blob: 00815973d4126492d596f278431c342bc7b6efc6 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreeffad8d2008-01-29 08:49:27 -050016 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
Eric Paris828dfe12008-04-17 13:17:49 -040017 * Paul Moore <paul.moore@hp.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
27#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070028#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/errno.h>
30#include <linux/sched.h>
31#include <linux/security.h>
32#include <linux/xattr.h>
33#include <linux/capability.h>
34#include <linux/unistd.h>
35#include <linux/mm.h>
36#include <linux/mman.h>
37#include <linux/slab.h>
38#include <linux/pagemap.h>
39#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#include <linux/spinlock.h>
41#include <linux/syscalls.h>
42#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040043#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/namei.h>
45#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070046#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/netfilter_ipv4.h>
48#include <linux/netfilter_ipv6.h>
49#include <linux/tty.h>
50#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070051#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070052#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore220deb92008-01-29 08:38:23 -050053#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050054#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040055#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <asm/ioctls.h>
Paul Moored621d352008-01-29 08:43:36 -050057#include <asm/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070058#include <linux/bitops.h>
59#include <linux/interrupt.h>
60#include <linux/netdevice.h> /* for network interface checks */
61#include <linux/netlink.h>
62#include <linux/tcp.h>
63#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080064#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070065#include <linux/quota.h>
66#include <linux/un.h> /* for Unix socket types */
67#include <net/af_unix.h> /* for Unix socket types */
68#include <linux/parser.h>
69#include <linux/nfs_mount.h>
70#include <net/ipv6.h>
71#include <linux/hugetlb.h>
72#include <linux/personality.h>
73#include <linux/sysctl.h>
74#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070075#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070076#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070077#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070078#include <linux/posix-timers.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070079
80#include "avc.h"
81#include "objsec.h"
82#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050083#include "netnode.h"
Paul Moore3e112172008-04-10 10:48:14 -040084#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080085#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050086#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020087#include "audit.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070088
89#define XATTR_SELINUX_SUFFIX "selinux"
90#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
91
Eric Parisc9180a52007-11-30 13:00:35 -050092#define NUM_SEL_MNT_OPTS 4
93
Linus Torvalds1da177e2005-04-16 15:20:36 -070094extern unsigned int policydb_loaded_version;
95extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
James Morris4e5ab4c2006-06-09 00:33:33 -070096extern int selinux_compat_net;
James Morris20510f22007-10-16 23:31:32 -070097extern struct security_operations *security_ops;
Linus Torvalds1da177e2005-04-16 15:20:36 -070098
Paul Moored621d352008-01-29 08:43:36 -050099/* SECMARK reference count */
100atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400103int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700104
105static int __init enforcing_setup(char *str)
106{
Eric Parisf5269712008-05-14 11:27:45 -0400107 unsigned long enforcing;
108 if (!strict_strtoul(str, 0, &enforcing))
109 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110 return 1;
111}
112__setup("enforcing=", enforcing_setup);
113#endif
114
115#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
116int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117
118static int __init selinux_enabled_setup(char *str)
119{
Eric Parisf5269712008-05-14 11:27:45 -0400120 unsigned long enabled;
121 if (!strict_strtoul(str, 0, &enabled))
122 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700123 return 1;
124}
125__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400126#else
127int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700128#endif
129
Linus Torvalds1da177e2005-04-16 15:20:36 -0700130
James Morris6f0f0fd2008-07-10 17:02:07 +0900131/*
132 * Minimal support for a secondary security module,
133 * just to allow the use of the capability module.
134 */
Eric Paris828dfe12008-04-17 13:17:49 -0400135static struct security_operations *secondary_ops;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136
137/* Lists of inode and superblock security structures initialized
138 before the policy was loaded. */
139static LIST_HEAD(superblock_security_head);
140static DEFINE_SPINLOCK(sb_security_lock);
141
Christoph Lametere18b8902006-12-06 20:33:20 -0800142static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800143
Paul Moored621d352008-01-29 08:43:36 -0500144/**
145 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
146 *
147 * Description:
148 * This function checks the SECMARK reference counter to see if any SECMARK
149 * targets are currently configured, if the reference counter is greater than
150 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
151 * enabled, false (0) if SECMARK is disabled.
152 *
153 */
154static int selinux_secmark_enabled(void)
155{
156 return (atomic_read(&selinux_secmark_refcount) > 0);
157}
158
David Howellsd84f4f92008-11-14 10:39:23 +1100159/*
160 * initialise the security for the init task
161 */
162static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700163{
David Howells3b11a1d2008-11-14 10:39:26 +1100164 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700165 struct task_security_struct *tsec;
166
James Morris89d155e2005-10-30 14:59:21 -0800167 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100169 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700170
David Howellsd84f4f92008-11-14 10:39:23 +1100171 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100172 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700173}
174
David Howells275bb412008-11-14 10:39:19 +1100175/*
David Howells88e67f32008-11-14 10:39:21 +1100176 * get the security ID of a set of credentials
177 */
178static inline u32 cred_sid(const struct cred *cred)
179{
180 const struct task_security_struct *tsec;
181
182 tsec = cred->security;
183 return tsec->sid;
184}
185
186/*
David Howells3b11a1d2008-11-14 10:39:26 +1100187 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100188 */
189static inline u32 task_sid(const struct task_struct *task)
190{
David Howells275bb412008-11-14 10:39:19 +1100191 u32 sid;
192
193 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100194 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100195 rcu_read_unlock();
196 return sid;
197}
198
199/*
David Howells3b11a1d2008-11-14 10:39:26 +1100200 * get the subjective security ID of the current task
David Howells275bb412008-11-14 10:39:19 +1100201 */
202static inline u32 current_sid(void)
203{
204 const struct task_security_struct *tsec = current_cred()->security;
205
206 return tsec->sid;
207}
208
David Howells88e67f32008-11-14 10:39:21 +1100209/* Allocate and free functions for each kind of security blob. */
210
Linus Torvalds1da177e2005-04-16 15:20:36 -0700211static int inode_alloc_security(struct inode *inode)
212{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100214 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215
Josef Bacika02fe132008-04-04 09:35:05 +1100216 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217 if (!isec)
218 return -ENOMEM;
219
Eric Paris23970742006-09-25 23:32:01 -0700220 mutex_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 isec->inode = inode;
223 isec->sid = SECINITSID_UNLABELED;
224 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100225 isec->task_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700226 inode->i_security = isec;
227
228 return 0;
229}
230
231static void inode_free_security(struct inode *inode)
232{
233 struct inode_security_struct *isec = inode->i_security;
234 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
235
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236 spin_lock(&sbsec->isec_lock);
237 if (!list_empty(&isec->list))
238 list_del_init(&isec->list);
239 spin_unlock(&sbsec->isec_lock);
240
241 inode->i_security = NULL;
James Morris7cae7e22006-03-22 00:09:22 -0800242 kmem_cache_free(sel_inode_cache, isec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700243}
244
245static int file_alloc_security(struct file *file)
246{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700247 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100248 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700249
Stephen Smalley26d2a4b2006-02-01 03:05:55 -0800250 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251 if (!fsec)
252 return -ENOMEM;
253
David Howells275bb412008-11-14 10:39:19 +1100254 fsec->sid = sid;
255 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 file->f_security = fsec;
257
258 return 0;
259}
260
261static void file_free_security(struct file *file)
262{
263 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700264 file->f_security = NULL;
265 kfree(fsec);
266}
267
268static int superblock_alloc_security(struct super_block *sb)
269{
270 struct superblock_security_struct *sbsec;
271
James Morris89d155e2005-10-30 14:59:21 -0800272 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700273 if (!sbsec)
274 return -ENOMEM;
275
Eric Parisbc7e9822006-09-25 23:32:02 -0700276 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700277 INIT_LIST_HEAD(&sbsec->list);
278 INIT_LIST_HEAD(&sbsec->isec_head);
279 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700280 sbsec->sb = sb;
281 sbsec->sid = SECINITSID_UNLABELED;
282 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700283 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700284 sb->s_security = sbsec;
285
286 return 0;
287}
288
289static void superblock_free_security(struct super_block *sb)
290{
291 struct superblock_security_struct *sbsec = sb->s_security;
292
Linus Torvalds1da177e2005-04-16 15:20:36 -0700293 spin_lock(&sb_security_lock);
294 if (!list_empty(&sbsec->list))
295 list_del_init(&sbsec->list);
296 spin_unlock(&sb_security_lock);
297
298 sb->s_security = NULL;
299 kfree(sbsec);
300}
301
Al Viro7d877f32005-10-21 03:20:43 -0400302static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700303{
304 struct sk_security_struct *ssec;
305
James Morris89d155e2005-10-30 14:59:21 -0800306 ssec = kzalloc(sizeof(*ssec), priority);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700307 if (!ssec)
308 return -ENOMEM;
309
Linus Torvalds1da177e2005-04-16 15:20:36 -0700310 ssec->peer_sid = SECINITSID_UNLABELED;
Venkat Yekkirala892c1412006-08-04 23:08:56 -0700311 ssec->sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700312 sk->sk_security = ssec;
313
Paul Mooref74af6e2008-02-25 11:40:33 -0500314 selinux_netlbl_sk_security_reset(ssec, family);
Paul Moore99f59ed2006-08-29 17:53:48 -0700315
Linus Torvalds1da177e2005-04-16 15:20:36 -0700316 return 0;
317}
318
319static void sk_free_security(struct sock *sk)
320{
321 struct sk_security_struct *ssec = sk->sk_security;
322
Linus Torvalds1da177e2005-04-16 15:20:36 -0700323 sk->sk_security = NULL;
Paul Moore6c5b3fc2008-10-10 10:16:33 -0400324 selinux_netlbl_sk_security_free(ssec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700325 kfree(ssec);
326}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700327
328/* The security server must be initialized before
329 any labeling or access decisions can be provided. */
330extern int ss_initialized;
331
332/* The file system's label must be initialized prior to use. */
333
334static char *labeling_behaviors[6] = {
335 "uses xattr",
336 "uses transition SIDs",
337 "uses task SIDs",
338 "uses genfs_contexts",
339 "not configured for labeling",
340 "uses mountpoint labeling",
341};
342
343static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
344
345static inline int inode_doinit(struct inode *inode)
346{
347 return inode_doinit_with_dentry(inode, NULL);
348}
349
350enum {
Eric Paris31e87932007-09-19 17:19:12 -0400351 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700352 Opt_context = 1,
353 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500354 Opt_defcontext = 3,
355 Opt_rootcontext = 4,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700356};
357
Steven Whitehousea447c092008-10-13 10:46:57 +0100358static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400359 {Opt_context, CONTEXT_STR "%s"},
360 {Opt_fscontext, FSCONTEXT_STR "%s"},
361 {Opt_defcontext, DEFCONTEXT_STR "%s"},
362 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
Eric Paris31e87932007-09-19 17:19:12 -0400363 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700364};
365
366#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
367
Eric Parisc312feb2006-07-10 04:43:53 -0700368static int may_context_mount_sb_relabel(u32 sid,
369 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100370 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700371{
David Howells275bb412008-11-14 10:39:19 +1100372 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700373 int rc;
374
375 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
376 FILESYSTEM__RELABELFROM, NULL);
377 if (rc)
378 return rc;
379
380 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
381 FILESYSTEM__RELABELTO, NULL);
382 return rc;
383}
384
Eric Paris08089252006-07-10 04:43:55 -0700385static int may_context_mount_inode_relabel(u32 sid,
386 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100387 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700388{
David Howells275bb412008-11-14 10:39:19 +1100389 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700390 int rc;
391 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
392 FILESYSTEM__RELABELFROM, NULL);
393 if (rc)
394 return rc;
395
396 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
397 FILESYSTEM__ASSOCIATE, NULL);
398 return rc;
399}
400
Eric Parisc9180a52007-11-30 13:00:35 -0500401static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700402{
403 struct superblock_security_struct *sbsec = sb->s_security;
404 struct dentry *root = sb->s_root;
Eric Parisc9180a52007-11-30 13:00:35 -0500405 struct inode *root_inode = root->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700406 int rc = 0;
407
Linus Torvalds1da177e2005-04-16 15:20:36 -0700408 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
409 /* Make sure that the xattr handler exists and that no
410 error other than -ENODATA is returned by getxattr on
411 the root directory. -ENODATA is ok, as this may be
412 the first boot of the SELinux kernel before we have
413 assigned xattr values to the filesystem. */
Eric Parisc9180a52007-11-30 13:00:35 -0500414 if (!root_inode->i_op->getxattr) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700415 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
416 "xattr support\n", sb->s_id, sb->s_type->name);
417 rc = -EOPNOTSUPP;
418 goto out;
419 }
Eric Parisc9180a52007-11-30 13:00:35 -0500420 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700421 if (rc < 0 && rc != -ENODATA) {
422 if (rc == -EOPNOTSUPP)
423 printk(KERN_WARNING "SELinux: (dev %s, type "
424 "%s) has no security xattr handler\n",
425 sb->s_id, sb->s_type->name);
426 else
427 printk(KERN_WARNING "SELinux: (dev %s, type "
428 "%s) getxattr errno %d\n", sb->s_id,
429 sb->s_type->name, -rc);
430 goto out;
431 }
432 }
433
Linus Torvalds1da177e2005-04-16 15:20:36 -0700434 sbsec->initialized = 1;
435
Eric Parisc9180a52007-11-30 13:00:35 -0500436 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Eric Parisfadcdb42007-02-22 18:11:31 -0500437 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700438 sb->s_id, sb->s_type->name);
Eric Parisc9180a52007-11-30 13:00:35 -0500439 else
Eric Parisfadcdb42007-02-22 18:11:31 -0500440 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700441 sb->s_id, sb->s_type->name,
442 labeling_behaviors[sbsec->behavior-1]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443
444 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500445 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700446
447 /* Initialize any other inodes associated with the superblock, e.g.
448 inodes created prior to initial policy load or inodes created
449 during get_sb by a pseudo filesystem that directly
450 populates itself. */
451 spin_lock(&sbsec->isec_lock);
452next_inode:
453 if (!list_empty(&sbsec->isec_head)) {
454 struct inode_security_struct *isec =
455 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500456 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700457 struct inode *inode = isec->inode;
458 spin_unlock(&sbsec->isec_lock);
459 inode = igrab(inode);
460 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500461 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700462 inode_doinit(inode);
463 iput(inode);
464 }
465 spin_lock(&sbsec->isec_lock);
466 list_del_init(&isec->list);
467 goto next_inode;
468 }
469 spin_unlock(&sbsec->isec_lock);
470out:
Eric Parisc9180a52007-11-30 13:00:35 -0500471 return rc;
472}
473
474/*
475 * This function should allow an FS to ask what it's mount security
476 * options were so it can use those later for submounts, displaying
477 * mount options, or whatever.
478 */
479static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500480 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500481{
482 int rc = 0, i;
483 struct superblock_security_struct *sbsec = sb->s_security;
484 char *context = NULL;
485 u32 len;
486 char tmp;
487
Eric Parise0007522008-03-05 10:31:54 -0500488 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500489
490 if (!sbsec->initialized)
491 return -EINVAL;
492
493 if (!ss_initialized)
494 return -EINVAL;
495
496 /*
497 * if we ever use sbsec flags for anything other than tracking mount
498 * settings this is going to need a mask
499 */
500 tmp = sbsec->flags;
501 /* count the number of mount options for this sb */
502 for (i = 0; i < 8; i++) {
503 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500504 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500505 tmp >>= 1;
506 }
507
Eric Parise0007522008-03-05 10:31:54 -0500508 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
509 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500510 rc = -ENOMEM;
511 goto out_free;
512 }
513
Eric Parise0007522008-03-05 10:31:54 -0500514 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
515 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500516 rc = -ENOMEM;
517 goto out_free;
518 }
519
520 i = 0;
521 if (sbsec->flags & FSCONTEXT_MNT) {
522 rc = security_sid_to_context(sbsec->sid, &context, &len);
523 if (rc)
524 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500525 opts->mnt_opts[i] = context;
526 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500527 }
528 if (sbsec->flags & CONTEXT_MNT) {
529 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
530 if (rc)
531 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500532 opts->mnt_opts[i] = context;
533 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500534 }
535 if (sbsec->flags & DEFCONTEXT_MNT) {
536 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
537 if (rc)
538 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500539 opts->mnt_opts[i] = context;
540 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500541 }
542 if (sbsec->flags & ROOTCONTEXT_MNT) {
543 struct inode *root = sbsec->sb->s_root->d_inode;
544 struct inode_security_struct *isec = root->i_security;
545
546 rc = security_sid_to_context(isec->sid, &context, &len);
547 if (rc)
548 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500549 opts->mnt_opts[i] = context;
550 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500551 }
552
Eric Parise0007522008-03-05 10:31:54 -0500553 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500554
555 return 0;
556
557out_free:
Eric Parise0007522008-03-05 10:31:54 -0500558 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500559 return rc;
560}
561
562static int bad_option(struct superblock_security_struct *sbsec, char flag,
563 u32 old_sid, u32 new_sid)
564{
565 /* check if the old mount command had the same options */
566 if (sbsec->initialized)
567 if (!(sbsec->flags & flag) ||
568 (old_sid != new_sid))
569 return 1;
570
571 /* check if we were passed the same options twice,
572 * aka someone passed context=a,context=b
573 */
574 if (!sbsec->initialized)
575 if (sbsec->flags & flag)
576 return 1;
577 return 0;
578}
Eric Parise0007522008-03-05 10:31:54 -0500579
Eric Parisc9180a52007-11-30 13:00:35 -0500580/*
581 * Allow filesystems with binary mount data to explicitly set mount point
582 * labeling information.
583 */
Eric Parise0007522008-03-05 10:31:54 -0500584static int selinux_set_mnt_opts(struct super_block *sb,
585 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500586{
David Howells275bb412008-11-14 10:39:19 +1100587 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500588 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500589 struct superblock_security_struct *sbsec = sb->s_security;
590 const char *name = sb->s_type->name;
James Morris089be432008-07-15 18:32:49 +1000591 struct inode *inode = sbsec->sb->s_root->d_inode;
592 struct inode_security_struct *root_isec = inode->i_security;
Eric Parisc9180a52007-11-30 13:00:35 -0500593 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
594 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500595 char **mount_options = opts->mnt_opts;
596 int *flags = opts->mnt_opts_flags;
597 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500598
599 mutex_lock(&sbsec->lock);
600
601 if (!ss_initialized) {
602 if (!num_opts) {
603 /* Defer initialization until selinux_complete_init,
604 after the initial policy is loaded and the security
605 server is ready to handle calls. */
606 spin_lock(&sb_security_lock);
607 if (list_empty(&sbsec->list))
608 list_add(&sbsec->list, &superblock_security_head);
609 spin_unlock(&sb_security_lock);
610 goto out;
611 }
612 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400613 printk(KERN_WARNING "SELinux: Unable to set superblock options "
614 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500615 goto out;
616 }
617
618 /*
Eric Parise0007522008-03-05 10:31:54 -0500619 * Binary mount data FS will come through this function twice. Once
620 * from an explicit call and once from the generic calls from the vfs.
621 * Since the generic VFS calls will not contain any security mount data
622 * we need to skip the double mount verification.
623 *
624 * This does open a hole in which we will not notice if the first
625 * mount using this sb set explict options and a second mount using
626 * this sb does not set any security options. (The first options
627 * will be used for both mounts)
628 */
629 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
630 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400631 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500632
633 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500634 * parse the mount options, check if they are valid sids.
635 * also check if someone is trying to mount the same sb more
636 * than once with different security options.
637 */
638 for (i = 0; i < num_opts; i++) {
639 u32 sid;
640 rc = security_context_to_sid(mount_options[i],
641 strlen(mount_options[i]), &sid);
642 if (rc) {
643 printk(KERN_WARNING "SELinux: security_context_to_sid"
644 "(%s) failed for (dev %s, type %s) errno=%d\n",
645 mount_options[i], sb->s_id, name, rc);
646 goto out;
647 }
648 switch (flags[i]) {
649 case FSCONTEXT_MNT:
650 fscontext_sid = sid;
651
652 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
653 fscontext_sid))
654 goto out_double_mount;
655
656 sbsec->flags |= FSCONTEXT_MNT;
657 break;
658 case CONTEXT_MNT:
659 context_sid = sid;
660
661 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
662 context_sid))
663 goto out_double_mount;
664
665 sbsec->flags |= CONTEXT_MNT;
666 break;
667 case ROOTCONTEXT_MNT:
668 rootcontext_sid = sid;
669
670 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
671 rootcontext_sid))
672 goto out_double_mount;
673
674 sbsec->flags |= ROOTCONTEXT_MNT;
675
676 break;
677 case DEFCONTEXT_MNT:
678 defcontext_sid = sid;
679
680 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
681 defcontext_sid))
682 goto out_double_mount;
683
684 sbsec->flags |= DEFCONTEXT_MNT;
685
686 break;
687 default:
688 rc = -EINVAL;
689 goto out;
690 }
691 }
692
693 if (sbsec->initialized) {
694 /* previously mounted with options, but not on this attempt? */
695 if (sbsec->flags && !num_opts)
696 goto out_double_mount;
697 rc = 0;
698 goto out;
699 }
700
James Morris089be432008-07-15 18:32:49 +1000701 if (strcmp(sb->s_type->name, "proc") == 0)
Eric Parisc9180a52007-11-30 13:00:35 -0500702 sbsec->proc = 1;
703
704 /* Determine the labeling behavior to use for this filesystem type. */
Stephen Smalley459c19f2008-12-05 09:12:19 -0500705 rc = security_fs_use(sbsec->proc ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
Eric Parisc9180a52007-11-30 13:00:35 -0500706 if (rc) {
707 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
James Morris089be432008-07-15 18:32:49 +1000708 __func__, sb->s_type->name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500709 goto out;
710 }
711
712 /* sets the context of the superblock for the fs being mounted. */
713 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100714 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500715 if (rc)
716 goto out;
717
718 sbsec->sid = fscontext_sid;
719 }
720
721 /*
722 * Switch to using mount point labeling behavior.
723 * sets the label used on all file below the mountpoint, and will set
724 * the superblock context if not already set.
725 */
726 if (context_sid) {
727 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100728 rc = may_context_mount_sb_relabel(context_sid, sbsec,
729 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500730 if (rc)
731 goto out;
732 sbsec->sid = context_sid;
733 } else {
David Howells275bb412008-11-14 10:39:19 +1100734 rc = may_context_mount_inode_relabel(context_sid, sbsec,
735 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500736 if (rc)
737 goto out;
738 }
739 if (!rootcontext_sid)
740 rootcontext_sid = context_sid;
741
742 sbsec->mntpoint_sid = context_sid;
743 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
744 }
745
746 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100747 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
748 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500749 if (rc)
750 goto out;
751
752 root_isec->sid = rootcontext_sid;
753 root_isec->initialized = 1;
754 }
755
756 if (defcontext_sid) {
757 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
758 rc = -EINVAL;
759 printk(KERN_WARNING "SELinux: defcontext option is "
760 "invalid for this filesystem type\n");
761 goto out;
762 }
763
764 if (defcontext_sid != sbsec->def_sid) {
765 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100766 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500767 if (rc)
768 goto out;
769 }
770
771 sbsec->def_sid = defcontext_sid;
772 }
773
774 rc = sb_finish_set_opts(sb);
775out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700776 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700777 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500778out_double_mount:
779 rc = -EINVAL;
780 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
781 "security settings for (dev %s, type %s)\n", sb->s_id, name);
782 goto out;
783}
784
785static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
786 struct super_block *newsb)
787{
788 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
789 struct superblock_security_struct *newsbsec = newsb->s_security;
790
791 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
792 int set_context = (oldsbsec->flags & CONTEXT_MNT);
793 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
794
Eric Paris0f5e6422008-04-21 16:24:11 -0400795 /*
796 * if the parent was able to be mounted it clearly had no special lsm
797 * mount options. thus we can safely put this sb on the list and deal
798 * with it later
799 */
800 if (!ss_initialized) {
801 spin_lock(&sb_security_lock);
802 if (list_empty(&newsbsec->list))
803 list_add(&newsbsec->list, &superblock_security_head);
804 spin_unlock(&sb_security_lock);
805 return;
806 }
Eric Parisc9180a52007-11-30 13:00:35 -0500807
Eric Parisc9180a52007-11-30 13:00:35 -0500808 /* how can we clone if the old one wasn't set up?? */
809 BUG_ON(!oldsbsec->initialized);
810
Eric Paris5a552612008-04-09 14:08:35 -0400811 /* if fs is reusing a sb, just let its options stand... */
812 if (newsbsec->initialized)
813 return;
814
Eric Parisc9180a52007-11-30 13:00:35 -0500815 mutex_lock(&newsbsec->lock);
816
817 newsbsec->flags = oldsbsec->flags;
818
819 newsbsec->sid = oldsbsec->sid;
820 newsbsec->def_sid = oldsbsec->def_sid;
821 newsbsec->behavior = oldsbsec->behavior;
822
823 if (set_context) {
824 u32 sid = oldsbsec->mntpoint_sid;
825
826 if (!set_fscontext)
827 newsbsec->sid = sid;
828 if (!set_rootcontext) {
829 struct inode *newinode = newsb->s_root->d_inode;
830 struct inode_security_struct *newisec = newinode->i_security;
831 newisec->sid = sid;
832 }
833 newsbsec->mntpoint_sid = sid;
834 }
835 if (set_rootcontext) {
836 const struct inode *oldinode = oldsb->s_root->d_inode;
837 const struct inode_security_struct *oldisec = oldinode->i_security;
838 struct inode *newinode = newsb->s_root->d_inode;
839 struct inode_security_struct *newisec = newinode->i_security;
840
841 newisec->sid = oldisec->sid;
842 }
843
844 sb_finish_set_opts(newsb);
845 mutex_unlock(&newsbsec->lock);
846}
847
Adrian Bunk2e1479d2008-03-17 22:29:23 +0200848static int selinux_parse_opts_str(char *options,
849 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500850{
Eric Parise0007522008-03-05 10:31:54 -0500851 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -0500852 char *context = NULL, *defcontext = NULL;
853 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -0500854 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500855
Eric Parise0007522008-03-05 10:31:54 -0500856 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500857
858 /* Standard string-based options. */
859 while ((p = strsep(&options, "|")) != NULL) {
860 int token;
861 substring_t args[MAX_OPT_ARGS];
862
863 if (!*p)
864 continue;
865
866 token = match_token(p, tokens, args);
867
868 switch (token) {
869 case Opt_context:
870 if (context || defcontext) {
871 rc = -EINVAL;
872 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
873 goto out_err;
874 }
875 context = match_strdup(&args[0]);
876 if (!context) {
877 rc = -ENOMEM;
878 goto out_err;
879 }
880 break;
881
882 case Opt_fscontext:
883 if (fscontext) {
884 rc = -EINVAL;
885 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
886 goto out_err;
887 }
888 fscontext = match_strdup(&args[0]);
889 if (!fscontext) {
890 rc = -ENOMEM;
891 goto out_err;
892 }
893 break;
894
895 case Opt_rootcontext:
896 if (rootcontext) {
897 rc = -EINVAL;
898 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
899 goto out_err;
900 }
901 rootcontext = match_strdup(&args[0]);
902 if (!rootcontext) {
903 rc = -ENOMEM;
904 goto out_err;
905 }
906 break;
907
908 case Opt_defcontext:
909 if (context || defcontext) {
910 rc = -EINVAL;
911 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
912 goto out_err;
913 }
914 defcontext = match_strdup(&args[0]);
915 if (!defcontext) {
916 rc = -ENOMEM;
917 goto out_err;
918 }
919 break;
920
921 default:
922 rc = -EINVAL;
923 printk(KERN_WARNING "SELinux: unknown mount option\n");
924 goto out_err;
925
926 }
927 }
928
Eric Parise0007522008-03-05 10:31:54 -0500929 rc = -ENOMEM;
930 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
931 if (!opts->mnt_opts)
932 goto out_err;
933
934 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
935 if (!opts->mnt_opts_flags) {
936 kfree(opts->mnt_opts);
937 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -0500938 }
939
Eric Parise0007522008-03-05 10:31:54 -0500940 if (fscontext) {
941 opts->mnt_opts[num_mnt_opts] = fscontext;
942 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
943 }
944 if (context) {
945 opts->mnt_opts[num_mnt_opts] = context;
946 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
947 }
948 if (rootcontext) {
949 opts->mnt_opts[num_mnt_opts] = rootcontext;
950 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
951 }
952 if (defcontext) {
953 opts->mnt_opts[num_mnt_opts] = defcontext;
954 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
955 }
956
957 opts->num_mnt_opts = num_mnt_opts;
958 return 0;
959
Eric Parisc9180a52007-11-30 13:00:35 -0500960out_err:
961 kfree(context);
962 kfree(defcontext);
963 kfree(fscontext);
964 kfree(rootcontext);
965 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700966}
Eric Parise0007522008-03-05 10:31:54 -0500967/*
968 * string mount options parsing and call set the sbsec
969 */
970static int superblock_doinit(struct super_block *sb, void *data)
971{
972 int rc = 0;
973 char *options = data;
974 struct security_mnt_opts opts;
975
976 security_init_mnt_opts(&opts);
977
978 if (!data)
979 goto out;
980
981 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
982
983 rc = selinux_parse_opts_str(options, &opts);
984 if (rc)
985 goto out_err;
986
987out:
988 rc = selinux_set_mnt_opts(sb, &opts);
989
990out_err:
991 security_free_mnt_opts(&opts);
992 return rc;
993}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700994
Adrian Bunk3583a712008-07-22 20:21:23 +0300995static void selinux_write_opts(struct seq_file *m,
996 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +1000997{
998 int i;
999 char *prefix;
1000
1001 for (i = 0; i < opts->num_mnt_opts; i++) {
1002 char *has_comma = strchr(opts->mnt_opts[i], ',');
1003
1004 switch (opts->mnt_opts_flags[i]) {
1005 case CONTEXT_MNT:
1006 prefix = CONTEXT_STR;
1007 break;
1008 case FSCONTEXT_MNT:
1009 prefix = FSCONTEXT_STR;
1010 break;
1011 case ROOTCONTEXT_MNT:
1012 prefix = ROOTCONTEXT_STR;
1013 break;
1014 case DEFCONTEXT_MNT:
1015 prefix = DEFCONTEXT_STR;
1016 break;
1017 default:
1018 BUG();
1019 };
1020 /* we need a comma before each option */
1021 seq_putc(m, ',');
1022 seq_puts(m, prefix);
1023 if (has_comma)
1024 seq_putc(m, '\"');
1025 seq_puts(m, opts->mnt_opts[i]);
1026 if (has_comma)
1027 seq_putc(m, '\"');
1028 }
1029}
1030
1031static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1032{
1033 struct security_mnt_opts opts;
1034 int rc;
1035
1036 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001037 if (rc) {
1038 /* before policy load we may get EINVAL, don't show anything */
1039 if (rc == -EINVAL)
1040 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001041 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001042 }
Eric Paris2069f452008-07-04 09:47:13 +10001043
1044 selinux_write_opts(m, &opts);
1045
1046 security_free_mnt_opts(&opts);
1047
1048 return rc;
1049}
1050
Linus Torvalds1da177e2005-04-16 15:20:36 -07001051static inline u16 inode_mode_to_security_class(umode_t mode)
1052{
1053 switch (mode & S_IFMT) {
1054 case S_IFSOCK:
1055 return SECCLASS_SOCK_FILE;
1056 case S_IFLNK:
1057 return SECCLASS_LNK_FILE;
1058 case S_IFREG:
1059 return SECCLASS_FILE;
1060 case S_IFBLK:
1061 return SECCLASS_BLK_FILE;
1062 case S_IFDIR:
1063 return SECCLASS_DIR;
1064 case S_IFCHR:
1065 return SECCLASS_CHR_FILE;
1066 case S_IFIFO:
1067 return SECCLASS_FIFO_FILE;
1068
1069 }
1070
1071 return SECCLASS_FILE;
1072}
1073
James Morris13402582005-09-30 14:24:34 -04001074static inline int default_protocol_stream(int protocol)
1075{
1076 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1077}
1078
1079static inline int default_protocol_dgram(int protocol)
1080{
1081 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1082}
1083
Linus Torvalds1da177e2005-04-16 15:20:36 -07001084static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1085{
1086 switch (family) {
1087 case PF_UNIX:
1088 switch (type) {
1089 case SOCK_STREAM:
1090 case SOCK_SEQPACKET:
1091 return SECCLASS_UNIX_STREAM_SOCKET;
1092 case SOCK_DGRAM:
1093 return SECCLASS_UNIX_DGRAM_SOCKET;
1094 }
1095 break;
1096 case PF_INET:
1097 case PF_INET6:
1098 switch (type) {
1099 case SOCK_STREAM:
James Morris13402582005-09-30 14:24:34 -04001100 if (default_protocol_stream(protocol))
1101 return SECCLASS_TCP_SOCKET;
1102 else
1103 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001104 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001105 if (default_protocol_dgram(protocol))
1106 return SECCLASS_UDP_SOCKET;
1107 else
1108 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001109 case SOCK_DCCP:
1110 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001111 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001112 return SECCLASS_RAWIP_SOCKET;
1113 }
1114 break;
1115 case PF_NETLINK:
1116 switch (protocol) {
1117 case NETLINK_ROUTE:
1118 return SECCLASS_NETLINK_ROUTE_SOCKET;
1119 case NETLINK_FIREWALL:
1120 return SECCLASS_NETLINK_FIREWALL_SOCKET;
James Morris216efaa2005-08-15 20:34:48 -07001121 case NETLINK_INET_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001122 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1123 case NETLINK_NFLOG:
1124 return SECCLASS_NETLINK_NFLOG_SOCKET;
1125 case NETLINK_XFRM:
1126 return SECCLASS_NETLINK_XFRM_SOCKET;
1127 case NETLINK_SELINUX:
1128 return SECCLASS_NETLINK_SELINUX_SOCKET;
1129 case NETLINK_AUDIT:
1130 return SECCLASS_NETLINK_AUDIT_SOCKET;
1131 case NETLINK_IP6_FW:
1132 return SECCLASS_NETLINK_IP6FW_SOCKET;
1133 case NETLINK_DNRTMSG:
1134 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001135 case NETLINK_KOBJECT_UEVENT:
1136 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001137 default:
1138 return SECCLASS_NETLINK_SOCKET;
1139 }
1140 case PF_PACKET:
1141 return SECCLASS_PACKET_SOCKET;
1142 case PF_KEY:
1143 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001144 case PF_APPLETALK:
1145 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001146 }
1147
1148 return SECCLASS_SOCKET;
1149}
1150
1151#ifdef CONFIG_PROC_FS
1152static int selinux_proc_get_sid(struct proc_dir_entry *de,
1153 u16 tclass,
1154 u32 *sid)
1155{
1156 int buflen, rc;
1157 char *buffer, *path, *end;
1158
Eric Paris828dfe12008-04-17 13:17:49 -04001159 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001160 if (!buffer)
1161 return -ENOMEM;
1162
1163 buflen = PAGE_SIZE;
1164 end = buffer+buflen;
1165 *--end = '\0';
1166 buflen--;
1167 path = end-1;
1168 *path = '/';
1169 while (de && de != de->parent) {
1170 buflen -= de->namelen + 1;
1171 if (buflen < 0)
1172 break;
1173 end -= de->namelen;
1174 memcpy(end, de->name, de->namelen);
1175 *--end = '/';
1176 path = end;
1177 de = de->parent;
1178 }
1179 rc = security_genfs_sid("proc", path, tclass, sid);
1180 free_page((unsigned long)buffer);
1181 return rc;
1182}
1183#else
1184static int selinux_proc_get_sid(struct proc_dir_entry *de,
1185 u16 tclass,
1186 u32 *sid)
1187{
1188 return -EINVAL;
1189}
1190#endif
1191
1192/* The inode's security attributes must be initialized before first use. */
1193static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1194{
1195 struct superblock_security_struct *sbsec = NULL;
1196 struct inode_security_struct *isec = inode->i_security;
1197 u32 sid;
1198 struct dentry *dentry;
1199#define INITCONTEXTLEN 255
1200 char *context = NULL;
1201 unsigned len = 0;
1202 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001203
1204 if (isec->initialized)
1205 goto out;
1206
Eric Paris23970742006-09-25 23:32:01 -07001207 mutex_lock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001208 if (isec->initialized)
Eric Paris23970742006-09-25 23:32:01 -07001209 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001210
1211 sbsec = inode->i_sb->s_security;
1212 if (!sbsec->initialized) {
1213 /* Defer initialization until selinux_complete_init,
1214 after the initial policy is loaded and the security
1215 server is ready to handle calls. */
1216 spin_lock(&sbsec->isec_lock);
1217 if (list_empty(&isec->list))
1218 list_add(&isec->list, &sbsec->isec_head);
1219 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001220 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001221 }
1222
1223 switch (sbsec->behavior) {
1224 case SECURITY_FS_USE_XATTR:
1225 if (!inode->i_op->getxattr) {
1226 isec->sid = sbsec->def_sid;
1227 break;
1228 }
1229
1230 /* Need a dentry, since the xattr API requires one.
1231 Life would be simpler if we could just pass the inode. */
1232 if (opt_dentry) {
1233 /* Called from d_instantiate or d_splice_alias. */
1234 dentry = dget(opt_dentry);
1235 } else {
1236 /* Called from selinux_complete_init, try to find a dentry. */
1237 dentry = d_find_alias(inode);
1238 }
1239 if (!dentry) {
Eric Paris744ba352008-04-17 11:52:44 -04001240 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001241 "ino=%ld\n", __func__, inode->i_sb->s_id,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001242 inode->i_ino);
Eric Paris23970742006-09-25 23:32:01 -07001243 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001244 }
1245
1246 len = INITCONTEXTLEN;
Stephen Smalley869ab512008-04-04 08:46:05 -04001247 context = kmalloc(len, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001248 if (!context) {
1249 rc = -ENOMEM;
1250 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001251 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001252 }
1253 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1254 context, len);
1255 if (rc == -ERANGE) {
1256 /* Need a larger buffer. Query for the right size. */
1257 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1258 NULL, 0);
1259 if (rc < 0) {
1260 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001261 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001262 }
1263 kfree(context);
1264 len = rc;
Stephen Smalley869ab512008-04-04 08:46:05 -04001265 context = kmalloc(len, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001266 if (!context) {
1267 rc = -ENOMEM;
1268 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001269 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001270 }
1271 rc = inode->i_op->getxattr(dentry,
1272 XATTR_NAME_SELINUX,
1273 context, len);
1274 }
1275 dput(dentry);
1276 if (rc < 0) {
1277 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001278 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001279 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001280 -rc, inode->i_sb->s_id, inode->i_ino);
1281 kfree(context);
Eric Paris23970742006-09-25 23:32:01 -07001282 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001283 }
1284 /* Map ENODATA to the default file SID */
1285 sid = sbsec->def_sid;
1286 rc = 0;
1287 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001288 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001289 sbsec->def_sid,
1290 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001291 if (rc) {
Eric Paris744ba352008-04-17 11:52:44 -04001292 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
Linus Torvalds1da177e2005-04-16 15:20:36 -07001293 "returned %d for dev=%s ino=%ld\n",
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001294 __func__, context, -rc,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001295 inode->i_sb->s_id, inode->i_ino);
1296 kfree(context);
1297 /* Leave with the unlabeled SID */
1298 rc = 0;
1299 break;
1300 }
1301 }
1302 kfree(context);
1303 isec->sid = sid;
1304 break;
1305 case SECURITY_FS_USE_TASK:
1306 isec->sid = isec->task_sid;
1307 break;
1308 case SECURITY_FS_USE_TRANS:
1309 /* Default to the fs SID. */
1310 isec->sid = sbsec->sid;
1311
1312 /* Try to obtain a transition SID. */
1313 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1314 rc = security_transition_sid(isec->task_sid,
1315 sbsec->sid,
1316 isec->sclass,
1317 &sid);
1318 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001319 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001320 isec->sid = sid;
1321 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001322 case SECURITY_FS_USE_MNTPOINT:
1323 isec->sid = sbsec->mntpoint_sid;
1324 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001325 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001326 /* Default to the fs superblock SID. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001327 isec->sid = sbsec->sid;
1328
Stephen Smalleyea6b1842008-09-22 15:41:19 -04001329 if (sbsec->proc && !S_ISLNK(inode->i_mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001330 struct proc_inode *proci = PROC_I(inode);
1331 if (proci->pde) {
1332 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1333 rc = selinux_proc_get_sid(proci->pde,
1334 isec->sclass,
1335 &sid);
1336 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001337 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001338 isec->sid = sid;
1339 }
1340 }
1341 break;
1342 }
1343
1344 isec->initialized = 1;
1345
Eric Paris23970742006-09-25 23:32:01 -07001346out_unlock:
1347 mutex_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001348out:
1349 if (isec->sclass == SECCLASS_FILE)
1350 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001351 return rc;
1352}
1353
1354/* Convert a Linux signal to an access vector. */
1355static inline u32 signal_to_av(int sig)
1356{
1357 u32 perm = 0;
1358
1359 switch (sig) {
1360 case SIGCHLD:
1361 /* Commonly granted from child to parent. */
1362 perm = PROCESS__SIGCHLD;
1363 break;
1364 case SIGKILL:
1365 /* Cannot be caught or ignored */
1366 perm = PROCESS__SIGKILL;
1367 break;
1368 case SIGSTOP:
1369 /* Cannot be caught or ignored */
1370 perm = PROCESS__SIGSTOP;
1371 break;
1372 default:
1373 /* All other signals. */
1374 perm = PROCESS__SIGNAL;
1375 break;
1376 }
1377
1378 return perm;
1379}
1380
David Howells275bb412008-11-14 10:39:19 +11001381/*
David Howellsd84f4f92008-11-14 10:39:23 +11001382 * Check permission between a pair of credentials
1383 * fork check, ptrace check, etc.
1384 */
1385static int cred_has_perm(const struct cred *actor,
1386 const struct cred *target,
1387 u32 perms)
1388{
1389 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1390
1391 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1392}
1393
1394/*
David Howells88e67f32008-11-14 10:39:21 +11001395 * Check permission between a pair of tasks, e.g. signal checks,
David Howells275bb412008-11-14 10:39:19 +11001396 * fork check, ptrace check, etc.
1397 * tsk1 is the actor and tsk2 is the target
David Howells3b11a1d2008-11-14 10:39:26 +11001398 * - this uses the default subjective creds of tsk1
David Howells275bb412008-11-14 10:39:19 +11001399 */
1400static int task_has_perm(const struct task_struct *tsk1,
1401 const struct task_struct *tsk2,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001402 u32 perms)
1403{
David Howells275bb412008-11-14 10:39:19 +11001404 const struct task_security_struct *__tsec1, *__tsec2;
1405 u32 sid1, sid2;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001406
David Howells275bb412008-11-14 10:39:19 +11001407 rcu_read_lock();
1408 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1409 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1410 rcu_read_unlock();
1411 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001412}
1413
David Howells3b11a1d2008-11-14 10:39:26 +11001414/*
1415 * Check permission between current and another task, e.g. signal checks,
1416 * fork check, ptrace check, etc.
1417 * current is the actor and tsk2 is the target
1418 * - this uses current's subjective creds
1419 */
1420static int current_has_perm(const struct task_struct *tsk,
1421 u32 perms)
1422{
1423 u32 sid, tsid;
1424
1425 sid = current_sid();
1426 tsid = task_sid(tsk);
1427 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1428}
1429
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001430#if CAP_LAST_CAP > 63
1431#error Fix SELinux to handle capabilities > 63.
1432#endif
1433
Linus Torvalds1da177e2005-04-16 15:20:36 -07001434/* Check whether a task is allowed to use a capability. */
1435static int task_has_capability(struct task_struct *tsk,
David Howells3699c532009-01-06 22:27:01 +00001436 const struct cred *cred,
Eric Paris06112162008-11-11 22:02:50 +11001437 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001438{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001439 struct avc_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001440 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001441 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001442 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001443 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001444 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001445
Eric Paris828dfe12008-04-17 13:17:49 -04001446 AVC_AUDIT_DATA_INIT(&ad, CAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001447 ad.tsk = tsk;
1448 ad.u.cap = cap;
1449
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001450 switch (CAP_TO_INDEX(cap)) {
1451 case 0:
1452 sclass = SECCLASS_CAPABILITY;
1453 break;
1454 case 1:
1455 sclass = SECCLASS_CAPABILITY2;
1456 break;
1457 default:
1458 printk(KERN_ERR
1459 "SELinux: out of range capability %d\n", cap);
1460 BUG();
1461 }
Eric Paris06112162008-11-11 22:02:50 +11001462
David Howells275bb412008-11-14 10:39:19 +11001463 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris06112162008-11-11 22:02:50 +11001464 if (audit == SECURITY_CAP_AUDIT)
David Howells275bb412008-11-14 10:39:19 +11001465 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
Eric Paris06112162008-11-11 22:02:50 +11001466 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001467}
1468
1469/* Check whether a task is allowed to use a system operation. */
1470static int task_has_system(struct task_struct *tsk,
1471 u32 perms)
1472{
David Howells275bb412008-11-14 10:39:19 +11001473 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001474
David Howells275bb412008-11-14 10:39:19 +11001475 return avc_has_perm(sid, SECINITSID_KERNEL,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001476 SECCLASS_SYSTEM, perms, NULL);
1477}
1478
1479/* Check whether a task has a particular permission to an inode.
1480 The 'adp' parameter is optional and allows other audit
1481 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001482static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001483 struct inode *inode,
1484 u32 perms,
1485 struct avc_audit_data *adp)
1486{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001487 struct inode_security_struct *isec;
1488 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001489 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490
Eric Paris828dfe12008-04-17 13:17:49 -04001491 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001492 return 0;
1493
David Howells88e67f32008-11-14 10:39:21 +11001494 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001495 isec = inode->i_security;
1496
1497 if (!adp) {
1498 adp = &ad;
1499 AVC_AUDIT_DATA_INIT(&ad, FS);
1500 ad.u.fs.inode = inode;
1501 }
1502
David Howells275bb412008-11-14 10:39:19 +11001503 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001504}
1505
1506/* Same as inode_has_perm, but pass explicit audit data containing
1507 the dentry to help the auditing code to more easily generate the
1508 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001509static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510 struct vfsmount *mnt,
1511 struct dentry *dentry,
1512 u32 av)
1513{
1514 struct inode *inode = dentry->d_inode;
1515 struct avc_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001516
Eric Paris828dfe12008-04-17 13:17:49 -04001517 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001518 ad.u.fs.path.mnt = mnt;
1519 ad.u.fs.path.dentry = dentry;
David Howells88e67f32008-11-14 10:39:21 +11001520 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001521}
1522
1523/* Check whether a task can use an open file descriptor to
1524 access an inode in a given way. Check access to the
1525 descriptor itself, and then use dentry_has_perm to
1526 check a particular permission to the file.
1527 Access to the descriptor is implicitly granted if it
1528 has the same SID as the process. If av is zero, then
1529 access to the file is not checked, e.g. for cases
1530 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001531static int file_has_perm(const struct cred *cred,
1532 struct file *file,
1533 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001534{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001535 struct file_security_struct *fsec = file->f_security;
Jan Blunck44707fd2008-02-14 19:38:33 -08001536 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001537 struct avc_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001538 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001539 int rc;
1540
1541 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001542 ad.u.fs.path = file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001543
David Howells275bb412008-11-14 10:39:19 +11001544 if (sid != fsec->sid) {
1545 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001546 SECCLASS_FD,
1547 FD__USE,
1548 &ad);
1549 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001550 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001551 }
1552
1553 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001554 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001555 if (av)
David Howells88e67f32008-11-14 10:39:21 +11001556 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001557
David Howells88e67f32008-11-14 10:39:21 +11001558out:
1559 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001560}
1561
1562/* Check whether a task can create a file. */
1563static int may_create(struct inode *dir,
1564 struct dentry *dentry,
1565 u16 tclass)
1566{
David Howells275bb412008-11-14 10:39:19 +11001567 const struct cred *cred = current_cred();
1568 const struct task_security_struct *tsec = cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001569 struct inode_security_struct *dsec;
1570 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001571 u32 sid, newsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001572 struct avc_audit_data ad;
1573 int rc;
1574
Linus Torvalds1da177e2005-04-16 15:20:36 -07001575 dsec = dir->i_security;
1576 sbsec = dir->i_sb->s_security;
1577
David Howells275bb412008-11-14 10:39:19 +11001578 sid = tsec->sid;
1579 newsid = tsec->create_sid;
1580
Linus Torvalds1da177e2005-04-16 15:20:36 -07001581 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001582 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001583
David Howells275bb412008-11-14 10:39:19 +11001584 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 DIR__ADD_NAME | DIR__SEARCH,
1586 &ad);
1587 if (rc)
1588 return rc;
1589
David Howells275bb412008-11-14 10:39:19 +11001590 if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) {
1591 rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001592 if (rc)
1593 return rc;
1594 }
1595
David Howells275bb412008-11-14 10:39:19 +11001596 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001597 if (rc)
1598 return rc;
1599
1600 return avc_has_perm(newsid, sbsec->sid,
1601 SECCLASS_FILESYSTEM,
1602 FILESYSTEM__ASSOCIATE, &ad);
1603}
1604
Michael LeMay4eb582c2006-06-26 00:24:57 -07001605/* Check whether a task can create a key. */
1606static int may_create_key(u32 ksid,
1607 struct task_struct *ctx)
1608{
David Howells275bb412008-11-14 10:39:19 +11001609 u32 sid = task_sid(ctx);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001610
David Howells275bb412008-11-14 10:39:19 +11001611 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001612}
1613
Eric Paris828dfe12008-04-17 13:17:49 -04001614#define MAY_LINK 0
1615#define MAY_UNLINK 1
1616#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001617
1618/* Check whether a task can link, unlink, or rmdir a file/directory. */
1619static int may_link(struct inode *dir,
1620 struct dentry *dentry,
1621 int kind)
1622
1623{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001624 struct inode_security_struct *dsec, *isec;
1625 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001626 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001627 u32 av;
1628 int rc;
1629
Linus Torvalds1da177e2005-04-16 15:20:36 -07001630 dsec = dir->i_security;
1631 isec = dentry->d_inode->i_security;
1632
1633 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001634 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001635
1636 av = DIR__SEARCH;
1637 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001638 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001639 if (rc)
1640 return rc;
1641
1642 switch (kind) {
1643 case MAY_LINK:
1644 av = FILE__LINK;
1645 break;
1646 case MAY_UNLINK:
1647 av = FILE__UNLINK;
1648 break;
1649 case MAY_RMDIR:
1650 av = DIR__RMDIR;
1651 break;
1652 default:
Eric Paris744ba352008-04-17 11:52:44 -04001653 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1654 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001655 return 0;
1656 }
1657
David Howells275bb412008-11-14 10:39:19 +11001658 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001659 return rc;
1660}
1661
1662static inline int may_rename(struct inode *old_dir,
1663 struct dentry *old_dentry,
1664 struct inode *new_dir,
1665 struct dentry *new_dentry)
1666{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001667 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1668 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001669 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001670 u32 av;
1671 int old_is_dir, new_is_dir;
1672 int rc;
1673
Linus Torvalds1da177e2005-04-16 15:20:36 -07001674 old_dsec = old_dir->i_security;
1675 old_isec = old_dentry->d_inode->i_security;
1676 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1677 new_dsec = new_dir->i_security;
1678
1679 AVC_AUDIT_DATA_INIT(&ad, FS);
1680
Jan Blunck44707fd2008-02-14 19:38:33 -08001681 ad.u.fs.path.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11001682 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001683 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1684 if (rc)
1685 return rc;
David Howells275bb412008-11-14 10:39:19 +11001686 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001687 old_isec->sclass, FILE__RENAME, &ad);
1688 if (rc)
1689 return rc;
1690 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11001691 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001692 old_isec->sclass, DIR__REPARENT, &ad);
1693 if (rc)
1694 return rc;
1695 }
1696
Jan Blunck44707fd2008-02-14 19:38:33 -08001697 ad.u.fs.path.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001698 av = DIR__ADD_NAME | DIR__SEARCH;
1699 if (new_dentry->d_inode)
1700 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11001701 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001702 if (rc)
1703 return rc;
1704 if (new_dentry->d_inode) {
1705 new_isec = new_dentry->d_inode->i_security;
1706 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11001707 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001708 new_isec->sclass,
1709 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1710 if (rc)
1711 return rc;
1712 }
1713
1714 return 0;
1715}
1716
1717/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001718static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001719 struct super_block *sb,
1720 u32 perms,
1721 struct avc_audit_data *ad)
1722{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001723 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11001724 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001725
Linus Torvalds1da177e2005-04-16 15:20:36 -07001726 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11001727 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001728}
1729
1730/* Convert a Linux mode and permission mask to an access vector. */
1731static inline u32 file_mask_to_av(int mode, int mask)
1732{
1733 u32 av = 0;
1734
1735 if ((mode & S_IFMT) != S_IFDIR) {
1736 if (mask & MAY_EXEC)
1737 av |= FILE__EXECUTE;
1738 if (mask & MAY_READ)
1739 av |= FILE__READ;
1740
1741 if (mask & MAY_APPEND)
1742 av |= FILE__APPEND;
1743 else if (mask & MAY_WRITE)
1744 av |= FILE__WRITE;
1745
1746 } else {
1747 if (mask & MAY_EXEC)
1748 av |= DIR__SEARCH;
1749 if (mask & MAY_WRITE)
1750 av |= DIR__WRITE;
1751 if (mask & MAY_READ)
1752 av |= DIR__READ;
1753 }
1754
1755 return av;
1756}
1757
1758/* Convert a Linux file to an access vector. */
1759static inline u32 file_to_av(struct file *file)
1760{
1761 u32 av = 0;
1762
1763 if (file->f_mode & FMODE_READ)
1764 av |= FILE__READ;
1765 if (file->f_mode & FMODE_WRITE) {
1766 if (file->f_flags & O_APPEND)
1767 av |= FILE__APPEND;
1768 else
1769 av |= FILE__WRITE;
1770 }
Stephen Smalley0794c662008-03-17 08:55:18 -04001771 if (!av) {
1772 /*
1773 * Special file opened with flags 3 for ioctl-only use.
1774 */
1775 av = FILE__IOCTL;
1776 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001777
1778 return av;
1779}
1780
Eric Paris8b6a5a32008-10-29 17:06:46 -04001781/*
1782 * Convert a file to an access vector and include the correct open
1783 * open permission.
1784 */
1785static inline u32 open_file_to_av(struct file *file)
1786{
1787 u32 av = file_to_av(file);
1788
1789 if (selinux_policycap_openperm) {
1790 mode_t mode = file->f_path.dentry->d_inode->i_mode;
1791 /*
1792 * lnk files and socks do not really have an 'open'
1793 */
1794 if (S_ISREG(mode))
1795 av |= FILE__OPEN;
1796 else if (S_ISCHR(mode))
1797 av |= CHR_FILE__OPEN;
1798 else if (S_ISBLK(mode))
1799 av |= BLK_FILE__OPEN;
1800 else if (S_ISFIFO(mode))
1801 av |= FIFO_FILE__OPEN;
1802 else if (S_ISDIR(mode))
1803 av |= DIR__OPEN;
1804 else
1805 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1806 "unknown mode:%o\n", __func__, mode);
1807 }
1808 return av;
1809}
1810
Linus Torvalds1da177e2005-04-16 15:20:36 -07001811/* Hook functions begin here. */
1812
David Howells5cd9c582008-08-14 11:37:28 +01001813static int selinux_ptrace_may_access(struct task_struct *child,
1814 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001815{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001816 int rc;
1817
David Howells5cd9c582008-08-14 11:37:28 +01001818 rc = secondary_ops->ptrace_may_access(child, mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001819 if (rc)
1820 return rc;
1821
Stephen Smalley006ebb42008-05-19 08:32:49 -04001822 if (mode == PTRACE_MODE_READ) {
David Howells275bb412008-11-14 10:39:19 +11001823 u32 sid = current_sid();
1824 u32 csid = task_sid(child);
1825 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalley006ebb42008-05-19 08:32:49 -04001826 }
1827
David Howells3b11a1d2008-11-14 10:39:26 +11001828 return current_has_perm(child, PROCESS__PTRACE);
David Howells5cd9c582008-08-14 11:37:28 +01001829}
1830
1831static int selinux_ptrace_traceme(struct task_struct *parent)
1832{
1833 int rc;
1834
1835 rc = secondary_ops->ptrace_traceme(parent);
1836 if (rc)
1837 return rc;
1838
1839 return task_has_perm(parent, current, PROCESS__PTRACE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001840}
1841
1842static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04001843 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001844{
1845 int error;
1846
David Howells3b11a1d2008-11-14 10:39:26 +11001847 error = current_has_perm(target, PROCESS__GETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001848 if (error)
1849 return error;
1850
1851 return secondary_ops->capget(target, effective, inheritable, permitted);
1852}
1853
David Howellsd84f4f92008-11-14 10:39:23 +11001854static int selinux_capset(struct cred *new, const struct cred *old,
1855 const kernel_cap_t *effective,
1856 const kernel_cap_t *inheritable,
1857 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001858{
1859 int error;
1860
David Howellsd84f4f92008-11-14 10:39:23 +11001861 error = secondary_ops->capset(new, old,
1862 effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001863 if (error)
1864 return error;
1865
David Howellsd84f4f92008-11-14 10:39:23 +11001866 return cred_has_perm(old, new, PROCESS__SETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001867}
1868
David Howells3699c532009-01-06 22:27:01 +00001869static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1870 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001871{
1872 int rc;
1873
David Howells3699c532009-01-06 22:27:01 +00001874 rc = secondary_ops->capable(tsk, cred, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001875 if (rc)
1876 return rc;
1877
David Howells3699c532009-01-06 22:27:01 +00001878 return task_has_capability(tsk, cred, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001879}
1880
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001881static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1882{
1883 int buflen, rc;
1884 char *buffer, *path, *end;
1885
1886 rc = -ENOMEM;
Eric Paris828dfe12008-04-17 13:17:49 -04001887 buffer = (char *)__get_free_page(GFP_KERNEL);
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001888 if (!buffer)
1889 goto out;
1890
1891 buflen = PAGE_SIZE;
1892 end = buffer+buflen;
1893 *--end = '\0';
1894 buflen--;
1895 path = end-1;
1896 *path = '/';
1897 while (table) {
1898 const char *name = table->procname;
1899 size_t namelen = strlen(name);
1900 buflen -= namelen + 1;
1901 if (buflen < 0)
1902 goto out_free;
1903 end -= namelen;
1904 memcpy(end, name, namelen);
1905 *--end = '/';
1906 path = end;
1907 table = table->parent;
1908 }
Eric W. Biedermanb599fdf2007-02-14 00:34:15 -08001909 buflen -= 4;
1910 if (buflen < 0)
1911 goto out_free;
1912 end -= 4;
1913 memcpy(end, "/sys", 4);
1914 path = end;
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001915 rc = security_genfs_sid("proc", path, tclass, sid);
1916out_free:
1917 free_page((unsigned long)buffer);
1918out:
1919 return rc;
1920}
1921
Linus Torvalds1da177e2005-04-16 15:20:36 -07001922static int selinux_sysctl(ctl_table *table, int op)
1923{
1924 int error = 0;
1925 u32 av;
David Howells275bb412008-11-14 10:39:19 +11001926 u32 tsid, sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001927 int rc;
1928
1929 rc = secondary_ops->sysctl(table, op);
1930 if (rc)
1931 return rc;
1932
David Howells275bb412008-11-14 10:39:19 +11001933 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001934
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001935 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1936 SECCLASS_DIR : SECCLASS_FILE, &tsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001937 if (rc) {
1938 /* Default to the well-defined sysctl SID. */
1939 tsid = SECINITSID_SYSCTL;
1940 }
1941
1942 /* The op values are "defined" in sysctl.c, thereby creating
1943 * a bad coupling between this module and sysctl.c */
Eric Paris828dfe12008-04-17 13:17:49 -04001944 if (op == 001) {
David Howells275bb412008-11-14 10:39:19 +11001945 error = avc_has_perm(sid, tsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001946 SECCLASS_DIR, DIR__SEARCH, NULL);
1947 } else {
1948 av = 0;
1949 if (op & 004)
1950 av |= FILE__READ;
1951 if (op & 002)
1952 av |= FILE__WRITE;
1953 if (av)
David Howells275bb412008-11-14 10:39:19 +11001954 error = avc_has_perm(sid, tsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001955 SECCLASS_FILE, av, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001956 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001957
1958 return error;
1959}
1960
1961static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1962{
David Howells88e67f32008-11-14 10:39:21 +11001963 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001964 int rc = 0;
1965
1966 if (!sb)
1967 return 0;
1968
1969 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04001970 case Q_SYNC:
1971 case Q_QUOTAON:
1972 case Q_QUOTAOFF:
1973 case Q_SETINFO:
1974 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001975 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001976 break;
1977 case Q_GETFMT:
1978 case Q_GETINFO:
1979 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001980 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001981 break;
1982 default:
1983 rc = 0; /* let the kernel handle invalid cmds */
1984 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001985 }
1986 return rc;
1987}
1988
1989static int selinux_quota_on(struct dentry *dentry)
1990{
David Howells88e67f32008-11-14 10:39:21 +11001991 const struct cred *cred = current_cred();
1992
1993 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001994}
1995
1996static int selinux_syslog(int type)
1997{
1998 int rc;
1999
2000 rc = secondary_ops->syslog(type);
2001 if (rc)
2002 return rc;
2003
2004 switch (type) {
Eric Paris828dfe12008-04-17 13:17:49 -04002005 case 3: /* Read last kernel messages */
2006 case 10: /* Return size of the log buffer */
2007 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2008 break;
2009 case 6: /* Disable logging to console */
2010 case 7: /* Enable logging to console */
2011 case 8: /* Set level of messages printed to console */
2012 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2013 break;
2014 case 0: /* Close log */
2015 case 1: /* Open log */
2016 case 2: /* Read from log */
2017 case 4: /* Read/clear last kernel messages */
2018 case 5: /* Clear ring buffer */
2019 default:
2020 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2021 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002022 }
2023 return rc;
2024}
2025
2026/*
2027 * Check that a process has enough memory to allocate a new virtual
2028 * mapping. 0 means there is enough memory for the allocation to
2029 * succeed and -ENOMEM implies there is not.
2030 *
2031 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
2032 * if the capability is granted, but __vm_enough_memory requires 1 if
2033 * the capability is granted.
2034 *
2035 * Do not audit the selinux permission check, as this is applied to all
2036 * processes that allocate mappings.
2037 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002038static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002039{
2040 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002041
David Howells3699c532009-01-06 22:27:01 +00002042 rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
2043 SECURITY_CAP_NOAUDIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002044 if (rc == 0)
2045 cap_sys_admin = 1;
2046
Alan Cox34b4e4a2007-08-22 14:01:28 -07002047 return __vm_enough_memory(mm, pages, cap_sys_admin);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002048}
2049
2050/* binprm security operations */
2051
David Howellsa6f76f22008-11-14 10:39:24 +11002052static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002053{
David Howellsa6f76f22008-11-14 10:39:24 +11002054 const struct task_security_struct *old_tsec;
2055 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002056 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002057 struct avc_audit_data ad;
David Howellsa6f76f22008-11-14 10:39:24 +11002058 struct inode *inode = bprm->file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002059 int rc;
2060
David Howellsa6f76f22008-11-14 10:39:24 +11002061 rc = secondary_ops->bprm_set_creds(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002062 if (rc)
2063 return rc;
2064
David Howellsa6f76f22008-11-14 10:39:24 +11002065 /* SELinux context only depends on initial program or script and not
2066 * the script interpreter */
2067 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002068 return 0;
2069
David Howellsa6f76f22008-11-14 10:39:24 +11002070 old_tsec = current_security();
2071 new_tsec = bprm->cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002072 isec = inode->i_security;
2073
2074 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002075 new_tsec->sid = old_tsec->sid;
2076 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002077
Michael LeMay28eba5b2006-06-27 02:53:42 -07002078 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002079 new_tsec->create_sid = 0;
2080 new_tsec->keycreate_sid = 0;
2081 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002082
David Howellsa6f76f22008-11-14 10:39:24 +11002083 if (old_tsec->exec_sid) {
2084 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002085 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002086 new_tsec->exec_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002087 } else {
2088 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11002089 rc = security_transition_sid(old_tsec->sid, isec->sid,
2090 SECCLASS_PROCESS, &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002091 if (rc)
2092 return rc;
2093 }
2094
2095 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002096 ad.u.fs.path = bprm->file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002097
Josef Sipek3d5ff522006-12-08 02:37:38 -08002098 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
David Howellsa6f76f22008-11-14 10:39:24 +11002099 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002100
David Howellsa6f76f22008-11-14 10:39:24 +11002101 if (new_tsec->sid == old_tsec->sid) {
2102 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002103 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2104 if (rc)
2105 return rc;
2106 } else {
2107 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002108 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002109 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2110 if (rc)
2111 return rc;
2112
David Howellsa6f76f22008-11-14 10:39:24 +11002113 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002114 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2115 if (rc)
2116 return rc;
2117
David Howellsa6f76f22008-11-14 10:39:24 +11002118 /* Check for shared state */
2119 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2120 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2121 SECCLASS_PROCESS, PROCESS__SHARE,
2122 NULL);
2123 if (rc)
2124 return -EPERM;
2125 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002126
David Howellsa6f76f22008-11-14 10:39:24 +11002127 /* Make sure that anyone attempting to ptrace over a task that
2128 * changes its SID has the appropriate permit */
2129 if (bprm->unsafe &
2130 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2131 struct task_struct *tracer;
2132 struct task_security_struct *sec;
2133 u32 ptsid = 0;
2134
2135 rcu_read_lock();
2136 tracer = tracehook_tracer_task(current);
2137 if (likely(tracer != NULL)) {
2138 sec = __task_cred(tracer)->security;
2139 ptsid = sec->sid;
2140 }
2141 rcu_read_unlock();
2142
2143 if (ptsid != 0) {
2144 rc = avc_has_perm(ptsid, new_tsec->sid,
2145 SECCLASS_PROCESS,
2146 PROCESS__PTRACE, NULL);
2147 if (rc)
2148 return -EPERM;
2149 }
2150 }
2151
2152 /* Clear any possibly unsafe personality bits on exec: */
2153 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002154 }
2155
Linus Torvalds1da177e2005-04-16 15:20:36 -07002156 return 0;
2157}
2158
Eric Paris828dfe12008-04-17 13:17:49 -04002159static int selinux_bprm_check_security(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002160{
2161 return secondary_ops->bprm_check_security(bprm);
2162}
2163
Eric Paris828dfe12008-04-17 13:17:49 -04002164static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002165{
David Howells275bb412008-11-14 10:39:19 +11002166 const struct cred *cred = current_cred();
2167 const struct task_security_struct *tsec = cred->security;
2168 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002169 int atsecure = 0;
2170
David Howells275bb412008-11-14 10:39:19 +11002171 sid = tsec->sid;
2172 osid = tsec->osid;
2173
2174 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002175 /* Enable secure mode for SIDs transitions unless
2176 the noatsecure permission is granted between
2177 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002178 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002179 SECCLASS_PROCESS,
2180 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002181 }
2182
2183 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2184}
2185
Linus Torvalds1da177e2005-04-16 15:20:36 -07002186extern struct vfsmount *selinuxfs_mount;
2187extern struct dentry *selinux_null;
2188
2189/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002190static inline void flush_unauthorized_files(const struct cred *cred,
2191 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002192{
2193 struct avc_audit_data ad;
2194 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002195 struct tty_struct *tty;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002196 struct fdtable *fdt;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002197 long j = -1;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002198 int drop_tty = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002199
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002200 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002201 if (tty) {
2202 file_list_lock();
Eric Paris37dd0bd2008-10-31 17:40:00 -04002203 if (!list_empty(&tty->tty_files)) {
2204 struct inode *inode;
2205
Linus Torvalds1da177e2005-04-16 15:20:36 -07002206 /* Revalidate access to controlling tty.
2207 Use inode_has_perm on the tty inode directly rather
2208 than using file_has_perm, as this particular open
2209 file may belong to another process and we are only
2210 interested in the inode-based check here. */
Eric Paris37dd0bd2008-10-31 17:40:00 -04002211 file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
2212 inode = file->f_path.dentry->d_inode;
David Howells88e67f32008-11-14 10:39:21 +11002213 if (inode_has_perm(cred, inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002214 FILE__READ | FILE__WRITE, NULL)) {
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002215 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002216 }
2217 }
2218 file_list_unlock();
Alan Cox452a00d2008-10-13 10:39:13 +01002219 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002220 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002221 /* Reset controlling tty. */
2222 if (drop_tty)
2223 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002224
2225 /* Revalidate access to inherited open files. */
2226
Eric Paris828dfe12008-04-17 13:17:49 -04002227 AVC_AUDIT_DATA_INIT(&ad, FS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002228
2229 spin_lock(&files->file_lock);
2230 for (;;) {
2231 unsigned long set, i;
2232 int fd;
2233
2234 j++;
2235 i = j * __NFDBITS;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002236 fdt = files_fdtable(files);
Vadim Lobanovbbea9f62006-12-10 02:21:12 -08002237 if (i >= fdt->max_fds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002238 break;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002239 set = fdt->open_fds->fds_bits[j];
Linus Torvalds1da177e2005-04-16 15:20:36 -07002240 if (!set)
2241 continue;
2242 spin_unlock(&files->file_lock);
Eric Paris828dfe12008-04-17 13:17:49 -04002243 for ( ; set ; i++, set >>= 1) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002244 if (set & 1) {
2245 file = fget(i);
2246 if (!file)
2247 continue;
David Howells88e67f32008-11-14 10:39:21 +11002248 if (file_has_perm(cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002249 file,
2250 file_to_av(file))) {
2251 sys_close(i);
2252 fd = get_unused_fd();
2253 if (fd != i) {
2254 if (fd >= 0)
2255 put_unused_fd(fd);
2256 fput(file);
2257 continue;
2258 }
2259 if (devnull) {
Nick Piggin095975d2006-01-08 01:02:19 -08002260 get_file(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002261 } else {
David Howells745ca242008-11-14 10:39:22 +11002262 devnull = dentry_open(
2263 dget(selinux_null),
2264 mntget(selinuxfs_mount),
2265 O_RDWR, cred);
Akinobu Mitafc5d81e2006-11-27 15:16:48 +09002266 if (IS_ERR(devnull)) {
2267 devnull = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002268 put_unused_fd(fd);
2269 fput(file);
2270 continue;
2271 }
2272 }
2273 fd_install(fd, devnull);
2274 }
2275 fput(file);
2276 }
2277 }
2278 spin_lock(&files->file_lock);
2279
2280 }
2281 spin_unlock(&files->file_lock);
2282}
2283
Linus Torvalds1da177e2005-04-16 15:20:36 -07002284/*
David Howellsa6f76f22008-11-14 10:39:24 +11002285 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002286 */
David Howellsa6f76f22008-11-14 10:39:24 +11002287static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002288{
David Howellsa6f76f22008-11-14 10:39:24 +11002289 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002290 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002291 int rc, i;
2292
David Howellsa6f76f22008-11-14 10:39:24 +11002293 secondary_ops->bprm_committing_creds(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002294
David Howellsa6f76f22008-11-14 10:39:24 +11002295 new_tsec = bprm->cred->security;
2296 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002297 return;
2298
2299 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002300 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002301
David Howellsa6f76f22008-11-14 10:39:24 +11002302 /* Always clear parent death signal on SID transitions. */
2303 current->pdeath_signal = 0;
2304
2305 /* Check whether the new SID can inherit resource limits from the old
2306 * SID. If not, reset all soft limits to the lower of the current
2307 * task's hard limit and the init task's soft limit.
2308 *
2309 * Note that the setting of hard limits (even to lower them) can be
2310 * controlled by the setrlimit check. The inclusion of the init task's
2311 * soft limit into the computation is to avoid resetting soft limits
2312 * higher than the default soft limit for cases where the default is
2313 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2314 */
2315 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2316 PROCESS__RLIMITINH, NULL);
2317 if (rc) {
2318 for (i = 0; i < RLIM_NLIMITS; i++) {
2319 rlim = current->signal->rlim + i;
2320 initrlim = init_task.signal->rlim + i;
2321 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2322 }
2323 update_rlimit_cpu(rlim->rlim_cur);
2324 }
2325}
2326
2327/*
2328 * Clean up the process immediately after the installation of new credentials
2329 * due to exec
2330 */
2331static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2332{
2333 const struct task_security_struct *tsec = current_security();
2334 struct itimerval itimer;
2335 struct sighand_struct *psig;
2336 u32 osid, sid;
2337 int rc, i;
2338 unsigned long flags;
2339
2340 secondary_ops->bprm_committed_creds(bprm);
2341
2342 osid = tsec->osid;
2343 sid = tsec->sid;
2344
2345 if (sid == osid)
2346 return;
2347
2348 /* Check whether the new SID can inherit signal state from the old SID.
2349 * If not, clear itimers to avoid subsequent signal generation and
2350 * flush and unblock signals.
2351 *
2352 * This must occur _after_ the task SID has been updated so that any
2353 * kill done after the flush will be checked against the new SID.
2354 */
2355 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002356 if (rc) {
2357 memset(&itimer, 0, sizeof itimer);
2358 for (i = 0; i < 3; i++)
2359 do_setitimer(i, &itimer, NULL);
2360 flush_signals(current);
2361 spin_lock_irq(&current->sighand->siglock);
2362 flush_signal_handlers(current, 1);
2363 sigemptyset(&current->blocked);
2364 recalc_sigpending();
2365 spin_unlock_irq(&current->sighand->siglock);
2366 }
2367
David Howellsa6f76f22008-11-14 10:39:24 +11002368 /* Wake up the parent if it is waiting so that it can recheck
2369 * wait permission to the new task SID. */
Eric Paris41d9f9c2008-11-04 15:18:26 -05002370 read_lock_irq(&tasklist_lock);
2371 psig = current->parent->sighand;
2372 spin_lock_irqsave(&psig->siglock, flags);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002373 wake_up_interruptible(&current->parent->signal->wait_chldexit);
Eric Paris41d9f9c2008-11-04 15:18:26 -05002374 spin_unlock_irqrestore(&psig->siglock, flags);
2375 read_unlock_irq(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002376}
2377
2378/* superblock security operations */
2379
2380static int selinux_sb_alloc_security(struct super_block *sb)
2381{
2382 return superblock_alloc_security(sb);
2383}
2384
2385static void selinux_sb_free_security(struct super_block *sb)
2386{
2387 superblock_free_security(sb);
2388}
2389
2390static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2391{
2392 if (plen > olen)
2393 return 0;
2394
2395 return !memcmp(prefix, option, plen);
2396}
2397
2398static inline int selinux_option(char *option, int len)
2399{
Eric Paris832cbd92008-04-01 13:24:09 -04002400 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2401 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2402 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2403 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002404}
2405
2406static inline void take_option(char **to, char *from, int *first, int len)
2407{
2408 if (!*first) {
2409 **to = ',';
2410 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002411 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002412 *first = 0;
2413 memcpy(*to, from, len);
2414 *to += len;
2415}
2416
Eric Paris828dfe12008-04-17 13:17:49 -04002417static inline void take_selinux_option(char **to, char *from, int *first,
2418 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002419{
2420 int current_size = 0;
2421
2422 if (!*first) {
2423 **to = '|';
2424 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002425 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002426 *first = 0;
2427
2428 while (current_size < len) {
2429 if (*from != '"') {
2430 **to = *from;
2431 *to += 1;
2432 }
2433 from += 1;
2434 current_size += 1;
2435 }
2436}
2437
Eric Parise0007522008-03-05 10:31:54 -05002438static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002439{
2440 int fnosec, fsec, rc = 0;
2441 char *in_save, *in_curr, *in_end;
2442 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002443 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002444
2445 in_curr = orig;
2446 sec_curr = copy;
2447
Linus Torvalds1da177e2005-04-16 15:20:36 -07002448 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2449 if (!nosec) {
2450 rc = -ENOMEM;
2451 goto out;
2452 }
2453
2454 nosec_save = nosec;
2455 fnosec = fsec = 1;
2456 in_save = in_end = orig;
2457
2458 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002459 if (*in_end == '"')
2460 open_quote = !open_quote;
2461 if ((*in_end == ',' && open_quote == 0) ||
2462 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002463 int len = in_end - in_curr;
2464
2465 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002466 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002467 else
2468 take_option(&nosec, in_curr, &fnosec, len);
2469
2470 in_curr = in_end + 1;
2471 }
2472 } while (*in_end++);
2473
Eric Paris6931dfc2005-06-30 02:58:51 -07002474 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002475 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002476out:
2477 return rc;
2478}
2479
James Morris12204e22008-12-19 10:44:42 +11002480static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002481{
David Howells88e67f32008-11-14 10:39:21 +11002482 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002483 struct avc_audit_data ad;
2484 int rc;
2485
2486 rc = superblock_doinit(sb, data);
2487 if (rc)
2488 return rc;
2489
James Morris74192242008-12-19 11:41:10 +11002490 /* Allow all mounts performed by the kernel */
2491 if (flags & MS_KERNMOUNT)
2492 return 0;
2493
Eric Paris828dfe12008-04-17 13:17:49 -04002494 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002495 ad.u.fs.path.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002496 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497}
2498
David Howells726c3342006-06-23 02:02:58 -07002499static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002500{
David Howells88e67f32008-11-14 10:39:21 +11002501 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002502 struct avc_audit_data ad;
2503
Eric Paris828dfe12008-04-17 13:17:49 -04002504 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002505 ad.u.fs.path.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002506 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002507}
2508
Eric Paris828dfe12008-04-17 13:17:49 -04002509static int selinux_mount(char *dev_name,
Al Virob5266eb2008-03-22 17:48:24 -04002510 struct path *path,
Eric Paris828dfe12008-04-17 13:17:49 -04002511 char *type,
2512 unsigned long flags,
2513 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002514{
David Howells88e67f32008-11-14 10:39:21 +11002515 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002516 int rc;
2517
Al Virob5266eb2008-03-22 17:48:24 -04002518 rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002519 if (rc)
2520 return rc;
2521
2522 if (flags & MS_REMOUNT)
David Howells88e67f32008-11-14 10:39:21 +11002523 return superblock_has_perm(cred, path->mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002524 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002525 else
David Howells88e67f32008-11-14 10:39:21 +11002526 return dentry_has_perm(cred, path->mnt, path->dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002527 FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002528}
2529
2530static int selinux_umount(struct vfsmount *mnt, int flags)
2531{
David Howells88e67f32008-11-14 10:39:21 +11002532 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002533 int rc;
2534
2535 rc = secondary_ops->sb_umount(mnt, flags);
2536 if (rc)
2537 return rc;
2538
David Howells88e67f32008-11-14 10:39:21 +11002539 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002540 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002541}
2542
2543/* inode security operations */
2544
2545static int selinux_inode_alloc_security(struct inode *inode)
2546{
2547 return inode_alloc_security(inode);
2548}
2549
2550static void selinux_inode_free_security(struct inode *inode)
2551{
2552 inode_free_security(inode);
2553}
2554
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002555static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2556 char **name, void **value,
2557 size_t *len)
2558{
David Howells275bb412008-11-14 10:39:19 +11002559 const struct cred *cred = current_cred();
2560 const struct task_security_struct *tsec = cred->security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002561 struct inode_security_struct *dsec;
2562 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002563 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002564 int rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002565 char *namep = NULL, *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002566
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002567 dsec = dir->i_security;
2568 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002569
David Howells275bb412008-11-14 10:39:19 +11002570 sid = tsec->sid;
2571 newsid = tsec->create_sid;
2572
2573 if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) {
2574 rc = security_transition_sid(sid, dsec->sid,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002575 inode_mode_to_security_class(inode->i_mode),
2576 &newsid);
2577 if (rc) {
2578 printk(KERN_WARNING "%s: "
2579 "security_transition_sid failed, rc=%d (dev=%s "
2580 "ino=%ld)\n",
Harvey Harrisondd6f9532008-03-06 10:03:59 +11002581 __func__,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002582 -rc, inode->i_sb->s_id, inode->i_ino);
2583 return rc;
2584 }
2585 }
2586
Eric Paris296fddf2006-09-25 23:32:00 -07002587 /* Possibly defer initialization to selinux_complete_init. */
2588 if (sbsec->initialized) {
2589 struct inode_security_struct *isec = inode->i_security;
2590 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2591 isec->sid = newsid;
2592 isec->initialized = 1;
2593 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002594
Stephen Smalley8aad3872006-03-22 00:09:13 -08002595 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
Stephen Smalley25a74f32005-11-08 21:34:33 -08002596 return -EOPNOTSUPP;
2597
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002598 if (name) {
Josef Bacika02fe132008-04-04 09:35:05 +11002599 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002600 if (!namep)
2601 return -ENOMEM;
2602 *name = namep;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002603 }
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002604
2605 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002606 rc = security_sid_to_context_force(newsid, &context, &clen);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002607 if (rc) {
2608 kfree(namep);
2609 return rc;
2610 }
2611 *value = context;
2612 *len = clen;
2613 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002614
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002615 return 0;
2616}
2617
Linus Torvalds1da177e2005-04-16 15:20:36 -07002618static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2619{
2620 return may_create(dir, dentry, SECCLASS_FILE);
2621}
2622
Linus Torvalds1da177e2005-04-16 15:20:36 -07002623static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2624{
2625 int rc;
2626
Eric Paris828dfe12008-04-17 13:17:49 -04002627 rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002628 if (rc)
2629 return rc;
2630 return may_link(dir, old_dentry, MAY_LINK);
2631}
2632
Linus Torvalds1da177e2005-04-16 15:20:36 -07002633static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2634{
2635 int rc;
2636
2637 rc = secondary_ops->inode_unlink(dir, dentry);
2638 if (rc)
2639 return rc;
2640 return may_link(dir, dentry, MAY_UNLINK);
2641}
2642
2643static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2644{
2645 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2646}
2647
Linus Torvalds1da177e2005-04-16 15:20:36 -07002648static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2649{
2650 return may_create(dir, dentry, SECCLASS_DIR);
2651}
2652
Linus Torvalds1da177e2005-04-16 15:20:36 -07002653static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2654{
2655 return may_link(dir, dentry, MAY_RMDIR);
2656}
2657
2658static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2659{
2660 int rc;
2661
2662 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2663 if (rc)
2664 return rc;
2665
2666 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2667}
2668
Linus Torvalds1da177e2005-04-16 15:20:36 -07002669static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002670 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002671{
2672 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2673}
2674
Linus Torvalds1da177e2005-04-16 15:20:36 -07002675static int selinux_inode_readlink(struct dentry *dentry)
2676{
David Howells88e67f32008-11-14 10:39:21 +11002677 const struct cred *cred = current_cred();
2678
2679 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002680}
2681
2682static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2683{
David Howells88e67f32008-11-14 10:39:21 +11002684 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002685 int rc;
2686
Eric Paris828dfe12008-04-17 13:17:49 -04002687 rc = secondary_ops->inode_follow_link(dentry, nameidata);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002688 if (rc)
2689 return rc;
David Howells88e67f32008-11-14 10:39:21 +11002690 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002691}
2692
Al Virob77b0642008-07-17 09:37:02 -04002693static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002694{
David Howells88e67f32008-11-14 10:39:21 +11002695 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002696 int rc;
2697
Al Virob77b0642008-07-17 09:37:02 -04002698 rc = secondary_ops->inode_permission(inode, mask);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002699 if (rc)
2700 return rc;
2701
2702 if (!mask) {
2703 /* No permission to check. Existence test. */
2704 return 0;
2705 }
2706
David Howells88e67f32008-11-14 10:39:21 +11002707 return inode_has_perm(cred, inode,
Eric Paris8b6a5a32008-10-29 17:06:46 -04002708 file_mask_to_av(inode->i_mode, mask), NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002709}
2710
2711static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2712{
David Howells88e67f32008-11-14 10:39:21 +11002713 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002714 int rc;
2715
2716 rc = secondary_ops->inode_setattr(dentry, iattr);
2717 if (rc)
2718 return rc;
2719
2720 if (iattr->ia_valid & ATTR_FORCE)
2721 return 0;
2722
2723 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2724 ATTR_ATIME_SET | ATTR_MTIME_SET))
David Howells88e67f32008-11-14 10:39:21 +11002725 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002726
David Howells88e67f32008-11-14 10:39:21 +11002727 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002728}
2729
2730static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2731{
David Howells88e67f32008-11-14 10:39:21 +11002732 const struct cred *cred = current_cred();
2733
2734 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002735}
2736
David Howells8f0cfa52008-04-29 00:59:41 -07002737static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07002738{
David Howells88e67f32008-11-14 10:39:21 +11002739 const struct cred *cred = current_cred();
2740
Serge E. Hallynb5376772007-10-16 23:31:36 -07002741 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2742 sizeof XATTR_SECURITY_PREFIX - 1)) {
2743 if (!strcmp(name, XATTR_NAME_CAPS)) {
2744 if (!capable(CAP_SETFCAP))
2745 return -EPERM;
2746 } else if (!capable(CAP_SYS_ADMIN)) {
2747 /* A different attribute in the security namespace.
2748 Restrict to administrator. */
2749 return -EPERM;
2750 }
2751 }
2752
2753 /* Not an attribute we recognize, so just check the
2754 ordinary setattr permission. */
David Howells88e67f32008-11-14 10:39:21 +11002755 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07002756}
2757
David Howells8f0cfa52008-04-29 00:59:41 -07002758static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2759 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002760{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002761 struct inode *inode = dentry->d_inode;
2762 struct inode_security_struct *isec = inode->i_security;
2763 struct superblock_security_struct *sbsec;
2764 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002765 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002766 int rc = 0;
2767
Serge E. Hallynb5376772007-10-16 23:31:36 -07002768 if (strcmp(name, XATTR_NAME_SELINUX))
2769 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002770
2771 sbsec = inode->i_sb->s_security;
2772 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2773 return -EOPNOTSUPP;
2774
Satyam Sharma3bd858a2007-07-17 15:00:08 +05302775 if (!is_owner_or_cap(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002776 return -EPERM;
2777
Eric Paris828dfe12008-04-17 13:17:49 -04002778 AVC_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002779 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002780
David Howells275bb412008-11-14 10:39:19 +11002781 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002782 FILE__RELABELFROM, &ad);
2783 if (rc)
2784 return rc;
2785
2786 rc = security_context_to_sid(value, size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04002787 if (rc == -EINVAL) {
2788 if (!capable(CAP_MAC_ADMIN))
2789 return rc;
2790 rc = security_context_to_sid_force(value, size, &newsid);
2791 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002792 if (rc)
2793 return rc;
2794
David Howells275bb412008-11-14 10:39:19 +11002795 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002796 FILE__RELABELTO, &ad);
2797 if (rc)
2798 return rc;
2799
David Howells275bb412008-11-14 10:39:19 +11002800 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04002801 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002802 if (rc)
2803 return rc;
2804
2805 return avc_has_perm(newsid,
2806 sbsec->sid,
2807 SECCLASS_FILESYSTEM,
2808 FILESYSTEM__ASSOCIATE,
2809 &ad);
2810}
2811
David Howells8f0cfa52008-04-29 00:59:41 -07002812static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04002813 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07002814 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002815{
2816 struct inode *inode = dentry->d_inode;
2817 struct inode_security_struct *isec = inode->i_security;
2818 u32 newsid;
2819 int rc;
2820
2821 if (strcmp(name, XATTR_NAME_SELINUX)) {
2822 /* Not an attribute we recognize, so nothing to do. */
2823 return;
2824 }
2825
Stephen Smalley12b29f32008-05-07 13:03:20 -04002826 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002827 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002828 printk(KERN_ERR "SELinux: unable to map context to SID"
2829 "for (%s, %lu), rc=%d\n",
2830 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002831 return;
2832 }
2833
2834 isec->sid = newsid;
2835 return;
2836}
2837
David Howells8f0cfa52008-04-29 00:59:41 -07002838static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002839{
David Howells88e67f32008-11-14 10:39:21 +11002840 const struct cred *cred = current_cred();
2841
2842 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002843}
2844
Eric Paris828dfe12008-04-17 13:17:49 -04002845static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002846{
David Howells88e67f32008-11-14 10:39:21 +11002847 const struct cred *cred = current_cred();
2848
2849 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002850}
2851
David Howells8f0cfa52008-04-29 00:59:41 -07002852static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002853{
Serge E. Hallynb5376772007-10-16 23:31:36 -07002854 if (strcmp(name, XATTR_NAME_SELINUX))
2855 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002856
2857 /* No one is allowed to remove a SELinux security label.
2858 You can change the label, but all data must be labeled. */
2859 return -EACCES;
2860}
2861
James Morrisd381d8a2005-10-30 14:59:22 -08002862/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002863 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08002864 *
2865 * Permission check is handled by selinux_inode_getxattr hook.
2866 */
David P. Quigley42492592008-02-04 22:29:39 -08002867static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002868{
David P. Quigley42492592008-02-04 22:29:39 -08002869 u32 size;
2870 int error;
2871 char *context = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002872 struct inode_security_struct *isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002873
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002874 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2875 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002876
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002877 /*
2878 * If the caller has CAP_MAC_ADMIN, then get the raw context
2879 * value even if it is not defined by current policy; otherwise,
2880 * use the in-core value under current policy.
2881 * Use the non-auditing forms of the permission checks since
2882 * getxattr may be called by unprivileged processes commonly
2883 * and lack of permission just means that we fall back to the
2884 * in-core context value, not a denial.
2885 */
David Howells3699c532009-01-06 22:27:01 +00002886 error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
2887 SECURITY_CAP_NOAUDIT);
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002888 if (!error)
2889 error = security_sid_to_context_force(isec->sid, &context,
2890 &size);
2891 else
2892 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08002893 if (error)
2894 return error;
2895 error = size;
2896 if (alloc) {
2897 *buffer = context;
2898 goto out_nofree;
2899 }
2900 kfree(context);
2901out_nofree:
2902 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002903}
2904
2905static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04002906 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002907{
2908 struct inode_security_struct *isec = inode->i_security;
2909 u32 newsid;
2910 int rc;
2911
2912 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2913 return -EOPNOTSUPP;
2914
2915 if (!value || !size)
2916 return -EACCES;
2917
Eric Paris828dfe12008-04-17 13:17:49 -04002918 rc = security_context_to_sid((void *)value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002919 if (rc)
2920 return rc;
2921
2922 isec->sid = newsid;
2923 return 0;
2924}
2925
2926static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2927{
2928 const int len = sizeof(XATTR_NAME_SELINUX);
2929 if (buffer && len <= buffer_size)
2930 memcpy(buffer, XATTR_NAME_SELINUX, len);
2931 return len;
2932}
2933
Serge E. Hallynb5376772007-10-16 23:31:36 -07002934static int selinux_inode_need_killpriv(struct dentry *dentry)
2935{
2936 return secondary_ops->inode_need_killpriv(dentry);
2937}
2938
2939static int selinux_inode_killpriv(struct dentry *dentry)
2940{
2941 return secondary_ops->inode_killpriv(dentry);
2942}
2943
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02002944static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2945{
2946 struct inode_security_struct *isec = inode->i_security;
2947 *secid = isec->sid;
2948}
2949
Linus Torvalds1da177e2005-04-16 15:20:36 -07002950/* file security operations */
2951
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002952static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002953{
David Howells88e67f32008-11-14 10:39:21 +11002954 const struct cred *cred = current_cred();
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07002955 int rc;
Josef Sipek3d5ff522006-12-08 02:37:38 -08002956 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002957
2958 if (!mask) {
2959 /* No permission to check. Existence test. */
2960 return 0;
2961 }
2962
2963 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2964 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2965 mask |= MAY_APPEND;
2966
David Howells88e67f32008-11-14 10:39:21 +11002967 rc = file_has_perm(cred, file,
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07002968 file_mask_to_av(inode->i_mode, mask));
2969 if (rc)
2970 return rc;
2971
2972 return selinux_netlbl_inode_permission(inode, mask);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002973}
2974
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002975static int selinux_file_permission(struct file *file, int mask)
2976{
2977 struct inode *inode = file->f_path.dentry->d_inode;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002978 struct file_security_struct *fsec = file->f_security;
2979 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11002980 u32 sid = current_sid();
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002981
2982 if (!mask) {
2983 /* No permission to check. Existence test. */
2984 return 0;
2985 }
2986
David Howells275bb412008-11-14 10:39:19 +11002987 if (sid == fsec->sid && fsec->isid == isec->sid
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002988 && fsec->pseqno == avc_policy_seqno())
2989 return selinux_netlbl_inode_permission(inode, mask);
2990
2991 return selinux_revalidate_file_permission(file, mask);
2992}
2993
Linus Torvalds1da177e2005-04-16 15:20:36 -07002994static int selinux_file_alloc_security(struct file *file)
2995{
2996 return file_alloc_security(file);
2997}
2998
2999static void selinux_file_free_security(struct file *file)
3000{
3001 file_free_security(file);
3002}
3003
3004static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3005 unsigned long arg)
3006{
David Howells88e67f32008-11-14 10:39:21 +11003007 const struct cred *cred = current_cred();
Stephen Smalley242631c2008-06-05 09:21:28 -04003008 u32 av = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003009
Stephen Smalley242631c2008-06-05 09:21:28 -04003010 if (_IOC_DIR(cmd) & _IOC_WRITE)
3011 av |= FILE__WRITE;
3012 if (_IOC_DIR(cmd) & _IOC_READ)
3013 av |= FILE__READ;
3014 if (!av)
3015 av = FILE__IOCTL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003016
David Howells88e67f32008-11-14 10:39:21 +11003017 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003018}
3019
3020static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3021{
David Howells88e67f32008-11-14 10:39:21 +11003022 const struct cred *cred = current_cred();
David Howellsd84f4f92008-11-14 10:39:23 +11003023 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003024
Linus Torvalds1da177e2005-04-16 15:20:36 -07003025#ifndef CONFIG_PPC32
3026 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3027 /*
3028 * We are making executable an anonymous mapping or a
3029 * private file mapping that will also be writable.
3030 * This has an additional check.
3031 */
David Howellsd84f4f92008-11-14 10:39:23 +11003032 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003033 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003034 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003035 }
3036#endif
3037
3038 if (file) {
3039 /* read access is always possible with a mapping */
3040 u32 av = FILE__READ;
3041
3042 /* write access only matters if the mapping is shared */
3043 if (shared && (prot & PROT_WRITE))
3044 av |= FILE__WRITE;
3045
3046 if (prot & PROT_EXEC)
3047 av |= FILE__EXECUTE;
3048
David Howells88e67f32008-11-14 10:39:21 +11003049 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003050 }
David Howellsd84f4f92008-11-14 10:39:23 +11003051
3052error:
3053 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003054}
3055
3056static int selinux_file_mmap(struct file *file, unsigned long reqprot,
Eric Parised032182007-06-28 15:55:21 -04003057 unsigned long prot, unsigned long flags,
3058 unsigned long addr, unsigned long addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003059{
Eric Parised032182007-06-28 15:55:21 -04003060 int rc = 0;
David Howells275bb412008-11-14 10:39:19 +11003061 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003062
Eric Parised032182007-06-28 15:55:21 -04003063 if (addr < mmap_min_addr)
3064 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3065 MEMPROTECT__MMAP_ZERO, NULL);
3066 if (rc || addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003067 return rc;
3068
3069 if (selinux_checkreqprot)
3070 prot = reqprot;
3071
3072 return file_map_prot_check(file, prot,
3073 (flags & MAP_TYPE) == MAP_SHARED);
3074}
3075
3076static int selinux_file_mprotect(struct vm_area_struct *vma,
3077 unsigned long reqprot,
3078 unsigned long prot)
3079{
David Howells88e67f32008-11-14 10:39:21 +11003080 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003081 int rc;
3082
3083 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
3084 if (rc)
3085 return rc;
3086
3087 if (selinux_checkreqprot)
3088 prot = reqprot;
3089
3090#ifndef CONFIG_PPC32
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003091 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3092 rc = 0;
3093 if (vma->vm_start >= vma->vm_mm->start_brk &&
3094 vma->vm_end <= vma->vm_mm->brk) {
David Howellsd84f4f92008-11-14 10:39:23 +11003095 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003096 } else if (!vma->vm_file &&
3097 vma->vm_start <= vma->vm_mm->start_stack &&
3098 vma->vm_end >= vma->vm_mm->start_stack) {
David Howells3b11a1d2008-11-14 10:39:26 +11003099 rc = current_has_perm(current, PROCESS__EXECSTACK);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003100 } else if (vma->vm_file && vma->anon_vma) {
3101 /*
3102 * We are making executable a file mapping that has
3103 * had some COW done. Since pages might have been
3104 * written, check ability to execute the possibly
3105 * modified content. This typically should only
3106 * occur for text relocations.
3107 */
David Howellsd84f4f92008-11-14 10:39:23 +11003108 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003109 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003110 if (rc)
3111 return rc;
3112 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003113#endif
3114
3115 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3116}
3117
3118static int selinux_file_lock(struct file *file, unsigned int cmd)
3119{
David Howells88e67f32008-11-14 10:39:21 +11003120 const struct cred *cred = current_cred();
3121
3122 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003123}
3124
3125static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3126 unsigned long arg)
3127{
David Howells88e67f32008-11-14 10:39:21 +11003128 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003129 int err = 0;
3130
3131 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003132 case F_SETFL:
3133 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3134 err = -EINVAL;
3135 break;
3136 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003137
Eric Paris828dfe12008-04-17 13:17:49 -04003138 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003139 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003140 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003141 }
3142 /* fall through */
3143 case F_SETOWN:
3144 case F_SETSIG:
3145 case F_GETFL:
3146 case F_GETOWN:
3147 case F_GETSIG:
3148 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003149 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003150 break;
3151 case F_GETLK:
3152 case F_SETLK:
3153 case F_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003154#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003155 case F_GETLK64:
3156 case F_SETLK64:
3157 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003158#endif
Eric Paris828dfe12008-04-17 13:17:49 -04003159 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3160 err = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003161 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003162 }
David Howells88e67f32008-11-14 10:39:21 +11003163 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003164 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003165 }
3166
3167 return err;
3168}
3169
3170static int selinux_file_set_fowner(struct file *file)
3171{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003172 struct file_security_struct *fsec;
3173
Linus Torvalds1da177e2005-04-16 15:20:36 -07003174 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003175 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003176
3177 return 0;
3178}
3179
3180static int selinux_file_send_sigiotask(struct task_struct *tsk,
3181 struct fown_struct *fown, int signum)
3182{
Eric Paris828dfe12008-04-17 13:17:49 -04003183 struct file *file;
David Howells275bb412008-11-14 10:39:19 +11003184 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003185 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003186 struct file_security_struct *fsec;
3187
3188 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003189 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003190
Linus Torvalds1da177e2005-04-16 15:20:36 -07003191 fsec = file->f_security;
3192
3193 if (!signum)
3194 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3195 else
3196 perm = signal_to_av(signum);
3197
David Howells275bb412008-11-14 10:39:19 +11003198 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003199 SECCLASS_PROCESS, perm, NULL);
3200}
3201
3202static int selinux_file_receive(struct file *file)
3203{
David Howells88e67f32008-11-14 10:39:21 +11003204 const struct cred *cred = current_cred();
3205
3206 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003207}
3208
David Howells745ca242008-11-14 10:39:22 +11003209static int selinux_dentry_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003210{
3211 struct file_security_struct *fsec;
3212 struct inode *inode;
3213 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003214
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003215 inode = file->f_path.dentry->d_inode;
3216 fsec = file->f_security;
3217 isec = inode->i_security;
3218 /*
3219 * Save inode label and policy sequence number
3220 * at open-time so that selinux_file_permission
3221 * can determine whether revalidation is necessary.
3222 * Task label is already saved in the file security
3223 * struct as its SID.
3224 */
3225 fsec->isid = isec->sid;
3226 fsec->pseqno = avc_policy_seqno();
3227 /*
3228 * Since the inode label or policy seqno may have changed
3229 * between the selinux_inode_permission check and the saving
3230 * of state above, recheck that access is still permitted.
3231 * Otherwise, access might never be revalidated against the
3232 * new inode label or new policy.
3233 * This check is not redundant - do not remove.
3234 */
David Howells88e67f32008-11-14 10:39:21 +11003235 return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003236}
3237
Linus Torvalds1da177e2005-04-16 15:20:36 -07003238/* task security operations */
3239
3240static int selinux_task_create(unsigned long clone_flags)
3241{
3242 int rc;
3243
3244 rc = secondary_ops->task_create(clone_flags);
3245 if (rc)
3246 return rc;
3247
David Howells3b11a1d2008-11-14 10:39:26 +11003248 return current_has_perm(current, PROCESS__FORK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003249}
3250
David Howellsf1752ee2008-11-14 10:39:17 +11003251/*
3252 * detach and free the LSM part of a set of credentials
3253 */
3254static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003255{
David Howellsf1752ee2008-11-14 10:39:17 +11003256 struct task_security_struct *tsec = cred->security;
3257 cred->security = NULL;
3258 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003259}
3260
David Howellsd84f4f92008-11-14 10:39:23 +11003261/*
3262 * prepare a new set of credentials for modification
3263 */
3264static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3265 gfp_t gfp)
3266{
3267 const struct task_security_struct *old_tsec;
3268 struct task_security_struct *tsec;
3269
3270 old_tsec = old->security;
3271
3272 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3273 if (!tsec)
3274 return -ENOMEM;
3275
3276 new->security = tsec;
3277 return 0;
3278}
3279
3280/*
3281 * commit new credentials
3282 */
3283static void selinux_cred_commit(struct cred *new, const struct cred *old)
3284{
3285 secondary_ops->cred_commit(new, old);
3286}
3287
David Howells3a3b7ce2008-11-14 10:39:28 +11003288/*
3289 * set the security data for a kernel service
3290 * - all the creation contexts are set to unlabelled
3291 */
3292static int selinux_kernel_act_as(struct cred *new, u32 secid)
3293{
3294 struct task_security_struct *tsec = new->security;
3295 u32 sid = current_sid();
3296 int ret;
3297
3298 ret = avc_has_perm(sid, secid,
3299 SECCLASS_KERNEL_SERVICE,
3300 KERNEL_SERVICE__USE_AS_OVERRIDE,
3301 NULL);
3302 if (ret == 0) {
3303 tsec->sid = secid;
3304 tsec->create_sid = 0;
3305 tsec->keycreate_sid = 0;
3306 tsec->sockcreate_sid = 0;
3307 }
3308 return ret;
3309}
3310
3311/*
3312 * set the file creation context in a security record to the same as the
3313 * objective context of the specified inode
3314 */
3315static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3316{
3317 struct inode_security_struct *isec = inode->i_security;
3318 struct task_security_struct *tsec = new->security;
3319 u32 sid = current_sid();
3320 int ret;
3321
3322 ret = avc_has_perm(sid, isec->sid,
3323 SECCLASS_KERNEL_SERVICE,
3324 KERNEL_SERVICE__CREATE_FILES_AS,
3325 NULL);
3326
3327 if (ret == 0)
3328 tsec->create_sid = isec->sid;
3329 return 0;
3330}
3331
Linus Torvalds1da177e2005-04-16 15:20:36 -07003332static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3333{
3334 /* Since setuid only affects the current process, and
3335 since the SELinux controls are not based on the Linux
3336 identity attributes, SELinux does not need to control
3337 this operation. However, SELinux does control the use
3338 of the CAP_SETUID and CAP_SETGID capabilities using the
3339 capable hook. */
3340 return 0;
3341}
3342
David Howellsd84f4f92008-11-14 10:39:23 +11003343static int selinux_task_fix_setuid(struct cred *new, const struct cred *old,
3344 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003345{
David Howellsd84f4f92008-11-14 10:39:23 +11003346 return secondary_ops->task_fix_setuid(new, old, flags);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003347}
3348
3349static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3350{
3351 /* See the comment for setuid above. */
3352 return 0;
3353}
3354
3355static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3356{
David Howells3b11a1d2008-11-14 10:39:26 +11003357 return current_has_perm(p, PROCESS__SETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003358}
3359
3360static int selinux_task_getpgid(struct task_struct *p)
3361{
David Howells3b11a1d2008-11-14 10:39:26 +11003362 return current_has_perm(p, PROCESS__GETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003363}
3364
3365static int selinux_task_getsid(struct task_struct *p)
3366{
David Howells3b11a1d2008-11-14 10:39:26 +11003367 return current_has_perm(p, PROCESS__GETSESSION);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003368}
3369
David Quigleyf9008e42006-06-30 01:55:46 -07003370static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3371{
David Howells275bb412008-11-14 10:39:19 +11003372 *secid = task_sid(p);
David Quigleyf9008e42006-06-30 01:55:46 -07003373}
3374
Linus Torvalds1da177e2005-04-16 15:20:36 -07003375static int selinux_task_setgroups(struct group_info *group_info)
3376{
3377 /* See the comment for setuid above. */
3378 return 0;
3379}
3380
3381static int selinux_task_setnice(struct task_struct *p, int nice)
3382{
3383 int rc;
3384
3385 rc = secondary_ops->task_setnice(p, nice);
3386 if (rc)
3387 return rc;
3388
David Howells3b11a1d2008-11-14 10:39:26 +11003389 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003390}
3391
James Morris03e68062006-06-23 02:03:58 -07003392static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3393{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003394 int rc;
3395
3396 rc = secondary_ops->task_setioprio(p, ioprio);
3397 if (rc)
3398 return rc;
3399
David Howells3b11a1d2008-11-14 10:39:26 +11003400 return current_has_perm(p, PROCESS__SETSCHED);
James Morris03e68062006-06-23 02:03:58 -07003401}
3402
David Quigleya1836a42006-06-30 01:55:49 -07003403static int selinux_task_getioprio(struct task_struct *p)
3404{
David Howells3b11a1d2008-11-14 10:39:26 +11003405 return current_has_perm(p, PROCESS__GETSCHED);
David Quigleya1836a42006-06-30 01:55:49 -07003406}
3407
Linus Torvalds1da177e2005-04-16 15:20:36 -07003408static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3409{
3410 struct rlimit *old_rlim = current->signal->rlim + resource;
3411 int rc;
3412
3413 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3414 if (rc)
3415 return rc;
3416
3417 /* Control the ability to change the hard limit (whether
3418 lowering or raising it), so that the hard limit can
3419 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003420 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003421 if (old_rlim->rlim_max != new_rlim->rlim_max)
David Howells3b11a1d2008-11-14 10:39:26 +11003422 return current_has_perm(current, PROCESS__SETRLIMIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003423
3424 return 0;
3425}
3426
3427static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3428{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003429 int rc;
3430
3431 rc = secondary_ops->task_setscheduler(p, policy, lp);
3432 if (rc)
3433 return rc;
3434
David Howells3b11a1d2008-11-14 10:39:26 +11003435 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003436}
3437
3438static int selinux_task_getscheduler(struct task_struct *p)
3439{
David Howells3b11a1d2008-11-14 10:39:26 +11003440 return current_has_perm(p, PROCESS__GETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003441}
3442
David Quigley35601542006-06-23 02:04:01 -07003443static int selinux_task_movememory(struct task_struct *p)
3444{
David Howells3b11a1d2008-11-14 10:39:26 +11003445 return current_has_perm(p, PROCESS__SETSCHED);
David Quigley35601542006-06-23 02:04:01 -07003446}
3447
David Quigleyf9008e42006-06-30 01:55:46 -07003448static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3449 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003450{
3451 u32 perm;
3452 int rc;
3453
David Quigleyf9008e42006-06-30 01:55:46 -07003454 rc = secondary_ops->task_kill(p, info, sig, secid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003455 if (rc)
3456 return rc;
3457
Linus Torvalds1da177e2005-04-16 15:20:36 -07003458 if (!sig)
3459 perm = PROCESS__SIGNULL; /* null signal; existence test */
3460 else
3461 perm = signal_to_av(sig);
David Quigleyf9008e42006-06-30 01:55:46 -07003462 if (secid)
David Howells275bb412008-11-14 10:39:19 +11003463 rc = avc_has_perm(secid, task_sid(p),
3464 SECCLASS_PROCESS, perm, NULL);
David Quigleyf9008e42006-06-30 01:55:46 -07003465 else
David Howells3b11a1d2008-11-14 10:39:26 +11003466 rc = current_has_perm(p, perm);
David Quigleyf9008e42006-06-30 01:55:46 -07003467 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003468}
3469
3470static int selinux_task_prctl(int option,
3471 unsigned long arg2,
3472 unsigned long arg3,
3473 unsigned long arg4,
David Howellsd84f4f92008-11-14 10:39:23 +11003474 unsigned long arg5)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003475{
3476 /* The current prctl operations do not appear to require
3477 any SELinux controls since they merely observe or modify
3478 the state of the current process. */
David Howellsd84f4f92008-11-14 10:39:23 +11003479 return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003480}
3481
3482static int selinux_task_wait(struct task_struct *p)
3483{
Eric Paris8a535142007-10-22 16:10:31 -04003484 return task_has_perm(p, current, PROCESS__SIGCHLD);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003485}
3486
Linus Torvalds1da177e2005-04-16 15:20:36 -07003487static void selinux_task_to_inode(struct task_struct *p,
3488 struct inode *inode)
3489{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003490 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11003491 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003492
David Howells275bb412008-11-14 10:39:19 +11003493 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003494 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003495}
3496
Linus Torvalds1da177e2005-04-16 15:20:36 -07003497/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003498static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3499 struct avc_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003500{
3501 int offset, ihlen, ret = -EINVAL;
3502 struct iphdr _iph, *ih;
3503
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003504 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003505 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3506 if (ih == NULL)
3507 goto out;
3508
3509 ihlen = ih->ihl * 4;
3510 if (ihlen < sizeof(_iph))
3511 goto out;
3512
3513 ad->u.net.v4info.saddr = ih->saddr;
3514 ad->u.net.v4info.daddr = ih->daddr;
3515 ret = 0;
3516
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003517 if (proto)
3518 *proto = ih->protocol;
3519
Linus Torvalds1da177e2005-04-16 15:20:36 -07003520 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04003521 case IPPROTO_TCP: {
3522 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003523
Eric Paris828dfe12008-04-17 13:17:49 -04003524 if (ntohs(ih->frag_off) & IP_OFFSET)
3525 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003526
3527 offset += ihlen;
3528 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3529 if (th == NULL)
3530 break;
3531
3532 ad->u.net.sport = th->source;
3533 ad->u.net.dport = th->dest;
3534 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003535 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003536
Eric Paris828dfe12008-04-17 13:17:49 -04003537 case IPPROTO_UDP: {
3538 struct udphdr _udph, *uh;
3539
3540 if (ntohs(ih->frag_off) & IP_OFFSET)
3541 break;
3542
3543 offset += ihlen;
3544 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3545 if (uh == NULL)
3546 break;
3547
3548 ad->u.net.sport = uh->source;
3549 ad->u.net.dport = uh->dest;
3550 break;
3551 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003552
James Morris2ee92d42006-11-13 16:09:01 -08003553 case IPPROTO_DCCP: {
3554 struct dccp_hdr _dccph, *dh;
3555
3556 if (ntohs(ih->frag_off) & IP_OFFSET)
3557 break;
3558
3559 offset += ihlen;
3560 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3561 if (dh == NULL)
3562 break;
3563
3564 ad->u.net.sport = dh->dccph_sport;
3565 ad->u.net.dport = dh->dccph_dport;
3566 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003567 }
James Morris2ee92d42006-11-13 16:09:01 -08003568
Eric Paris828dfe12008-04-17 13:17:49 -04003569 default:
3570 break;
3571 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003572out:
3573 return ret;
3574}
3575
3576#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3577
3578/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003579static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3580 struct avc_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003581{
3582 u8 nexthdr;
3583 int ret = -EINVAL, offset;
3584 struct ipv6hdr _ipv6h, *ip6;
3585
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003586 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003587 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3588 if (ip6 == NULL)
3589 goto out;
3590
3591 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3592 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3593 ret = 0;
3594
3595 nexthdr = ip6->nexthdr;
3596 offset += sizeof(_ipv6h);
Herbert Xu0d3d0772005-04-24 20:16:19 -07003597 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003598 if (offset < 0)
3599 goto out;
3600
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003601 if (proto)
3602 *proto = nexthdr;
3603
Linus Torvalds1da177e2005-04-16 15:20:36 -07003604 switch (nexthdr) {
3605 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04003606 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003607
3608 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3609 if (th == NULL)
3610 break;
3611
3612 ad->u.net.sport = th->source;
3613 ad->u.net.dport = th->dest;
3614 break;
3615 }
3616
3617 case IPPROTO_UDP: {
3618 struct udphdr _udph, *uh;
3619
3620 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3621 if (uh == NULL)
3622 break;
3623
3624 ad->u.net.sport = uh->source;
3625 ad->u.net.dport = uh->dest;
3626 break;
3627 }
3628
James Morris2ee92d42006-11-13 16:09:01 -08003629 case IPPROTO_DCCP: {
3630 struct dccp_hdr _dccph, *dh;
3631
3632 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3633 if (dh == NULL)
3634 break;
3635
3636 ad->u.net.sport = dh->dccph_sport;
3637 ad->u.net.dport = dh->dccph_dport;
3638 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003639 }
James Morris2ee92d42006-11-13 16:09:01 -08003640
Linus Torvalds1da177e2005-04-16 15:20:36 -07003641 /* includes fragments */
3642 default:
3643 break;
3644 }
3645out:
3646 return ret;
3647}
3648
3649#endif /* IPV6 */
3650
3651static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10003652 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003653{
David Howellscf9481e2008-07-27 21:31:07 +10003654 char *addrp;
3655 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003656
3657 switch (ad->u.net.family) {
3658 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003659 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003660 if (ret)
3661 goto parse_error;
3662 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3663 &ad->u.net.v4info.daddr);
3664 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003665
3666#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3667 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003668 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003669 if (ret)
3670 goto parse_error;
3671 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3672 &ad->u.net.v6info.daddr);
3673 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003674#endif /* IPV6 */
3675 default:
David Howellscf9481e2008-07-27 21:31:07 +10003676 addrp = NULL;
3677 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003678 }
3679
David Howellscf9481e2008-07-27 21:31:07 +10003680parse_error:
3681 printk(KERN_WARNING
3682 "SELinux: failure in selinux_parse_skb(),"
3683 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07003684 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10003685
3686okay:
3687 if (_addrp)
3688 *_addrp = addrp;
3689 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003690}
3691
Paul Moore4f6a9932007-03-01 14:35:22 -05003692/**
Paul Moore220deb92008-01-29 08:38:23 -05003693 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05003694 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05003695 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05003696 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05003697 *
3698 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05003699 * Check the various different forms of network peer labeling and determine
3700 * the peer label/SID for the packet; most of the magic actually occurs in
3701 * the security server function security_net_peersid_cmp(). The function
3702 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3703 * or -EACCES if @sid is invalid due to inconsistencies with the different
3704 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05003705 *
3706 */
Paul Moore220deb92008-01-29 08:38:23 -05003707static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05003708{
Paul Moore71f1cb02008-01-29 08:51:16 -05003709 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05003710 u32 xfrm_sid;
3711 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05003712 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05003713
3714 selinux_skb_xfrm_sid(skb, &xfrm_sid);
Paul Moore5dbe1eb2008-01-29 08:44:18 -05003715 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
Paul Moore220deb92008-01-29 08:38:23 -05003716
Paul Moore71f1cb02008-01-29 08:51:16 -05003717 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3718 if (unlikely(err)) {
3719 printk(KERN_WARNING
3720 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3721 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05003722 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05003723 }
Paul Moore220deb92008-01-29 08:38:23 -05003724
3725 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05003726}
3727
Linus Torvalds1da177e2005-04-16 15:20:36 -07003728/* socket security operations */
3729static int socket_has_perm(struct task_struct *task, struct socket *sock,
3730 u32 perms)
3731{
3732 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003733 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003734 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003735 int err = 0;
3736
Linus Torvalds1da177e2005-04-16 15:20:36 -07003737 isec = SOCK_INODE(sock)->i_security;
3738
3739 if (isec->sid == SECINITSID_KERNEL)
3740 goto out;
David Howells275bb412008-11-14 10:39:19 +11003741 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003742
Eric Paris828dfe12008-04-17 13:17:49 -04003743 AVC_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003744 ad.u.net.sk = sock->sk;
David Howells275bb412008-11-14 10:39:19 +11003745 err = avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003746
3747out:
3748 return err;
3749}
3750
3751static int selinux_socket_create(int family, int type,
3752 int protocol, int kern)
3753{
David Howells275bb412008-11-14 10:39:19 +11003754 const struct cred *cred = current_cred();
3755 const struct task_security_struct *tsec = cred->security;
3756 u32 sid, newsid;
3757 u16 secclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003758 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003759
3760 if (kern)
3761 goto out;
3762
David Howells275bb412008-11-14 10:39:19 +11003763 sid = tsec->sid;
3764 newsid = tsec->sockcreate_sid ?: sid;
3765
3766 secclass = socket_type_to_security_class(family, type, protocol);
3767 err = avc_has_perm(sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003768
3769out:
3770 return err;
3771}
3772
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003773static int selinux_socket_post_create(struct socket *sock, int family,
3774 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003775{
David Howells275bb412008-11-14 10:39:19 +11003776 const struct cred *cred = current_cred();
3777 const struct task_security_struct *tsec = cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003778 struct inode_security_struct *isec;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003779 struct sk_security_struct *sksec;
David Howells275bb412008-11-14 10:39:19 +11003780 u32 sid, newsid;
3781 int err = 0;
3782
3783 sid = tsec->sid;
3784 newsid = tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003785
3786 isec = SOCK_INODE(sock)->i_security;
3787
David Howells275bb412008-11-14 10:39:19 +11003788 if (kern)
3789 isec->sid = SECINITSID_KERNEL;
3790 else if (newsid)
3791 isec->sid = newsid;
3792 else
3793 isec->sid = sid;
3794
Linus Torvalds1da177e2005-04-16 15:20:36 -07003795 isec->sclass = socket_type_to_security_class(family, type, protocol);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003796 isec->initialized = 1;
3797
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003798 if (sock->sk) {
3799 sksec = sock->sk->sk_security;
3800 sksec->sid = isec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05003801 sksec->sclass = isec->sclass;
Paul Moore9f2ad662006-11-17 17:38:53 -05003802 err = selinux_netlbl_socket_post_create(sock);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003803 }
3804
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003805 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003806}
3807
3808/* Range of port numbers used to automatically bind.
3809 Need to determine whether we should perform a name_bind
3810 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003811
3812static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3813{
3814 u16 family;
3815 int err;
3816
3817 err = socket_has_perm(current, sock, SOCKET__BIND);
3818 if (err)
3819 goto out;
3820
3821 /*
3822 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04003823 * Multiple address binding for SCTP is not supported yet: we just
3824 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003825 */
3826 family = sock->sk->sk_family;
3827 if (family == PF_INET || family == PF_INET6) {
3828 char *addrp;
3829 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003830 struct avc_audit_data ad;
3831 struct sockaddr_in *addr4 = NULL;
3832 struct sockaddr_in6 *addr6 = NULL;
3833 unsigned short snum;
3834 struct sock *sk = sock->sk;
James Morrise399f982008-06-12 01:39:58 +10003835 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003836
Linus Torvalds1da177e2005-04-16 15:20:36 -07003837 isec = SOCK_INODE(sock)->i_security;
3838
3839 if (family == PF_INET) {
3840 addr4 = (struct sockaddr_in *)address;
3841 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003842 addrp = (char *)&addr4->sin_addr.s_addr;
3843 } else {
3844 addr6 = (struct sockaddr_in6 *)address;
3845 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003846 addrp = (char *)&addr6->sin6_addr.s6_addr;
3847 }
3848
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003849 if (snum) {
3850 int low, high;
3851
3852 inet_get_local_port_range(&low, &high);
3853
3854 if (snum < max(PROT_SOCK, low) || snum > high) {
Paul Moore3e112172008-04-10 10:48:14 -04003855 err = sel_netport_sid(sk->sk_protocol,
3856 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003857 if (err)
3858 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04003859 AVC_AUDIT_DATA_INIT(&ad, NET);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003860 ad.u.net.sport = htons(snum);
3861 ad.u.net.family = family;
3862 err = avc_has_perm(isec->sid, sid,
3863 isec->sclass,
3864 SOCKET__NAME_BIND, &ad);
3865 if (err)
3866 goto out;
3867 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003868 }
Eric Paris828dfe12008-04-17 13:17:49 -04003869
3870 switch (isec->sclass) {
James Morris13402582005-09-30 14:24:34 -04003871 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003872 node_perm = TCP_SOCKET__NODE_BIND;
3873 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003874
James Morris13402582005-09-30 14:24:34 -04003875 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003876 node_perm = UDP_SOCKET__NODE_BIND;
3877 break;
James Morris2ee92d42006-11-13 16:09:01 -08003878
3879 case SECCLASS_DCCP_SOCKET:
3880 node_perm = DCCP_SOCKET__NODE_BIND;
3881 break;
3882
Linus Torvalds1da177e2005-04-16 15:20:36 -07003883 default:
3884 node_perm = RAWIP_SOCKET__NODE_BIND;
3885 break;
3886 }
Eric Paris828dfe12008-04-17 13:17:49 -04003887
Paul Moore224dfbd2008-01-29 08:38:13 -05003888 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003889 if (err)
3890 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04003891
3892 AVC_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003893 ad.u.net.sport = htons(snum);
3894 ad.u.net.family = family;
3895
3896 if (family == PF_INET)
3897 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3898 else
3899 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3900
3901 err = avc_has_perm(isec->sid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04003902 isec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003903 if (err)
3904 goto out;
3905 }
3906out:
3907 return err;
3908}
3909
3910static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3911{
Paul Moore014ab192008-10-10 10:16:33 -04003912 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003913 struct inode_security_struct *isec;
3914 int err;
3915
3916 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3917 if (err)
3918 return err;
3919
3920 /*
James Morris2ee92d42006-11-13 16:09:01 -08003921 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003922 */
3923 isec = SOCK_INODE(sock)->i_security;
James Morris2ee92d42006-11-13 16:09:01 -08003924 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3925 isec->sclass == SECCLASS_DCCP_SOCKET) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003926 struct avc_audit_data ad;
3927 struct sockaddr_in *addr4 = NULL;
3928 struct sockaddr_in6 *addr6 = NULL;
3929 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08003930 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003931
3932 if (sk->sk_family == PF_INET) {
3933 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003934 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003935 return -EINVAL;
3936 snum = ntohs(addr4->sin_port);
3937 } else {
3938 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003939 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003940 return -EINVAL;
3941 snum = ntohs(addr6->sin6_port);
3942 }
3943
Paul Moore3e112172008-04-10 10:48:14 -04003944 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003945 if (err)
3946 goto out;
3947
James Morris2ee92d42006-11-13 16:09:01 -08003948 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3949 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3950
Eric Paris828dfe12008-04-17 13:17:49 -04003951 AVC_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003952 ad.u.net.dport = htons(snum);
3953 ad.u.net.family = sk->sk_family;
James Morris2ee92d42006-11-13 16:09:01 -08003954 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003955 if (err)
3956 goto out;
3957 }
3958
Paul Moore014ab192008-10-10 10:16:33 -04003959 err = selinux_netlbl_socket_connect(sk, address);
3960
Linus Torvalds1da177e2005-04-16 15:20:36 -07003961out:
3962 return err;
3963}
3964
3965static int selinux_socket_listen(struct socket *sock, int backlog)
3966{
3967 return socket_has_perm(current, sock, SOCKET__LISTEN);
3968}
3969
3970static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3971{
3972 int err;
3973 struct inode_security_struct *isec;
3974 struct inode_security_struct *newisec;
3975
3976 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3977 if (err)
3978 return err;
3979
3980 newisec = SOCK_INODE(newsock)->i_security;
3981
3982 isec = SOCK_INODE(sock)->i_security;
3983 newisec->sclass = isec->sclass;
3984 newisec->sid = isec->sid;
3985 newisec->initialized = 1;
3986
3987 return 0;
3988}
3989
3990static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04003991 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003992{
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003993 int rc;
3994
3995 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3996 if (rc)
3997 return rc;
3998
3999 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004000}
4001
4002static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4003 int size, int flags)
4004{
4005 return socket_has_perm(current, sock, SOCKET__READ);
4006}
4007
4008static int selinux_socket_getsockname(struct socket *sock)
4009{
4010 return socket_has_perm(current, sock, SOCKET__GETATTR);
4011}
4012
4013static int selinux_socket_getpeername(struct socket *sock)
4014{
4015 return socket_has_perm(current, sock, SOCKET__GETATTR);
4016}
4017
Eric Paris828dfe12008-04-17 13:17:49 -04004018static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004019{
Paul Mooref8687af2006-10-30 15:22:15 -08004020 int err;
4021
4022 err = socket_has_perm(current, sock, SOCKET__SETOPT);
4023 if (err)
4024 return err;
4025
4026 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004027}
4028
4029static int selinux_socket_getsockopt(struct socket *sock, int level,
4030 int optname)
4031{
4032 return socket_has_perm(current, sock, SOCKET__GETOPT);
4033}
4034
4035static int selinux_socket_shutdown(struct socket *sock, int how)
4036{
4037 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
4038}
4039
4040static int selinux_socket_unix_stream_connect(struct socket *sock,
4041 struct socket *other,
4042 struct sock *newsk)
4043{
4044 struct sk_security_struct *ssec;
4045 struct inode_security_struct *isec;
4046 struct inode_security_struct *other_isec;
4047 struct avc_audit_data ad;
4048 int err;
4049
4050 err = secondary_ops->unix_stream_connect(sock, other, newsk);
4051 if (err)
4052 return err;
4053
4054 isec = SOCK_INODE(sock)->i_security;
4055 other_isec = SOCK_INODE(other)->i_security;
4056
Eric Paris828dfe12008-04-17 13:17:49 -04004057 AVC_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004058 ad.u.net.sk = other->sk;
4059
4060 err = avc_has_perm(isec->sid, other_isec->sid,
4061 isec->sclass,
4062 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4063 if (err)
4064 return err;
4065
4066 /* connecting socket */
4067 ssec = sock->sk->sk_security;
4068 ssec->peer_sid = other_isec->sid;
Eric Paris828dfe12008-04-17 13:17:49 -04004069
Linus Torvalds1da177e2005-04-16 15:20:36 -07004070 /* server child socket */
4071 ssec = newsk->sk_security;
4072 ssec->peer_sid = isec->sid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004073 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
4074
4075 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004076}
4077
4078static int selinux_socket_unix_may_send(struct socket *sock,
4079 struct socket *other)
4080{
4081 struct inode_security_struct *isec;
4082 struct inode_security_struct *other_isec;
4083 struct avc_audit_data ad;
4084 int err;
4085
4086 isec = SOCK_INODE(sock)->i_security;
4087 other_isec = SOCK_INODE(other)->i_security;
4088
Eric Paris828dfe12008-04-17 13:17:49 -04004089 AVC_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004090 ad.u.net.sk = other->sk;
4091
4092 err = avc_has_perm(isec->sid, other_isec->sid,
4093 isec->sclass, SOCKET__SENDTO, &ad);
4094 if (err)
4095 return err;
4096
4097 return 0;
4098}
4099
Paul Mooreeffad8d2008-01-29 08:49:27 -05004100static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4101 u32 peer_sid,
4102 struct avc_audit_data *ad)
4103{
4104 int err;
4105 u32 if_sid;
4106 u32 node_sid;
4107
4108 err = sel_netif_sid(ifindex, &if_sid);
4109 if (err)
4110 return err;
4111 err = avc_has_perm(peer_sid, if_sid,
4112 SECCLASS_NETIF, NETIF__INGRESS, ad);
4113 if (err)
4114 return err;
4115
4116 err = sel_netnode_sid(addrp, family, &node_sid);
4117 if (err)
4118 return err;
4119 return avc_has_perm(peer_sid, node_sid,
4120 SECCLASS_NODE, NODE__RECVFROM, ad);
4121}
4122
Paul Moore220deb92008-01-29 08:38:23 -05004123static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
4124 struct sk_buff *skb,
4125 struct avc_audit_data *ad,
4126 u16 family,
4127 char *addrp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004128{
Paul Moore220deb92008-01-29 08:38:23 -05004129 int err;
4130 struct sk_security_struct *sksec = sk->sk_security;
4131 u16 sk_class;
4132 u32 netif_perm, node_perm, recv_perm;
4133 u32 port_sid, node_sid, if_sid, sk_sid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004134
Paul Moore220deb92008-01-29 08:38:23 -05004135 sk_sid = sksec->sid;
4136 sk_class = sksec->sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004137
Paul Moore220deb92008-01-29 08:38:23 -05004138 switch (sk_class) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004139 case SECCLASS_UDP_SOCKET:
4140 netif_perm = NETIF__UDP_RECV;
4141 node_perm = NODE__UDP_RECV;
4142 recv_perm = UDP_SOCKET__RECV_MSG;
4143 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004144 case SECCLASS_TCP_SOCKET:
4145 netif_perm = NETIF__TCP_RECV;
4146 node_perm = NODE__TCP_RECV;
4147 recv_perm = TCP_SOCKET__RECV_MSG;
4148 break;
James Morris2ee92d42006-11-13 16:09:01 -08004149 case SECCLASS_DCCP_SOCKET:
4150 netif_perm = NETIF__DCCP_RECV;
4151 node_perm = NODE__DCCP_RECV;
4152 recv_perm = DCCP_SOCKET__RECV_MSG;
4153 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004154 default:
4155 netif_perm = NETIF__RAWIP_RECV;
4156 node_perm = NODE__RAWIP_RECV;
Paul Moore220deb92008-01-29 08:38:23 -05004157 recv_perm = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004158 break;
4159 }
4160
Paul Moore220deb92008-01-29 08:38:23 -05004161 err = sel_netif_sid(skb->iif, &if_sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004162 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004163 return err;
4164 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4165 if (err)
4166 return err;
Eric Paris828dfe12008-04-17 13:17:49 -04004167
Paul Moore224dfbd2008-01-29 08:38:13 -05004168 err = sel_netnode_sid(addrp, family, &node_sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004169 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004170 return err;
4171 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004172 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004173 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004174
Paul Moore220deb92008-01-29 08:38:23 -05004175 if (!recv_perm)
4176 return 0;
Paul Moore3e112172008-04-10 10:48:14 -04004177 err = sel_netport_sid(sk->sk_protocol,
4178 ntohs(ad->u.net.sport), &port_sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004179 if (unlikely(err)) {
4180 printk(KERN_WARNING
4181 "SELinux: failure in"
4182 " selinux_sock_rcv_skb_iptables_compat(),"
4183 " network port label not found\n");
Paul Moore220deb92008-01-29 08:38:23 -05004184 return err;
Paul Moore71f1cb02008-01-29 08:51:16 -05004185 }
Paul Moore220deb92008-01-29 08:38:23 -05004186 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4187}
Linus Torvalds1da177e2005-04-16 15:20:36 -07004188
Paul Moore220deb92008-01-29 08:38:23 -05004189static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004190 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004191{
Paul Moore277d3422008-12-31 12:54:11 -05004192 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004193 struct sk_security_struct *sksec = sk->sk_security;
4194 u32 peer_sid;
4195 u32 sk_sid = sksec->sid;
Paul Moored8395c82008-10-10 10:16:30 -04004196 struct avc_audit_data ad;
4197 char *addrp;
4198
4199 AVC_AUDIT_DATA_INIT(&ad, NET);
4200 ad.u.net.netif = skb->iif;
4201 ad.u.net.family = family;
4202 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4203 if (err)
4204 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004205
4206 if (selinux_compat_net)
Paul Moored8395c82008-10-10 10:16:30 -04004207 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, &ad,
Paul Moore220deb92008-01-29 08:38:23 -05004208 family, addrp);
Paul Moore277d3422008-12-31 12:54:11 -05004209 else if (selinux_secmark_enabled())
Paul Moore220deb92008-01-29 08:38:23 -05004210 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004211 PACKET__RECV, &ad);
Paul Moore220deb92008-01-29 08:38:23 -05004212 if (err)
4213 return err;
4214
4215 if (selinux_policycap_netpeer) {
4216 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004217 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004218 return err;
4219 err = avc_has_perm(sk_sid, peer_sid,
Paul Moored8395c82008-10-10 10:16:30 -04004220 SECCLASS_PEER, PEER__RECV, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004221 if (err)
4222 selinux_netlbl_err(skb, err, 0);
Paul Moore220deb92008-01-29 08:38:23 -05004223 } else {
Paul Moored8395c82008-10-10 10:16:30 -04004224 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
Paul Moore220deb92008-01-29 08:38:23 -05004225 if (err)
4226 return err;
Paul Moored8395c82008-10-10 10:16:30 -04004227 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004228 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004229
James Morris4e5ab4c2006-06-09 00:33:33 -07004230 return err;
4231}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004232
James Morris4e5ab4c2006-06-09 00:33:33 -07004233static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4234{
Paul Moore220deb92008-01-29 08:38:23 -05004235 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004236 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004237 u16 family = sk->sk_family;
4238 u32 sk_sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004239 struct avc_audit_data ad;
4240 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004241 u8 secmark_active;
4242 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004243
James Morris4e5ab4c2006-06-09 00:33:33 -07004244 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004245 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004246
4247 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004248 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004249 family = PF_INET;
4250
Paul Moored8395c82008-10-10 10:16:30 -04004251 /* If any sort of compatibility mode is enabled then handoff processing
4252 * to the selinux_sock_rcv_skb_compat() function to deal with the
4253 * special handling. We do this in an attempt to keep this function
4254 * as fast and as clean as possible. */
4255 if (selinux_compat_net || !selinux_policycap_netpeer)
4256 return selinux_sock_rcv_skb_compat(sk, skb, family);
4257
4258 secmark_active = selinux_secmark_enabled();
4259 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4260 if (!secmark_active && !peerlbl_active)
4261 return 0;
4262
James Morris4e5ab4c2006-06-09 00:33:33 -07004263 AVC_AUDIT_DATA_INIT(&ad, NET);
Paul Mooreda5645a2008-01-29 08:38:10 -05004264 ad.u.net.netif = skb->iif;
James Morris4e5ab4c2006-06-09 00:33:33 -07004265 ad.u.net.family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004266 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004267 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004268 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004269
Paul Moored8395c82008-10-10 10:16:30 -04004270 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004271 u32 peer_sid;
4272
4273 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4274 if (err)
4275 return err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004276 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4277 peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004278 if (err) {
4279 selinux_netlbl_err(skb, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004280 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004281 }
Paul Moored621d352008-01-29 08:43:36 -05004282 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4283 PEER__RECV, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004284 if (err)
4285 selinux_netlbl_err(skb, err, 0);
Paul Moored621d352008-01-29 08:43:36 -05004286 }
4287
Paul Moored8395c82008-10-10 10:16:30 -04004288 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004289 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4290 PACKET__RECV, &ad);
4291 if (err)
4292 return err;
4293 }
4294
Paul Moored621d352008-01-29 08:43:36 -05004295 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004296}
4297
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004298static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4299 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004300{
4301 int err = 0;
4302 char *scontext;
4303 u32 scontext_len;
4304 struct sk_security_struct *ssec;
4305 struct inode_security_struct *isec;
Paul Moore3de4bab2006-11-17 17:38:54 -05004306 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004307
4308 isec = SOCK_INODE(sock)->i_security;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004309
Paul Moore3de4bab2006-11-17 17:38:54 -05004310 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4311 isec->sclass == SECCLASS_TCP_SOCKET) {
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004312 ssec = sock->sk->sk_security;
4313 peer_sid = ssec->peer_sid;
4314 }
Paul Moore3de4bab2006-11-17 17:38:54 -05004315 if (peer_sid == SECSID_NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004316 err = -ENOPROTOOPT;
4317 goto out;
4318 }
4319
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004320 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4321
Linus Torvalds1da177e2005-04-16 15:20:36 -07004322 if (err)
4323 goto out;
4324
4325 if (scontext_len > len) {
4326 err = -ERANGE;
4327 goto out_len;
4328 }
4329
4330 if (copy_to_user(optval, scontext, scontext_len))
4331 err = -EFAULT;
4332
4333out_len:
4334 if (put_user(scontext_len, optlen))
4335 err = -EFAULT;
4336
4337 kfree(scontext);
Eric Paris828dfe12008-04-17 13:17:49 -04004338out:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004339 return err;
4340}
4341
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004342static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004343{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004344 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004345 u16 family;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004346
Paul Mooreaa862902008-10-10 10:16:29 -04004347 if (skb && skb->protocol == htons(ETH_P_IP))
4348 family = PF_INET;
4349 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4350 family = PF_INET6;
4351 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004352 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004353 else
4354 goto out;
4355
4356 if (sock && family == PF_UNIX)
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02004357 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
Paul Moore3de4bab2006-11-17 17:38:54 -05004358 else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004359 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004360
Paul Moore75e22912008-01-29 08:38:04 -05004361out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004362 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004363 if (peer_secid == SECSID_NULL)
4364 return -EINVAL;
4365 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004366}
4367
Al Viro7d877f32005-10-21 03:20:43 -04004368static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004369{
4370 return sk_alloc_security(sk, family, priority);
4371}
4372
4373static void selinux_sk_free_security(struct sock *sk)
4374{
4375 sk_free_security(sk);
4376}
4377
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004378static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4379{
4380 struct sk_security_struct *ssec = sk->sk_security;
4381 struct sk_security_struct *newssec = newsk->sk_security;
4382
4383 newssec->sid = ssec->sid;
4384 newssec->peer_sid = ssec->peer_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004385 newssec->sclass = ssec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004386
Paul Mooref74af6e2008-02-25 11:40:33 -05004387 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004388}
4389
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004390static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004391{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004392 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004393 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004394 else {
4395 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004396
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004397 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004398 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004399}
4400
Eric Paris828dfe12008-04-17 13:17:49 -04004401static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004402{
4403 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4404 struct sk_security_struct *sksec = sk->sk_security;
4405
David Woodhouse2148ccc2006-09-29 15:50:25 -07004406 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4407 sk->sk_family == PF_UNIX)
4408 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004409 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004410}
4411
Adrian Bunk9a673e52006-08-15 00:03:53 -07004412static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4413 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004414{
4415 struct sk_security_struct *sksec = sk->sk_security;
4416 int err;
Paul Mooreaa862902008-10-10 10:16:29 -04004417 u16 family = sk->sk_family;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004418 u32 newsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004419 u32 peersid;
4420
Paul Mooreaa862902008-10-10 10:16:29 -04004421 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4422 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4423 family = PF_INET;
4424
4425 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004426 if (err)
4427 return err;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004428 if (peersid == SECSID_NULL) {
4429 req->secid = sksec->sid;
Paul Moore3de4bab2006-11-17 17:38:54 -05004430 req->peer_secid = SECSID_NULL;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004431 return 0;
4432 }
4433
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004434 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4435 if (err)
4436 return err;
4437
4438 req->secid = newsid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004439 req->peer_secid = peersid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004440 return 0;
4441}
4442
Adrian Bunk9a673e52006-08-15 00:03:53 -07004443static void selinux_inet_csk_clone(struct sock *newsk,
4444 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004445{
4446 struct sk_security_struct *newsksec = newsk->sk_security;
4447
4448 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004449 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004450 /* NOTE: Ideally, we should also get the isec->sid for the
4451 new socket in sync, but we don't have the isec available yet.
4452 So we will wait until sock_graft to do it, by which
4453 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004454
Paul Moore9f2ad662006-11-17 17:38:53 -05004455 /* We don't need to take any sort of lock here as we are the only
4456 * thread with access to newsksec */
4457 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004458}
4459
Paul Moore014ab192008-10-10 10:16:33 -04004460static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004461{
Paul Mooreaa862902008-10-10 10:16:29 -04004462 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004463 struct sk_security_struct *sksec = sk->sk_security;
4464
Paul Mooreaa862902008-10-10 10:16:29 -04004465 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4466 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4467 family = PF_INET;
4468
4469 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Paul Moore014ab192008-10-10 10:16:33 -04004470
4471 selinux_netlbl_inet_conn_established(sk, family);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004472}
4473
Adrian Bunk9a673e52006-08-15 00:03:53 -07004474static void selinux_req_classify_flow(const struct request_sock *req,
4475 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004476{
4477 fl->secid = req->secid;
4478}
4479
Linus Torvalds1da177e2005-04-16 15:20:36 -07004480static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4481{
4482 int err = 0;
4483 u32 perm;
4484 struct nlmsghdr *nlh;
4485 struct socket *sock = sk->sk_socket;
4486 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
Eric Paris828dfe12008-04-17 13:17:49 -04004487
Linus Torvalds1da177e2005-04-16 15:20:36 -07004488 if (skb->len < NLMSG_SPACE(0)) {
4489 err = -EINVAL;
4490 goto out;
4491 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07004492 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04004493
Linus Torvalds1da177e2005-04-16 15:20:36 -07004494 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4495 if (err) {
4496 if (err == -EINVAL) {
David Woodhouse9ad9ad32005-06-22 15:04:33 +01004497 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004498 "SELinux: unrecognized netlink message"
4499 " type=%hu for sclass=%hu\n",
4500 nlh->nlmsg_type, isec->sclass);
Eric Paris39c9aed2008-11-05 09:34:42 -05004501 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07004502 err = 0;
4503 }
4504
4505 /* Ignore */
4506 if (err == -ENOENT)
4507 err = 0;
4508 goto out;
4509 }
4510
4511 err = socket_has_perm(current, sock, perm);
4512out:
4513 return err;
4514}
4515
4516#ifdef CONFIG_NETFILTER
4517
Paul Mooreeffad8d2008-01-29 08:49:27 -05004518static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4519 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004520{
Paul Mooredfaebe92008-10-10 10:16:31 -04004521 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004522 char *addrp;
4523 u32 peer_sid;
4524 struct avc_audit_data ad;
4525 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04004526 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004527 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004528
Paul Mooreeffad8d2008-01-29 08:49:27 -05004529 if (!selinux_policycap_netpeer)
4530 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004531
Paul Mooreeffad8d2008-01-29 08:49:27 -05004532 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04004533 netlbl_active = netlbl_enabled();
4534 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05004535 if (!secmark_active && !peerlbl_active)
4536 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004537
Paul Moored8395c82008-10-10 10:16:30 -04004538 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4539 return NF_DROP;
4540
Paul Mooreeffad8d2008-01-29 08:49:27 -05004541 AVC_AUDIT_DATA_INIT(&ad, NET);
4542 ad.u.net.netif = ifindex;
4543 ad.u.net.family = family;
4544 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4545 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004546
Paul Mooredfaebe92008-10-10 10:16:31 -04004547 if (peerlbl_active) {
4548 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4549 peer_sid, &ad);
4550 if (err) {
4551 selinux_netlbl_err(skb, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004552 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04004553 }
4554 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05004555
4556 if (secmark_active)
4557 if (avc_has_perm(peer_sid, skb->secmark,
4558 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4559 return NF_DROP;
4560
Paul Moore948bf852008-10-10 10:16:32 -04004561 if (netlbl_active)
4562 /* we do this in the FORWARD path and not the POST_ROUTING
4563 * path because we want to make sure we apply the necessary
4564 * labeling before IPsec is applied so we can leverage AH
4565 * protection */
4566 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4567 return NF_DROP;
4568
Paul Mooreeffad8d2008-01-29 08:49:27 -05004569 return NF_ACCEPT;
4570}
4571
4572static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4573 struct sk_buff *skb,
4574 const struct net_device *in,
4575 const struct net_device *out,
4576 int (*okfn)(struct sk_buff *))
4577{
4578 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4579}
4580
4581#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4582static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4583 struct sk_buff *skb,
4584 const struct net_device *in,
4585 const struct net_device *out,
4586 int (*okfn)(struct sk_buff *))
4587{
4588 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4589}
4590#endif /* IPV6 */
4591
Paul Moore948bf852008-10-10 10:16:32 -04004592static unsigned int selinux_ip_output(struct sk_buff *skb,
4593 u16 family)
4594{
4595 u32 sid;
4596
4597 if (!netlbl_enabled())
4598 return NF_ACCEPT;
4599
4600 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4601 * because we want to make sure we apply the necessary labeling
4602 * before IPsec is applied so we can leverage AH protection */
4603 if (skb->sk) {
4604 struct sk_security_struct *sksec = skb->sk->sk_security;
4605 sid = sksec->sid;
4606 } else
4607 sid = SECINITSID_KERNEL;
4608 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4609 return NF_DROP;
4610
4611 return NF_ACCEPT;
4612}
4613
4614static unsigned int selinux_ipv4_output(unsigned int hooknum,
4615 struct sk_buff *skb,
4616 const struct net_device *in,
4617 const struct net_device *out,
4618 int (*okfn)(struct sk_buff *))
4619{
4620 return selinux_ip_output(skb, PF_INET);
4621}
4622
Paul Mooreeffad8d2008-01-29 08:49:27 -05004623static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4624 int ifindex,
4625 struct avc_audit_data *ad,
4626 u16 family, char *addrp)
4627{
4628 int err;
4629 struct sk_security_struct *sksec = sk->sk_security;
4630 u16 sk_class;
4631 u32 netif_perm, node_perm, send_perm;
4632 u32 port_sid, node_sid, if_sid, sk_sid;
4633
4634 sk_sid = sksec->sid;
4635 sk_class = sksec->sclass;
4636
4637 switch (sk_class) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004638 case SECCLASS_UDP_SOCKET:
4639 netif_perm = NETIF__UDP_SEND;
4640 node_perm = NODE__UDP_SEND;
4641 send_perm = UDP_SOCKET__SEND_MSG;
4642 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004643 case SECCLASS_TCP_SOCKET:
4644 netif_perm = NETIF__TCP_SEND;
4645 node_perm = NODE__TCP_SEND;
4646 send_perm = TCP_SOCKET__SEND_MSG;
4647 break;
James Morris2ee92d42006-11-13 16:09:01 -08004648 case SECCLASS_DCCP_SOCKET:
4649 netif_perm = NETIF__DCCP_SEND;
4650 node_perm = NODE__DCCP_SEND;
4651 send_perm = DCCP_SOCKET__SEND_MSG;
4652 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004653 default:
4654 netif_perm = NETIF__RAWIP_SEND;
4655 node_perm = NODE__RAWIP_SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004656 send_perm = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004657 break;
4658 }
4659
Paul Mooreeffad8d2008-01-29 08:49:27 -05004660 err = sel_netif_sid(ifindex, &if_sid);
James Morris4e5ab4c2006-06-09 00:33:33 -07004661 if (err)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004662 return err;
4663 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4664 return err;
Eric Paris828dfe12008-04-17 13:17:49 -04004665
Paul Moore224dfbd2008-01-29 08:38:13 -05004666 err = sel_netnode_sid(addrp, family, &node_sid);
James Morris4e5ab4c2006-06-09 00:33:33 -07004667 if (err)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004668 return err;
4669 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
James Morris4e5ab4c2006-06-09 00:33:33 -07004670 if (err)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004671 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004672
Paul Mooreeffad8d2008-01-29 08:49:27 -05004673 if (send_perm != 0)
4674 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004675
Paul Moore3e112172008-04-10 10:48:14 -04004676 err = sel_netport_sid(sk->sk_protocol,
4677 ntohs(ad->u.net.dport), &port_sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004678 if (unlikely(err)) {
4679 printk(KERN_WARNING
4680 "SELinux: failure in"
4681 " selinux_ip_postroute_iptables_compat(),"
4682 " network port label not found\n");
Paul Mooreeffad8d2008-01-29 08:49:27 -05004683 return err;
Paul Moore71f1cb02008-01-29 08:51:16 -05004684 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05004685 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
James Morris4e5ab4c2006-06-09 00:33:33 -07004686}
Linus Torvalds1da177e2005-04-16 15:20:36 -07004687
Paul Mooreeffad8d2008-01-29 08:49:27 -05004688static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4689 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04004690 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07004691{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004692 struct sock *sk = skb->sk;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004693 struct sk_security_struct *sksec;
Paul Moored8395c82008-10-10 10:16:30 -04004694 struct avc_audit_data ad;
4695 char *addrp;
4696 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07004697
Paul Mooreeffad8d2008-01-29 08:49:27 -05004698 if (sk == NULL)
4699 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004700 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07004701
Paul Moored8395c82008-10-10 10:16:30 -04004702 AVC_AUDIT_DATA_INIT(&ad, NET);
4703 ad.u.net.netif = ifindex;
4704 ad.u.net.family = family;
4705 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4706 return NF_DROP;
4707
Paul Mooreeffad8d2008-01-29 08:49:27 -05004708 if (selinux_compat_net) {
4709 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04004710 &ad, family, addrp))
Paul Mooreeffad8d2008-01-29 08:49:27 -05004711 return NF_DROP;
Paul Moore277d3422008-12-31 12:54:11 -05004712 } else if (selinux_secmark_enabled()) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004713 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04004714 SECCLASS_PACKET, PACKET__SEND, &ad))
Paul Mooreeffad8d2008-01-29 08:49:27 -05004715 return NF_DROP;
4716 }
James Morris4e5ab4c2006-06-09 00:33:33 -07004717
Paul Mooreeffad8d2008-01-29 08:49:27 -05004718 if (selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004719 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
Paul Mooreeffad8d2008-01-29 08:49:27 -05004720 return NF_DROP;
James Morris4e5ab4c2006-06-09 00:33:33 -07004721
Paul Mooreeffad8d2008-01-29 08:49:27 -05004722 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004723}
4724
Paul Mooreeffad8d2008-01-29 08:49:27 -05004725static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4726 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004727{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004728 u32 secmark_perm;
4729 u32 peer_sid;
4730 struct sock *sk;
4731 struct avc_audit_data ad;
4732 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004733 u8 secmark_active;
4734 u8 peerlbl_active;
4735
Paul Mooreeffad8d2008-01-29 08:49:27 -05004736 /* If any sort of compatibility mode is enabled then handoff processing
4737 * to the selinux_ip_postroute_compat() function to deal with the
4738 * special handling. We do this in an attempt to keep this function
4739 * as fast and as clean as possible. */
4740 if (selinux_compat_net || !selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004741 return selinux_ip_postroute_compat(skb, ifindex, family);
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004742#ifdef CONFIG_XFRM
Paul Mooreeffad8d2008-01-29 08:49:27 -05004743 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4744 * packet transformation so allow the packet to pass without any checks
4745 * since we'll have another chance to perform access control checks
4746 * when the packet is on it's final way out.
4747 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4748 * is NULL, in this case go ahead and apply access control. */
4749 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4750 return NF_ACCEPT;
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004751#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05004752 secmark_active = selinux_secmark_enabled();
4753 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4754 if (!secmark_active && !peerlbl_active)
4755 return NF_ACCEPT;
4756
Paul Moored8395c82008-10-10 10:16:30 -04004757 /* if the packet is being forwarded then get the peer label from the
4758 * packet itself; otherwise check to see if it is from a local
4759 * application or the kernel, if from an application get the peer label
4760 * from the sending socket, otherwise use the kernel's sid */
Paul Mooreeffad8d2008-01-29 08:49:27 -05004761 sk = skb->sk;
Paul Moored8395c82008-10-10 10:16:30 -04004762 if (sk == NULL) {
4763 switch (family) {
4764 case PF_INET:
4765 if (IPCB(skb)->flags & IPSKB_FORWARDED)
4766 secmark_perm = PACKET__FORWARD_OUT;
4767 else
4768 secmark_perm = PACKET__SEND;
4769 break;
4770 case PF_INET6:
4771 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4772 secmark_perm = PACKET__FORWARD_OUT;
4773 else
4774 secmark_perm = PACKET__SEND;
4775 break;
4776 default:
4777 return NF_DROP;
4778 }
4779 if (secmark_perm == PACKET__FORWARD_OUT) {
4780 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4781 return NF_DROP;
4782 } else
4783 peer_sid = SECINITSID_KERNEL;
4784 } else {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004785 struct sk_security_struct *sksec = sk->sk_security;
4786 peer_sid = sksec->sid;
4787 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004788 }
4789
Paul Moored8395c82008-10-10 10:16:30 -04004790 AVC_AUDIT_DATA_INIT(&ad, NET);
4791 ad.u.net.netif = ifindex;
4792 ad.u.net.family = family;
4793 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4794 return NF_DROP;
4795
Paul Mooreeffad8d2008-01-29 08:49:27 -05004796 if (secmark_active)
4797 if (avc_has_perm(peer_sid, skb->secmark,
4798 SECCLASS_PACKET, secmark_perm, &ad))
4799 return NF_DROP;
4800
4801 if (peerlbl_active) {
4802 u32 if_sid;
4803 u32 node_sid;
4804
4805 if (sel_netif_sid(ifindex, &if_sid))
4806 return NF_DROP;
4807 if (avc_has_perm(peer_sid, if_sid,
4808 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4809 return NF_DROP;
4810
4811 if (sel_netnode_sid(addrp, family, &node_sid))
4812 return NF_DROP;
4813 if (avc_has_perm(peer_sid, node_sid,
4814 SECCLASS_NODE, NODE__SENDTO, &ad))
4815 return NF_DROP;
4816 }
4817
4818 return NF_ACCEPT;
4819}
4820
4821static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4822 struct sk_buff *skb,
4823 const struct net_device *in,
4824 const struct net_device *out,
4825 int (*okfn)(struct sk_buff *))
4826{
4827 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004828}
4829
4830#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004831static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4832 struct sk_buff *skb,
4833 const struct net_device *in,
4834 const struct net_device *out,
4835 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004836{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004837 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004838}
Linus Torvalds1da177e2005-04-16 15:20:36 -07004839#endif /* IPV6 */
4840
4841#endif /* CONFIG_NETFILTER */
4842
Linus Torvalds1da177e2005-04-16 15:20:36 -07004843static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4844{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004845 int err;
4846
4847 err = secondary_ops->netlink_send(sk, skb);
4848 if (err)
4849 return err;
4850
Linus Torvalds1da177e2005-04-16 15:20:36 -07004851 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4852 err = selinux_nlmsg_perm(sk, skb);
4853
4854 return err;
4855}
4856
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004857static int selinux_netlink_recv(struct sk_buff *skb, int capability)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004858{
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004859 int err;
4860 struct avc_audit_data ad;
4861
4862 err = secondary_ops->netlink_recv(skb, capability);
4863 if (err)
4864 return err;
4865
4866 AVC_AUDIT_DATA_INIT(&ad, CAP);
4867 ad.u.cap = capability;
4868
4869 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
Eric Paris828dfe12008-04-17 13:17:49 -04004870 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004871}
4872
4873static int ipc_alloc_security(struct task_struct *task,
4874 struct kern_ipc_perm *perm,
4875 u16 sclass)
4876{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004877 struct ipc_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11004878 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004879
James Morris89d155e2005-10-30 14:59:21 -08004880 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004881 if (!isec)
4882 return -ENOMEM;
4883
David Howells275bb412008-11-14 10:39:19 +11004884 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004885 isec->sclass = sclass;
David Howells275bb412008-11-14 10:39:19 +11004886 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004887 perm->security = isec;
4888
4889 return 0;
4890}
4891
4892static void ipc_free_security(struct kern_ipc_perm *perm)
4893{
4894 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004895 perm->security = NULL;
4896 kfree(isec);
4897}
4898
4899static int msg_msg_alloc_security(struct msg_msg *msg)
4900{
4901 struct msg_security_struct *msec;
4902
James Morris89d155e2005-10-30 14:59:21 -08004903 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004904 if (!msec)
4905 return -ENOMEM;
4906
Linus Torvalds1da177e2005-04-16 15:20:36 -07004907 msec->sid = SECINITSID_UNLABELED;
4908 msg->security = msec;
4909
4910 return 0;
4911}
4912
4913static void msg_msg_free_security(struct msg_msg *msg)
4914{
4915 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004916
4917 msg->security = NULL;
4918 kfree(msec);
4919}
4920
4921static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07004922 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004923{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004924 struct ipc_security_struct *isec;
4925 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004926 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004927
Linus Torvalds1da177e2005-04-16 15:20:36 -07004928 isec = ipc_perms->security;
4929
4930 AVC_AUDIT_DATA_INIT(&ad, IPC);
4931 ad.u.ipc_id = ipc_perms->key;
4932
David Howells275bb412008-11-14 10:39:19 +11004933 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004934}
4935
4936static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4937{
4938 return msg_msg_alloc_security(msg);
4939}
4940
4941static void selinux_msg_msg_free_security(struct msg_msg *msg)
4942{
4943 msg_msg_free_security(msg);
4944}
4945
4946/* message queue security operations */
4947static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4948{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004949 struct ipc_security_struct *isec;
4950 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004951 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004952 int rc;
4953
4954 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4955 if (rc)
4956 return rc;
4957
Linus Torvalds1da177e2005-04-16 15:20:36 -07004958 isec = msq->q_perm.security;
4959
4960 AVC_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04004961 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004962
David Howells275bb412008-11-14 10:39:19 +11004963 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004964 MSGQ__CREATE, &ad);
4965 if (rc) {
4966 ipc_free_security(&msq->q_perm);
4967 return rc;
4968 }
4969 return 0;
4970}
4971
4972static void selinux_msg_queue_free_security(struct msg_queue *msq)
4973{
4974 ipc_free_security(&msq->q_perm);
4975}
4976
4977static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4978{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004979 struct ipc_security_struct *isec;
4980 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004981 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004982
Linus Torvalds1da177e2005-04-16 15:20:36 -07004983 isec = msq->q_perm.security;
4984
4985 AVC_AUDIT_DATA_INIT(&ad, IPC);
4986 ad.u.ipc_id = msq->q_perm.key;
4987
David Howells275bb412008-11-14 10:39:19 +11004988 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004989 MSGQ__ASSOCIATE, &ad);
4990}
4991
4992static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4993{
4994 int err;
4995 int perms;
4996
Eric Paris828dfe12008-04-17 13:17:49 -04004997 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004998 case IPC_INFO:
4999 case MSG_INFO:
5000 /* No specific object, just general system-wide information. */
5001 return task_has_system(current, SYSTEM__IPC_INFO);
5002 case IPC_STAT:
5003 case MSG_STAT:
5004 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5005 break;
5006 case IPC_SET:
5007 perms = MSGQ__SETATTR;
5008 break;
5009 case IPC_RMID:
5010 perms = MSGQ__DESTROY;
5011 break;
5012 default:
5013 return 0;
5014 }
5015
Stephen Smalley6af963f2005-05-01 08:58:39 -07005016 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005017 return err;
5018}
5019
5020static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5021{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005022 struct ipc_security_struct *isec;
5023 struct msg_security_struct *msec;
5024 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005025 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005026 int rc;
5027
Linus Torvalds1da177e2005-04-16 15:20:36 -07005028 isec = msq->q_perm.security;
5029 msec = msg->security;
5030
5031 /*
5032 * First time through, need to assign label to the message
5033 */
5034 if (msec->sid == SECINITSID_UNLABELED) {
5035 /*
5036 * Compute new sid based on current process and
5037 * message queue this message will be stored in
5038 */
David Howells275bb412008-11-14 10:39:19 +11005039 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005040 &msec->sid);
5041 if (rc)
5042 return rc;
5043 }
5044
5045 AVC_AUDIT_DATA_INIT(&ad, IPC);
5046 ad.u.ipc_id = msq->q_perm.key;
5047
5048 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11005049 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005050 MSGQ__WRITE, &ad);
5051 if (!rc)
5052 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11005053 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5054 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005055 if (!rc)
5056 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11005057 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5058 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005059
5060 return rc;
5061}
5062
5063static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5064 struct task_struct *target,
5065 long type, int mode)
5066{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005067 struct ipc_security_struct *isec;
5068 struct msg_security_struct *msec;
5069 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005070 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005071 int rc;
5072
Linus Torvalds1da177e2005-04-16 15:20:36 -07005073 isec = msq->q_perm.security;
5074 msec = msg->security;
5075
5076 AVC_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04005077 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005078
David Howells275bb412008-11-14 10:39:19 +11005079 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005080 SECCLASS_MSGQ, MSGQ__READ, &ad);
5081 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11005082 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005083 SECCLASS_MSG, MSG__RECEIVE, &ad);
5084 return rc;
5085}
5086
5087/* Shared Memory security operations */
5088static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5089{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005090 struct ipc_security_struct *isec;
5091 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005092 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005093 int rc;
5094
5095 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5096 if (rc)
5097 return rc;
5098
Linus Torvalds1da177e2005-04-16 15:20:36 -07005099 isec = shp->shm_perm.security;
5100
5101 AVC_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04005102 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005103
David Howells275bb412008-11-14 10:39:19 +11005104 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005105 SHM__CREATE, &ad);
5106 if (rc) {
5107 ipc_free_security(&shp->shm_perm);
5108 return rc;
5109 }
5110 return 0;
5111}
5112
5113static void selinux_shm_free_security(struct shmid_kernel *shp)
5114{
5115 ipc_free_security(&shp->shm_perm);
5116}
5117
5118static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5119{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005120 struct ipc_security_struct *isec;
5121 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005122 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005123
Linus Torvalds1da177e2005-04-16 15:20:36 -07005124 isec = shp->shm_perm.security;
5125
5126 AVC_AUDIT_DATA_INIT(&ad, IPC);
5127 ad.u.ipc_id = shp->shm_perm.key;
5128
David Howells275bb412008-11-14 10:39:19 +11005129 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005130 SHM__ASSOCIATE, &ad);
5131}
5132
5133/* Note, at this point, shp is locked down */
5134static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5135{
5136 int perms;
5137 int err;
5138
Eric Paris828dfe12008-04-17 13:17:49 -04005139 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005140 case IPC_INFO:
5141 case SHM_INFO:
5142 /* No specific object, just general system-wide information. */
5143 return task_has_system(current, SYSTEM__IPC_INFO);
5144 case IPC_STAT:
5145 case SHM_STAT:
5146 perms = SHM__GETATTR | SHM__ASSOCIATE;
5147 break;
5148 case IPC_SET:
5149 perms = SHM__SETATTR;
5150 break;
5151 case SHM_LOCK:
5152 case SHM_UNLOCK:
5153 perms = SHM__LOCK;
5154 break;
5155 case IPC_RMID:
5156 perms = SHM__DESTROY;
5157 break;
5158 default:
5159 return 0;
5160 }
5161
Stephen Smalley6af963f2005-05-01 08:58:39 -07005162 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005163 return err;
5164}
5165
5166static int selinux_shm_shmat(struct shmid_kernel *shp,
5167 char __user *shmaddr, int shmflg)
5168{
5169 u32 perms;
5170 int rc;
5171
5172 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
5173 if (rc)
5174 return rc;
5175
5176 if (shmflg & SHM_RDONLY)
5177 perms = SHM__READ;
5178 else
5179 perms = SHM__READ | SHM__WRITE;
5180
Stephen Smalley6af963f2005-05-01 08:58:39 -07005181 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005182}
5183
5184/* Semaphore security operations */
5185static int selinux_sem_alloc_security(struct sem_array *sma)
5186{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005187 struct ipc_security_struct *isec;
5188 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005189 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005190 int rc;
5191
5192 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5193 if (rc)
5194 return rc;
5195
Linus Torvalds1da177e2005-04-16 15:20:36 -07005196 isec = sma->sem_perm.security;
5197
5198 AVC_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04005199 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005200
David Howells275bb412008-11-14 10:39:19 +11005201 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005202 SEM__CREATE, &ad);
5203 if (rc) {
5204 ipc_free_security(&sma->sem_perm);
5205 return rc;
5206 }
5207 return 0;
5208}
5209
5210static void selinux_sem_free_security(struct sem_array *sma)
5211{
5212 ipc_free_security(&sma->sem_perm);
5213}
5214
5215static int selinux_sem_associate(struct sem_array *sma, int semflg)
5216{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005217 struct ipc_security_struct *isec;
5218 struct avc_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005219 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005220
Linus Torvalds1da177e2005-04-16 15:20:36 -07005221 isec = sma->sem_perm.security;
5222
5223 AVC_AUDIT_DATA_INIT(&ad, IPC);
5224 ad.u.ipc_id = sma->sem_perm.key;
5225
David Howells275bb412008-11-14 10:39:19 +11005226 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005227 SEM__ASSOCIATE, &ad);
5228}
5229
5230/* Note, at this point, sma is locked down */
5231static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5232{
5233 int err;
5234 u32 perms;
5235
Eric Paris828dfe12008-04-17 13:17:49 -04005236 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005237 case IPC_INFO:
5238 case SEM_INFO:
5239 /* No specific object, just general system-wide information. */
5240 return task_has_system(current, SYSTEM__IPC_INFO);
5241 case GETPID:
5242 case GETNCNT:
5243 case GETZCNT:
5244 perms = SEM__GETATTR;
5245 break;
5246 case GETVAL:
5247 case GETALL:
5248 perms = SEM__READ;
5249 break;
5250 case SETVAL:
5251 case SETALL:
5252 perms = SEM__WRITE;
5253 break;
5254 case IPC_RMID:
5255 perms = SEM__DESTROY;
5256 break;
5257 case IPC_SET:
5258 perms = SEM__SETATTR;
5259 break;
5260 case IPC_STAT:
5261 case SEM_STAT:
5262 perms = SEM__GETATTR | SEM__ASSOCIATE;
5263 break;
5264 default:
5265 return 0;
5266 }
5267
Stephen Smalley6af963f2005-05-01 08:58:39 -07005268 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005269 return err;
5270}
5271
5272static int selinux_sem_semop(struct sem_array *sma,
5273 struct sembuf *sops, unsigned nsops, int alter)
5274{
5275 u32 perms;
5276
5277 if (alter)
5278 perms = SEM__READ | SEM__WRITE;
5279 else
5280 perms = SEM__READ;
5281
Stephen Smalley6af963f2005-05-01 08:58:39 -07005282 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005283}
5284
5285static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5286{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005287 u32 av = 0;
5288
Linus Torvalds1da177e2005-04-16 15:20:36 -07005289 av = 0;
5290 if (flag & S_IRUGO)
5291 av |= IPC__UNIX_READ;
5292 if (flag & S_IWUGO)
5293 av |= IPC__UNIX_WRITE;
5294
5295 if (av == 0)
5296 return 0;
5297
Stephen Smalley6af963f2005-05-01 08:58:39 -07005298 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005299}
5300
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02005301static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5302{
5303 struct ipc_security_struct *isec = ipcp->security;
5304 *secid = isec->sid;
5305}
5306
Eric Paris828dfe12008-04-17 13:17:49 -04005307static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005308{
5309 if (inode)
5310 inode_doinit_with_dentry(inode, dentry);
5311}
5312
5313static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005314 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005315{
David Howells275bb412008-11-14 10:39:19 +11005316 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005317 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005318 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005319 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005320
5321 if (current != p) {
David Howells3b11a1d2008-11-14 10:39:26 +11005322 error = current_has_perm(p, PROCESS__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005323 if (error)
5324 return error;
5325 }
5326
David Howells275bb412008-11-14 10:39:19 +11005327 rcu_read_lock();
5328 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005329
5330 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005331 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005332 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005333 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005334 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005335 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005336 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005337 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005338 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005339 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005340 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005341 sid = __tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005342 else
David Howells275bb412008-11-14 10:39:19 +11005343 goto invalid;
5344 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005345
5346 if (!sid)
5347 return 0;
5348
Al Viro04ff9702007-03-12 16:17:58 +00005349 error = security_sid_to_context(sid, value, &len);
5350 if (error)
5351 return error;
5352 return len;
David Howells275bb412008-11-14 10:39:19 +11005353
5354invalid:
5355 rcu_read_unlock();
5356 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005357}
5358
5359static int selinux_setprocattr(struct task_struct *p,
5360 char *name, void *value, size_t size)
5361{
5362 struct task_security_struct *tsec;
Roland McGrath03563572008-03-26 15:46:39 -07005363 struct task_struct *tracer;
David Howellsd84f4f92008-11-14 10:39:23 +11005364 struct cred *new;
5365 u32 sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005366 int error;
5367 char *str = value;
5368
5369 if (current != p) {
5370 /* SELinux only allows a process to change its own
5371 security attributes. */
5372 return -EACCES;
5373 }
5374
5375 /*
5376 * Basic control over ability to set these attributes at all.
5377 * current == p, but we'll pass them separately in case the
5378 * above restriction is ever removed.
5379 */
5380 if (!strcmp(name, "exec"))
David Howells3b11a1d2008-11-14 10:39:26 +11005381 error = current_has_perm(p, PROCESS__SETEXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005382 else if (!strcmp(name, "fscreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005383 error = current_has_perm(p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005384 else if (!strcmp(name, "keycreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005385 error = current_has_perm(p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07005386 else if (!strcmp(name, "sockcreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005387 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005388 else if (!strcmp(name, "current"))
David Howells3b11a1d2008-11-14 10:39:26 +11005389 error = current_has_perm(p, PROCESS__SETCURRENT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005390 else
5391 error = -EINVAL;
5392 if (error)
5393 return error;
5394
5395 /* Obtain a SID for the context, if one was specified. */
5396 if (size && str[1] && str[1] != '\n') {
5397 if (str[size-1] == '\n') {
5398 str[size-1] = 0;
5399 size--;
5400 }
5401 error = security_context_to_sid(value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005402 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5403 if (!capable(CAP_MAC_ADMIN))
5404 return error;
5405 error = security_context_to_sid_force(value, size,
5406 &sid);
5407 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005408 if (error)
5409 return error;
5410 }
5411
David Howellsd84f4f92008-11-14 10:39:23 +11005412 new = prepare_creds();
5413 if (!new)
5414 return -ENOMEM;
5415
Linus Torvalds1da177e2005-04-16 15:20:36 -07005416 /* Permission checking based on the specified context is
5417 performed during the actual operation (execve,
5418 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11005419 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07005420 checks and may_create for the file creation checks. The
5421 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11005422 tsec = new->security;
5423 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005424 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005425 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005426 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005427 } else if (!strcmp(name, "keycreate")) {
Michael LeMay4eb582c2006-06-26 00:24:57 -07005428 error = may_create_key(sid, p);
5429 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005430 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005431 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005432 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07005433 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005434 } else if (!strcmp(name, "current")) {
5435 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005436 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11005437 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09005438
David Howellsd84f4f92008-11-14 10:39:23 +11005439 /* Only allow single threaded processes to change context */
5440 error = -EPERM;
5441 if (!is_single_threaded(p)) {
5442 error = security_bounded_transition(tsec->sid, sid);
5443 if (error)
5444 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04005445 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005446
5447 /* Check permissions for the transition. */
5448 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04005449 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005450 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005451 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005452
5453 /* Check for ptracing, and update the task SID if ok.
5454 Otherwise, leave SID unchanged and fail. */
David Howellsd84f4f92008-11-14 10:39:23 +11005455 ptsid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005456 task_lock(p);
Roland McGrath0d094ef2008-07-25 19:45:49 -07005457 tracer = tracehook_tracer_task(p);
David Howellsd84f4f92008-11-14 10:39:23 +11005458 if (tracer)
5459 ptsid = task_sid(tracer);
5460 task_unlock(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005461
David Howellsd84f4f92008-11-14 10:39:23 +11005462 if (tracer) {
5463 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5464 PROCESS__PTRACE, NULL);
5465 if (error)
5466 goto abort_change;
5467 }
5468
5469 tsec->sid = sid;
5470 } else {
5471 error = -EINVAL;
5472 goto abort_change;
5473 }
5474
5475 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005476 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11005477
5478abort_change:
5479 abort_creds(new);
5480 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005481}
5482
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005483static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5484{
5485 return security_sid_to_context(secid, secdata, seclen);
5486}
5487
David Howells7bf570d2008-04-29 20:52:51 +01005488static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00005489{
5490 return security_context_to_sid(secdata, seclen, secid);
5491}
5492
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005493static void selinux_release_secctx(char *secdata, u32 seclen)
5494{
Paul Moore088999e2007-08-01 11:12:58 -04005495 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005496}
5497
Michael LeMayd7200242006-06-22 14:47:17 -07005498#ifdef CONFIG_KEYS
5499
David Howellsd84f4f92008-11-14 10:39:23 +11005500static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07005501 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07005502{
David Howellsd84f4f92008-11-14 10:39:23 +11005503 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07005504 struct key_security_struct *ksec;
5505
5506 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5507 if (!ksec)
5508 return -ENOMEM;
5509
David Howellsd84f4f92008-11-14 10:39:23 +11005510 tsec = cred->security;
5511 if (tsec->keycreate_sid)
5512 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005513 else
David Howellsd84f4f92008-11-14 10:39:23 +11005514 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005515
David Howells275bb412008-11-14 10:39:19 +11005516 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07005517 return 0;
5518}
5519
5520static void selinux_key_free(struct key *k)
5521{
5522 struct key_security_struct *ksec = k->security;
5523
5524 k->security = NULL;
5525 kfree(ksec);
5526}
5527
5528static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11005529 const struct cred *cred,
5530 key_perm_t perm)
Michael LeMayd7200242006-06-22 14:47:17 -07005531{
5532 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07005533 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11005534 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005535
5536 /* if no specific permissions are requested, we skip the
5537 permission check. No serious, additional covert channels
5538 appear to be created. */
5539 if (perm == 0)
5540 return 0;
5541
David Howellsd84f4f92008-11-14 10:39:23 +11005542 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11005543
5544 key = key_ref_to_ptr(key_ref);
5545 ksec = key->security;
5546
5547 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07005548}
5549
David Howells70a5bb72008-04-29 01:01:26 -07005550static int selinux_key_getsecurity(struct key *key, char **_buffer)
5551{
5552 struct key_security_struct *ksec = key->security;
5553 char *context = NULL;
5554 unsigned len;
5555 int rc;
5556
5557 rc = security_sid_to_context(ksec->sid, &context, &len);
5558 if (!rc)
5559 rc = len;
5560 *_buffer = context;
5561 return rc;
5562}
5563
Michael LeMayd7200242006-06-22 14:47:17 -07005564#endif
5565
Linus Torvalds1da177e2005-04-16 15:20:36 -07005566static struct security_operations selinux_ops = {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005567 .name = "selinux",
5568
David Howells5cd9c582008-08-14 11:37:28 +01005569 .ptrace_may_access = selinux_ptrace_may_access,
5570 .ptrace_traceme = selinux_ptrace_traceme,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005571 .capget = selinux_capget,
David Howellsd84f4f92008-11-14 10:39:23 +11005572 .capset = selinux_capset,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005573 .sysctl = selinux_sysctl,
5574 .capable = selinux_capable,
5575 .quotactl = selinux_quotactl,
5576 .quota_on = selinux_quota_on,
5577 .syslog = selinux_syslog,
5578 .vm_enough_memory = selinux_vm_enough_memory,
5579
5580 .netlink_send = selinux_netlink_send,
Eric Paris828dfe12008-04-17 13:17:49 -04005581 .netlink_recv = selinux_netlink_recv,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005582
David Howellsa6f76f22008-11-14 10:39:24 +11005583 .bprm_set_creds = selinux_bprm_set_creds,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005584 .bprm_check_security = selinux_bprm_check_security,
David Howellsa6f76f22008-11-14 10:39:24 +11005585 .bprm_committing_creds = selinux_bprm_committing_creds,
5586 .bprm_committed_creds = selinux_bprm_committed_creds,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005587 .bprm_secureexec = selinux_bprm_secureexec,
5588
5589 .sb_alloc_security = selinux_sb_alloc_security,
5590 .sb_free_security = selinux_sb_free_security,
5591 .sb_copy_data = selinux_sb_copy_data,
Eric Paris828dfe12008-04-17 13:17:49 -04005592 .sb_kern_mount = selinux_sb_kern_mount,
Eric Paris2069f452008-07-04 09:47:13 +10005593 .sb_show_options = selinux_sb_show_options,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005594 .sb_statfs = selinux_sb_statfs,
5595 .sb_mount = selinux_mount,
5596 .sb_umount = selinux_umount,
Eric Parisc9180a52007-11-30 13:00:35 -05005597 .sb_set_mnt_opts = selinux_set_mnt_opts,
Eric Paris828dfe12008-04-17 13:17:49 -04005598 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
Eric Parise0007522008-03-05 10:31:54 -05005599 .sb_parse_opts_str = selinux_parse_opts_str,
5600
Linus Torvalds1da177e2005-04-16 15:20:36 -07005601
5602 .inode_alloc_security = selinux_inode_alloc_security,
5603 .inode_free_security = selinux_inode_free_security,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07005604 .inode_init_security = selinux_inode_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005605 .inode_create = selinux_inode_create,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005606 .inode_link = selinux_inode_link,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005607 .inode_unlink = selinux_inode_unlink,
5608 .inode_symlink = selinux_inode_symlink,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005609 .inode_mkdir = selinux_inode_mkdir,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005610 .inode_rmdir = selinux_inode_rmdir,
5611 .inode_mknod = selinux_inode_mknod,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005612 .inode_rename = selinux_inode_rename,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005613 .inode_readlink = selinux_inode_readlink,
5614 .inode_follow_link = selinux_inode_follow_link,
5615 .inode_permission = selinux_inode_permission,
5616 .inode_setattr = selinux_inode_setattr,
5617 .inode_getattr = selinux_inode_getattr,
5618 .inode_setxattr = selinux_inode_setxattr,
5619 .inode_post_setxattr = selinux_inode_post_setxattr,
5620 .inode_getxattr = selinux_inode_getxattr,
5621 .inode_listxattr = selinux_inode_listxattr,
5622 .inode_removexattr = selinux_inode_removexattr,
Eric Paris828dfe12008-04-17 13:17:49 -04005623 .inode_getsecurity = selinux_inode_getsecurity,
5624 .inode_setsecurity = selinux_inode_setsecurity,
5625 .inode_listsecurity = selinux_inode_listsecurity,
Serge E. Hallynb5376772007-10-16 23:31:36 -07005626 .inode_need_killpriv = selinux_inode_need_killpriv,
5627 .inode_killpriv = selinux_inode_killpriv,
Eric Parisf5269712008-05-14 11:27:45 -04005628 .inode_getsecid = selinux_inode_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005629
5630 .file_permission = selinux_file_permission,
5631 .file_alloc_security = selinux_file_alloc_security,
5632 .file_free_security = selinux_file_free_security,
5633 .file_ioctl = selinux_file_ioctl,
5634 .file_mmap = selinux_file_mmap,
5635 .file_mprotect = selinux_file_mprotect,
5636 .file_lock = selinux_file_lock,
5637 .file_fcntl = selinux_file_fcntl,
5638 .file_set_fowner = selinux_file_set_fowner,
5639 .file_send_sigiotask = selinux_file_send_sigiotask,
5640 .file_receive = selinux_file_receive,
5641
Eric Paris828dfe12008-04-17 13:17:49 -04005642 .dentry_open = selinux_dentry_open,
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09005643
Linus Torvalds1da177e2005-04-16 15:20:36 -07005644 .task_create = selinux_task_create,
David Howellsf1752ee2008-11-14 10:39:17 +11005645 .cred_free = selinux_cred_free,
David Howellsd84f4f92008-11-14 10:39:23 +11005646 .cred_prepare = selinux_cred_prepare,
5647 .cred_commit = selinux_cred_commit,
David Howells3a3b7ce2008-11-14 10:39:28 +11005648 .kernel_act_as = selinux_kernel_act_as,
5649 .kernel_create_files_as = selinux_kernel_create_files_as,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005650 .task_setuid = selinux_task_setuid,
David Howellsd84f4f92008-11-14 10:39:23 +11005651 .task_fix_setuid = selinux_task_fix_setuid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005652 .task_setgid = selinux_task_setgid,
5653 .task_setpgid = selinux_task_setpgid,
5654 .task_getpgid = selinux_task_getpgid,
Eric Paris828dfe12008-04-17 13:17:49 -04005655 .task_getsid = selinux_task_getsid,
David Quigleyf9008e42006-06-30 01:55:46 -07005656 .task_getsecid = selinux_task_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005657 .task_setgroups = selinux_task_setgroups,
5658 .task_setnice = selinux_task_setnice,
James Morris03e68062006-06-23 02:03:58 -07005659 .task_setioprio = selinux_task_setioprio,
David Quigleya1836a42006-06-30 01:55:49 -07005660 .task_getioprio = selinux_task_getioprio,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005661 .task_setrlimit = selinux_task_setrlimit,
5662 .task_setscheduler = selinux_task_setscheduler,
5663 .task_getscheduler = selinux_task_getscheduler,
David Quigley35601542006-06-23 02:04:01 -07005664 .task_movememory = selinux_task_movememory,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005665 .task_kill = selinux_task_kill,
5666 .task_wait = selinux_task_wait,
5667 .task_prctl = selinux_task_prctl,
Eric Paris828dfe12008-04-17 13:17:49 -04005668 .task_to_inode = selinux_task_to_inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005669
5670 .ipc_permission = selinux_ipc_permission,
Eric Parisf5269712008-05-14 11:27:45 -04005671 .ipc_getsecid = selinux_ipc_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005672
5673 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5674 .msg_msg_free_security = selinux_msg_msg_free_security,
5675
5676 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5677 .msg_queue_free_security = selinux_msg_queue_free_security,
5678 .msg_queue_associate = selinux_msg_queue_associate,
5679 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5680 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5681 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5682
5683 .shm_alloc_security = selinux_shm_alloc_security,
5684 .shm_free_security = selinux_shm_free_security,
5685 .shm_associate = selinux_shm_associate,
5686 .shm_shmctl = selinux_shm_shmctl,
5687 .shm_shmat = selinux_shm_shmat,
5688
Eric Paris828dfe12008-04-17 13:17:49 -04005689 .sem_alloc_security = selinux_sem_alloc_security,
5690 .sem_free_security = selinux_sem_free_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005691 .sem_associate = selinux_sem_associate,
5692 .sem_semctl = selinux_sem_semctl,
5693 .sem_semop = selinux_sem_semop,
5694
Eric Paris828dfe12008-04-17 13:17:49 -04005695 .d_instantiate = selinux_d_instantiate,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005696
Eric Paris828dfe12008-04-17 13:17:49 -04005697 .getprocattr = selinux_getprocattr,
5698 .setprocattr = selinux_setprocattr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005699
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005700 .secid_to_secctx = selinux_secid_to_secctx,
David Howells63cb3442008-01-15 23:47:35 +00005701 .secctx_to_secid = selinux_secctx_to_secid,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005702 .release_secctx = selinux_release_secctx,
5703
Eric Paris828dfe12008-04-17 13:17:49 -04005704 .unix_stream_connect = selinux_socket_unix_stream_connect,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005705 .unix_may_send = selinux_socket_unix_may_send,
5706
5707 .socket_create = selinux_socket_create,
5708 .socket_post_create = selinux_socket_post_create,
5709 .socket_bind = selinux_socket_bind,
5710 .socket_connect = selinux_socket_connect,
5711 .socket_listen = selinux_socket_listen,
5712 .socket_accept = selinux_socket_accept,
5713 .socket_sendmsg = selinux_socket_sendmsg,
5714 .socket_recvmsg = selinux_socket_recvmsg,
5715 .socket_getsockname = selinux_socket_getsockname,
5716 .socket_getpeername = selinux_socket_getpeername,
5717 .socket_getsockopt = selinux_socket_getsockopt,
5718 .socket_setsockopt = selinux_socket_setsockopt,
5719 .socket_shutdown = selinux_socket_shutdown,
5720 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005721 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5722 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005723 .sk_alloc_security = selinux_sk_alloc_security,
5724 .sk_free_security = selinux_sk_free_security,
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005725 .sk_clone_security = selinux_sk_clone_security,
Eric Paris828dfe12008-04-17 13:17:49 -04005726 .sk_getsecid = selinux_sk_getsecid,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005727 .sock_graft = selinux_sock_graft,
5728 .inet_conn_request = selinux_inet_conn_request,
5729 .inet_csk_clone = selinux_inet_csk_clone,
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005730 .inet_conn_established = selinux_inet_conn_established,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005731 .req_classify_flow = selinux_req_classify_flow,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005732
5733#ifdef CONFIG_SECURITY_NETWORK_XFRM
5734 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5735 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5736 .xfrm_policy_free_security = selinux_xfrm_policy_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005737 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005738 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5739 .xfrm_state_free_security = selinux_xfrm_state_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005740 .xfrm_state_delete_security = selinux_xfrm_state_delete,
Eric Paris828dfe12008-04-17 13:17:49 -04005741 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005742 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005743 .xfrm_decode_session = selinux_xfrm_decode_session,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005744#endif
Michael LeMayd7200242006-06-22 14:47:17 -07005745
5746#ifdef CONFIG_KEYS
Eric Paris828dfe12008-04-17 13:17:49 -04005747 .key_alloc = selinux_key_alloc,
5748 .key_free = selinux_key_free,
5749 .key_permission = selinux_key_permission,
David Howells70a5bb72008-04-29 01:01:26 -07005750 .key_getsecurity = selinux_key_getsecurity,
Michael LeMayd7200242006-06-22 14:47:17 -07005751#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02005752
5753#ifdef CONFIG_AUDIT
5754 .audit_rule_init = selinux_audit_rule_init,
5755 .audit_rule_known = selinux_audit_rule_known,
5756 .audit_rule_match = selinux_audit_rule_match,
5757 .audit_rule_free = selinux_audit_rule_free,
5758#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07005759};
5760
5761static __init int selinux_init(void)
5762{
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005763 if (!security_module_enable(&selinux_ops)) {
5764 selinux_enabled = 0;
5765 return 0;
5766 }
5767
Linus Torvalds1da177e2005-04-16 15:20:36 -07005768 if (!selinux_enabled) {
5769 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5770 return 0;
5771 }
5772
5773 printk(KERN_INFO "SELinux: Initializing.\n");
5774
5775 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11005776 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005777
James Morris7cae7e22006-03-22 00:09:22 -08005778 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5779 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09005780 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005781 avc_init();
5782
James Morris6f0f0fd2008-07-10 17:02:07 +09005783 secondary_ops = security_ops;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005784 if (!secondary_ops)
Eric Paris828dfe12008-04-17 13:17:49 -04005785 panic("SELinux: No initial security operations\n");
5786 if (register_security(&selinux_ops))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005787 panic("SELinux: Unable to register with kernel.\n");
5788
Eric Paris828dfe12008-04-17 13:17:49 -04005789 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05005790 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04005791 else
Eric Parisfadcdb42007-02-22 18:11:31 -05005792 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07005793
Linus Torvalds1da177e2005-04-16 15:20:36 -07005794 return 0;
5795}
5796
5797void selinux_complete_init(void)
5798{
Eric Parisfadcdb42007-02-22 18:11:31 -05005799 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005800
5801 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05005802 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07005803 spin_lock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005804 spin_lock(&sb_security_lock);
5805next_sb:
5806 if (!list_empty(&superblock_security_head)) {
5807 struct superblock_security_struct *sbsec =
5808 list_entry(superblock_security_head.next,
Eric Paris828dfe12008-04-17 13:17:49 -04005809 struct superblock_security_struct,
5810 list);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005811 struct super_block *sb = sbsec->sb;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005812 sb->s_count++;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005813 spin_unlock(&sb_security_lock);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07005814 spin_unlock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005815 down_read(&sb->s_umount);
5816 if (sb->s_root)
5817 superblock_doinit(sb, NULL);
5818 drop_super(sb);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07005819 spin_lock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005820 spin_lock(&sb_security_lock);
5821 list_del_init(&sbsec->list);
5822 goto next_sb;
5823 }
5824 spin_unlock(&sb_security_lock);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07005825 spin_unlock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005826}
5827
5828/* SELinux requires early initialization in order to label
5829 all processes and objects when they are created. */
5830security_initcall(selinux_init);
5831
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005832#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005833
Paul Mooreeffad8d2008-01-29 08:49:27 -05005834static struct nf_hook_ops selinux_ipv4_ops[] = {
5835 {
5836 .hook = selinux_ipv4_postroute,
5837 .owner = THIS_MODULE,
5838 .pf = PF_INET,
5839 .hooknum = NF_INET_POST_ROUTING,
5840 .priority = NF_IP_PRI_SELINUX_LAST,
5841 },
5842 {
5843 .hook = selinux_ipv4_forward,
5844 .owner = THIS_MODULE,
5845 .pf = PF_INET,
5846 .hooknum = NF_INET_FORWARD,
5847 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04005848 },
5849 {
5850 .hook = selinux_ipv4_output,
5851 .owner = THIS_MODULE,
5852 .pf = PF_INET,
5853 .hooknum = NF_INET_LOCAL_OUT,
5854 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005855 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005856};
5857
5858#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5859
Paul Mooreeffad8d2008-01-29 08:49:27 -05005860static struct nf_hook_ops selinux_ipv6_ops[] = {
5861 {
5862 .hook = selinux_ipv6_postroute,
5863 .owner = THIS_MODULE,
5864 .pf = PF_INET6,
5865 .hooknum = NF_INET_POST_ROUTING,
5866 .priority = NF_IP6_PRI_SELINUX_LAST,
5867 },
5868 {
5869 .hook = selinux_ipv6_forward,
5870 .owner = THIS_MODULE,
5871 .pf = PF_INET6,
5872 .hooknum = NF_INET_FORWARD,
5873 .priority = NF_IP6_PRI_SELINUX_FIRST,
5874 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005875};
5876
5877#endif /* IPV6 */
5878
5879static int __init selinux_nf_ip_init(void)
5880{
5881 int err = 0;
5882
5883 if (!selinux_enabled)
5884 goto out;
Eric Parisfadcdb42007-02-22 18:11:31 -05005885
5886 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5887
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005888 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5889 if (err)
5890 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005891
5892#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005893 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5894 if (err)
5895 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005896#endif /* IPV6 */
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005897
Linus Torvalds1da177e2005-04-16 15:20:36 -07005898out:
5899 return err;
5900}
5901
5902__initcall(selinux_nf_ip_init);
5903
5904#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5905static void selinux_nf_ip_exit(void)
5906{
Eric Parisfadcdb42007-02-22 18:11:31 -05005907 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005908
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005909 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005910#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005911 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005912#endif /* IPV6 */
5913}
5914#endif
5915
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005916#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005917
5918#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5919#define selinux_nf_ip_exit()
5920#endif
5921
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005922#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005923
5924#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04005925static int selinux_disabled;
5926
Linus Torvalds1da177e2005-04-16 15:20:36 -07005927int selinux_disable(void)
5928{
5929 extern void exit_sel_fs(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005930
5931 if (ss_initialized) {
5932 /* Not permitted after initial policy load. */
5933 return -EINVAL;
5934 }
5935
5936 if (selinux_disabled) {
5937 /* Only do this once. */
5938 return -EINVAL;
5939 }
5940
5941 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5942
5943 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04005944 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005945
5946 /* Reset security_ops to the secondary module, dummy or capability. */
5947 security_ops = secondary_ops;
5948
5949 /* Unregister netfilter hooks. */
5950 selinux_nf_ip_exit();
5951
5952 /* Unregister selinuxfs. */
5953 exit_sel_fs();
5954
5955 return 0;
5956}
5957#endif