec = msq->q_perm.security;
3758
3759 AVC_AUDIT_DATA_INIT(&ad, IPC);
3760 ad.u.ipc_id = msq->q_perm.key;
3761
3762 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3763 MSGQ__ASSOCIATE, &ad);
3764 }
3765
3766 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3767 {
3768 int err;
3769 int perms;
3770
3771 switch(cmd) {
3772 case IPC_INFO:
3773 case MSG_INFO:
3774 /* No specific object, just general system-wide information. */
3775 return task_has_system(current, SYSTEM__IPC_INFO);
3776 case IPC_STAT:
3777 case MSG_STAT:
3778 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3779 break;
3780 case IPC_SET:
3781 perms = MSGQ__SETATTR;
3782 break;
3783 case IPC_RMID:
3784 perms = MSGQ__DESTROY;
3785 break;
3786 default:
3787 return 0;
3788 }
3789
3790 err = ipc_has_perm(&msq->q_perm, perms);
3791 return err;
3792 }
3793
3794 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3795 {
3796 struct task_security_struct *tsec;
3797 struct ipc_security_struct *isec;
3798 struct msg_security_struct *msec;
3799 struct avc_audit_data ad;
3800 int rc;
3801
3802 tsec = current->security;
3803 isec = msq->q_perm.security;
3804 msec = msg->security;
3805
3806 /*
3807 * First time through, need to assign label to the message
3808 */
3809 if (msec->sid == SECINITSID_UNLABELED) {
3810 /*
3811 * Compute new sid based on current process and
3812 * message queue this message will be stored in
3813 */
3814 rc = security_transition_sid(tsec->sid,
3815 isec->sid,
3816 SECCLASS_MSG,
3817 &msec->sid);
3818 if (rc)
3819 return rc;
3820 }
3821
3822 AVC_AUDIT_DATA_INIT(&ad, IPC);
3823 ad.u.ipc_id = msq->q_perm.key;
3824
3825 /* Can this process write to the queue? */
3826 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3827 MSGQ__WRITE, &ad);
3828 if (!rc)
3829 /* Can this process send the message */
3830 rc = avc_has_perm(tsec->sid, msec->sid,
3831 SECCLASS_MSG, MSG__SEND, &ad);
3832 if (!rc)
3833 /* Can the message be put in the queue? */
3834 rc = avc_has_perm(msec->sid, isec->sid,
3835 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3836
3837 return rc;
3838 }
3839
3840 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3841 struct task_struct *target,
3842 long type, int mode)
3843 {
3844 struct task_security_struct *tsec;
3845 struct ipc_security_struct *isec;
3846 struct msg_security_struct *msec;
3847 struct avc_audit_data ad;
3848 int rc;
3849
3850 tsec = target->security;
3851 isec = msq->q_perm.security;
3852 msec = msg->security;
3853
3854 AVC_AUDIT_DATA_INIT(&ad, IPC);
3855 ad.u.ipc_id = msq->q_perm.key;
3856
3857 rc = avc_has_perm(tsec->sid, isec->sid,
3858 SECCLASS_MSGQ, MSGQ__READ, &ad);
3859 if (!rc)
3860 rc = avc_has_perm(tsec->sid, msec->sid,
3861 SECCLASS_MSG, MSG__RECEIVE, &ad);
3862 return rc;
3863 }
3864
3865 /* Shared Memory security operations */
3866 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3867 {
3868 struct task_security_struct *tsec;
3869 struct ipc_security_struct *isec;
3870 struct avc_audit_data ad;
3871 int rc;
3872
3873 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3874 if (rc)
3875 return rc;
3876
3877 tsec = current->security;
3878 isec = shp->shm_perm.security;
3879
3880 AVC_AUDIT_DATA_INIT(&ad, IPC);
3881 ad.u.ipc_id = shp->shm_perm.key;
3882
3883 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3884 SHM__CREATE, &ad);
3885 if (rc) {
3886 ipc_free_security(&shp->shm_perm);
3887 return rc;
3888 }
3889 return 0;
3890 }
3891
3892 static void selinux_shm_free_security(struct shmid_kernel *shp)
3893 {
3894 ipc_free_security(&shp->shm_perm);
3895 }
3896
3897 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3898 {
3899 struct task_security_struct *tsec;
3900 struct ipc_security_struct *isec;
3901 struct avc_audit_data ad;
3902
3903 tsec = current->security;
3904 isec = shp->shm_perm.security;
3905
3906 AVC_AUDIT_DATA_INIT(&ad, IPC);
3907 ad.u.ipc_id = shp->shm_perm.key;
3908
3909 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3910 SHM__ASSOCIATE, &ad);
3911 }
3912
3913 /* Note, at this point, shp is locked down */
3914 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3915 {
3916 int perms;
3917 int err;
3918
3919 switch(cmd) {
3920 case IPC_INFO:
3921 case SHM_INFO:
3922 /* No specific object, just general system-wide information. */
3923 return task_has_system(current, SYSTEM__IPC_INFO);
3924 case IPC_STAT:
3925 case SHM_STAT:
3926 perms = SHM__GETATTR | SHM__ASSOCIATE;
3927 break;
3928 case IPC_SET:
3929 perms = SHM__SETATTR;
3930 break;
3931 case SHM_LOCK:
3932 case SHM_UNLOCK:
3933 perms = SHM__LOCK;
3934 break;
3935 case IPC_RMID:
3936 perms = SHM__DESTROY;
3937 break;
3938 default:
3939 return 0;
3940 }
3941
3942 err = ipc_has_perm(&shp->shm_perm, perms);
3943 return err;
3944 }
3945
3946 static int selinux_shm_shmat(struct shmid_kernel *shp,
3947 char __user *shmaddr, int shmflg)
3948 {
3949 u32 perms;
3950 int rc;
3951
3952 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3953 if (rc)
3954 return rc;
3955
3956 if (shmflg & SHM_RDONLY)
3957 perms = SHM__READ;
3958 else
3959 perms = SHM__READ | SHM__WRITE;
3960
3961 return ipc_has_perm(&shp->shm_perm, perms);
3962 }
3963
3964 /* Semaphore security operations */
3965 static int selinux_sem_alloc_security(struct sem_array *sma)
3966 {
3967 struct task_security_struct *tsec;
3968 struct ipc_security_struct *isec;
3969 struct avc_audit_data ad;
3970 int rc;
3971
3972 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3973 if (rc)
3974 return rc;
3975
3976 tsec = current->security;
3977 isec = sma->sem_perm.security;
3978
3979 AVC_AUDIT_DATA_INIT(&ad, IPC);
3980 ad.u.ipc_id = sma->sem_perm.key;
3981
3982 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3983 SEM__CREATE, &ad);
3984 if (rc) {
3985 ipc_free_security(&sma->sem_perm);
3986 return rc;
3987 }
3988 return 0;
3989 }
3990
3991 static void selinux_sem_free_security(struct sem_array *sma)
3992 {
3993 ipc_free_security(&sma->sem_perm);
3994 }
3995
3996 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3997 {
3998 struct task_security_struct *tsec;
3999 struct ipc_security_struct *isec;
4000 struct avc_audit_data ad;
4001
4002 tsec = current->security;
4003 isec = sma->sem_perm.security;
4004
4005 AVC_AUDIT_DATA_INIT(&ad, IPC);
4006 ad.u.ipc_id = sma->sem_perm.key;
4007
4008 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4009 SEM__ASSOCIATE, &ad);
4010 }
4011
4012 /* Note, at this point, sma is locked down */
4013 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4014 {
4015 int err;
4016 u32 perms;
4017
4018 switch(cmd) {
4019 case IPC_INFO:
4020 case SEM_INFO:
4021 /* No specific object, just general system-wide information. */
4022 return task_has_system(current, SYSTEM__IPC_INFO);
4023 case GETPID:
4024 case GETNCNT:
4025 case GETZCNT:
4026 perms = SEM__GETATTR;
4027 break;
4028 case GETVAL:
4029 case GETALL:
4030 perms = SEM__READ;
4031 break;
4032 case SETVAL:
4033 case SETALL:
4034 perms = SEM__WRITE;
4035 break;
4036 case IPC_RMID:
4037 perms = SEM__DESTROY;
4038 break;
4039 case IPC_SET:
4040 perms = SEM__SETATTR;
4041 break;
4042 case IPC_STAT:
4043 case SEM_STAT:
4044 perms = SEM__GETATTR | SEM__ASSOCIATE;
4045 break;
4046 default:
4047 return 0;
4048 }
4049
4050 err = ipc_has_perm(&sma->sem_perm, perms);
4051 return err;
4052 }
4053
4054 static int selinux_sem_semop(struct sem_array *sma,
4055 struct sembuf *sops, unsigned nsops, int alter)
4056 {
4057 u32 perms;
4058
4059 if (alter)
4060 perms = SEM__READ | SEM__WRITE;
4061 else
4062 perms = SEM__READ;
4063
4064 return ipc_has_perm(&sma->sem_perm, perms);
4065 }
4066
4067 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4068 {
4069 u32 av = 0;
4070
4071 av = 0;
4072 if (flag & S_IRUGO)
4073 av |= IPC__UNIX_READ;
4074 if (flag & S_IWUGO)
4075 av |= IPC__UNIX_WRITE;
4076
4077 if (av == 0)
4078 return 0;
4079
4080 return ipc_has_perm(ipcp, av);
4081 }
4082
4083 /* module stacking operations */
4084 static int selinux_register_security (const char *name, struct security_operations *ops)
4085 {
4086 if (secondary_ops != original_ops) {
4087 printk(KERN_INFO "%s: There is already a secondary security "
4088 "module registered.\n", __FUNCTION__);
4089 return -EINVAL;
4090 }
4091
4092 secondary_ops = ops;
4093
4094 printk(KERN_INFO "%s: Registering secondary module %s\n",
4095 __FUNCTION__,
4096 name);
4097
4098 return 0;
4099 }
4100
4101 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4102 {
4103 if (ops != secondary_ops) {
4104 printk (KERN_INFO "%s: trying to unregister a security module "
4105 "that is not registered.\n", __FUNCTION__);
4106 return -EINVAL;
4107 }
4108
4109 secondary_ops = original_ops;
4110
4111 return 0;
4112 }
4113
4114 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4115 {
4116 if (inode)
4117 inode_doinit_with_dentry(inode, dentry);
4118 }
4119
4120 static int selinux_getprocattr(struct task_struct *p,
4121 char *name, void *value, size_t size)
4122 {
4123 struct task_security_struct *tsec;
4124 u32 sid, len;
4125 char *context;
4126 int error;
4127
4128 if (current != p) {
4129 error = task_has_perm(current, p, PROCESS__GETATTR);
4130 if (error)
4131 return error;
4132 }
4133
4134 if (!size)
4135 return -ERANGE;
4136
4137 tsec = p->security;
4138
4139 if (!strcmp(name, "current"))
4140 sid = tsec->sid;
4141 else if (!strcmp(name, "prev"))
4142 sid = tsec->osid;
4143 else if (!strcmp(name, "exec"))
4144 sid = tsec->exec_sid;
4145 else if (!strcmp(name, "fscreate"))
4146 sid = tsec->create_sid;
4147 else
4148 return -EINVAL;
4149
4150 if (!sid)
4151 return 0;
4152
4153 error = security_sid_to_context(sid, &context, &len);
4154 if (error)
4155 return error;
4156 if (len > size) {
4157 kfree(context);
4158 return -ERANGE;
4159 }
4160 memcpy(value, context, len);
4161 kfree(context);
4162 return len;
4163 }
4164
4165 static int selinux_setprocattr(struct task_struct *p,
4166 char *name, void *value, size_t size)
4167 {
4168 struct task_security_struct *tsec;
4169 u32 sid = 0;
4170 int error;
4171 char *str = value;
4172
4173 if (current != p) {
4174 /* SELinux only allows a process to change its own
4175 security attributes. */
4176 return -EACCES;
4177 }
4178
4179 /*
4180 * Basic control over ability to set these attributes at all.
4181 * current == p, but we'll pass them separately in case the
4182 * above restriction is ever removed.
4183 */
4184 if (!strcmp(name, "exec"))
4185 error = task_has_perm(current, p, PROCESS__SETEXEC);
4186 else if (!strcmp(name, "fscreate"))
4187 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4188 else if (!strcmp(name, "current"))
4189 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4190 else
4191 error = -EINVAL;
4192 if (error)
4193 return error;
4194
4195 /* Obtain a SID for the context, if one was specified. */
4196 if (size && str[1] && str[1] != '\n') {
4197 if (str[size-1] == '\n') {
4198 str[size-1] = 0;
4199 size--;
4200 }
4201 error = security_context_to_sid(value, size, &sid);
4202 if (error)
4203 return error;
4204 }
4205
4206 /* Permission checking based on the specified context is
4207 performed during the actual operation (execve,
4208 open/mkdir/...), when we know the full context of the
4209 operation. See selinux_bprm_set_security for the execve
4210 checks and may_create for the file creation checks. The
4211 operation will then fail if the context is not permitted. */
4212 tsec = p->security;
4213 if (!strcmp(name, "exec"))
4214 tsec->exec_sid = sid;
4215 else if (!strcmp(name, "fscreate"))
4216 tsec->create_sid = sid;
4217 else if (!strcmp(name, "current")) {
4218 struct av_decision avd;
4219
4220 if (sid == 0)
4221 return -EINVAL;
4222
4223 /* Only allow single threaded processes to change context */
4224 if (atomic_read(&p->mm->mm_users) != 1) {
4225 struct task_struct *g, *t;
4226 struct mm_struct *mm = p->mm;
4227 read_lock(&tasklist_lock);
4228 do_each_thread(g, t)
4229 if (t->mm == mm && t != p) {
4230 read_unlock(&tasklist_lock);
4231 return -EPERM;
4232 }
4233 while_each_thread(g, t);
4234 read_unlock(&tasklist_lock);
4235 }
4236
4237 /* Check permissions for the transition. */
4238 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4239 PROCESS__DYNTRANSITION, NULL);
4240 if (error)
4241 return error;
4242
4243 /* Check for ptracing, and update the task SID if ok.
4244 Otherwise, leave SID unchanged and fail. */
4245 task_lock(p);
4246 if (p->ptrace & PT_PTRACED) {
4247 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4248 SECCLASS_PROCESS,
4249 PROCESS__PTRACE, &avd);
4250 if (!error)
4251 tsec->sid = sid;
4252 task_unlock(p);
4253 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4254 PROCESS__PTRACE, &avd, error, NULL);
4255 if (error)
4256 return error;
4257 } else {
4258 tsec->sid = sid;
4259 task_unlock(p);
4260 }
4261 }
4262 else
4263 return -EINVAL;
4264
4265 return size;
4266 }
4267
4268 static struct security_operations selinux_ops = {
4269 .ptrace = selinux_ptrace,
4270 .capget = selinux_capget,
4271 .capset_check = selinux_capset_check,
4272 .capset_set = selinux_capset_set,
4273 .sysctl = selinux_sysctl,
4274 .capable = selinux_capable,
4275 .quotactl = selinux_quotactl,
4276 .quota_on = selinux_quota_on,
4277 .syslog = selinux_syslog,
4278 .vm_enough_memory = selinux_vm_enough_memory,
4279
4280 .netlink_send = selinux_netlink_send,
4281 .netlink_recv = selinux_netlink_recv,
4282
4283 .bprm_alloc_security = selinux_bprm_alloc_security,
4284 .bprm_free_security = selinux_bprm_free_security,
4285 .bprm_apply_creds = selinux_bprm_apply_creds,
4286 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4287 .bprm_set_security = selinux_bprm_set_security,
4288 .bprm_check_security = selinux_bprm_check_security,
4289 .bprm_secureexec = selinux_bprm_secureexec,
4290
4291 .sb_alloc_security = selinux_sb_alloc_security,
4292 .sb_free_security = selinux_sb_free_security,
4293 .sb_copy_data = selinux_sb_copy_data,
4294 .sb_kern_mount = selinux_sb_kern_mount,
4295 .sb_statfs = selinux_sb_statfs,
4296 .sb_mount = selinux_mount,
4297 .sb_umount = selinux_umount,
4298
4299 .inode_alloc_security = selinux_inode_alloc_security,
4300 .inode_free_security = selinux_inode_free_security,
4301 .inode_create = selinux_inode_create,
4302 .inode_post_create = selinux_inode_post_create,
4303 .inode_link = selinux_inode_link,
4304 .inode_post_link = selinux_inode_post_link,
4305 .inode_unlink = selinux_inode_unlink,
4306 .inode_symlink = selinux_inode_symlink,
4307 .inode_post_symlink = selinux_inode_post_symlink,
4308 .inode_mkdir = selinux_inode_mkdir,
4309 .inode_post_mkdir = selinux_inode_post_mkdir,
4310 .inode_rmdir = selinux_inode_rmdir,
4311 .inode_mknod = selinux_inode_mknod,
4312 .inode_post_mknod = selinux_inode_post_mknod,
4313 .inode_rename = selinux_inode_rename,
4314 .inode_post_rename = selinux_inode_post_rename,
4315 .inode_readlink = selinux_inode_readlink,
4316 .inode_follow_link = selinux_inode_follow_link,
4317 .inode_permission = selinux_inode_permission,
4318 .inode_setattr = selinux_inode_setattr,
4319 .inode_getattr = selinux_inode_getattr,
4320 .inode_setxattr = selinux_inode_setxattr,
4321 .inode_post_setxattr = selinux_inode_post_setxattr,
4322 .inode_getxattr = selinux_inode_getxattr,
4323 .inode_listxattr = selinux_inode_listxattr,
4324 .inode_removexattr = selinux_inode_removexattr,
4325 .inode_getsecurity = selinux_inode_getsecurity,
4326 .inode_setsecurity = selinux_inode_setsecurity,
4327 .inode_listsecurity = selinux_inode_listsecurity,
4328
4329 .file_permission = selinux_file_permission,
4330 .file_alloc_security = selinux_file_alloc_security,
4331 .file_free_security = selinux_file_free_security,
4332 .file_ioctl = selinux_file_ioctl,
4333 .file_mmap = selinux_file_mmap,
4334 .file_mprotect = selinux_file_mprotect,
4335 .file_lock = selinux_file_lock,
4336 .file_fcntl = selinux_file_fcntl,
4337 .file_set_fowner = selinux_file_set_fowner,
4338 .file_send_sigiotask = selinux_file_send_sigiotask,
4339 .file_receive = selinux_file_receive,
4340
4341 .task_create = selinux_task_create,
4342 .task_alloc_security = selinux_task_alloc_security,
4343 .task_free_security = selinux_task_free_security,
4344 .task_setuid = selinux_task_setuid,
4345 .task_post_setuid = selinux_task_post_setuid,
4346 .task_setgid = selinux_task_setgid,
4347 .task_setpgid = selinux_task_setpgid,
4348 .task_getpgid = selinux_task_getpgid,
4349 .task_getsid = selinux_task_getsid,
4350 .task_setgroups = selinux_task_setgroups,
4351 .task_setnice = selinux_task_setnice,
4352 .task_setrlimit = selinux_task_setrlimit,
4353 .task_setscheduler = selinux_task_setscheduler,
4354 .task_getscheduler = selinux_task_getscheduler,
4355 .task_kill = selinux_task_kill,
4356 .task_wait = selinux_task_wait,
4357 .task_prctl = selinux_task_prctl,
4358 .task_reparent_to_init = selinux_task_reparent_to_init,
4359 .task_to_inode = selinux_task_to_inode,
4360
4361 .ipc_permission = selinux_ipc_permission,
4362
4363 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4364 .msg_msg_free_security = selinux_msg_msg_free_security,
4365
4366 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4367 .msg_queue_free_security = selinux_msg_queue_free_security,
4368 .msg_queue_associate = selinux_msg_queue_associate,
4369 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4370 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4371 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4372
4373 .shm_alloc_security = selinux_shm_alloc_security,
4374 .shm_free_security = selinux_shm_free_security,
4375 .shm_associate = selinux_shm_associate,
4376 .shm_shmctl = selinux_shm_shmctl,
4377 .shm_shmat = selinux_shm_shmat,
4378
4379 .sem_alloc_security = selinux_sem_alloc_security,
4380 .sem_free_security = selinux_sem_free_security,
4381 .sem_associate = selinux_sem_associate,
4382 .sem_semctl = selinux_sem_semctl,
4383 .sem_semop = selinux_sem_semop,
4384
4385 .register_security = selinux_register_security,
4386 .unregister_security = selinux_unregister_security,
4387
4388 .d_instantiate = selinux_d_instantiate,
4389
4390 .getprocattr = selinux_getprocattr,
4391 .setprocattr = selinux_setprocattr,
4392
4393 #ifdef CONFIG_SECURITY_NETWORK
4394 .unix_stream_connect = selinux_socket_unix_stream_connect,
4395 .unix_may_send = selinux_socket_unix_may_send,
4396
4397 .socket_create = selinux_socket_create,
4398 .socket_post_create = selinux_socket_post_create,
4399 .socket_bind = selinux_socket_bind,
4400 .socket_connect = selinux_socket_connect,
4401 .socket_listen = selinux_socket_listen,
4402 .socket_accept = selinux_socket_accept,
4403 .socket_sendmsg = selinux_socket_sendmsg,
4404 .socket_recvmsg = selinux_socket_recvmsg,
4405 .socket_getsockname = selinux_socket_getsockname,
4406 .socket_getpeername = selinux_socket_getpeername,
4407 .socket_getsockopt = selinux_socket_getsockopt,
4408 .socket_setsockopt = selinux_socket_setsockopt,
4409 .socket_shutdown = selinux_socket_shutdown,
4410 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4411 .socket_getpeersec = selinux_socket_getpeersec,
4412 .sk_alloc_security = selinux_sk_alloc_security,
4413 .sk_free_security = selinux_sk_free_security,
4414 #endif
4415 };
4416
4417 static __init int selinux_init(void)
4418 {
4419 struct task_security_struct *tsec;
4420
4421 if (!selinux_enabled) {
4422 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4423 return 0;
4424 }
4425
4426 printk(KERN_INFO "SELinux: Initializing.\n");
4427
4428 /* Set the security state for the initial task. */
4429 if (task_alloc_security(current))
4430 panic("SELinux: Failed to initialize initial task.\n");
4431 tsec = current->security;
4432 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4433
4434 avc_init();
4435
4436 original_ops = secondary_ops = security_ops;
4437 if (!secondary_ops)
4438 panic ("SELinux: No initial security operations\n");
4439 if (register_security (&selinux_ops))
4440 panic("SELinux: Unable to register with kernel.\n");
4441
4442 if (selinux_enforcing) {
4443 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4444 } else {
4445 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4446 }
4447 return 0;
4448 }
4449
4450 void selinux_complete_init(void)
4451 {
4452 printk(KERN_INFO "SELinux: Completing initialization.\n");
4453
4454 /* Set up any superblocks initialized prior to the policy load. */
4455 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4456 spin_lock(&sb_security_lock);
4457 next_sb:
4458 if (!list_empty(&superblock_security_head)) {
4459 struct superblock_security_struct *sbsec =
4460 list_entry(superblock_security_head.next,
4461 struct superblock_security_struct,
4462 list);
4463 struct super_block *sb = sbsec->sb;
4464 spin_lock(&sb_lock);
4465 sb->s_count++;
4466 spin_unlock(&sb_lock);
4467 spin_unlock(&sb_security_lock);
4468 down_read(&sb->s_umount);
4469 if (sb->s_root)
4470 superblock_doinit(sb, NULL);
4471 drop_super(sb);
4472 spin_lock(&sb_security_lock);
4473 list_del_init(&sbsec->list);
4474 goto next_sb;
4475 }
4476 spin_unlock(&sb_security_lock);
4477 }
4478
4479 /* SELinux requires early initialization in order to label
4480 all processes and objects when they are created. */
4481 security_initcall(selinux_init);
4482
4483 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4484
4485 static struct nf_hook_ops selinux_ipv4_op = {
4486 .hook = selinux_ipv4_postroute_last,
4487 .owner = THIS_MODULE,
4488 .pf = PF_INET,
4489 .hooknum = NF_IP_POST_ROUTING,
4490 .priority = NF_IP_PRI_SELINUX_LAST,
4491 };
4492
4493 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4494
4495 static struct nf_hook_ops selinux_ipv6_op = {
4496 .hook = selinux_ipv6_postroute_last,
4497 .owner = THIS_MODULE,
4498 .pf = PF_INET6,
4499 .hooknum = NF_IP6_POST_ROUTING,
4500 .priority = NF_IP6_PRI_SELINUX_LAST,
4501 };
4502
4503 #endif /* IPV6 */
4504
4505 static int __init selinux_nf_ip_init(void)
4506 {
4507 int err = 0;
4508
4509 if (!selinux_enabled)
4510 goto out;
4511
4512 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4513
4514 err = nf_register_hook(&selinux_ipv4_op);
4515 if (err)
4516 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4517
4518 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4519
4520 err = nf_register_hook(&selinux_ipv6_op);
4521 if (err)
4522 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4523
4524 #endif /* IPV6 */
4525 out:
4526 return err;
4527 }
4528
4529 __initcall(selinux_nf_ip_init);
4530
4531 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4532 static void selinux_nf_ip_exit(void)
4533 {
4534 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4535
4536 nf_unregister_hook(&selinux_ipv4_op);
4537 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4538 nf_unregister_hook(&selinux_ipv6_op);
4539 #endif /* IPV6 */
4540 }
4541 #endif
4542
4543 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4544
4545 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4546 #define selinux_nf_ip_exit()
4547 #endif
4548
4549 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4550
4551 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4552 int selinux_disable(void)
4553 {
4554 extern void exit_sel_fs(void);
4555 static int selinux_disabled = 0;
4556
4557 if (ss_initialized) {
4558 /* Not permitted after initial policy load. */
4559 return -EINVAL;
4560 }
4561
4562 if (selinux_disabled) {
4563 /* Only do this once. */
4564 return -EINVAL;
4565 }
4566
4567 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4568
4569 selinux_disabled = 1;
4570
4571 /* Reset security_ops to the secondary module, dummy or capability. */
4572 security_ops = secondary_ops;
4573
4574 /* Unregister netfilter hooks. */
4575 selinux_nf_ip_exit();
4576
4577 /* Unregister selinuxfs. */
4578 exit_sel_fs();
4579
4580 return 0;
4581 }
4582 #endif
4583
4584
kernel source for telekom puls (alcatel/mediatek)