blob: c868a7454c788348eb83ea2025986762aa1008ce [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050027#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070029#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070030#include <linux/errno.h>
31#include <linux/sched.h>
32#include <linux/security.h>
33#include <linux/xattr.h>
34#include <linux/capability.h>
35#include <linux/unistd.h>
36#include <linux/mm.h>
37#include <linux/mman.h>
38#include <linux/slab.h>
39#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050040#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070041#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070042#include <linux/spinlock.h>
43#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050044#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070045#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040046#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/namei.h>
48#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/netfilter_ipv4.h>
50#include <linux/netfilter_ipv6.h>
51#include <linux/tty.h>
52#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070053#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070054#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore220deb92008-01-29 08:38:23 -050055#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050056#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040057#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070058#include <asm/ioctls.h>
Arun Sharma60063492011-07-26 16:09:06 -070059#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070060#include <linux/bitops.h>
61#include <linux/interrupt.h>
62#include <linux/netdevice.h> /* for network interface checks */
63#include <linux/netlink.h>
64#include <linux/tcp.h>
65#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080066#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/quota.h>
68#include <linux/un.h> /* for Unix socket types */
69#include <net/af_unix.h> /* for Unix socket types */
70#include <linux/parser.h>
71#include <linux/nfs_mount.h>
72#include <net/ipv6.h>
73#include <linux/hugetlb.h>
74#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070075#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070076#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070077#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070078#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070079#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080080#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070081#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040082#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000083#include <linux/msg.h>
84#include <linux/shm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070085
86#include "avc.h"
87#include "objsec.h"
88#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050089#include "netnode.h"
Paul Moore3e112172008-04-10 10:48:14 -040090#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080091#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050092#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020093#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +100094#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070095
David P. Quigley11689d42009-01-16 09:22:03 -050096#define NUM_SEL_MNT_OPTS 5
Eric Parisc9180a52007-11-30 13:00:35 -050097
James Morris20510f22007-10-16 23:31:32 -070098extern struct security_operations *security_ops;
Linus Torvalds1da177e2005-04-16 15:20:36 -070099
Paul Moored621d352008-01-29 08:43:36 -0500100/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000101static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500102
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400104int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700105
106static int __init enforcing_setup(char *str)
107{
Eric Parisf5269712008-05-14 11:27:45 -0400108 unsigned long enforcing;
109 if (!strict_strtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700111 return 1;
112}
113__setup("enforcing=", enforcing_setup);
114#endif
115
116#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119static int __init selinux_enabled_setup(char *str)
120{
Eric Parisf5269712008-05-14 11:27:45 -0400121 unsigned long enabled;
122 if (!strict_strtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700124 return 1;
125}
126__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400127#else
128int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700129#endif
130
Christoph Lametere18b8902006-12-06 20:33:20 -0800131static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800132
Paul Moored621d352008-01-29 08:43:36 -0500133/**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
140 * enabled, false (0) if SECMARK is disabled.
141 *
142 */
143static int selinux_secmark_enabled(void)
144{
145 return (atomic_read(&selinux_secmark_refcount) > 0);
146}
147
David Howellsd84f4f92008-11-14 10:39:23 +1100148/*
149 * initialise the security for the init task
150 */
151static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700152{
David Howells3b11a1d2008-11-14 10:39:26 +1100153 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700154 struct task_security_struct *tsec;
155
James Morris89d155e2005-10-30 14:59:21 -0800156 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700157 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100158 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700159
David Howellsd84f4f92008-11-14 10:39:23 +1100160 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100161 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700162}
163
David Howells275bb412008-11-14 10:39:19 +1100164/*
David Howells88e67f32008-11-14 10:39:21 +1100165 * get the security ID of a set of credentials
166 */
167static inline u32 cred_sid(const struct cred *cred)
168{
169 const struct task_security_struct *tsec;
170
171 tsec = cred->security;
172 return tsec->sid;
173}
174
175/*
David Howells3b11a1d2008-11-14 10:39:26 +1100176 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100177 */
178static inline u32 task_sid(const struct task_struct *task)
179{
David Howells275bb412008-11-14 10:39:19 +1100180 u32 sid;
181
182 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100183 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100184 rcu_read_unlock();
185 return sid;
186}
187
188/*
David Howells3b11a1d2008-11-14 10:39:26 +1100189 * get the subjective security ID of the current task
David Howells275bb412008-11-14 10:39:19 +1100190 */
191static inline u32 current_sid(void)
192{
Paul Moore5fb49872010-04-22 14:46:19 -0400193 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +1100194
195 return tsec->sid;
196}
197
David Howells88e67f32008-11-14 10:39:21 +1100198/* Allocate and free functions for each kind of security blob. */
199
Linus Torvalds1da177e2005-04-16 15:20:36 -0700200static int inode_alloc_security(struct inode *inode)
201{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700202 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100203 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700204
Josef Bacika02fe132008-04-04 09:35:05 +1100205 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700206 if (!isec)
207 return -ENOMEM;
208
Eric Paris23970742006-09-25 23:32:01 -0700209 mutex_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700211 isec->inode = inode;
212 isec->sid = SECINITSID_UNLABELED;
213 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100214 isec->task_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215 inode->i_security = isec;
216
217 return 0;
218}
219
220static void inode_free_security(struct inode *inode)
221{
222 struct inode_security_struct *isec = inode->i_security;
223 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
224
Linus Torvalds1da177e2005-04-16 15:20:36 -0700225 spin_lock(&sbsec->isec_lock);
226 if (!list_empty(&isec->list))
227 list_del_init(&isec->list);
228 spin_unlock(&sbsec->isec_lock);
229
230 inode->i_security = NULL;
James Morris7cae7e22006-03-22 00:09:22 -0800231 kmem_cache_free(sel_inode_cache, isec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700232}
233
234static int file_alloc_security(struct file *file)
235{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100237 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700238
Stephen Smalley26d2a4b2006-02-01 03:05:55 -0800239 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700240 if (!fsec)
241 return -ENOMEM;
242
David Howells275bb412008-11-14 10:39:19 +1100243 fsec->sid = sid;
244 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245 file->f_security = fsec;
246
247 return 0;
248}
249
250static void file_free_security(struct file *file)
251{
252 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 file->f_security = NULL;
254 kfree(fsec);
255}
256
257static int superblock_alloc_security(struct super_block *sb)
258{
259 struct superblock_security_struct *sbsec;
260
James Morris89d155e2005-10-30 14:59:21 -0800261 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700262 if (!sbsec)
263 return -ENOMEM;
264
Eric Parisbc7e9822006-09-25 23:32:02 -0700265 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266 INIT_LIST_HEAD(&sbsec->isec_head);
267 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700268 sbsec->sb = sb;
269 sbsec->sid = SECINITSID_UNLABELED;
270 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700271 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700272 sb->s_security = sbsec;
273
274 return 0;
275}
276
277static void superblock_free_security(struct super_block *sb)
278{
279 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700280 sb->s_security = NULL;
281 kfree(sbsec);
282}
283
Linus Torvalds1da177e2005-04-16 15:20:36 -0700284/* The file system's label must be initialized prior to use. */
285
Stephen Hemminger634a5392010-03-04 21:59:03 -0800286static const char *labeling_behaviors[6] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700287 "uses xattr",
288 "uses transition SIDs",
289 "uses task SIDs",
290 "uses genfs_contexts",
291 "not configured for labeling",
292 "uses mountpoint labeling",
293};
294
295static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
296
297static inline int inode_doinit(struct inode *inode)
298{
299 return inode_doinit_with_dentry(inode, NULL);
300}
301
302enum {
Eric Paris31e87932007-09-19 17:19:12 -0400303 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700304 Opt_context = 1,
305 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500306 Opt_defcontext = 3,
307 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500308 Opt_labelsupport = 5,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700309};
310
Steven Whitehousea447c092008-10-13 10:46:57 +0100311static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400312 {Opt_context, CONTEXT_STR "%s"},
313 {Opt_fscontext, FSCONTEXT_STR "%s"},
314 {Opt_defcontext, DEFCONTEXT_STR "%s"},
315 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500316 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400317 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700318};
319
320#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
321
Eric Parisc312feb2006-07-10 04:43:53 -0700322static int may_context_mount_sb_relabel(u32 sid,
323 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100324 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700325{
David Howells275bb412008-11-14 10:39:19 +1100326 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700327 int rc;
328
329 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
330 FILESYSTEM__RELABELFROM, NULL);
331 if (rc)
332 return rc;
333
334 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
335 FILESYSTEM__RELABELTO, NULL);
336 return rc;
337}
338
Eric Paris08089252006-07-10 04:43:55 -0700339static int may_context_mount_inode_relabel(u32 sid,
340 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100341 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700342{
David Howells275bb412008-11-14 10:39:19 +1100343 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700344 int rc;
345 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELFROM, NULL);
347 if (rc)
348 return rc;
349
350 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
351 FILESYSTEM__ASSOCIATE, NULL);
352 return rc;
353}
354
Eric Parisc9180a52007-11-30 13:00:35 -0500355static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700356{
357 struct superblock_security_struct *sbsec = sb->s_security;
358 struct dentry *root = sb->s_root;
Eric Parisc9180a52007-11-30 13:00:35 -0500359 struct inode *root_inode = root->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700360 int rc = 0;
361
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
363 /* Make sure that the xattr handler exists and that no
364 error other than -ENODATA is returned by getxattr on
365 the root directory. -ENODATA is ok, as this may be
366 the first boot of the SELinux kernel before we have
367 assigned xattr values to the filesystem. */
Eric Parisc9180a52007-11-30 13:00:35 -0500368 if (!root_inode->i_op->getxattr) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
370 "xattr support\n", sb->s_id, sb->s_type->name);
371 rc = -EOPNOTSUPP;
372 goto out;
373 }
Eric Parisc9180a52007-11-30 13:00:35 -0500374 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700375 if (rc < 0 && rc != -ENODATA) {
376 if (rc == -EOPNOTSUPP)
377 printk(KERN_WARNING "SELinux: (dev %s, type "
378 "%s) has no security xattr handler\n",
379 sb->s_id, sb->s_type->name);
380 else
381 printk(KERN_WARNING "SELinux: (dev %s, type "
382 "%s) getxattr errno %d\n", sb->s_id,
383 sb->s_type->name, -rc);
384 goto out;
385 }
386 }
387
David P. Quigley11689d42009-01-16 09:22:03 -0500388 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700389
Eric Parisc9180a52007-11-30 13:00:35 -0500390 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Eric Parisfadcdb42007-02-22 18:11:31 -0500391 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 sb->s_id, sb->s_type->name);
Eric Parisc9180a52007-11-30 13:00:35 -0500393 else
Eric Parisfadcdb42007-02-22 18:11:31 -0500394 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700395 sb->s_id, sb->s_type->name,
396 labeling_behaviors[sbsec->behavior-1]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397
David P. Quigley11689d42009-01-16 09:22:03 -0500398 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
399 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
400 sbsec->behavior == SECURITY_FS_USE_NONE ||
401 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
402 sbsec->flags &= ~SE_SBLABELSUPP;
403
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400404 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
405 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
406 sbsec->flags |= SE_SBLABELSUPP;
407
Linus Torvalds1da177e2005-04-16 15:20:36 -0700408 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500409 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700410
411 /* Initialize any other inodes associated with the superblock, e.g.
412 inodes created prior to initial policy load or inodes created
413 during get_sb by a pseudo filesystem that directly
414 populates itself. */
415 spin_lock(&sbsec->isec_lock);
416next_inode:
417 if (!list_empty(&sbsec->isec_head)) {
418 struct inode_security_struct *isec =
419 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500420 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700421 struct inode *inode = isec->inode;
422 spin_unlock(&sbsec->isec_lock);
423 inode = igrab(inode);
424 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500425 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700426 inode_doinit(inode);
427 iput(inode);
428 }
429 spin_lock(&sbsec->isec_lock);
430 list_del_init(&isec->list);
431 goto next_inode;
432 }
433 spin_unlock(&sbsec->isec_lock);
434out:
Eric Parisc9180a52007-11-30 13:00:35 -0500435 return rc;
436}
437
438/*
439 * This function should allow an FS to ask what it's mount security
440 * options were so it can use those later for submounts, displaying
441 * mount options, or whatever.
442 */
443static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500444 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500445{
446 int rc = 0, i;
447 struct superblock_security_struct *sbsec = sb->s_security;
448 char *context = NULL;
449 u32 len;
450 char tmp;
451
Eric Parise0007522008-03-05 10:31:54 -0500452 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500453
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500454 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500455 return -EINVAL;
456
457 if (!ss_initialized)
458 return -EINVAL;
459
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500460 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500461 /* count the number of mount options for this sb */
462 for (i = 0; i < 8; i++) {
463 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500464 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500465 tmp >>= 1;
466 }
David P. Quigley11689d42009-01-16 09:22:03 -0500467 /* Check if the Label support flag is set */
468 if (sbsec->flags & SE_SBLABELSUPP)
469 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500470
Eric Parise0007522008-03-05 10:31:54 -0500471 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
472 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500473 rc = -ENOMEM;
474 goto out_free;
475 }
476
Eric Parise0007522008-03-05 10:31:54 -0500477 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
478 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500479 rc = -ENOMEM;
480 goto out_free;
481 }
482
483 i = 0;
484 if (sbsec->flags & FSCONTEXT_MNT) {
485 rc = security_sid_to_context(sbsec->sid, &context, &len);
486 if (rc)
487 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500488 opts->mnt_opts[i] = context;
489 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500490 }
491 if (sbsec->flags & CONTEXT_MNT) {
492 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
493 if (rc)
494 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500495 opts->mnt_opts[i] = context;
496 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500497 }
498 if (sbsec->flags & DEFCONTEXT_MNT) {
499 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
500 if (rc)
501 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500502 opts->mnt_opts[i] = context;
503 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500504 }
505 if (sbsec->flags & ROOTCONTEXT_MNT) {
506 struct inode *root = sbsec->sb->s_root->d_inode;
507 struct inode_security_struct *isec = root->i_security;
508
509 rc = security_sid_to_context(isec->sid, &context, &len);
510 if (rc)
511 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500512 opts->mnt_opts[i] = context;
513 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500514 }
David P. Quigley11689d42009-01-16 09:22:03 -0500515 if (sbsec->flags & SE_SBLABELSUPP) {
516 opts->mnt_opts[i] = NULL;
517 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
518 }
Eric Parisc9180a52007-11-30 13:00:35 -0500519
Eric Parise0007522008-03-05 10:31:54 -0500520 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500521
522 return 0;
523
524out_free:
Eric Parise0007522008-03-05 10:31:54 -0500525 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500526 return rc;
527}
528
529static int bad_option(struct superblock_security_struct *sbsec, char flag,
530 u32 old_sid, u32 new_sid)
531{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500532 char mnt_flags = sbsec->flags & SE_MNTMASK;
533
Eric Parisc9180a52007-11-30 13:00:35 -0500534 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500535 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500536 if (!(sbsec->flags & flag) ||
537 (old_sid != new_sid))
538 return 1;
539
540 /* check if we were passed the same options twice,
541 * aka someone passed context=a,context=b
542 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500543 if (!(sbsec->flags & SE_SBINITIALIZED))
544 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500545 return 1;
546 return 0;
547}
Eric Parise0007522008-03-05 10:31:54 -0500548
Eric Parisc9180a52007-11-30 13:00:35 -0500549/*
550 * Allow filesystems with binary mount data to explicitly set mount point
551 * labeling information.
552 */
Eric Parise0007522008-03-05 10:31:54 -0500553static int selinux_set_mnt_opts(struct super_block *sb,
554 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500555{
David Howells275bb412008-11-14 10:39:19 +1100556 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500557 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500558 struct superblock_security_struct *sbsec = sb->s_security;
559 const char *name = sb->s_type->name;
James Morris089be432008-07-15 18:32:49 +1000560 struct inode *inode = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *root_isec = inode->i_security;
Eric Parisc9180a52007-11-30 13:00:35 -0500562 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
563 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500564 char **mount_options = opts->mnt_opts;
565 int *flags = opts->mnt_opts_flags;
566 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500567
568 mutex_lock(&sbsec->lock);
569
570 if (!ss_initialized) {
571 if (!num_opts) {
572 /* Defer initialization until selinux_complete_init,
573 after the initial policy is loaded and the security
574 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500575 goto out;
576 }
577 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400578 printk(KERN_WARNING "SELinux: Unable to set superblock options "
579 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500580 goto out;
581 }
582
583 /*
Eric Parise0007522008-03-05 10:31:54 -0500584 * Binary mount data FS will come through this function twice. Once
585 * from an explicit call and once from the generic calls from the vfs.
586 * Since the generic VFS calls will not contain any security mount data
587 * we need to skip the double mount verification.
588 *
589 * This does open a hole in which we will not notice if the first
590 * mount using this sb set explict options and a second mount using
591 * this sb does not set any security options. (The first options
592 * will be used for both mounts)
593 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500594 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500595 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400596 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500597
598 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500599 * parse the mount options, check if they are valid sids.
600 * also check if someone is trying to mount the same sb more
601 * than once with different security options.
602 */
603 for (i = 0; i < num_opts; i++) {
604 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500605
606 if (flags[i] == SE_SBLABELSUPP)
607 continue;
Eric Parisc9180a52007-11-30 13:00:35 -0500608 rc = security_context_to_sid(mount_options[i],
609 strlen(mount_options[i]), &sid);
610 if (rc) {
611 printk(KERN_WARNING "SELinux: security_context_to_sid"
612 "(%s) failed for (dev %s, type %s) errno=%d\n",
613 mount_options[i], sb->s_id, name, rc);
614 goto out;
615 }
616 switch (flags[i]) {
617 case FSCONTEXT_MNT:
618 fscontext_sid = sid;
619
620 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
621 fscontext_sid))
622 goto out_double_mount;
623
624 sbsec->flags |= FSCONTEXT_MNT;
625 break;
626 case CONTEXT_MNT:
627 context_sid = sid;
628
629 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
630 context_sid))
631 goto out_double_mount;
632
633 sbsec->flags |= CONTEXT_MNT;
634 break;
635 case ROOTCONTEXT_MNT:
636 rootcontext_sid = sid;
637
638 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
639 rootcontext_sid))
640 goto out_double_mount;
641
642 sbsec->flags |= ROOTCONTEXT_MNT;
643
644 break;
645 case DEFCONTEXT_MNT:
646 defcontext_sid = sid;
647
648 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
649 defcontext_sid))
650 goto out_double_mount;
651
652 sbsec->flags |= DEFCONTEXT_MNT;
653
654 break;
655 default:
656 rc = -EINVAL;
657 goto out;
658 }
659 }
660
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500661 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500662 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500663 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500664 goto out_double_mount;
665 rc = 0;
666 goto out;
667 }
668
James Morris089be432008-07-15 18:32:49 +1000669 if (strcmp(sb->s_type->name, "proc") == 0)
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500670 sbsec->flags |= SE_SBPROC;
Eric Parisc9180a52007-11-30 13:00:35 -0500671
672 /* Determine the labeling behavior to use for this filesystem type. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500673 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
Eric Parisc9180a52007-11-30 13:00:35 -0500674 if (rc) {
675 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
James Morris089be432008-07-15 18:32:49 +1000676 __func__, sb->s_type->name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500677 goto out;
678 }
679
680 /* sets the context of the superblock for the fs being mounted. */
681 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100682 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500683 if (rc)
684 goto out;
685
686 sbsec->sid = fscontext_sid;
687 }
688
689 /*
690 * Switch to using mount point labeling behavior.
691 * sets the label used on all file below the mountpoint, and will set
692 * the superblock context if not already set.
693 */
694 if (context_sid) {
695 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100696 rc = may_context_mount_sb_relabel(context_sid, sbsec,
697 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500698 if (rc)
699 goto out;
700 sbsec->sid = context_sid;
701 } else {
David Howells275bb412008-11-14 10:39:19 +1100702 rc = may_context_mount_inode_relabel(context_sid, sbsec,
703 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500704 if (rc)
705 goto out;
706 }
707 if (!rootcontext_sid)
708 rootcontext_sid = context_sid;
709
710 sbsec->mntpoint_sid = context_sid;
711 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
712 }
713
714 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100715 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
716 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500717 if (rc)
718 goto out;
719
720 root_isec->sid = rootcontext_sid;
721 root_isec->initialized = 1;
722 }
723
724 if (defcontext_sid) {
725 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
726 rc = -EINVAL;
727 printk(KERN_WARNING "SELinux: defcontext option is "
728 "invalid for this filesystem type\n");
729 goto out;
730 }
731
732 if (defcontext_sid != sbsec->def_sid) {
733 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100734 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500735 if (rc)
736 goto out;
737 }
738
739 sbsec->def_sid = defcontext_sid;
740 }
741
742 rc = sb_finish_set_opts(sb);
743out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700744 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700745 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500746out_double_mount:
747 rc = -EINVAL;
748 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
749 "security settings for (dev %s, type %s)\n", sb->s_id, name);
750 goto out;
751}
752
753static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
754 struct super_block *newsb)
755{
756 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
757 struct superblock_security_struct *newsbsec = newsb->s_security;
758
759 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
760 int set_context = (oldsbsec->flags & CONTEXT_MNT);
761 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
762
Eric Paris0f5e6422008-04-21 16:24:11 -0400763 /*
764 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400765 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400766 */
Al Viroe8c26252010-03-23 06:36:54 -0400767 if (!ss_initialized)
Eric Paris0f5e6422008-04-21 16:24:11 -0400768 return;
Eric Parisc9180a52007-11-30 13:00:35 -0500769
Eric Parisc9180a52007-11-30 13:00:35 -0500770 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500771 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500772
Eric Paris5a552612008-04-09 14:08:35 -0400773 /* if fs is reusing a sb, just let its options stand... */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500774 if (newsbsec->flags & SE_SBINITIALIZED)
Eric Paris5a552612008-04-09 14:08:35 -0400775 return;
776
Eric Parisc9180a52007-11-30 13:00:35 -0500777 mutex_lock(&newsbsec->lock);
778
779 newsbsec->flags = oldsbsec->flags;
780
781 newsbsec->sid = oldsbsec->sid;
782 newsbsec->def_sid = oldsbsec->def_sid;
783 newsbsec->behavior = oldsbsec->behavior;
784
785 if (set_context) {
786 u32 sid = oldsbsec->mntpoint_sid;
787
788 if (!set_fscontext)
789 newsbsec->sid = sid;
790 if (!set_rootcontext) {
791 struct inode *newinode = newsb->s_root->d_inode;
792 struct inode_security_struct *newisec = newinode->i_security;
793 newisec->sid = sid;
794 }
795 newsbsec->mntpoint_sid = sid;
796 }
797 if (set_rootcontext) {
798 const struct inode *oldinode = oldsb->s_root->d_inode;
799 const struct inode_security_struct *oldisec = oldinode->i_security;
800 struct inode *newinode = newsb->s_root->d_inode;
801 struct inode_security_struct *newisec = newinode->i_security;
802
803 newisec->sid = oldisec->sid;
804 }
805
806 sb_finish_set_opts(newsb);
807 mutex_unlock(&newsbsec->lock);
808}
809
Adrian Bunk2e1479d2008-03-17 22:29:23 +0200810static int selinux_parse_opts_str(char *options,
811 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500812{
Eric Parise0007522008-03-05 10:31:54 -0500813 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -0500814 char *context = NULL, *defcontext = NULL;
815 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -0500816 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500817
Eric Parise0007522008-03-05 10:31:54 -0500818 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500819
820 /* Standard string-based options. */
821 while ((p = strsep(&options, "|")) != NULL) {
822 int token;
823 substring_t args[MAX_OPT_ARGS];
824
825 if (!*p)
826 continue;
827
828 token = match_token(p, tokens, args);
829
830 switch (token) {
831 case Opt_context:
832 if (context || defcontext) {
833 rc = -EINVAL;
834 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
835 goto out_err;
836 }
837 context = match_strdup(&args[0]);
838 if (!context) {
839 rc = -ENOMEM;
840 goto out_err;
841 }
842 break;
843
844 case Opt_fscontext:
845 if (fscontext) {
846 rc = -EINVAL;
847 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
848 goto out_err;
849 }
850 fscontext = match_strdup(&args[0]);
851 if (!fscontext) {
852 rc = -ENOMEM;
853 goto out_err;
854 }
855 break;
856
857 case Opt_rootcontext:
858 if (rootcontext) {
859 rc = -EINVAL;
860 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
861 goto out_err;
862 }
863 rootcontext = match_strdup(&args[0]);
864 if (!rootcontext) {
865 rc = -ENOMEM;
866 goto out_err;
867 }
868 break;
869
870 case Opt_defcontext:
871 if (context || defcontext) {
872 rc = -EINVAL;
873 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
874 goto out_err;
875 }
876 defcontext = match_strdup(&args[0]);
877 if (!defcontext) {
878 rc = -ENOMEM;
879 goto out_err;
880 }
881 break;
David P. Quigley11689d42009-01-16 09:22:03 -0500882 case Opt_labelsupport:
883 break;
Eric Parisc9180a52007-11-30 13:00:35 -0500884 default:
885 rc = -EINVAL;
886 printk(KERN_WARNING "SELinux: unknown mount option\n");
887 goto out_err;
888
889 }
890 }
891
Eric Parise0007522008-03-05 10:31:54 -0500892 rc = -ENOMEM;
893 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
894 if (!opts->mnt_opts)
895 goto out_err;
896
897 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
898 if (!opts->mnt_opts_flags) {
899 kfree(opts->mnt_opts);
900 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -0500901 }
902
Eric Parise0007522008-03-05 10:31:54 -0500903 if (fscontext) {
904 opts->mnt_opts[num_mnt_opts] = fscontext;
905 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
906 }
907 if (context) {
908 opts->mnt_opts[num_mnt_opts] = context;
909 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
910 }
911 if (rootcontext) {
912 opts->mnt_opts[num_mnt_opts] = rootcontext;
913 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
914 }
915 if (defcontext) {
916 opts->mnt_opts[num_mnt_opts] = defcontext;
917 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
918 }
919
920 opts->num_mnt_opts = num_mnt_opts;
921 return 0;
922
Eric Parisc9180a52007-11-30 13:00:35 -0500923out_err:
924 kfree(context);
925 kfree(defcontext);
926 kfree(fscontext);
927 kfree(rootcontext);
928 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700929}
Eric Parise0007522008-03-05 10:31:54 -0500930/*
931 * string mount options parsing and call set the sbsec
932 */
933static int superblock_doinit(struct super_block *sb, void *data)
934{
935 int rc = 0;
936 char *options = data;
937 struct security_mnt_opts opts;
938
939 security_init_mnt_opts(&opts);
940
941 if (!data)
942 goto out;
943
944 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
945
946 rc = selinux_parse_opts_str(options, &opts);
947 if (rc)
948 goto out_err;
949
950out:
951 rc = selinux_set_mnt_opts(sb, &opts);
952
953out_err:
954 security_free_mnt_opts(&opts);
955 return rc;
956}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700957
Adrian Bunk3583a712008-07-22 20:21:23 +0300958static void selinux_write_opts(struct seq_file *m,
959 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +1000960{
961 int i;
962 char *prefix;
963
964 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -0500965 char *has_comma;
966
967 if (opts->mnt_opts[i])
968 has_comma = strchr(opts->mnt_opts[i], ',');
969 else
970 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +1000971
972 switch (opts->mnt_opts_flags[i]) {
973 case CONTEXT_MNT:
974 prefix = CONTEXT_STR;
975 break;
976 case FSCONTEXT_MNT:
977 prefix = FSCONTEXT_STR;
978 break;
979 case ROOTCONTEXT_MNT:
980 prefix = ROOTCONTEXT_STR;
981 break;
982 case DEFCONTEXT_MNT:
983 prefix = DEFCONTEXT_STR;
984 break;
David P. Quigley11689d42009-01-16 09:22:03 -0500985 case SE_SBLABELSUPP:
986 seq_putc(m, ',');
987 seq_puts(m, LABELSUPP_STR);
988 continue;
Eric Paris2069f452008-07-04 09:47:13 +1000989 default:
990 BUG();
Eric Parisa35c6c82011-04-20 10:21:28 -0400991 return;
Eric Paris2069f452008-07-04 09:47:13 +1000992 };
993 /* we need a comma before each option */
994 seq_putc(m, ',');
995 seq_puts(m, prefix);
996 if (has_comma)
997 seq_putc(m, '\"');
998 seq_puts(m, opts->mnt_opts[i]);
999 if (has_comma)
1000 seq_putc(m, '\"');
1001 }
1002}
1003
1004static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1005{
1006 struct security_mnt_opts opts;
1007 int rc;
1008
1009 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001010 if (rc) {
1011 /* before policy load we may get EINVAL, don't show anything */
1012 if (rc == -EINVAL)
1013 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001014 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001015 }
Eric Paris2069f452008-07-04 09:47:13 +10001016
1017 selinux_write_opts(m, &opts);
1018
1019 security_free_mnt_opts(&opts);
1020
1021 return rc;
1022}
1023
Linus Torvalds1da177e2005-04-16 15:20:36 -07001024static inline u16 inode_mode_to_security_class(umode_t mode)
1025{
1026 switch (mode & S_IFMT) {
1027 case S_IFSOCK:
1028 return SECCLASS_SOCK_FILE;
1029 case S_IFLNK:
1030 return SECCLASS_LNK_FILE;
1031 case S_IFREG:
1032 return SECCLASS_FILE;
1033 case S_IFBLK:
1034 return SECCLASS_BLK_FILE;
1035 case S_IFDIR:
1036 return SECCLASS_DIR;
1037 case S_IFCHR:
1038 return SECCLASS_CHR_FILE;
1039 case S_IFIFO:
1040 return SECCLASS_FIFO_FILE;
1041
1042 }
1043
1044 return SECCLASS_FILE;
1045}
1046
James Morris13402582005-09-30 14:24:34 -04001047static inline int default_protocol_stream(int protocol)
1048{
1049 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1050}
1051
1052static inline int default_protocol_dgram(int protocol)
1053{
1054 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1055}
1056
Linus Torvalds1da177e2005-04-16 15:20:36 -07001057static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1058{
1059 switch (family) {
1060 case PF_UNIX:
1061 switch (type) {
1062 case SOCK_STREAM:
1063 case SOCK_SEQPACKET:
1064 return SECCLASS_UNIX_STREAM_SOCKET;
1065 case SOCK_DGRAM:
1066 return SECCLASS_UNIX_DGRAM_SOCKET;
1067 }
1068 break;
1069 case PF_INET:
1070 case PF_INET6:
1071 switch (type) {
1072 case SOCK_STREAM:
James Morris13402582005-09-30 14:24:34 -04001073 if (default_protocol_stream(protocol))
1074 return SECCLASS_TCP_SOCKET;
1075 else
1076 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001077 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001078 if (default_protocol_dgram(protocol))
1079 return SECCLASS_UDP_SOCKET;
1080 else
1081 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001082 case SOCK_DCCP:
1083 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001084 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001085 return SECCLASS_RAWIP_SOCKET;
1086 }
1087 break;
1088 case PF_NETLINK:
1089 switch (protocol) {
1090 case NETLINK_ROUTE:
1091 return SECCLASS_NETLINK_ROUTE_SOCKET;
1092 case NETLINK_FIREWALL:
1093 return SECCLASS_NETLINK_FIREWALL_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001094 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001095 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1096 case NETLINK_NFLOG:
1097 return SECCLASS_NETLINK_NFLOG_SOCKET;
1098 case NETLINK_XFRM:
1099 return SECCLASS_NETLINK_XFRM_SOCKET;
1100 case NETLINK_SELINUX:
1101 return SECCLASS_NETLINK_SELINUX_SOCKET;
1102 case NETLINK_AUDIT:
1103 return SECCLASS_NETLINK_AUDIT_SOCKET;
1104 case NETLINK_IP6_FW:
1105 return SECCLASS_NETLINK_IP6FW_SOCKET;
1106 case NETLINK_DNRTMSG:
1107 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001108 case NETLINK_KOBJECT_UEVENT:
1109 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001110 default:
1111 return SECCLASS_NETLINK_SOCKET;
1112 }
1113 case PF_PACKET:
1114 return SECCLASS_PACKET_SOCKET;
1115 case PF_KEY:
1116 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001117 case PF_APPLETALK:
1118 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001119 }
1120
1121 return SECCLASS_SOCKET;
1122}
1123
1124#ifdef CONFIG_PROC_FS
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001125static int selinux_proc_get_sid(struct dentry *dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001126 u16 tclass,
1127 u32 *sid)
1128{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001129 int rc;
1130 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001131
Eric Paris828dfe12008-04-17 13:17:49 -04001132 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001133 if (!buffer)
1134 return -ENOMEM;
1135
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001136 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1137 if (IS_ERR(path))
1138 rc = PTR_ERR(path);
1139 else {
1140 /* each process gets a /proc/PID/ entry. Strip off the
1141 * PID part to get a valid selinux labeling.
1142 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1143 while (path[1] >= '0' && path[1] <= '9') {
1144 path[1] = '/';
1145 path++;
1146 }
1147 rc = security_genfs_sid("proc", path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001148 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001149 free_page((unsigned long)buffer);
1150 return rc;
1151}
1152#else
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001153static int selinux_proc_get_sid(struct dentry *dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001154 u16 tclass,
1155 u32 *sid)
1156{
1157 return -EINVAL;
1158}
1159#endif
1160
1161/* The inode's security attributes must be initialized before first use. */
1162static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1163{
1164 struct superblock_security_struct *sbsec = NULL;
1165 struct inode_security_struct *isec = inode->i_security;
1166 u32 sid;
1167 struct dentry *dentry;
1168#define INITCONTEXTLEN 255
1169 char *context = NULL;
1170 unsigned len = 0;
1171 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001172
1173 if (isec->initialized)
1174 goto out;
1175
Eric Paris23970742006-09-25 23:32:01 -07001176 mutex_lock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001177 if (isec->initialized)
Eric Paris23970742006-09-25 23:32:01 -07001178 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001179
1180 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001181 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001182 /* Defer initialization until selinux_complete_init,
1183 after the initial policy is loaded and the security
1184 server is ready to handle calls. */
1185 spin_lock(&sbsec->isec_lock);
1186 if (list_empty(&isec->list))
1187 list_add(&isec->list, &sbsec->isec_head);
1188 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001189 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001190 }
1191
1192 switch (sbsec->behavior) {
1193 case SECURITY_FS_USE_XATTR:
1194 if (!inode->i_op->getxattr) {
1195 isec->sid = sbsec->def_sid;
1196 break;
1197 }
1198
1199 /* Need a dentry, since the xattr API requires one.
1200 Life would be simpler if we could just pass the inode. */
1201 if (opt_dentry) {
1202 /* Called from d_instantiate or d_splice_alias. */
1203 dentry = dget(opt_dentry);
1204 } else {
1205 /* Called from selinux_complete_init, try to find a dentry. */
1206 dentry = d_find_alias(inode);
1207 }
1208 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001209 /*
1210 * this is can be hit on boot when a file is accessed
1211 * before the policy is loaded. When we load policy we
1212 * may find inodes that have no dentry on the
1213 * sbsec->isec_head list. No reason to complain as these
1214 * will get fixed up the next time we go through
1215 * inode_doinit with a dentry, before these inodes could
1216 * be used again by userspace.
1217 */
Eric Paris23970742006-09-25 23:32:01 -07001218 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001219 }
1220
1221 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001222 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001223 if (!context) {
1224 rc = -ENOMEM;
1225 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001226 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001227 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001228 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001229 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1230 context, len);
1231 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001232 kfree(context);
1233
Linus Torvalds1da177e2005-04-16 15:20:36 -07001234 /* Need a larger buffer. Query for the right size. */
1235 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1236 NULL, 0);
1237 if (rc < 0) {
1238 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001239 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001240 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001241 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001242 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001243 if (!context) {
1244 rc = -ENOMEM;
1245 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001246 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001247 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001248 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001249 rc = inode->i_op->getxattr(dentry,
1250 XATTR_NAME_SELINUX,
1251 context, len);
1252 }
1253 dput(dentry);
1254 if (rc < 0) {
1255 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001256 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001257 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001258 -rc, inode->i_sb->s_id, inode->i_ino);
1259 kfree(context);
Eric Paris23970742006-09-25 23:32:01 -07001260 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001261 }
1262 /* Map ENODATA to the default file SID */
1263 sid = sbsec->def_sid;
1264 rc = 0;
1265 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001266 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001267 sbsec->def_sid,
1268 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001269 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001270 char *dev = inode->i_sb->s_id;
1271 unsigned long ino = inode->i_ino;
1272
1273 if (rc == -EINVAL) {
1274 if (printk_ratelimit())
1275 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1276 "context=%s. This indicates you may need to relabel the inode or the "
1277 "filesystem in question.\n", ino, dev, context);
1278 } else {
1279 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1280 "returned %d for dev=%s ino=%ld\n",
1281 __func__, context, -rc, dev, ino);
1282 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001283 kfree(context);
1284 /* Leave with the unlabeled SID */
1285 rc = 0;
1286 break;
1287 }
1288 }
1289 kfree(context);
1290 isec->sid = sid;
1291 break;
1292 case SECURITY_FS_USE_TASK:
1293 isec->sid = isec->task_sid;
1294 break;
1295 case SECURITY_FS_USE_TRANS:
1296 /* Default to the fs SID. */
1297 isec->sid = sbsec->sid;
1298
1299 /* Try to obtain a transition SID. */
1300 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Eric Paris652bb9b2011-02-01 11:05:40 -05001301 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1302 isec->sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001303 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001304 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001305 isec->sid = sid;
1306 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001307 case SECURITY_FS_USE_MNTPOINT:
1308 isec->sid = sbsec->mntpoint_sid;
1309 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001310 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001311 /* Default to the fs superblock SID. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001312 isec->sid = sbsec->sid;
1313
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001314 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001315 if (opt_dentry) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001316 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001317 rc = selinux_proc_get_sid(opt_dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001318 isec->sclass,
1319 &sid);
1320 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001321 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001322 isec->sid = sid;
1323 }
1324 }
1325 break;
1326 }
1327
1328 isec->initialized = 1;
1329
Eric Paris23970742006-09-25 23:32:01 -07001330out_unlock:
1331 mutex_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001332out:
1333 if (isec->sclass == SECCLASS_FILE)
1334 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001335 return rc;
1336}
1337
1338/* Convert a Linux signal to an access vector. */
1339static inline u32 signal_to_av(int sig)
1340{
1341 u32 perm = 0;
1342
1343 switch (sig) {
1344 case SIGCHLD:
1345 /* Commonly granted from child to parent. */
1346 perm = PROCESS__SIGCHLD;
1347 break;
1348 case SIGKILL:
1349 /* Cannot be caught or ignored */
1350 perm = PROCESS__SIGKILL;
1351 break;
1352 case SIGSTOP:
1353 /* Cannot be caught or ignored */
1354 perm = PROCESS__SIGSTOP;
1355 break;
1356 default:
1357 /* All other signals. */
1358 perm = PROCESS__SIGNAL;
1359 break;
1360 }
1361
1362 return perm;
1363}
1364
David Howells275bb412008-11-14 10:39:19 +11001365/*
David Howellsd84f4f92008-11-14 10:39:23 +11001366 * Check permission between a pair of credentials
1367 * fork check, ptrace check, etc.
1368 */
1369static int cred_has_perm(const struct cred *actor,
1370 const struct cred *target,
1371 u32 perms)
1372{
1373 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1374
1375 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1376}
1377
1378/*
David Howells88e67f32008-11-14 10:39:21 +11001379 * Check permission between a pair of tasks, e.g. signal checks,
David Howells275bb412008-11-14 10:39:19 +11001380 * fork check, ptrace check, etc.
1381 * tsk1 is the actor and tsk2 is the target
David Howells3b11a1d2008-11-14 10:39:26 +11001382 * - this uses the default subjective creds of tsk1
David Howells275bb412008-11-14 10:39:19 +11001383 */
1384static int task_has_perm(const struct task_struct *tsk1,
1385 const struct task_struct *tsk2,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001386 u32 perms)
1387{
David Howells275bb412008-11-14 10:39:19 +11001388 const struct task_security_struct *__tsec1, *__tsec2;
1389 u32 sid1, sid2;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001390
David Howells275bb412008-11-14 10:39:19 +11001391 rcu_read_lock();
1392 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1393 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1394 rcu_read_unlock();
1395 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001396}
1397
David Howells3b11a1d2008-11-14 10:39:26 +11001398/*
1399 * Check permission between current and another task, e.g. signal checks,
1400 * fork check, ptrace check, etc.
1401 * current is the actor and tsk2 is the target
1402 * - this uses current's subjective creds
1403 */
1404static int current_has_perm(const struct task_struct *tsk,
1405 u32 perms)
1406{
1407 u32 sid, tsid;
1408
1409 sid = current_sid();
1410 tsid = task_sid(tsk);
1411 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1412}
1413
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001414#if CAP_LAST_CAP > 63
1415#error Fix SELinux to handle capabilities > 63.
1416#endif
1417
Linus Torvalds1da177e2005-04-16 15:20:36 -07001418/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001419static int cred_has_capability(const struct cred *cred,
Eric Paris06112162008-11-11 22:02:50 +11001420 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001421{
Thomas Liu2bf49692009-07-14 12:14:09 -04001422 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001423 struct selinux_audit_data sad = {0,};
Eric Paris06112162008-11-11 22:02:50 +11001424 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001425 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001426 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001427 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001428 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001429
Thomas Liu2bf49692009-07-14 12:14:09 -04001430 COMMON_AUDIT_DATA_INIT(&ad, CAP);
Eric Paris3b3b0e42012-04-03 09:37:02 -07001431 ad.selinux_audit_data = &sad;
Eric Paris6a9de492012-01-03 12:25:14 -05001432 ad.tsk = current;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001433 ad.u.cap = cap;
1434
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001435 switch (CAP_TO_INDEX(cap)) {
1436 case 0:
1437 sclass = SECCLASS_CAPABILITY;
1438 break;
1439 case 1:
1440 sclass = SECCLASS_CAPABILITY2;
1441 break;
1442 default:
1443 printk(KERN_ERR
1444 "SELinux: out of range capability %d\n", cap);
1445 BUG();
Eric Parisa35c6c82011-04-20 10:21:28 -04001446 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001447 }
Eric Paris06112162008-11-11 22:02:50 +11001448
David Howells275bb412008-11-14 10:39:19 +11001449 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001450 if (audit == SECURITY_CAP_AUDIT) {
1451 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1452 if (rc2)
1453 return rc2;
1454 }
Eric Paris06112162008-11-11 22:02:50 +11001455 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001456}
1457
1458/* Check whether a task is allowed to use a system operation. */
1459static int task_has_system(struct task_struct *tsk,
1460 u32 perms)
1461{
David Howells275bb412008-11-14 10:39:19 +11001462 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001463
David Howells275bb412008-11-14 10:39:19 +11001464 return avc_has_perm(sid, SECINITSID_KERNEL,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001465 SECCLASS_SYSTEM, perms, NULL);
1466}
1467
1468/* Check whether a task has a particular permission to an inode.
1469 The 'adp' parameter is optional and allows other audit
1470 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001471static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001472 struct inode *inode,
1473 u32 perms,
Eric Paris9ade0cf2011-04-25 16:26:29 -04001474 struct common_audit_data *adp,
1475 unsigned flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001476{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001477 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001478 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001479
David Howellse0e81732009-09-02 09:13:40 +01001480 validate_creds(cred);
1481
Eric Paris828dfe12008-04-17 13:17:49 -04001482 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001483 return 0;
1484
David Howells88e67f32008-11-14 10:39:21 +11001485 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001486 isec = inode->i_security;
1487
Eric Paris9ade0cf2011-04-25 16:26:29 -04001488 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001489}
1490
Linus Torvalds95f4efb2011-06-08 15:11:56 -07001491static int inode_has_perm_noadp(const struct cred *cred,
1492 struct inode *inode,
1493 u32 perms,
1494 unsigned flags)
1495{
1496 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001497 struct selinux_audit_data sad = {0,};
Linus Torvalds95f4efb2011-06-08 15:11:56 -07001498
1499 COMMON_AUDIT_DATA_INIT(&ad, INODE);
1500 ad.u.inode = inode;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001501 ad.selinux_audit_data = &sad;
Linus Torvalds95f4efb2011-06-08 15:11:56 -07001502 return inode_has_perm(cred, inode, perms, &ad, flags);
1503}
1504
Linus Torvalds1da177e2005-04-16 15:20:36 -07001505/* Same as inode_has_perm, but pass explicit audit data containing
1506 the dentry to help the auditing code to more easily generate the
1507 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001508static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001509 struct dentry *dentry,
1510 u32 av)
1511{
1512 struct inode *inode = dentry->d_inode;
Thomas Liu2bf49692009-07-14 12:14:09 -04001513 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001514 struct selinux_audit_data sad = {0,};
David Howells88e67f32008-11-14 10:39:21 +11001515
Eric Paris2875fa02011-04-28 16:04:24 -04001516 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1517 ad.u.dentry = dentry;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001518 ad.selinux_audit_data = &sad;
Eric Paris2875fa02011-04-28 16:04:24 -04001519 return inode_has_perm(cred, inode, av, &ad, 0);
1520}
1521
1522/* Same as inode_has_perm, but pass explicit audit data containing
1523 the path to help the auditing code to more easily generate the
1524 pathname if needed. */
1525static inline int path_has_perm(const struct cred *cred,
1526 struct path *path,
1527 u32 av)
1528{
1529 struct inode *inode = path->dentry->d_inode;
1530 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001531 struct selinux_audit_data sad = {0,};
Eric Paris2875fa02011-04-28 16:04:24 -04001532
Eric Parisf48b7392011-04-25 12:54:27 -04001533 COMMON_AUDIT_DATA_INIT(&ad, PATH);
Eric Paris2875fa02011-04-28 16:04:24 -04001534 ad.u.path = *path;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001535 ad.selinux_audit_data = &sad;
Eric Paris9ade0cf2011-04-25 16:26:29 -04001536 return inode_has_perm(cred, inode, av, &ad, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001537}
1538
1539/* Check whether a task can use an open file descriptor to
1540 access an inode in a given way. Check access to the
1541 descriptor itself, and then use dentry_has_perm to
1542 check a particular permission to the file.
1543 Access to the descriptor is implicitly granted if it
1544 has the same SID as the process. If av is zero, then
1545 access to the file is not checked, e.g. for cases
1546 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001547static int file_has_perm(const struct cred *cred,
1548 struct file *file,
1549 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001550{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001551 struct file_security_struct *fsec = file->f_security;
Jan Blunck44707fd2008-02-14 19:38:33 -08001552 struct inode *inode = file->f_path.dentry->d_inode;
Thomas Liu2bf49692009-07-14 12:14:09 -04001553 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001554 struct selinux_audit_data sad = {0,};
David Howells88e67f32008-11-14 10:39:21 +11001555 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 int rc;
1557
Eric Parisf48b7392011-04-25 12:54:27 -04001558 COMMON_AUDIT_DATA_INIT(&ad, PATH);
1559 ad.u.path = file->f_path;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001560 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001561
David Howells275bb412008-11-14 10:39:19 +11001562 if (sid != fsec->sid) {
1563 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001564 SECCLASS_FD,
1565 FD__USE,
1566 &ad);
1567 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001568 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001569 }
1570
1571 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001572 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001573 if (av)
Eric Paris9ade0cf2011-04-25 16:26:29 -04001574 rc = inode_has_perm(cred, inode, av, &ad, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001575
David Howells88e67f32008-11-14 10:39:21 +11001576out:
1577 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001578}
1579
1580/* Check whether a task can create a file. */
1581static int may_create(struct inode *dir,
1582 struct dentry *dentry,
1583 u16 tclass)
1584{
Paul Moore5fb49872010-04-22 14:46:19 -04001585 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001586 struct inode_security_struct *dsec;
1587 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001588 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001589 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001590 struct selinux_audit_data sad = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07001591 int rc;
1592
Linus Torvalds1da177e2005-04-16 15:20:36 -07001593 dsec = dir->i_security;
1594 sbsec = dir->i_sb->s_security;
1595
David Howells275bb412008-11-14 10:39:19 +11001596 sid = tsec->sid;
1597 newsid = tsec->create_sid;
1598
Eric Parisa2694342011-04-25 13:10:27 -04001599 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1600 ad.u.dentry = dentry;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001601 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001602
David Howells275bb412008-11-14 10:39:19 +11001603 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001604 DIR__ADD_NAME | DIR__SEARCH,
1605 &ad);
1606 if (rc)
1607 return rc;
1608
David P. Quigleycd895962009-01-16 09:22:04 -05001609 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
Eric Pariscb1e9222011-04-28 15:11:21 -04001610 rc = security_transition_sid(sid, dsec->sid, tclass,
1611 &dentry->d_name, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001612 if (rc)
1613 return rc;
1614 }
1615
David Howells275bb412008-11-14 10:39:19 +11001616 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001617 if (rc)
1618 return rc;
1619
1620 return avc_has_perm(newsid, sbsec->sid,
1621 SECCLASS_FILESYSTEM,
1622 FILESYSTEM__ASSOCIATE, &ad);
1623}
1624
Michael LeMay4eb582c2006-06-26 00:24:57 -07001625/* Check whether a task can create a key. */
1626static int may_create_key(u32 ksid,
1627 struct task_struct *ctx)
1628{
David Howells275bb412008-11-14 10:39:19 +11001629 u32 sid = task_sid(ctx);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001630
David Howells275bb412008-11-14 10:39:19 +11001631 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001632}
1633
Eric Paris828dfe12008-04-17 13:17:49 -04001634#define MAY_LINK 0
1635#define MAY_UNLINK 1
1636#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001637
1638/* Check whether a task can link, unlink, or rmdir a file/directory. */
1639static int may_link(struct inode *dir,
1640 struct dentry *dentry,
1641 int kind)
1642
1643{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001644 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001645 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001646 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11001647 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001648 u32 av;
1649 int rc;
1650
Linus Torvalds1da177e2005-04-16 15:20:36 -07001651 dsec = dir->i_security;
1652 isec = dentry->d_inode->i_security;
1653
Eric Parisa2694342011-04-25 13:10:27 -04001654 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1655 ad.u.dentry = dentry;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001656 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001657
1658 av = DIR__SEARCH;
1659 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001660 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001661 if (rc)
1662 return rc;
1663
1664 switch (kind) {
1665 case MAY_LINK:
1666 av = FILE__LINK;
1667 break;
1668 case MAY_UNLINK:
1669 av = FILE__UNLINK;
1670 break;
1671 case MAY_RMDIR:
1672 av = DIR__RMDIR;
1673 break;
1674 default:
Eric Paris744ba352008-04-17 11:52:44 -04001675 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1676 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001677 return 0;
1678 }
1679
David Howells275bb412008-11-14 10:39:19 +11001680 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001681 return rc;
1682}
1683
1684static inline int may_rename(struct inode *old_dir,
1685 struct dentry *old_dentry,
1686 struct inode *new_dir,
1687 struct dentry *new_dentry)
1688{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001689 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001690 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07001691 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11001692 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001693 u32 av;
1694 int old_is_dir, new_is_dir;
1695 int rc;
1696
Linus Torvalds1da177e2005-04-16 15:20:36 -07001697 old_dsec = old_dir->i_security;
1698 old_isec = old_dentry->d_inode->i_security;
1699 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1700 new_dsec = new_dir->i_security;
1701
Eric Parisa2694342011-04-25 13:10:27 -04001702 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
Eric Paris3b3b0e42012-04-03 09:37:02 -07001703 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001704
Eric Parisa2694342011-04-25 13:10:27 -04001705 ad.u.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11001706 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001707 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1708 if (rc)
1709 return rc;
David Howells275bb412008-11-14 10:39:19 +11001710 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001711 old_isec->sclass, FILE__RENAME, &ad);
1712 if (rc)
1713 return rc;
1714 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11001715 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001716 old_isec->sclass, DIR__REPARENT, &ad);
1717 if (rc)
1718 return rc;
1719 }
1720
Eric Parisa2694342011-04-25 13:10:27 -04001721 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001722 av = DIR__ADD_NAME | DIR__SEARCH;
1723 if (new_dentry->d_inode)
1724 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11001725 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001726 if (rc)
1727 return rc;
1728 if (new_dentry->d_inode) {
1729 new_isec = new_dentry->d_inode->i_security;
1730 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11001731 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001732 new_isec->sclass,
1733 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1734 if (rc)
1735 return rc;
1736 }
1737
1738 return 0;
1739}
1740
1741/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001742static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001743 struct super_block *sb,
1744 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001745 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001746{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001747 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11001748 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001749
Linus Torvalds1da177e2005-04-16 15:20:36 -07001750 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11001751 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001752}
1753
1754/* Convert a Linux mode and permission mask to an access vector. */
1755static inline u32 file_mask_to_av(int mode, int mask)
1756{
1757 u32 av = 0;
1758
Al Virodba19c62011-07-25 20:49:29 -04001759 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001760 if (mask & MAY_EXEC)
1761 av |= FILE__EXECUTE;
1762 if (mask & MAY_READ)
1763 av |= FILE__READ;
1764
1765 if (mask & MAY_APPEND)
1766 av |= FILE__APPEND;
1767 else if (mask & MAY_WRITE)
1768 av |= FILE__WRITE;
1769
1770 } else {
1771 if (mask & MAY_EXEC)
1772 av |= DIR__SEARCH;
1773 if (mask & MAY_WRITE)
1774 av |= DIR__WRITE;
1775 if (mask & MAY_READ)
1776 av |= DIR__READ;
1777 }
1778
1779 return av;
1780}
1781
1782/* Convert a Linux file to an access vector. */
1783static inline u32 file_to_av(struct file *file)
1784{
1785 u32 av = 0;
1786
1787 if (file->f_mode & FMODE_READ)
1788 av |= FILE__READ;
1789 if (file->f_mode & FMODE_WRITE) {
1790 if (file->f_flags & O_APPEND)
1791 av |= FILE__APPEND;
1792 else
1793 av |= FILE__WRITE;
1794 }
Stephen Smalley0794c662008-03-17 08:55:18 -04001795 if (!av) {
1796 /*
1797 * Special file opened with flags 3 for ioctl-only use.
1798 */
1799 av = FILE__IOCTL;
1800 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001801
1802 return av;
1803}
1804
Eric Paris8b6a5a32008-10-29 17:06:46 -04001805/*
1806 * Convert a file to an access vector and include the correct open
1807 * open permission.
1808 */
1809static inline u32 open_file_to_av(struct file *file)
1810{
1811 u32 av = file_to_av(file);
1812
Eric Paris49b7b8d2010-07-23 11:44:09 -04001813 if (selinux_policycap_openperm)
1814 av |= FILE__OPEN;
1815
Eric Paris8b6a5a32008-10-29 17:06:46 -04001816 return av;
1817}
1818
Linus Torvalds1da177e2005-04-16 15:20:36 -07001819/* Hook functions begin here. */
1820
Stephen Smalley48a23702012-11-05 08:15:34 -05001821static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1822{
1823 u32 mysid = current_sid();
1824 u32 mgrsid = task_sid(mgr);
1825
1826 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL);
1827}
1828
1829static int selinux_binder_transaction(struct task_struct *from, struct task_struct *to)
1830{
1831 u32 mysid = current_sid();
1832 u32 fromsid = task_sid(from);
1833 u32 tosid = task_sid(to);
1834 int rc;
1835
1836 if (mysid != fromsid) {
1837 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, BINDER__IMPERSONATE, NULL);
1838 if (rc)
1839 return rc;
1840 }
1841
1842 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, NULL);
1843}
1844
1845static int selinux_binder_transfer_binder(struct task_struct *from, struct task_struct *to)
1846{
1847 u32 fromsid = task_sid(from);
1848 u32 tosid = task_sid(to);
1849 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, NULL);
1850}
1851
1852static int selinux_binder_transfer_file(struct task_struct *from, struct task_struct *to, struct file *file)
1853{
1854 u32 sid = task_sid(to);
1855 struct file_security_struct *fsec = file->f_security;
1856 struct inode *inode = file->f_path.dentry->d_inode;
1857 struct inode_security_struct *isec = inode->i_security;
1858 struct common_audit_data ad;
1859 struct selinux_audit_data sad = {0,};
1860 int rc;
1861
1862 COMMON_AUDIT_DATA_INIT(&ad, PATH);
1863 ad.u.path = file->f_path;
1864 ad.selinux_audit_data = &sad;
1865
1866 if (sid != fsec->sid) {
1867 rc = avc_has_perm(sid, fsec->sid,
1868 SECCLASS_FD,
1869 FD__USE,
1870 &ad);
1871 if (rc)
1872 return rc;
1873 }
1874
1875 if (unlikely(IS_PRIVATE(inode)))
1876 return 0;
1877
1878 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1879 &ad);
1880}
1881
Ingo Molnar9e488582009-05-07 19:26:19 +10001882static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01001883 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001884{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001885 int rc;
1886
Ingo Molnar9e488582009-05-07 19:26:19 +10001887 rc = cap_ptrace_access_check(child, mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001888 if (rc)
1889 return rc;
1890
Eric Paris69f594a2012-01-03 12:25:15 -05001891 if (mode & PTRACE_MODE_READ) {
David Howells275bb412008-11-14 10:39:19 +11001892 u32 sid = current_sid();
1893 u32 csid = task_sid(child);
1894 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalley006ebb42008-05-19 08:32:49 -04001895 }
1896
David Howells3b11a1d2008-11-14 10:39:26 +11001897 return current_has_perm(child, PROCESS__PTRACE);
David Howells5cd9c582008-08-14 11:37:28 +01001898}
1899
1900static int selinux_ptrace_traceme(struct task_struct *parent)
1901{
1902 int rc;
1903
Eric Paris200ac532009-02-12 15:01:04 -05001904 rc = cap_ptrace_traceme(parent);
David Howells5cd9c582008-08-14 11:37:28 +01001905 if (rc)
1906 return rc;
1907
1908 return task_has_perm(parent, current, PROCESS__PTRACE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001909}
1910
1911static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04001912 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001913{
1914 int error;
1915
David Howells3b11a1d2008-11-14 10:39:26 +11001916 error = current_has_perm(target, PROCESS__GETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001917 if (error)
1918 return error;
1919
Eric Paris200ac532009-02-12 15:01:04 -05001920 return cap_capget(target, effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001921}
1922
David Howellsd84f4f92008-11-14 10:39:23 +11001923static int selinux_capset(struct cred *new, const struct cred *old,
1924 const kernel_cap_t *effective,
1925 const kernel_cap_t *inheritable,
1926 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001927{
1928 int error;
1929
Eric Paris200ac532009-02-12 15:01:04 -05001930 error = cap_capset(new, old,
David Howellsd84f4f92008-11-14 10:39:23 +11001931 effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001932 if (error)
1933 return error;
1934
David Howellsd84f4f92008-11-14 10:39:23 +11001935 return cred_has_perm(old, new, PROCESS__SETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001936}
1937
James Morris5626d3e2009-01-30 10:05:06 +11001938/*
1939 * (This comment used to live with the selinux_task_setuid hook,
1940 * which was removed).
1941 *
1942 * Since setuid only affects the current process, and since the SELinux
1943 * controls are not based on the Linux identity attributes, SELinux does not
1944 * need to control this operation. However, SELinux does control the use of
1945 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1946 */
1947
Eric Paris6a9de492012-01-03 12:25:14 -05001948static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1949 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001950{
1951 int rc;
1952
Eric Paris6a9de492012-01-03 12:25:14 -05001953 rc = cap_capable(cred, ns, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001954 if (rc)
1955 return rc;
1956
Eric Paris6a9de492012-01-03 12:25:14 -05001957 return cred_has_capability(cred, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001958}
1959
Linus Torvalds1da177e2005-04-16 15:20:36 -07001960static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1961{
David Howells88e67f32008-11-14 10:39:21 +11001962 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001963 int rc = 0;
1964
1965 if (!sb)
1966 return 0;
1967
1968 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04001969 case Q_SYNC:
1970 case Q_QUOTAON:
1971 case Q_QUOTAOFF:
1972 case Q_SETINFO:
1973 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001974 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001975 break;
1976 case Q_GETFMT:
1977 case Q_GETINFO:
1978 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001979 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001980 break;
1981 default:
1982 rc = 0; /* let the kernel handle invalid cmds */
1983 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001984 }
1985 return rc;
1986}
1987
1988static int selinux_quota_on(struct dentry *dentry)
1989{
David Howells88e67f32008-11-14 10:39:21 +11001990 const struct cred *cred = current_cred();
1991
Eric Paris2875fa02011-04-28 16:04:24 -04001992 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001993}
1994
Eric Paris12b30522010-11-15 18:36:29 -05001995static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001996{
1997 int rc;
1998
Linus Torvalds1da177e2005-04-16 15:20:36 -07001999 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002000 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2001 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002002 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2003 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002004 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2005 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2006 /* Set level of messages printed to console */
2007 case SYSLOG_ACTION_CONSOLE_LEVEL:
Eric Paris828dfe12008-04-17 13:17:49 -04002008 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2009 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002010 case SYSLOG_ACTION_CLOSE: /* Close log */
2011 case SYSLOG_ACTION_OPEN: /* Open log */
2012 case SYSLOG_ACTION_READ: /* Read from log */
2013 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2014 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002015 default:
2016 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2017 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002018 }
2019 return rc;
2020}
2021
2022/*
2023 * Check that a process has enough memory to allocate a new virtual
2024 * mapping. 0 means there is enough memory for the allocation to
2025 * succeed and -ENOMEM implies there is not.
2026 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002027 * Do not audit the selinux permission check, as this is applied to all
2028 * processes that allocate mappings.
2029 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002030static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002031{
2032 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002033
Eric Paris6a9de492012-01-03 12:25:14 -05002034 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
David Howells3699c532009-01-06 22:27:01 +00002035 SECURITY_CAP_NOAUDIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002036 if (rc == 0)
2037 cap_sys_admin = 1;
2038
Alan Cox34b4e4a2007-08-22 14:01:28 -07002039 return __vm_enough_memory(mm, pages, cap_sys_admin);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002040}
2041
2042/* binprm security operations */
2043
David Howellsa6f76f22008-11-14 10:39:24 +11002044static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002045{
David Howellsa6f76f22008-11-14 10:39:24 +11002046 const struct task_security_struct *old_tsec;
2047 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002048 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002049 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07002050 struct selinux_audit_data sad = {0,};
David Howellsa6f76f22008-11-14 10:39:24 +11002051 struct inode *inode = bprm->file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002052 int rc;
2053
Eric Paris200ac532009-02-12 15:01:04 -05002054 rc = cap_bprm_set_creds(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002055 if (rc)
2056 return rc;
2057
David Howellsa6f76f22008-11-14 10:39:24 +11002058 /* SELinux context only depends on initial program or script and not
2059 * the script interpreter */
2060 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002061 return 0;
2062
David Howellsa6f76f22008-11-14 10:39:24 +11002063 old_tsec = current_security();
2064 new_tsec = bprm->cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002065 isec = inode->i_security;
2066
2067 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002068 new_tsec->sid = old_tsec->sid;
2069 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002070
Michael LeMay28eba5b2006-06-27 02:53:42 -07002071 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002072 new_tsec->create_sid = 0;
2073 new_tsec->keycreate_sid = 0;
2074 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002075
David Howellsa6f76f22008-11-14 10:39:24 +11002076 if (old_tsec->exec_sid) {
2077 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002078 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002079 new_tsec->exec_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002080 } else {
2081 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11002082 rc = security_transition_sid(old_tsec->sid, isec->sid,
Eric Paris652bb9b2011-02-01 11:05:40 -05002083 SECCLASS_PROCESS, NULL,
2084 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002085 if (rc)
2086 return rc;
2087 }
2088
Eric Parisf48b7392011-04-25 12:54:27 -04002089 COMMON_AUDIT_DATA_INIT(&ad, PATH);
Eric Paris3b3b0e42012-04-03 09:37:02 -07002090 ad.selinux_audit_data = &sad;
Eric Parisf48b7392011-04-25 12:54:27 -04002091 ad.u.path = bprm->file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002092
Josef Sipek3d5ff522006-12-08 02:37:38 -08002093 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
David Howellsa6f76f22008-11-14 10:39:24 +11002094 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002095
David Howellsa6f76f22008-11-14 10:39:24 +11002096 if (new_tsec->sid == old_tsec->sid) {
2097 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002098 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2099 if (rc)
2100 return rc;
2101 } else {
2102 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002103 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002104 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2105 if (rc)
2106 return rc;
2107
David Howellsa6f76f22008-11-14 10:39:24 +11002108 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002109 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2110 if (rc)
2111 return rc;
2112
David Howellsa6f76f22008-11-14 10:39:24 +11002113 /* Check for shared state */
2114 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2115 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2116 SECCLASS_PROCESS, PROCESS__SHARE,
2117 NULL);
2118 if (rc)
2119 return -EPERM;
2120 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002121
David Howellsa6f76f22008-11-14 10:39:24 +11002122 /* Make sure that anyone attempting to ptrace over a task that
2123 * changes its SID has the appropriate permit */
2124 if (bprm->unsafe &
2125 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2126 struct task_struct *tracer;
2127 struct task_security_struct *sec;
2128 u32 ptsid = 0;
2129
2130 rcu_read_lock();
Tejun Heo06d98472011-06-17 16:50:40 +02002131 tracer = ptrace_parent(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002132 if (likely(tracer != NULL)) {
2133 sec = __task_cred(tracer)->security;
2134 ptsid = sec->sid;
2135 }
2136 rcu_read_unlock();
2137
2138 if (ptsid != 0) {
2139 rc = avc_has_perm(ptsid, new_tsec->sid,
2140 SECCLASS_PROCESS,
2141 PROCESS__PTRACE, NULL);
2142 if (rc)
2143 return -EPERM;
2144 }
2145 }
2146
2147 /* Clear any possibly unsafe personality bits on exec: */
2148 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002149 }
2150
Linus Torvalds1da177e2005-04-16 15:20:36 -07002151 return 0;
2152}
2153
Eric Paris828dfe12008-04-17 13:17:49 -04002154static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002155{
Paul Moore5fb49872010-04-22 14:46:19 -04002156 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +11002157 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002158 int atsecure = 0;
2159
David Howells275bb412008-11-14 10:39:19 +11002160 sid = tsec->sid;
2161 osid = tsec->osid;
2162
2163 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002164 /* Enable secure mode for SIDs transitions unless
2165 the noatsecure permission is granted between
2166 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002167 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002168 SECCLASS_PROCESS,
2169 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002170 }
2171
Eric Paris200ac532009-02-12 15:01:04 -05002172 return (atsecure || cap_bprm_secureexec(bprm));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002173}
2174
Linus Torvalds1da177e2005-04-16 15:20:36 -07002175/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002176static inline void flush_unauthorized_files(const struct cred *cred,
2177 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002178{
Thomas Liu2bf49692009-07-14 12:14:09 -04002179 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07002180 struct selinux_audit_data sad = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07002181 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002182 struct tty_struct *tty;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002183 struct fdtable *fdt;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002184 long j = -1;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002185 int drop_tty = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002186
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002187 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002188 if (tty) {
Nick Pigginee2ffa02010-08-18 04:37:35 +10002189 spin_lock(&tty_files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002190 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002191 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002192 struct inode *inode;
2193
Linus Torvalds1da177e2005-04-16 15:20:36 -07002194 /* Revalidate access to controlling tty.
2195 Use inode_has_perm on the tty inode directly rather
2196 than using file_has_perm, as this particular open
2197 file may belong to another process and we are only
2198 interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002199 file_priv = list_first_entry(&tty->tty_files,
2200 struct tty_file_private, list);
2201 file = file_priv->file;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002202 inode = file->f_path.dentry->d_inode;
Linus Torvalds95f4efb2011-06-08 15:11:56 -07002203 if (inode_has_perm_noadp(cred, inode,
2204 FILE__READ | FILE__WRITE, 0)) {
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002205 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002206 }
2207 }
Nick Pigginee2ffa02010-08-18 04:37:35 +10002208 spin_unlock(&tty_files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002209 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002210 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002211 /* Reset controlling tty. */
2212 if (drop_tty)
2213 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002214
2215 /* Revalidate access to inherited open files. */
2216
Eric Parisf48b7392011-04-25 12:54:27 -04002217 COMMON_AUDIT_DATA_INIT(&ad, INODE);
Eric Paris3b3b0e42012-04-03 09:37:02 -07002218 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002219
2220 spin_lock(&files->file_lock);
2221 for (;;) {
2222 unsigned long set, i;
2223 int fd;
2224
2225 j++;
2226 i = j * __NFDBITS;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002227 fdt = files_fdtable(files);
Vadim Lobanovbbea9f62006-12-10 02:21:12 -08002228 if (i >= fdt->max_fds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002229 break;
David Howells1fd36ad2012-02-16 17:49:54 +00002230 set = fdt->open_fds[j];
Linus Torvalds1da177e2005-04-16 15:20:36 -07002231 if (!set)
2232 continue;
2233 spin_unlock(&files->file_lock);
Eric Paris828dfe12008-04-17 13:17:49 -04002234 for ( ; set ; i++, set >>= 1) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002235 if (set & 1) {
2236 file = fget(i);
2237 if (!file)
2238 continue;
David Howells88e67f32008-11-14 10:39:21 +11002239 if (file_has_perm(cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002240 file,
2241 file_to_av(file))) {
2242 sys_close(i);
2243 fd = get_unused_fd();
2244 if (fd != i) {
2245 if (fd >= 0)
2246 put_unused_fd(fd);
2247 fput(file);
2248 continue;
2249 }
2250 if (devnull) {
Nick Piggin095975d2006-01-08 01:02:19 -08002251 get_file(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002252 } else {
David Howells745ca242008-11-14 10:39:22 +11002253 devnull = dentry_open(
2254 dget(selinux_null),
2255 mntget(selinuxfs_mount),
2256 O_RDWR, cred);
Akinobu Mitafc5d81e2006-11-27 15:16:48 +09002257 if (IS_ERR(devnull)) {
2258 devnull = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002259 put_unused_fd(fd);
2260 fput(file);
2261 continue;
2262 }
2263 }
2264 fd_install(fd, devnull);
2265 }
2266 fput(file);
2267 }
2268 }
2269 spin_lock(&files->file_lock);
2270
2271 }
2272 spin_unlock(&files->file_lock);
2273}
2274
Linus Torvalds1da177e2005-04-16 15:20:36 -07002275/*
David Howellsa6f76f22008-11-14 10:39:24 +11002276 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002277 */
David Howellsa6f76f22008-11-14 10:39:24 +11002278static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002279{
David Howellsa6f76f22008-11-14 10:39:24 +11002280 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002281 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002282 int rc, i;
2283
David Howellsa6f76f22008-11-14 10:39:24 +11002284 new_tsec = bprm->cred->security;
2285 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002286 return;
2287
2288 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002289 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002290
David Howellsa6f76f22008-11-14 10:39:24 +11002291 /* Always clear parent death signal on SID transitions. */
2292 current->pdeath_signal = 0;
2293
2294 /* Check whether the new SID can inherit resource limits from the old
2295 * SID. If not, reset all soft limits to the lower of the current
2296 * task's hard limit and the init task's soft limit.
2297 *
2298 * Note that the setting of hard limits (even to lower them) can be
2299 * controlled by the setrlimit check. The inclusion of the init task's
2300 * soft limit into the computation is to avoid resetting soft limits
2301 * higher than the default soft limit for cases where the default is
2302 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2303 */
2304 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2305 PROCESS__RLIMITINH, NULL);
2306 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002307 /* protect against do_prlimit() */
2308 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002309 for (i = 0; i < RLIM_NLIMITS; i++) {
2310 rlim = current->signal->rlim + i;
2311 initrlim = init_task.signal->rlim + i;
2312 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2313 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002314 task_unlock(current);
2315 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002316 }
2317}
2318
2319/*
2320 * Clean up the process immediately after the installation of new credentials
2321 * due to exec
2322 */
2323static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2324{
2325 const struct task_security_struct *tsec = current_security();
2326 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002327 u32 osid, sid;
2328 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002329
David Howellsa6f76f22008-11-14 10:39:24 +11002330 osid = tsec->osid;
2331 sid = tsec->sid;
2332
2333 if (sid == osid)
2334 return;
2335
2336 /* Check whether the new SID can inherit signal state from the old SID.
2337 * If not, clear itimers to avoid subsequent signal generation and
2338 * flush and unblock signals.
2339 *
2340 * This must occur _after_ the task SID has been updated so that any
2341 * kill done after the flush will be checked against the new SID.
2342 */
2343 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002344 if (rc) {
2345 memset(&itimer, 0, sizeof itimer);
2346 for (i = 0; i < 3; i++)
2347 do_setitimer(i, &itimer, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002348 spin_lock_irq(&current->sighand->siglock);
David Howells3bcac022009-04-29 13:45:05 +01002349 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2350 __flush_signals(current);
2351 flush_signal_handlers(current, 1);
2352 sigemptyset(&current->blocked);
2353 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002354 spin_unlock_irq(&current->sighand->siglock);
2355 }
2356
David Howellsa6f76f22008-11-14 10:39:24 +11002357 /* Wake up the parent if it is waiting so that it can recheck
2358 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002359 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002360 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002361 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002362}
2363
2364/* superblock security operations */
2365
2366static int selinux_sb_alloc_security(struct super_block *sb)
2367{
2368 return superblock_alloc_security(sb);
2369}
2370
2371static void selinux_sb_free_security(struct super_block *sb)
2372{
2373 superblock_free_security(sb);
2374}
2375
2376static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2377{
2378 if (plen > olen)
2379 return 0;
2380
2381 return !memcmp(prefix, option, plen);
2382}
2383
2384static inline int selinux_option(char *option, int len)
2385{
Eric Paris832cbd92008-04-01 13:24:09 -04002386 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2387 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2388 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002389 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2390 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002391}
2392
2393static inline void take_option(char **to, char *from, int *first, int len)
2394{
2395 if (!*first) {
2396 **to = ',';
2397 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002398 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002399 *first = 0;
2400 memcpy(*to, from, len);
2401 *to += len;
2402}
2403
Eric Paris828dfe12008-04-17 13:17:49 -04002404static inline void take_selinux_option(char **to, char *from, int *first,
2405 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002406{
2407 int current_size = 0;
2408
2409 if (!*first) {
2410 **to = '|';
2411 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002412 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002413 *first = 0;
2414
2415 while (current_size < len) {
2416 if (*from != '"') {
2417 **to = *from;
2418 *to += 1;
2419 }
2420 from += 1;
2421 current_size += 1;
2422 }
2423}
2424
Eric Parise0007522008-03-05 10:31:54 -05002425static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002426{
2427 int fnosec, fsec, rc = 0;
2428 char *in_save, *in_curr, *in_end;
2429 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002430 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002431
2432 in_curr = orig;
2433 sec_curr = copy;
2434
Linus Torvalds1da177e2005-04-16 15:20:36 -07002435 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2436 if (!nosec) {
2437 rc = -ENOMEM;
2438 goto out;
2439 }
2440
2441 nosec_save = nosec;
2442 fnosec = fsec = 1;
2443 in_save = in_end = orig;
2444
2445 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002446 if (*in_end == '"')
2447 open_quote = !open_quote;
2448 if ((*in_end == ',' && open_quote == 0) ||
2449 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002450 int len = in_end - in_curr;
2451
2452 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002453 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002454 else
2455 take_option(&nosec, in_curr, &fnosec, len);
2456
2457 in_curr = in_end + 1;
2458 }
2459 } while (*in_end++);
2460
Eric Paris6931dfc2005-06-30 02:58:51 -07002461 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002462 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002463out:
2464 return rc;
2465}
2466
Eric Paris026eb162011-03-03 16:09:14 -05002467static int selinux_sb_remount(struct super_block *sb, void *data)
2468{
2469 int rc, i, *flags;
2470 struct security_mnt_opts opts;
2471 char *secdata, **mount_options;
2472 struct superblock_security_struct *sbsec = sb->s_security;
2473
2474 if (!(sbsec->flags & SE_SBINITIALIZED))
2475 return 0;
2476
2477 if (!data)
2478 return 0;
2479
2480 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2481 return 0;
2482
2483 security_init_mnt_opts(&opts);
2484 secdata = alloc_secdata();
2485 if (!secdata)
2486 return -ENOMEM;
2487 rc = selinux_sb_copy_data(data, secdata);
2488 if (rc)
2489 goto out_free_secdata;
2490
2491 rc = selinux_parse_opts_str(secdata, &opts);
2492 if (rc)
2493 goto out_free_secdata;
2494
2495 mount_options = opts.mnt_opts;
2496 flags = opts.mnt_opts_flags;
2497
2498 for (i = 0; i < opts.num_mnt_opts; i++) {
2499 u32 sid;
2500 size_t len;
2501
2502 if (flags[i] == SE_SBLABELSUPP)
2503 continue;
2504 len = strlen(mount_options[i]);
2505 rc = security_context_to_sid(mount_options[i], len, &sid);
2506 if (rc) {
2507 printk(KERN_WARNING "SELinux: security_context_to_sid"
2508 "(%s) failed for (dev %s, type %s) errno=%d\n",
2509 mount_options[i], sb->s_id, sb->s_type->name, rc);
2510 goto out_free_opts;
2511 }
2512 rc = -EINVAL;
2513 switch (flags[i]) {
2514 case FSCONTEXT_MNT:
2515 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2516 goto out_bad_option;
2517 break;
2518 case CONTEXT_MNT:
2519 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2520 goto out_bad_option;
2521 break;
2522 case ROOTCONTEXT_MNT: {
2523 struct inode_security_struct *root_isec;
2524 root_isec = sb->s_root->d_inode->i_security;
2525
2526 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2527 goto out_bad_option;
2528 break;
2529 }
2530 case DEFCONTEXT_MNT:
2531 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2532 goto out_bad_option;
2533 break;
2534 default:
2535 goto out_free_opts;
2536 }
2537 }
2538
2539 rc = 0;
2540out_free_opts:
2541 security_free_mnt_opts(&opts);
2542out_free_secdata:
2543 free_secdata(secdata);
2544 return rc;
2545out_bad_option:
2546 printk(KERN_WARNING "SELinux: unable to change security options "
2547 "during remount (dev %s, type=%s)\n", sb->s_id,
2548 sb->s_type->name);
2549 goto out_free_opts;
2550}
2551
James Morris12204e22008-12-19 10:44:42 +11002552static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002553{
David Howells88e67f32008-11-14 10:39:21 +11002554 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002555 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07002556 struct selinux_audit_data sad = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07002557 int rc;
2558
2559 rc = superblock_doinit(sb, data);
2560 if (rc)
2561 return rc;
2562
James Morris74192242008-12-19 11:41:10 +11002563 /* Allow all mounts performed by the kernel */
2564 if (flags & MS_KERNMOUNT)
2565 return 0;
2566
Eric Parisa2694342011-04-25 13:10:27 -04002567 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
Eric Paris3b3b0e42012-04-03 09:37:02 -07002568 ad.selinux_audit_data = &sad;
Eric Parisa2694342011-04-25 13:10:27 -04002569 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002570 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002571}
2572
David Howells726c3342006-06-23 02:02:58 -07002573static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002574{
David Howells88e67f32008-11-14 10:39:21 +11002575 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002576 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07002577 struct selinux_audit_data sad = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07002578
Eric Parisa2694342011-04-25 13:10:27 -04002579 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
Eric Paris3b3b0e42012-04-03 09:37:02 -07002580 ad.selinux_audit_data = &sad;
Eric Parisa2694342011-04-25 13:10:27 -04002581 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002582 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002583}
2584
Eric Paris828dfe12008-04-17 13:17:49 -04002585static int selinux_mount(char *dev_name,
Al Virob5266eb2008-03-22 17:48:24 -04002586 struct path *path,
Eric Paris828dfe12008-04-17 13:17:49 -04002587 char *type,
2588 unsigned long flags,
2589 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002590{
David Howells88e67f32008-11-14 10:39:21 +11002591 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002592
2593 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002594 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002595 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002596 else
Eric Paris2875fa02011-04-28 16:04:24 -04002597 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002598}
2599
2600static int selinux_umount(struct vfsmount *mnt, int flags)
2601{
David Howells88e67f32008-11-14 10:39:21 +11002602 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002603
David Howells88e67f32008-11-14 10:39:21 +11002604 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002605 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002606}
2607
2608/* inode security operations */
2609
2610static int selinux_inode_alloc_security(struct inode *inode)
2611{
2612 return inode_alloc_security(inode);
2613}
2614
2615static void selinux_inode_free_security(struct inode *inode)
2616{
2617 inode_free_security(inode);
2618}
2619
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002620static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Eric Paris2a7dba32011-02-01 11:05:39 -05002621 const struct qstr *qstr, char **name,
2622 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002623{
Paul Moore5fb49872010-04-22 14:46:19 -04002624 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002625 struct inode_security_struct *dsec;
2626 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002627 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002628 int rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002629 char *namep = NULL, *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002630
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002631 dsec = dir->i_security;
2632 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002633
David Howells275bb412008-11-14 10:39:19 +11002634 sid = tsec->sid;
2635 newsid = tsec->create_sid;
2636
Eric Paris415103f2010-12-02 16:13:40 -05002637 if ((sbsec->flags & SE_SBINITIALIZED) &&
2638 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2639 newsid = sbsec->mntpoint_sid;
2640 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
David Howells275bb412008-11-14 10:39:19 +11002641 rc = security_transition_sid(sid, dsec->sid,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002642 inode_mode_to_security_class(inode->i_mode),
Eric Paris652bb9b2011-02-01 11:05:40 -05002643 qstr, &newsid);
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002644 if (rc) {
2645 printk(KERN_WARNING "%s: "
2646 "security_transition_sid failed, rc=%d (dev=%s "
2647 "ino=%ld)\n",
Harvey Harrisondd6f9532008-03-06 10:03:59 +11002648 __func__,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002649 -rc, inode->i_sb->s_id, inode->i_ino);
2650 return rc;
2651 }
2652 }
2653
Eric Paris296fddf2006-09-25 23:32:00 -07002654 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002655 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002656 struct inode_security_struct *isec = inode->i_security;
2657 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2658 isec->sid = newsid;
2659 isec->initialized = 1;
2660 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002661
David P. Quigleycd895962009-01-16 09:22:04 -05002662 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002663 return -EOPNOTSUPP;
2664
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002665 if (name) {
Josef Bacika02fe132008-04-04 09:35:05 +11002666 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002667 if (!namep)
2668 return -ENOMEM;
2669 *name = namep;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002670 }
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002671
2672 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002673 rc = security_sid_to_context_force(newsid, &context, &clen);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002674 if (rc) {
2675 kfree(namep);
2676 return rc;
2677 }
2678 *value = context;
2679 *len = clen;
2680 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002681
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002682 return 0;
2683}
2684
Al Viro4acdaf22011-07-26 01:42:34 -04002685static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002686{
2687 return may_create(dir, dentry, SECCLASS_FILE);
2688}
2689
Linus Torvalds1da177e2005-04-16 15:20:36 -07002690static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2691{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002692 return may_link(dir, old_dentry, MAY_LINK);
2693}
2694
Linus Torvalds1da177e2005-04-16 15:20:36 -07002695static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2696{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002697 return may_link(dir, dentry, MAY_UNLINK);
2698}
2699
2700static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2701{
2702 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2703}
2704
Al Viro18bb1db2011-07-26 01:41:39 -04002705static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002706{
2707 return may_create(dir, dentry, SECCLASS_DIR);
2708}
2709
Linus Torvalds1da177e2005-04-16 15:20:36 -07002710static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2711{
2712 return may_link(dir, dentry, MAY_RMDIR);
2713}
2714
Al Viro1a67aaf2011-07-26 01:52:52 -04002715static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002716{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002717 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2718}
2719
Linus Torvalds1da177e2005-04-16 15:20:36 -07002720static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002721 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002722{
2723 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2724}
2725
Linus Torvalds1da177e2005-04-16 15:20:36 -07002726static int selinux_inode_readlink(struct dentry *dentry)
2727{
David Howells88e67f32008-11-14 10:39:21 +11002728 const struct cred *cred = current_cred();
2729
Eric Paris2875fa02011-04-28 16:04:24 -04002730 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002731}
2732
2733static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2734{
David Howells88e67f32008-11-14 10:39:21 +11002735 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002736
Eric Paris2875fa02011-04-28 16:04:24 -04002737 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002738}
2739
Al Viroe74f71e2011-06-20 19:38:15 -04002740static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002741{
David Howells88e67f32008-11-14 10:39:21 +11002742 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04002743 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07002744 struct selinux_audit_data sad = {0,};
Eric Parisb782e0a2010-07-23 11:44:03 -04002745 u32 perms;
2746 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04002747 unsigned flags = mask & MAY_NOT_BLOCK;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002748
Eric Parisb782e0a2010-07-23 11:44:03 -04002749 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04002750 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2751
Eric Parisb782e0a2010-07-23 11:44:03 -04002752 /* No permission to check. Existence test. */
2753 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002754 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002755
Eric Parisf48b7392011-04-25 12:54:27 -04002756 COMMON_AUDIT_DATA_INIT(&ad, INODE);
Eric Paris3b3b0e42012-04-03 09:37:02 -07002757 ad.selinux_audit_data = &sad;
Eric Parisf48b7392011-04-25 12:54:27 -04002758 ad.u.inode = inode;
Eric Parisb782e0a2010-07-23 11:44:03 -04002759
2760 if (from_access)
Eric Paris3b3b0e42012-04-03 09:37:02 -07002761 ad.selinux_audit_data->auditdeny |= FILE__AUDIT_ACCESS;
Eric Parisb782e0a2010-07-23 11:44:03 -04002762
2763 perms = file_mask_to_av(inode->i_mode, mask);
2764
Eric Paris9ade0cf2011-04-25 16:26:29 -04002765 return inode_has_perm(cred, inode, perms, &ad, flags);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002766}
2767
2768static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2769{
David Howells88e67f32008-11-14 10:39:21 +11002770 const struct cred *cred = current_cred();
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002771 unsigned int ia_valid = iattr->ia_valid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002772
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002773 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2774 if (ia_valid & ATTR_FORCE) {
2775 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2776 ATTR_FORCE);
2777 if (!ia_valid)
2778 return 0;
2779 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002780
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002781 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2782 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04002783 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002784
Eric Paris2875fa02011-04-28 16:04:24 -04002785 return dentry_has_perm(cred, dentry, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002786}
2787
2788static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2789{
David Howells88e67f32008-11-14 10:39:21 +11002790 const struct cred *cred = current_cred();
Eric Paris2875fa02011-04-28 16:04:24 -04002791 struct path path;
David Howells88e67f32008-11-14 10:39:21 +11002792
Eric Paris2875fa02011-04-28 16:04:24 -04002793 path.dentry = dentry;
2794 path.mnt = mnt;
2795
2796 return path_has_perm(cred, &path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002797}
2798
David Howells8f0cfa52008-04-29 00:59:41 -07002799static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07002800{
David Howells88e67f32008-11-14 10:39:21 +11002801 const struct cred *cred = current_cred();
2802
Serge E. Hallynb5376772007-10-16 23:31:36 -07002803 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2804 sizeof XATTR_SECURITY_PREFIX - 1)) {
2805 if (!strcmp(name, XATTR_NAME_CAPS)) {
2806 if (!capable(CAP_SETFCAP))
2807 return -EPERM;
2808 } else if (!capable(CAP_SYS_ADMIN)) {
2809 /* A different attribute in the security namespace.
2810 Restrict to administrator. */
2811 return -EPERM;
2812 }
2813 }
2814
2815 /* Not an attribute we recognize, so just check the
2816 ordinary setattr permission. */
Eric Paris2875fa02011-04-28 16:04:24 -04002817 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07002818}
2819
David Howells8f0cfa52008-04-29 00:59:41 -07002820static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2821 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002822{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002823 struct inode *inode = dentry->d_inode;
2824 struct inode_security_struct *isec = inode->i_security;
2825 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002826 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07002827 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11002828 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002829 int rc = 0;
2830
Serge E. Hallynb5376772007-10-16 23:31:36 -07002831 if (strcmp(name, XATTR_NAME_SELINUX))
2832 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002833
2834 sbsec = inode->i_sb->s_security;
David P. Quigleycd895962009-01-16 09:22:04 -05002835 if (!(sbsec->flags & SE_SBLABELSUPP))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002836 return -EOPNOTSUPP;
2837
Serge E. Hallyn2e149672011-03-23 16:43:26 -07002838 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002839 return -EPERM;
2840
Eric Parisa2694342011-04-25 13:10:27 -04002841 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
Eric Paris3b3b0e42012-04-03 09:37:02 -07002842 ad.selinux_audit_data = &sad;
Eric Parisa2694342011-04-25 13:10:27 -04002843 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002844
David Howells275bb412008-11-14 10:39:19 +11002845 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002846 FILE__RELABELFROM, &ad);
2847 if (rc)
2848 return rc;
2849
2850 rc = security_context_to_sid(value, size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04002851 if (rc == -EINVAL) {
2852 if (!capable(CAP_MAC_ADMIN))
2853 return rc;
2854 rc = security_context_to_sid_force(value, size, &newsid);
2855 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002856 if (rc)
2857 return rc;
2858
David Howells275bb412008-11-14 10:39:19 +11002859 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002860 FILE__RELABELTO, &ad);
2861 if (rc)
2862 return rc;
2863
David Howells275bb412008-11-14 10:39:19 +11002864 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04002865 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002866 if (rc)
2867 return rc;
2868
2869 return avc_has_perm(newsid,
2870 sbsec->sid,
2871 SECCLASS_FILESYSTEM,
2872 FILESYSTEM__ASSOCIATE,
2873 &ad);
2874}
2875
David Howells8f0cfa52008-04-29 00:59:41 -07002876static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04002877 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07002878 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002879{
2880 struct inode *inode = dentry->d_inode;
2881 struct inode_security_struct *isec = inode->i_security;
2882 u32 newsid;
2883 int rc;
2884
2885 if (strcmp(name, XATTR_NAME_SELINUX)) {
2886 /* Not an attribute we recognize, so nothing to do. */
2887 return;
2888 }
2889
Stephen Smalley12b29f32008-05-07 13:03:20 -04002890 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002891 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002892 printk(KERN_ERR "SELinux: unable to map context to SID"
2893 "for (%s, %lu), rc=%d\n",
2894 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002895 return;
2896 }
2897
2898 isec->sid = newsid;
2899 return;
2900}
2901
David Howells8f0cfa52008-04-29 00:59:41 -07002902static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002903{
David Howells88e67f32008-11-14 10:39:21 +11002904 const struct cred *cred = current_cred();
2905
Eric Paris2875fa02011-04-28 16:04:24 -04002906 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002907}
2908
Eric Paris828dfe12008-04-17 13:17:49 -04002909static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002910{
David Howells88e67f32008-11-14 10:39:21 +11002911 const struct cred *cred = current_cred();
2912
Eric Paris2875fa02011-04-28 16:04:24 -04002913 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002914}
2915
David Howells8f0cfa52008-04-29 00:59:41 -07002916static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002917{
Serge E. Hallynb5376772007-10-16 23:31:36 -07002918 if (strcmp(name, XATTR_NAME_SELINUX))
2919 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002920
2921 /* No one is allowed to remove a SELinux security label.
2922 You can change the label, but all data must be labeled. */
2923 return -EACCES;
2924}
2925
James Morrisd381d8a2005-10-30 14:59:22 -08002926/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002927 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08002928 *
2929 * Permission check is handled by selinux_inode_getxattr hook.
2930 */
David P. Quigley42492592008-02-04 22:29:39 -08002931static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002932{
David P. Quigley42492592008-02-04 22:29:39 -08002933 u32 size;
2934 int error;
2935 char *context = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002936 struct inode_security_struct *isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002937
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002938 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2939 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002940
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002941 /*
2942 * If the caller has CAP_MAC_ADMIN, then get the raw context
2943 * value even if it is not defined by current policy; otherwise,
2944 * use the in-core value under current policy.
2945 * Use the non-auditing forms of the permission checks since
2946 * getxattr may be called by unprivileged processes commonly
2947 * and lack of permission just means that we fall back to the
2948 * in-core context value, not a denial.
2949 */
Eric Paris6a9de492012-01-03 12:25:14 -05002950 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
David Howells3699c532009-01-06 22:27:01 +00002951 SECURITY_CAP_NOAUDIT);
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002952 if (!error)
2953 error = security_sid_to_context_force(isec->sid, &context,
2954 &size);
2955 else
2956 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08002957 if (error)
2958 return error;
2959 error = size;
2960 if (alloc) {
2961 *buffer = context;
2962 goto out_nofree;
2963 }
2964 kfree(context);
2965out_nofree:
2966 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002967}
2968
2969static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04002970 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002971{
2972 struct inode_security_struct *isec = inode->i_security;
2973 u32 newsid;
2974 int rc;
2975
2976 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2977 return -EOPNOTSUPP;
2978
2979 if (!value || !size)
2980 return -EACCES;
2981
Eric Paris828dfe12008-04-17 13:17:49 -04002982 rc = security_context_to_sid((void *)value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002983 if (rc)
2984 return rc;
2985
2986 isec->sid = newsid;
David P. Quigleyddd29ec2009-09-09 14:25:37 -04002987 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002988 return 0;
2989}
2990
2991static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2992{
2993 const int len = sizeof(XATTR_NAME_SELINUX);
2994 if (buffer && len <= buffer_size)
2995 memcpy(buffer, XATTR_NAME_SELINUX, len);
2996 return len;
2997}
2998
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02002999static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3000{
3001 struct inode_security_struct *isec = inode->i_security;
3002 *secid = isec->sid;
3003}
3004
Linus Torvalds1da177e2005-04-16 15:20:36 -07003005/* file security operations */
3006
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003007static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003008{
David Howells88e67f32008-11-14 10:39:21 +11003009 const struct cred *cred = current_cred();
Josef Sipek3d5ff522006-12-08 02:37:38 -08003010 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003011
Linus Torvalds1da177e2005-04-16 15:20:36 -07003012 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3013 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3014 mask |= MAY_APPEND;
3015
Paul Moore389fb802009-03-27 17:10:34 -04003016 return file_has_perm(cred, file,
3017 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003018}
3019
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003020static int selinux_file_permission(struct file *file, int mask)
3021{
Stephen Smalley20dda182009-06-22 14:54:53 -04003022 struct inode *inode = file->f_path.dentry->d_inode;
3023 struct file_security_struct *fsec = file->f_security;
3024 struct inode_security_struct *isec = inode->i_security;
3025 u32 sid = current_sid();
3026
Paul Moore389fb802009-03-27 17:10:34 -04003027 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003028 /* No permission to check. Existence test. */
3029 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003030
Stephen Smalley20dda182009-06-22 14:54:53 -04003031 if (sid == fsec->sid && fsec->isid == isec->sid &&
3032 fsec->pseqno == avc_policy_seqno())
3033 /* No change since dentry_open check. */
3034 return 0;
3035
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003036 return selinux_revalidate_file_permission(file, mask);
3037}
3038
Linus Torvalds1da177e2005-04-16 15:20:36 -07003039static int selinux_file_alloc_security(struct file *file)
3040{
3041 return file_alloc_security(file);
3042}
3043
3044static void selinux_file_free_security(struct file *file)
3045{
3046 file_free_security(file);
3047}
3048
3049static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3050 unsigned long arg)
3051{
David Howells88e67f32008-11-14 10:39:21 +11003052 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003053 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003054
Eric Paris0b24dcb2011-02-25 15:39:20 -05003055 switch (cmd) {
3056 case FIONREAD:
3057 /* fall through */
3058 case FIBMAP:
3059 /* fall through */
3060 case FIGETBSZ:
3061 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003062 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003063 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003064 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003065 error = file_has_perm(cred, file, FILE__GETATTR);
3066 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003067
Al Viro2f99c362012-03-23 16:04:05 -04003068 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003069 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003070 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003071 error = file_has_perm(cred, file, FILE__SETATTR);
3072 break;
3073
3074 /* sys_ioctl() checks */
3075 case FIONBIO:
3076 /* fall through */
3077 case FIOASYNC:
3078 error = file_has_perm(cred, file, 0);
3079 break;
3080
3081 case KDSKBENT:
3082 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003083 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3084 SECURITY_CAP_AUDIT);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003085 break;
3086
3087 /* default case assumes that the command will go
3088 * to the file's ioctl() function.
3089 */
3090 default:
3091 error = file_has_perm(cred, file, FILE__IOCTL);
3092 }
3093 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003094}
3095
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003096static int default_noexec;
3097
Linus Torvalds1da177e2005-04-16 15:20:36 -07003098static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3099{
David Howells88e67f32008-11-14 10:39:21 +11003100 const struct cred *cred = current_cred();
David Howellsd84f4f92008-11-14 10:39:23 +11003101 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003102
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003103 if (default_noexec &&
3104 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003105 /*
3106 * We are making executable an anonymous mapping or a
3107 * private file mapping that will also be writable.
3108 * This has an additional check.
3109 */
David Howellsd84f4f92008-11-14 10:39:23 +11003110 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003111 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003112 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003113 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003114
3115 if (file) {
3116 /* read access is always possible with a mapping */
3117 u32 av = FILE__READ;
3118
3119 /* write access only matters if the mapping is shared */
3120 if (shared && (prot & PROT_WRITE))
3121 av |= FILE__WRITE;
3122
3123 if (prot & PROT_EXEC)
3124 av |= FILE__EXECUTE;
3125
David Howells88e67f32008-11-14 10:39:21 +11003126 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003127 }
David Howellsd84f4f92008-11-14 10:39:23 +11003128
3129error:
3130 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003131}
3132
3133static int selinux_file_mmap(struct file *file, unsigned long reqprot,
Eric Parised032182007-06-28 15:55:21 -04003134 unsigned long prot, unsigned long flags,
3135 unsigned long addr, unsigned long addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003136{
Eric Parised032182007-06-28 15:55:21 -04003137 int rc = 0;
David Howells275bb412008-11-14 10:39:19 +11003138 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003139
Eric Paris84336d1a2009-07-31 12:54:05 -04003140 /*
3141 * notice that we are intentionally putting the SELinux check before
3142 * the secondary cap_file_mmap check. This is such a likely attempt
3143 * at bad behaviour/exploit that we always want to get the AVC, even
3144 * if DAC would have also denied the operation.
3145 */
Eric Parisa2551df2009-07-31 12:54:11 -04003146 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
Eric Parised032182007-06-28 15:55:21 -04003147 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3148 MEMPROTECT__MMAP_ZERO, NULL);
Eric Paris84336d1a2009-07-31 12:54:05 -04003149 if (rc)
3150 return rc;
3151 }
3152
3153 /* do DAC check on address space usage */
3154 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
Eric Parised032182007-06-28 15:55:21 -04003155 if (rc || addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003156 return rc;
3157
3158 if (selinux_checkreqprot)
3159 prot = reqprot;
3160
3161 return file_map_prot_check(file, prot,
3162 (flags & MAP_TYPE) == MAP_SHARED);
3163}
3164
3165static int selinux_file_mprotect(struct vm_area_struct *vma,
3166 unsigned long reqprot,
3167 unsigned long prot)
3168{
David Howells88e67f32008-11-14 10:39:21 +11003169 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003170
3171 if (selinux_checkreqprot)
3172 prot = reqprot;
3173
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003174 if (default_noexec &&
3175 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003176 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003177 if (vma->vm_start >= vma->vm_mm->start_brk &&
3178 vma->vm_end <= vma->vm_mm->brk) {
David Howellsd84f4f92008-11-14 10:39:23 +11003179 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003180 } else if (!vma->vm_file &&
3181 vma->vm_start <= vma->vm_mm->start_stack &&
3182 vma->vm_end >= vma->vm_mm->start_stack) {
David Howells3b11a1d2008-11-14 10:39:26 +11003183 rc = current_has_perm(current, PROCESS__EXECSTACK);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003184 } else if (vma->vm_file && vma->anon_vma) {
3185 /*
3186 * We are making executable a file mapping that has
3187 * had some COW done. Since pages might have been
3188 * written, check ability to execute the possibly
3189 * modified content. This typically should only
3190 * occur for text relocations.
3191 */
David Howellsd84f4f92008-11-14 10:39:23 +11003192 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003193 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003194 if (rc)
3195 return rc;
3196 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003197
3198 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3199}
3200
3201static int selinux_file_lock(struct file *file, unsigned int cmd)
3202{
David Howells88e67f32008-11-14 10:39:21 +11003203 const struct cred *cred = current_cred();
3204
3205 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003206}
3207
3208static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3209 unsigned long arg)
3210{
David Howells88e67f32008-11-14 10:39:21 +11003211 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003212 int err = 0;
3213
3214 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003215 case F_SETFL:
3216 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3217 err = -EINVAL;
3218 break;
3219 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003220
Eric Paris828dfe12008-04-17 13:17:49 -04003221 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003222 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003223 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003224 }
3225 /* fall through */
3226 case F_SETOWN:
3227 case F_SETSIG:
3228 case F_GETFL:
3229 case F_GETOWN:
3230 case F_GETSIG:
3231 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003232 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003233 break;
3234 case F_GETLK:
3235 case F_SETLK:
3236 case F_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003237#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003238 case F_GETLK64:
3239 case F_SETLK64:
3240 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003241#endif
Eric Paris828dfe12008-04-17 13:17:49 -04003242 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3243 err = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003244 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003245 }
David Howells88e67f32008-11-14 10:39:21 +11003246 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003247 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003248 }
3249
3250 return err;
3251}
3252
3253static int selinux_file_set_fowner(struct file *file)
3254{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003255 struct file_security_struct *fsec;
3256
Linus Torvalds1da177e2005-04-16 15:20:36 -07003257 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003258 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003259
3260 return 0;
3261}
3262
3263static int selinux_file_send_sigiotask(struct task_struct *tsk,
3264 struct fown_struct *fown, int signum)
3265{
Eric Paris828dfe12008-04-17 13:17:49 -04003266 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003267 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003268 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003269 struct file_security_struct *fsec;
3270
3271 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003272 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003273
Linus Torvalds1da177e2005-04-16 15:20:36 -07003274 fsec = file->f_security;
3275
3276 if (!signum)
3277 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3278 else
3279 perm = signal_to_av(signum);
3280
David Howells275bb412008-11-14 10:39:19 +11003281 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003282 SECCLASS_PROCESS, perm, NULL);
3283}
3284
3285static int selinux_file_receive(struct file *file)
3286{
David Howells88e67f32008-11-14 10:39:21 +11003287 const struct cred *cred = current_cred();
3288
3289 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003290}
3291
David Howells745ca242008-11-14 10:39:22 +11003292static int selinux_dentry_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003293{
3294 struct file_security_struct *fsec;
3295 struct inode *inode;
3296 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003297
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003298 inode = file->f_path.dentry->d_inode;
3299 fsec = file->f_security;
3300 isec = inode->i_security;
3301 /*
3302 * Save inode label and policy sequence number
3303 * at open-time so that selinux_file_permission
3304 * can determine whether revalidation is necessary.
3305 * Task label is already saved in the file security
3306 * struct as its SID.
3307 */
3308 fsec->isid = isec->sid;
3309 fsec->pseqno = avc_policy_seqno();
3310 /*
3311 * Since the inode label or policy seqno may have changed
3312 * between the selinux_inode_permission check and the saving
3313 * of state above, recheck that access is still permitted.
3314 * Otherwise, access might never be revalidated against the
3315 * new inode label or new policy.
3316 * This check is not redundant - do not remove.
3317 */
Linus Torvalds95f4efb2011-06-08 15:11:56 -07003318 return inode_has_perm_noadp(cred, inode, open_file_to_av(file), 0);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003319}
3320
Linus Torvalds1da177e2005-04-16 15:20:36 -07003321/* task security operations */
3322
3323static int selinux_task_create(unsigned long clone_flags)
3324{
David Howells3b11a1d2008-11-14 10:39:26 +11003325 return current_has_perm(current, PROCESS__FORK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003326}
3327
David Howellsf1752ee2008-11-14 10:39:17 +11003328/*
David Howellsee18d642009-09-02 09:14:21 +01003329 * allocate the SELinux part of blank credentials
3330 */
3331static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3332{
3333 struct task_security_struct *tsec;
3334
3335 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3336 if (!tsec)
3337 return -ENOMEM;
3338
3339 cred->security = tsec;
3340 return 0;
3341}
3342
3343/*
David Howellsf1752ee2008-11-14 10:39:17 +11003344 * detach and free the LSM part of a set of credentials
3345 */
3346static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003347{
David Howellsf1752ee2008-11-14 10:39:17 +11003348 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003349
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003350 /*
3351 * cred->security == NULL if security_cred_alloc_blank() or
3352 * security_prepare_creds() returned an error.
3353 */
3354 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003355 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003356 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003357}
3358
David Howellsd84f4f92008-11-14 10:39:23 +11003359/*
3360 * prepare a new set of credentials for modification
3361 */
3362static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3363 gfp_t gfp)
3364{
3365 const struct task_security_struct *old_tsec;
3366 struct task_security_struct *tsec;
3367
3368 old_tsec = old->security;
3369
3370 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3371 if (!tsec)
3372 return -ENOMEM;
3373
3374 new->security = tsec;
3375 return 0;
3376}
3377
3378/*
David Howellsee18d642009-09-02 09:14:21 +01003379 * transfer the SELinux data to a blank set of creds
3380 */
3381static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3382{
3383 const struct task_security_struct *old_tsec = old->security;
3384 struct task_security_struct *tsec = new->security;
3385
3386 *tsec = *old_tsec;
3387}
3388
3389/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003390 * set the security data for a kernel service
3391 * - all the creation contexts are set to unlabelled
3392 */
3393static int selinux_kernel_act_as(struct cred *new, u32 secid)
3394{
3395 struct task_security_struct *tsec = new->security;
3396 u32 sid = current_sid();
3397 int ret;
3398
3399 ret = avc_has_perm(sid, secid,
3400 SECCLASS_KERNEL_SERVICE,
3401 KERNEL_SERVICE__USE_AS_OVERRIDE,
3402 NULL);
3403 if (ret == 0) {
3404 tsec->sid = secid;
3405 tsec->create_sid = 0;
3406 tsec->keycreate_sid = 0;
3407 tsec->sockcreate_sid = 0;
3408 }
3409 return ret;
3410}
3411
3412/*
3413 * set the file creation context in a security record to the same as the
3414 * objective context of the specified inode
3415 */
3416static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3417{
3418 struct inode_security_struct *isec = inode->i_security;
3419 struct task_security_struct *tsec = new->security;
3420 u32 sid = current_sid();
3421 int ret;
3422
3423 ret = avc_has_perm(sid, isec->sid,
3424 SECCLASS_KERNEL_SERVICE,
3425 KERNEL_SERVICE__CREATE_FILES_AS,
3426 NULL);
3427
3428 if (ret == 0)
3429 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003430 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003431}
3432
Eric Parisdd8dbf22009-11-03 16:35:32 +11003433static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003434{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003435 u32 sid;
3436 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07003437 struct selinux_audit_data sad = {0,};
Eric Parisdd8dbf22009-11-03 16:35:32 +11003438
3439 sid = task_sid(current);
3440
3441 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
Eric Paris3b3b0e42012-04-03 09:37:02 -07003442 ad.selinux_audit_data = &sad;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003443 ad.u.kmod_name = kmod_name;
3444
3445 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3446 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003447}
3448
Linus Torvalds1da177e2005-04-16 15:20:36 -07003449static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3450{
David Howells3b11a1d2008-11-14 10:39:26 +11003451 return current_has_perm(p, PROCESS__SETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003452}
3453
3454static int selinux_task_getpgid(struct task_struct *p)
3455{
David Howells3b11a1d2008-11-14 10:39:26 +11003456 return current_has_perm(p, PROCESS__GETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003457}
3458
3459static int selinux_task_getsid(struct task_struct *p)
3460{
David Howells3b11a1d2008-11-14 10:39:26 +11003461 return current_has_perm(p, PROCESS__GETSESSION);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003462}
3463
David Quigleyf9008e42006-06-30 01:55:46 -07003464static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3465{
David Howells275bb412008-11-14 10:39:19 +11003466 *secid = task_sid(p);
David Quigleyf9008e42006-06-30 01:55:46 -07003467}
3468
Linus Torvalds1da177e2005-04-16 15:20:36 -07003469static int selinux_task_setnice(struct task_struct *p, int nice)
3470{
3471 int rc;
3472
Eric Paris200ac532009-02-12 15:01:04 -05003473 rc = cap_task_setnice(p, nice);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003474 if (rc)
3475 return rc;
3476
David Howells3b11a1d2008-11-14 10:39:26 +11003477 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003478}
3479
James Morris03e68062006-06-23 02:03:58 -07003480static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3481{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003482 int rc;
3483
Eric Paris200ac532009-02-12 15:01:04 -05003484 rc = cap_task_setioprio(p, ioprio);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003485 if (rc)
3486 return rc;
3487
David Howells3b11a1d2008-11-14 10:39:26 +11003488 return current_has_perm(p, PROCESS__SETSCHED);
James Morris03e68062006-06-23 02:03:58 -07003489}
3490
David Quigleya1836a42006-06-30 01:55:49 -07003491static int selinux_task_getioprio(struct task_struct *p)
3492{
David Howells3b11a1d2008-11-14 10:39:26 +11003493 return current_has_perm(p, PROCESS__GETSCHED);
David Quigleya1836a42006-06-30 01:55:49 -07003494}
3495
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003496static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3497 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003498{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003499 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003500
3501 /* Control the ability to change the hard limit (whether
3502 lowering or raising it), so that the hard limit can
3503 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003504 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003505 if (old_rlim->rlim_max != new_rlim->rlim_max)
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003506 return current_has_perm(p, PROCESS__SETRLIMIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003507
3508 return 0;
3509}
3510
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003511static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003512{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003513 int rc;
3514
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003515 rc = cap_task_setscheduler(p);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003516 if (rc)
3517 return rc;
3518
David Howells3b11a1d2008-11-14 10:39:26 +11003519 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003520}
3521
3522static int selinux_task_getscheduler(struct task_struct *p)
3523{
David Howells3b11a1d2008-11-14 10:39:26 +11003524 return current_has_perm(p, PROCESS__GETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003525}
3526
David Quigley35601542006-06-23 02:04:01 -07003527static int selinux_task_movememory(struct task_struct *p)
3528{
David Howells3b11a1d2008-11-14 10:39:26 +11003529 return current_has_perm(p, PROCESS__SETSCHED);
David Quigley35601542006-06-23 02:04:01 -07003530}
3531
David Quigleyf9008e42006-06-30 01:55:46 -07003532static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3533 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003534{
3535 u32 perm;
3536 int rc;
3537
Linus Torvalds1da177e2005-04-16 15:20:36 -07003538 if (!sig)
3539 perm = PROCESS__SIGNULL; /* null signal; existence test */
3540 else
3541 perm = signal_to_av(sig);
David Quigleyf9008e42006-06-30 01:55:46 -07003542 if (secid)
David Howells275bb412008-11-14 10:39:19 +11003543 rc = avc_has_perm(secid, task_sid(p),
3544 SECCLASS_PROCESS, perm, NULL);
David Quigleyf9008e42006-06-30 01:55:46 -07003545 else
David Howells3b11a1d2008-11-14 10:39:26 +11003546 rc = current_has_perm(p, perm);
David Quigleyf9008e42006-06-30 01:55:46 -07003547 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003548}
3549
Linus Torvalds1da177e2005-04-16 15:20:36 -07003550static int selinux_task_wait(struct task_struct *p)
3551{
Eric Paris8a535142007-10-22 16:10:31 -04003552 return task_has_perm(p, current, PROCESS__SIGCHLD);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003553}
3554
Linus Torvalds1da177e2005-04-16 15:20:36 -07003555static void selinux_task_to_inode(struct task_struct *p,
3556 struct inode *inode)
3557{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003558 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11003559 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003560
David Howells275bb412008-11-14 10:39:19 +11003561 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003562 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003563}
3564
Linus Torvalds1da177e2005-04-16 15:20:36 -07003565/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003566static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003567 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003568{
3569 int offset, ihlen, ret = -EINVAL;
3570 struct iphdr _iph, *ih;
3571
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003572 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003573 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3574 if (ih == NULL)
3575 goto out;
3576
3577 ihlen = ih->ihl * 4;
3578 if (ihlen < sizeof(_iph))
3579 goto out;
3580
Eric Paris48c62af2012-04-02 13:15:44 -04003581 ad->u.net->v4info.saddr = ih->saddr;
3582 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003583 ret = 0;
3584
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003585 if (proto)
3586 *proto = ih->protocol;
3587
Linus Torvalds1da177e2005-04-16 15:20:36 -07003588 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04003589 case IPPROTO_TCP: {
3590 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003591
Eric Paris828dfe12008-04-17 13:17:49 -04003592 if (ntohs(ih->frag_off) & IP_OFFSET)
3593 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003594
3595 offset += ihlen;
3596 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3597 if (th == NULL)
3598 break;
3599
Eric Paris48c62af2012-04-02 13:15:44 -04003600 ad->u.net->sport = th->source;
3601 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003602 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003603 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003604
Eric Paris828dfe12008-04-17 13:17:49 -04003605 case IPPROTO_UDP: {
3606 struct udphdr _udph, *uh;
3607
3608 if (ntohs(ih->frag_off) & IP_OFFSET)
3609 break;
3610
3611 offset += ihlen;
3612 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3613 if (uh == NULL)
3614 break;
3615
Eric Paris48c62af2012-04-02 13:15:44 -04003616 ad->u.net->sport = uh->source;
3617 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04003618 break;
3619 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003620
James Morris2ee92d42006-11-13 16:09:01 -08003621 case IPPROTO_DCCP: {
3622 struct dccp_hdr _dccph, *dh;
3623
3624 if (ntohs(ih->frag_off) & IP_OFFSET)
3625 break;
3626
3627 offset += ihlen;
3628 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3629 if (dh == NULL)
3630 break;
3631
Eric Paris48c62af2012-04-02 13:15:44 -04003632 ad->u.net->sport = dh->dccph_sport;
3633 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08003634 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003635 }
James Morris2ee92d42006-11-13 16:09:01 -08003636
Eric Paris828dfe12008-04-17 13:17:49 -04003637 default:
3638 break;
3639 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003640out:
3641 return ret;
3642}
3643
3644#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3645
3646/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003647static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003648 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003649{
3650 u8 nexthdr;
3651 int ret = -EINVAL, offset;
3652 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08003653 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003654
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003655 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003656 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3657 if (ip6 == NULL)
3658 goto out;
3659
Eric Paris48c62af2012-04-02 13:15:44 -04003660 ad->u.net->v6info.saddr = ip6->saddr;
3661 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003662 ret = 0;
3663
3664 nexthdr = ip6->nexthdr;
3665 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08003666 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003667 if (offset < 0)
3668 goto out;
3669
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003670 if (proto)
3671 *proto = nexthdr;
3672
Linus Torvalds1da177e2005-04-16 15:20:36 -07003673 switch (nexthdr) {
3674 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04003675 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003676
3677 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3678 if (th == NULL)
3679 break;
3680
Eric Paris48c62af2012-04-02 13:15:44 -04003681 ad->u.net->sport = th->source;
3682 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003683 break;
3684 }
3685
3686 case IPPROTO_UDP: {
3687 struct udphdr _udph, *uh;
3688
3689 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3690 if (uh == NULL)
3691 break;
3692
Eric Paris48c62af2012-04-02 13:15:44 -04003693 ad->u.net->sport = uh->source;
3694 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003695 break;
3696 }
3697
James Morris2ee92d42006-11-13 16:09:01 -08003698 case IPPROTO_DCCP: {
3699 struct dccp_hdr _dccph, *dh;
3700
3701 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3702 if (dh == NULL)
3703 break;
3704
Eric Paris48c62af2012-04-02 13:15:44 -04003705 ad->u.net->sport = dh->dccph_sport;
3706 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08003707 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003708 }
James Morris2ee92d42006-11-13 16:09:01 -08003709
Linus Torvalds1da177e2005-04-16 15:20:36 -07003710 /* includes fragments */
3711 default:
3712 break;
3713 }
3714out:
3715 return ret;
3716}
3717
3718#endif /* IPV6 */
3719
Thomas Liu2bf49692009-07-14 12:14:09 -04003720static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10003721 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003722{
David Howellscf9481e2008-07-27 21:31:07 +10003723 char *addrp;
3724 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003725
Eric Paris48c62af2012-04-02 13:15:44 -04003726 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003727 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003728 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003729 if (ret)
3730 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04003731 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3732 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10003733 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003734
3735#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3736 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003737 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003738 if (ret)
3739 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04003740 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3741 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10003742 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003743#endif /* IPV6 */
3744 default:
David Howellscf9481e2008-07-27 21:31:07 +10003745 addrp = NULL;
3746 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003747 }
3748
David Howellscf9481e2008-07-27 21:31:07 +10003749parse_error:
3750 printk(KERN_WARNING
3751 "SELinux: failure in selinux_parse_skb(),"
3752 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07003753 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10003754
3755okay:
3756 if (_addrp)
3757 *_addrp = addrp;
3758 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003759}
3760
Paul Moore4f6a9932007-03-01 14:35:22 -05003761/**
Paul Moore220deb92008-01-29 08:38:23 -05003762 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05003763 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05003764 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05003765 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05003766 *
3767 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05003768 * Check the various different forms of network peer labeling and determine
3769 * the peer label/SID for the packet; most of the magic actually occurs in
3770 * the security server function security_net_peersid_cmp(). The function
3771 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3772 * or -EACCES if @sid is invalid due to inconsistencies with the different
3773 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05003774 *
3775 */
Paul Moore220deb92008-01-29 08:38:23 -05003776static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05003777{
Paul Moore71f1cb02008-01-29 08:51:16 -05003778 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05003779 u32 xfrm_sid;
3780 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05003781 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05003782
3783 selinux_skb_xfrm_sid(skb, &xfrm_sid);
Paul Moore5dbe1eb2008-01-29 08:44:18 -05003784 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
Paul Moore220deb92008-01-29 08:38:23 -05003785
Paul Moore71f1cb02008-01-29 08:51:16 -05003786 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3787 if (unlikely(err)) {
3788 printk(KERN_WARNING
3789 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3790 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05003791 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05003792 }
Paul Moore220deb92008-01-29 08:38:23 -05003793
3794 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05003795}
3796
Linus Torvalds1da177e2005-04-16 15:20:36 -07003797/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04003798
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003799static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3800 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04003801{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003802 if (tsec->sockcreate_sid > SECSID_NULL) {
3803 *socksid = tsec->sockcreate_sid;
3804 return 0;
3805 }
3806
3807 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3808 socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04003809}
3810
Paul Moore253bfae2010-04-22 14:46:19 -04003811static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003812{
Paul Moore253bfae2010-04-22 14:46:19 -04003813 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04003814 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07003815 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04003816 struct lsm_network_audit net = {0,};
Paul Moore253bfae2010-04-22 14:46:19 -04003817 u32 tsid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003818
Satya Durga Srinivasu Prabhala90280652013-09-24 15:23:48 -07003819 if (unlikely(!sksec)) {
3820 pr_warn("SELinux: sksec is NULL, socket is already freed\n");
3821 return -EINVAL;
3822 }
3823
Paul Moore253bfae2010-04-22 14:46:19 -04003824 if (sksec->sid == SECINITSID_KERNEL)
3825 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003826
Thomas Liu2bf49692009-07-14 12:14:09 -04003827 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07003828 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04003829 ad.u.net = &net;
3830 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003831
Paul Moore253bfae2010-04-22 14:46:19 -04003832 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003833}
3834
3835static int selinux_socket_create(int family, int type,
3836 int protocol, int kern)
3837{
Paul Moore5fb49872010-04-22 14:46:19 -04003838 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04003839 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11003840 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003841 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003842
3843 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04003844 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003845
David Howells275bb412008-11-14 10:39:19 +11003846 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003847 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3848 if (rc)
3849 return rc;
3850
Paul Moored4f2d972010-04-22 14:46:18 -04003851 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003852}
3853
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003854static int selinux_socket_post_create(struct socket *sock, int family,
3855 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003856{
Paul Moore5fb49872010-04-22 14:46:19 -04003857 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04003858 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003859 struct sk_security_struct *sksec;
David Howells275bb412008-11-14 10:39:19 +11003860 int err = 0;
3861
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003862 isec->sclass = socket_type_to_security_class(family, type, protocol);
3863
David Howells275bb412008-11-14 10:39:19 +11003864 if (kern)
3865 isec->sid = SECINITSID_KERNEL;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003866 else {
3867 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3868 if (err)
3869 return err;
3870 }
David Howells275bb412008-11-14 10:39:19 +11003871
Linus Torvalds1da177e2005-04-16 15:20:36 -07003872 isec->initialized = 1;
3873
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003874 if (sock->sk) {
3875 sksec = sock->sk->sk_security;
3876 sksec->sid = isec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05003877 sksec->sclass = isec->sclass;
Paul Moore389fb802009-03-27 17:10:34 -04003878 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003879 }
3880
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003881 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003882}
3883
3884/* Range of port numbers used to automatically bind.
3885 Need to determine whether we should perform a name_bind
3886 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003887
3888static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3889{
Paul Moore253bfae2010-04-22 14:46:19 -04003890 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003891 u16 family;
3892 int err;
3893
Paul Moore253bfae2010-04-22 14:46:19 -04003894 err = sock_has_perm(current, sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003895 if (err)
3896 goto out;
3897
3898 /*
3899 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04003900 * Multiple address binding for SCTP is not supported yet: we just
3901 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003902 */
Paul Moore253bfae2010-04-22 14:46:19 -04003903 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003904 if (family == PF_INET || family == PF_INET6) {
3905 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04003906 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04003907 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07003908 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04003909 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07003910 struct sockaddr_in *addr4 = NULL;
3911 struct sockaddr_in6 *addr6 = NULL;
3912 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10003913 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003914
Linus Torvalds1da177e2005-04-16 15:20:36 -07003915 if (family == PF_INET) {
3916 addr4 = (struct sockaddr_in *)address;
3917 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003918 addrp = (char *)&addr4->sin_addr.s_addr;
3919 } else {
3920 addr6 = (struct sockaddr_in6 *)address;
3921 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003922 addrp = (char *)&addr6->sin6_addr.s6_addr;
3923 }
3924
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003925 if (snum) {
3926 int low, high;
3927
3928 inet_get_local_port_range(&low, &high);
3929
3930 if (snum < max(PROT_SOCK, low) || snum > high) {
Paul Moore3e112172008-04-10 10:48:14 -04003931 err = sel_netport_sid(sk->sk_protocol,
3932 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003933 if (err)
3934 goto out;
Thomas Liu2bf49692009-07-14 12:14:09 -04003935 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07003936 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04003937 ad.u.net = &net;
3938 ad.u.net->sport = htons(snum);
3939 ad.u.net->family = family;
Paul Moore253bfae2010-04-22 14:46:19 -04003940 err = avc_has_perm(sksec->sid, sid,
3941 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003942 SOCKET__NAME_BIND, &ad);
3943 if (err)
3944 goto out;
3945 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003946 }
Eric Paris828dfe12008-04-17 13:17:49 -04003947
Paul Moore253bfae2010-04-22 14:46:19 -04003948 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04003949 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003950 node_perm = TCP_SOCKET__NODE_BIND;
3951 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003952
James Morris13402582005-09-30 14:24:34 -04003953 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003954 node_perm = UDP_SOCKET__NODE_BIND;
3955 break;
James Morris2ee92d42006-11-13 16:09:01 -08003956
3957 case SECCLASS_DCCP_SOCKET:
3958 node_perm = DCCP_SOCKET__NODE_BIND;
3959 break;
3960
Linus Torvalds1da177e2005-04-16 15:20:36 -07003961 default:
3962 node_perm = RAWIP_SOCKET__NODE_BIND;
3963 break;
3964 }
Eric Paris828dfe12008-04-17 13:17:49 -04003965
Paul Moore224dfbd2008-01-29 08:38:13 -05003966 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003967 if (err)
3968 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04003969
Thomas Liu2bf49692009-07-14 12:14:09 -04003970 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07003971 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04003972 ad.u.net = &net;
3973 ad.u.net->sport = htons(snum);
3974 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003975
3976 if (family == PF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04003977 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003978 else
Eric Paris48c62af2012-04-02 13:15:44 -04003979 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003980
Paul Moore253bfae2010-04-22 14:46:19 -04003981 err = avc_has_perm(sksec->sid, sid,
3982 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003983 if (err)
3984 goto out;
3985 }
3986out:
3987 return err;
3988}
3989
3990static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3991{
Paul Moore014ab192008-10-10 10:16:33 -04003992 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04003993 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003994 int err;
3995
Paul Moore253bfae2010-04-22 14:46:19 -04003996 err = sock_has_perm(current, sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003997 if (err)
3998 return err;
3999
4000 /*
James Morris2ee92d42006-11-13 16:09:01 -08004001 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004002 */
Paul Moore253bfae2010-04-22 14:46:19 -04004003 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4004 sksec->sclass == SECCLASS_DCCP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004005 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004006 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004007 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004008 struct sockaddr_in *addr4 = NULL;
4009 struct sockaddr_in6 *addr6 = NULL;
4010 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004011 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004012
4013 if (sk->sk_family == PF_INET) {
4014 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004015 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004016 return -EINVAL;
4017 snum = ntohs(addr4->sin_port);
4018 } else {
4019 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004020 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004021 return -EINVAL;
4022 snum = ntohs(addr6->sin6_port);
4023 }
4024
Paul Moore3e112172008-04-10 10:48:14 -04004025 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004026 if (err)
4027 goto out;
4028
Paul Moore253bfae2010-04-22 14:46:19 -04004029 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
James Morris2ee92d42006-11-13 16:09:01 -08004030 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4031
Thomas Liu2bf49692009-07-14 12:14:09 -04004032 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004033 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004034 ad.u.net = &net;
4035 ad.u.net->dport = htons(snum);
4036 ad.u.net->family = sk->sk_family;
Paul Moore253bfae2010-04-22 14:46:19 -04004037 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004038 if (err)
4039 goto out;
4040 }
4041
Paul Moore014ab192008-10-10 10:16:33 -04004042 err = selinux_netlbl_socket_connect(sk, address);
4043
Linus Torvalds1da177e2005-04-16 15:20:36 -07004044out:
4045 return err;
4046}
4047
4048static int selinux_socket_listen(struct socket *sock, int backlog)
4049{
Paul Moore253bfae2010-04-22 14:46:19 -04004050 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004051}
4052
4053static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4054{
4055 int err;
4056 struct inode_security_struct *isec;
4057 struct inode_security_struct *newisec;
4058
Paul Moore253bfae2010-04-22 14:46:19 -04004059 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004060 if (err)
4061 return err;
4062
4063 newisec = SOCK_INODE(newsock)->i_security;
4064
4065 isec = SOCK_INODE(sock)->i_security;
4066 newisec->sclass = isec->sclass;
4067 newisec->sid = isec->sid;
4068 newisec->initialized = 1;
4069
4070 return 0;
4071}
4072
4073static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004074 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004075{
Paul Moore253bfae2010-04-22 14:46:19 -04004076 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004077}
4078
4079static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4080 int size, int flags)
4081{
Paul Moore253bfae2010-04-22 14:46:19 -04004082 return sock_has_perm(current, sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004083}
4084
4085static int selinux_socket_getsockname(struct socket *sock)
4086{
Paul Moore253bfae2010-04-22 14:46:19 -04004087 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004088}
4089
4090static int selinux_socket_getpeername(struct socket *sock)
4091{
Paul Moore253bfae2010-04-22 14:46:19 -04004092 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004093}
4094
Eric Paris828dfe12008-04-17 13:17:49 -04004095static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004096{
Paul Mooref8687af2006-10-30 15:22:15 -08004097 int err;
4098
Paul Moore253bfae2010-04-22 14:46:19 -04004099 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004100 if (err)
4101 return err;
4102
4103 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004104}
4105
4106static int selinux_socket_getsockopt(struct socket *sock, int level,
4107 int optname)
4108{
Paul Moore253bfae2010-04-22 14:46:19 -04004109 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004110}
4111
4112static int selinux_socket_shutdown(struct socket *sock, int how)
4113{
Paul Moore253bfae2010-04-22 14:46:19 -04004114 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004115}
4116
David S. Miller3610cda2011-01-05 15:38:53 -08004117static int selinux_socket_unix_stream_connect(struct sock *sock,
4118 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004119 struct sock *newsk)
4120{
David S. Miller3610cda2011-01-05 15:38:53 -08004121 struct sk_security_struct *sksec_sock = sock->sk_security;
4122 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004123 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004124 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004125 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004126 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004127 int err;
4128
Thomas Liu2bf49692009-07-14 12:14:09 -04004129 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004130 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004131 ad.u.net = &net;
4132 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004133
Paul Moore4d1e2452010-04-22 14:46:18 -04004134 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4135 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004136 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4137 if (err)
4138 return err;
4139
Linus Torvalds1da177e2005-04-16 15:20:36 -07004140 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004141 sksec_new->peer_sid = sksec_sock->sid;
4142 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4143 &sksec_new->sid);
4144 if (err)
4145 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004146
Paul Moore4d1e2452010-04-22 14:46:18 -04004147 /* connecting socket */
4148 sksec_sock->peer_sid = sksec_new->sid;
4149
4150 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004151}
4152
4153static int selinux_socket_unix_may_send(struct socket *sock,
4154 struct socket *other)
4155{
Paul Moore253bfae2010-04-22 14:46:19 -04004156 struct sk_security_struct *ssec = sock->sk->sk_security;
4157 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004158 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004159 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004160 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004161
Thomas Liu2bf49692009-07-14 12:14:09 -04004162 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004163 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004164 ad.u.net = &net;
4165 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004166
Paul Moore253bfae2010-04-22 14:46:19 -04004167 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4168 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004169}
4170
Paul Mooreeffad8d2008-01-29 08:49:27 -05004171static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4172 u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004173 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004174{
4175 int err;
4176 u32 if_sid;
4177 u32 node_sid;
4178
4179 err = sel_netif_sid(ifindex, &if_sid);
4180 if (err)
4181 return err;
4182 err = avc_has_perm(peer_sid, if_sid,
4183 SECCLASS_NETIF, NETIF__INGRESS, ad);
4184 if (err)
4185 return err;
4186
4187 err = sel_netnode_sid(addrp, family, &node_sid);
4188 if (err)
4189 return err;
4190 return avc_has_perm(peer_sid, node_sid,
4191 SECCLASS_NODE, NODE__RECVFROM, ad);
4192}
4193
Paul Moore220deb92008-01-29 08:38:23 -05004194static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004195 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004196{
Paul Moore277d3422008-12-31 12:54:11 -05004197 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004198 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004199 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004200 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004201 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004202 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004203 char *addrp;
4204
Thomas Liu2bf49692009-07-14 12:14:09 -04004205 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004206 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004207 ad.u.net = &net;
4208 ad.u.net->netif = skb->skb_iif;
4209 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004210 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4211 if (err)
4212 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004213
Paul Moore58bfbb52009-03-27 17:10:41 -04004214 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004215 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004216 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004217 if (err)
4218 return err;
4219 }
Paul Moore220deb92008-01-29 08:38:23 -05004220
Steffen Klassertb9679a72011-02-23 12:55:21 +01004221 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4222 if (err)
4223 return err;
4224 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004225
James Morris4e5ab4c2006-06-09 00:33:33 -07004226 return err;
4227}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004228
James Morris4e5ab4c2006-06-09 00:33:33 -07004229static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4230{
Paul Moore220deb92008-01-29 08:38:23 -05004231 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004232 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004233 u16 family = sk->sk_family;
4234 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004235 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004236 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004237 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004238 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004239 u8 secmark_active;
4240 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004241
James Morris4e5ab4c2006-06-09 00:33:33 -07004242 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004243 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004244
4245 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004246 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004247 family = PF_INET;
4248
Paul Moored8395c82008-10-10 10:16:30 -04004249 /* If any sort of compatibility mode is enabled then handoff processing
4250 * to the selinux_sock_rcv_skb_compat() function to deal with the
4251 * special handling. We do this in an attempt to keep this function
4252 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004253 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004254 return selinux_sock_rcv_skb_compat(sk, skb, family);
4255
4256 secmark_active = selinux_secmark_enabled();
4257 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4258 if (!secmark_active && !peerlbl_active)
4259 return 0;
4260
Thomas Liu2bf49692009-07-14 12:14:09 -04004261 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004262 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004263 ad.u.net = &net;
4264 ad.u.net->netif = skb->skb_iif;
4265 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004266 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004267 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004268 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004269
Paul Moored8395c82008-10-10 10:16:30 -04004270 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004271 u32 peer_sid;
4272
4273 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4274 if (err)
4275 return err;
Eric Dumazet8964be42009-11-20 15:35:04 -08004276 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004277 peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004278 if (err) {
4279 selinux_netlbl_err(skb, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004280 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004281 }
Paul Moored621d352008-01-29 08:43:36 -05004282 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4283 PEER__RECV, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004284 if (err)
4285 selinux_netlbl_err(skb, err, 0);
Paul Moored621d352008-01-29 08:43:36 -05004286 }
4287
Paul Moored8395c82008-10-10 10:16:30 -04004288 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004289 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4290 PACKET__RECV, &ad);
4291 if (err)
4292 return err;
4293 }
4294
Paul Moored621d352008-01-29 08:43:36 -05004295 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004296}
4297
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004298static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4299 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004300{
4301 int err = 0;
4302 char *scontext;
4303 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004304 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004305 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004306
Paul Moore253bfae2010-04-22 14:46:19 -04004307 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4308 sksec->sclass == SECCLASS_TCP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004309 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004310 if (peer_sid == SECSID_NULL)
4311 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004312
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004313 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004314 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004315 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004316
4317 if (scontext_len > len) {
4318 err = -ERANGE;
4319 goto out_len;
4320 }
4321
4322 if (copy_to_user(optval, scontext, scontext_len))
4323 err = -EFAULT;
4324
4325out_len:
4326 if (put_user(scontext_len, optlen))
4327 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004328 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004329 return err;
4330}
4331
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004332static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004333{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004334 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004335 u16 family;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004336
Paul Mooreaa862902008-10-10 10:16:29 -04004337 if (skb && skb->protocol == htons(ETH_P_IP))
4338 family = PF_INET;
4339 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4340 family = PF_INET6;
4341 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004342 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004343 else
4344 goto out;
4345
4346 if (sock && family == PF_UNIX)
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02004347 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
Paul Moore3de4bab2006-11-17 17:38:54 -05004348 else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004349 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004350
Paul Moore75e22912008-01-29 08:38:04 -05004351out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004352 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004353 if (peer_secid == SECSID_NULL)
4354 return -EINVAL;
4355 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004356}
4357
Al Viro7d877f32005-10-21 03:20:43 -04004358static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004359{
Paul Moore84914b72010-04-22 14:46:18 -04004360 struct sk_security_struct *sksec;
4361
4362 sksec = kzalloc(sizeof(*sksec), priority);
4363 if (!sksec)
4364 return -ENOMEM;
4365
4366 sksec->peer_sid = SECINITSID_UNLABELED;
4367 sksec->sid = SECINITSID_UNLABELED;
4368 selinux_netlbl_sk_security_reset(sksec);
4369 sk->sk_security = sksec;
4370
4371 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004372}
4373
4374static void selinux_sk_free_security(struct sock *sk)
4375{
Paul Moore84914b72010-04-22 14:46:18 -04004376 struct sk_security_struct *sksec = sk->sk_security;
4377
4378 sk->sk_security = NULL;
4379 selinux_netlbl_sk_security_free(sksec);
4380 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004381}
4382
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004383static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4384{
Eric Parisdd3e7832010-04-07 15:08:46 -04004385 struct sk_security_struct *sksec = sk->sk_security;
4386 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004387
Eric Parisdd3e7832010-04-07 15:08:46 -04004388 newsksec->sid = sksec->sid;
4389 newsksec->peer_sid = sksec->peer_sid;
4390 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004391
Eric Parisdd3e7832010-04-07 15:08:46 -04004392 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004393}
4394
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004395static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004396{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004397 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004398 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004399 else {
4400 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004401
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004402 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004403 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004404}
4405
Eric Paris828dfe12008-04-17 13:17:49 -04004406static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004407{
4408 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4409 struct sk_security_struct *sksec = sk->sk_security;
4410
David Woodhouse2148ccc2006-09-29 15:50:25 -07004411 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4412 sk->sk_family == PF_UNIX)
4413 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004414 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004415}
4416
Adrian Bunk9a673e52006-08-15 00:03:53 -07004417static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4418 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004419{
4420 struct sk_security_struct *sksec = sk->sk_security;
4421 int err;
Paul Mooreaa862902008-10-10 10:16:29 -04004422 u16 family = sk->sk_family;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004423 u32 newsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004424 u32 peersid;
4425
Paul Mooreaa862902008-10-10 10:16:29 -04004426 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4427 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4428 family = PF_INET;
4429
4430 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004431 if (err)
4432 return err;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004433 if (peersid == SECSID_NULL) {
4434 req->secid = sksec->sid;
Paul Moore3de4bab2006-11-17 17:38:54 -05004435 req->peer_secid = SECSID_NULL;
Paul Moore389fb802009-03-27 17:10:34 -04004436 } else {
4437 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4438 if (err)
4439 return err;
4440 req->secid = newsid;
4441 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004442 }
4443
Paul Moore389fb802009-03-27 17:10:34 -04004444 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004445}
4446
Adrian Bunk9a673e52006-08-15 00:03:53 -07004447static void selinux_inet_csk_clone(struct sock *newsk,
4448 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004449{
4450 struct sk_security_struct *newsksec = newsk->sk_security;
4451
4452 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004453 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004454 /* NOTE: Ideally, we should also get the isec->sid for the
4455 new socket in sync, but we don't have the isec available yet.
4456 So we will wait until sock_graft to do it, by which
4457 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004458
Paul Moore9f2ad662006-11-17 17:38:53 -05004459 /* We don't need to take any sort of lock here as we are the only
4460 * thread with access to newsksec */
Paul Moore389fb802009-03-27 17:10:34 -04004461 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004462}
4463
Paul Moore014ab192008-10-10 10:16:33 -04004464static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004465{
Paul Mooreaa862902008-10-10 10:16:29 -04004466 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004467 struct sk_security_struct *sksec = sk->sk_security;
4468
Paul Mooreaa862902008-10-10 10:16:29 -04004469 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4470 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4471 family = PF_INET;
4472
4473 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004474}
4475
Eric Paris2606fd12010-10-13 16:24:41 -04004476static int selinux_secmark_relabel_packet(u32 sid)
4477{
4478 const struct task_security_struct *__tsec;
4479 u32 tsid;
4480
4481 __tsec = current_security();
4482 tsid = __tsec->sid;
4483
4484 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4485}
4486
4487static void selinux_secmark_refcount_inc(void)
4488{
4489 atomic_inc(&selinux_secmark_refcount);
4490}
4491
4492static void selinux_secmark_refcount_dec(void)
4493{
4494 atomic_dec(&selinux_secmark_refcount);
4495}
4496
Adrian Bunk9a673e52006-08-15 00:03:53 -07004497static void selinux_req_classify_flow(const struct request_sock *req,
4498 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004499{
David S. Miller1d28f422011-03-12 00:29:39 -05004500 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004501}
4502
Paul Mooreed6d76e2009-08-28 18:12:49 -04004503static int selinux_tun_dev_create(void)
4504{
4505 u32 sid = current_sid();
4506
4507 /* we aren't taking into account the "sockcreate" SID since the socket
4508 * that is being created here is not a socket in the traditional sense,
4509 * instead it is a private sock, accessible only to the kernel, and
4510 * representing a wide range of network traffic spanning multiple
4511 * connections unlike traditional sockets - check the TUN driver to
4512 * get a better understanding of why this socket is special */
4513
4514 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4515 NULL);
4516}
4517
4518static void selinux_tun_dev_post_create(struct sock *sk)
4519{
4520 struct sk_security_struct *sksec = sk->sk_security;
4521
4522 /* we don't currently perform any NetLabel based labeling here and it
4523 * isn't clear that we would want to do so anyway; while we could apply
4524 * labeling without the support of the TUN user the resulting labeled
4525 * traffic from the other end of the connection would almost certainly
4526 * cause confusion to the TUN user that had no idea network labeling
4527 * protocols were being used */
4528
4529 /* see the comments in selinux_tun_dev_create() about why we don't use
4530 * the sockcreate SID here */
4531
4532 sksec->sid = current_sid();
4533 sksec->sclass = SECCLASS_TUN_SOCKET;
4534}
4535
4536static int selinux_tun_dev_attach(struct sock *sk)
4537{
4538 struct sk_security_struct *sksec = sk->sk_security;
4539 u32 sid = current_sid();
4540 int err;
4541
4542 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4543 TUN_SOCKET__RELABELFROM, NULL);
4544 if (err)
4545 return err;
4546 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4547 TUN_SOCKET__RELABELTO, NULL);
4548 if (err)
4549 return err;
4550
4551 sksec->sid = sid;
4552
4553 return 0;
4554}
4555
Linus Torvalds1da177e2005-04-16 15:20:36 -07004556static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4557{
4558 int err = 0;
4559 u32 perm;
4560 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04004561 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04004562
Linus Torvalds1da177e2005-04-16 15:20:36 -07004563 if (skb->len < NLMSG_SPACE(0)) {
4564 err = -EINVAL;
4565 goto out;
4566 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07004567 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04004568
Paul Moore253bfae2010-04-22 14:46:19 -04004569 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004570 if (err) {
4571 if (err == -EINVAL) {
David Woodhouse9ad9ad32005-06-22 15:04:33 +01004572 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004573 "SELinux: unrecognized netlink message"
4574 " type=%hu for sclass=%hu\n",
Paul Moore253bfae2010-04-22 14:46:19 -04004575 nlh->nlmsg_type, sksec->sclass);
Eric Paris39c9aed2008-11-05 09:34:42 -05004576 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07004577 err = 0;
4578 }
4579
4580 /* Ignore */
4581 if (err == -ENOENT)
4582 err = 0;
4583 goto out;
4584 }
4585
Paul Moore253bfae2010-04-22 14:46:19 -04004586 err = sock_has_perm(current, sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004587out:
4588 return err;
4589}
4590
4591#ifdef CONFIG_NETFILTER
4592
Paul Mooreeffad8d2008-01-29 08:49:27 -05004593static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4594 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004595{
Paul Mooredfaebe92008-10-10 10:16:31 -04004596 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004597 char *addrp;
4598 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004599 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004600 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004601 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05004602 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04004603 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004604 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004605
Paul Mooreeffad8d2008-01-29 08:49:27 -05004606 if (!selinux_policycap_netpeer)
4607 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004608
Paul Mooreeffad8d2008-01-29 08:49:27 -05004609 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04004610 netlbl_active = netlbl_enabled();
4611 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05004612 if (!secmark_active && !peerlbl_active)
4613 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004614
Paul Moored8395c82008-10-10 10:16:30 -04004615 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4616 return NF_DROP;
4617
Thomas Liu2bf49692009-07-14 12:14:09 -04004618 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004619 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004620 ad.u.net = &net;
4621 ad.u.net->netif = ifindex;
4622 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004623 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4624 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004625
Paul Mooredfaebe92008-10-10 10:16:31 -04004626 if (peerlbl_active) {
4627 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4628 peer_sid, &ad);
4629 if (err) {
4630 selinux_netlbl_err(skb, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004631 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04004632 }
4633 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05004634
4635 if (secmark_active)
4636 if (avc_has_perm(peer_sid, skb->secmark,
4637 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4638 return NF_DROP;
4639
Paul Moore948bf852008-10-10 10:16:32 -04004640 if (netlbl_active)
4641 /* we do this in the FORWARD path and not the POST_ROUTING
4642 * path because we want to make sure we apply the necessary
4643 * labeling before IPsec is applied so we can leverage AH
4644 * protection */
4645 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4646 return NF_DROP;
4647
Paul Mooreeffad8d2008-01-29 08:49:27 -05004648 return NF_ACCEPT;
4649}
4650
4651static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4652 struct sk_buff *skb,
4653 const struct net_device *in,
4654 const struct net_device *out,
4655 int (*okfn)(struct sk_buff *))
4656{
4657 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4658}
4659
4660#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4661static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4662 struct sk_buff *skb,
4663 const struct net_device *in,
4664 const struct net_device *out,
4665 int (*okfn)(struct sk_buff *))
4666{
4667 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4668}
4669#endif /* IPV6 */
4670
Paul Moore948bf852008-10-10 10:16:32 -04004671static unsigned int selinux_ip_output(struct sk_buff *skb,
4672 u16 family)
4673{
4674 u32 sid;
4675
4676 if (!netlbl_enabled())
4677 return NF_ACCEPT;
4678
4679 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4680 * because we want to make sure we apply the necessary labeling
4681 * before IPsec is applied so we can leverage AH protection */
4682 if (skb->sk) {
4683 struct sk_security_struct *sksec = skb->sk->sk_security;
4684 sid = sksec->sid;
4685 } else
4686 sid = SECINITSID_KERNEL;
4687 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4688 return NF_DROP;
4689
4690 return NF_ACCEPT;
4691}
4692
4693static unsigned int selinux_ipv4_output(unsigned int hooknum,
4694 struct sk_buff *skb,
4695 const struct net_device *in,
4696 const struct net_device *out,
4697 int (*okfn)(struct sk_buff *))
4698{
4699 return selinux_ip_output(skb, PF_INET);
4700}
4701
Paul Mooreeffad8d2008-01-29 08:49:27 -05004702static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4703 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04004704 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07004705{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004706 struct sock *sk = skb->sk;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004707 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004708 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004709 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004710 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004711 char *addrp;
4712 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07004713
Paul Mooreeffad8d2008-01-29 08:49:27 -05004714 if (sk == NULL)
4715 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004716 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07004717
Thomas Liu2bf49692009-07-14 12:14:09 -04004718 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004719 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004720 ad.u.net = &net;
4721 ad.u.net->netif = ifindex;
4722 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004723 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4724 return NF_DROP;
4725
Paul Moore58bfbb52009-03-27 17:10:41 -04004726 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05004727 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04004728 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00004729 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07004730
Steffen Klassertb9679a72011-02-23 12:55:21 +01004731 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4732 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07004733
Paul Mooreeffad8d2008-01-29 08:49:27 -05004734 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004735}
4736
Paul Mooreeffad8d2008-01-29 08:49:27 -05004737static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4738 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004739{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004740 u32 secmark_perm;
4741 u32 peer_sid;
4742 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04004743 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004744 struct selinux_audit_data sad = {0,};
Eric Paris48c62af2012-04-02 13:15:44 -04004745 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05004746 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004747 u8 secmark_active;
4748 u8 peerlbl_active;
4749
Paul Mooreeffad8d2008-01-29 08:49:27 -05004750 /* If any sort of compatibility mode is enabled then handoff processing
4751 * to the selinux_ip_postroute_compat() function to deal with the
4752 * special handling. We do this in an attempt to keep this function
4753 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004754 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004755 return selinux_ip_postroute_compat(skb, ifindex, family);
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004756#ifdef CONFIG_XFRM
Paul Mooreeffad8d2008-01-29 08:49:27 -05004757 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4758 * packet transformation so allow the packet to pass without any checks
4759 * since we'll have another chance to perform access control checks
4760 * when the packet is on it's final way out.
4761 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4762 * is NULL, in this case go ahead and apply access control. */
Eric Dumazetadf30902009-06-02 05:19:30 +00004763 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004764 return NF_ACCEPT;
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004765#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05004766 secmark_active = selinux_secmark_enabled();
4767 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4768 if (!secmark_active && !peerlbl_active)
4769 return NF_ACCEPT;
4770
Paul Moored8395c82008-10-10 10:16:30 -04004771 /* if the packet is being forwarded then get the peer label from the
4772 * packet itself; otherwise check to see if it is from a local
4773 * application or the kernel, if from an application get the peer label
4774 * from the sending socket, otherwise use the kernel's sid */
Paul Mooreeffad8d2008-01-29 08:49:27 -05004775 sk = skb->sk;
Paul Moored8395c82008-10-10 10:16:30 -04004776 if (sk == NULL) {
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004777 if (skb->skb_iif) {
4778 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04004779 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004780 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004781 } else {
4782 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04004783 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004784 }
Paul Moored8395c82008-10-10 10:16:30 -04004785 } else {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004786 struct sk_security_struct *sksec = sk->sk_security;
4787 peer_sid = sksec->sid;
4788 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004789 }
4790
Thomas Liu2bf49692009-07-14 12:14:09 -04004791 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004792 ad.selinux_audit_data = &sad;
Eric Paris48c62af2012-04-02 13:15:44 -04004793 ad.u.net = &net;
4794 ad.u.net->netif = ifindex;
4795 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004796 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00004797 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04004798
Paul Mooreeffad8d2008-01-29 08:49:27 -05004799 if (secmark_active)
4800 if (avc_has_perm(peer_sid, skb->secmark,
4801 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004802 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004803
4804 if (peerlbl_active) {
4805 u32 if_sid;
4806 u32 node_sid;
4807
4808 if (sel_netif_sid(ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004809 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004810 if (avc_has_perm(peer_sid, if_sid,
4811 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004812 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004813
4814 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004815 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004816 if (avc_has_perm(peer_sid, node_sid,
4817 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004818 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004819 }
4820
4821 return NF_ACCEPT;
4822}
4823
4824static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4825 struct sk_buff *skb,
4826 const struct net_device *in,
4827 const struct net_device *out,
4828 int (*okfn)(struct sk_buff *))
4829{
4830 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004831}
4832
4833#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004834static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4835 struct sk_buff *skb,
4836 const struct net_device *in,
4837 const struct net_device *out,
4838 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004839{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004840 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004841}
Linus Torvalds1da177e2005-04-16 15:20:36 -07004842#endif /* IPV6 */
4843
4844#endif /* CONFIG_NETFILTER */
4845
Linus Torvalds1da177e2005-04-16 15:20:36 -07004846static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4847{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004848 int err;
4849
Eric Paris200ac532009-02-12 15:01:04 -05004850 err = cap_netlink_send(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004851 if (err)
4852 return err;
4853
Stephen Smalley941fc5b2009-10-01 14:48:23 -04004854 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004855}
4856
Linus Torvalds1da177e2005-04-16 15:20:36 -07004857static int ipc_alloc_security(struct task_struct *task,
4858 struct kern_ipc_perm *perm,
4859 u16 sclass)
4860{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004861 struct ipc_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11004862 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004863
James Morris89d155e2005-10-30 14:59:21 -08004864 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004865 if (!isec)
4866 return -ENOMEM;
4867
David Howells275bb412008-11-14 10:39:19 +11004868 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004869 isec->sclass = sclass;
David Howells275bb412008-11-14 10:39:19 +11004870 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004871 perm->security = isec;
4872
4873 return 0;
4874}
4875
4876static void ipc_free_security(struct kern_ipc_perm *perm)
4877{
4878 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004879 perm->security = NULL;
4880 kfree(isec);
4881}
4882
4883static int msg_msg_alloc_security(struct msg_msg *msg)
4884{
4885 struct msg_security_struct *msec;
4886
James Morris89d155e2005-10-30 14:59:21 -08004887 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004888 if (!msec)
4889 return -ENOMEM;
4890
Linus Torvalds1da177e2005-04-16 15:20:36 -07004891 msec->sid = SECINITSID_UNLABELED;
4892 msg->security = msec;
4893
4894 return 0;
4895}
4896
4897static void msg_msg_free_security(struct msg_msg *msg)
4898{
4899 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004900
4901 msg->security = NULL;
4902 kfree(msec);
4903}
4904
4905static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07004906 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004907{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004908 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004909 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004910 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11004911 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004912
Linus Torvalds1da177e2005-04-16 15:20:36 -07004913 isec = ipc_perms->security;
4914
Thomas Liu2bf49692009-07-14 12:14:09 -04004915 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004916 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004917 ad.u.ipc_id = ipc_perms->key;
4918
David Howells275bb412008-11-14 10:39:19 +11004919 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004920}
4921
4922static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4923{
4924 return msg_msg_alloc_security(msg);
4925}
4926
4927static void selinux_msg_msg_free_security(struct msg_msg *msg)
4928{
4929 msg_msg_free_security(msg);
4930}
4931
4932/* message queue security operations */
4933static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4934{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004935 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004936 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004937 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11004938 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004939 int rc;
4940
4941 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4942 if (rc)
4943 return rc;
4944
Linus Torvalds1da177e2005-04-16 15:20:36 -07004945 isec = msq->q_perm.security;
4946
Thomas Liu2bf49692009-07-14 12:14:09 -04004947 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004948 ad.selinux_audit_data = &sad;
Eric Paris828dfe12008-04-17 13:17:49 -04004949 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004950
David Howells275bb412008-11-14 10:39:19 +11004951 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004952 MSGQ__CREATE, &ad);
4953 if (rc) {
4954 ipc_free_security(&msq->q_perm);
4955 return rc;
4956 }
4957 return 0;
4958}
4959
4960static void selinux_msg_queue_free_security(struct msg_queue *msq)
4961{
4962 ipc_free_security(&msq->q_perm);
4963}
4964
4965static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4966{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004967 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004968 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07004969 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11004970 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004971
Linus Torvalds1da177e2005-04-16 15:20:36 -07004972 isec = msq->q_perm.security;
4973
Thomas Liu2bf49692009-07-14 12:14:09 -04004974 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07004975 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004976 ad.u.ipc_id = msq->q_perm.key;
4977
David Howells275bb412008-11-14 10:39:19 +11004978 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004979 MSGQ__ASSOCIATE, &ad);
4980}
4981
4982static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4983{
4984 int err;
4985 int perms;
4986
Eric Paris828dfe12008-04-17 13:17:49 -04004987 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004988 case IPC_INFO:
4989 case MSG_INFO:
4990 /* No specific object, just general system-wide information. */
4991 return task_has_system(current, SYSTEM__IPC_INFO);
4992 case IPC_STAT:
4993 case MSG_STAT:
4994 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4995 break;
4996 case IPC_SET:
4997 perms = MSGQ__SETATTR;
4998 break;
4999 case IPC_RMID:
5000 perms = MSGQ__DESTROY;
5001 break;
5002 default:
5003 return 0;
5004 }
5005
Stephen Smalley6af963f2005-05-01 08:58:39 -07005006 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005007 return err;
5008}
5009
5010static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5011{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005012 struct ipc_security_struct *isec;
5013 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005014 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07005015 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11005016 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005017 int rc;
5018
Linus Torvalds1da177e2005-04-16 15:20:36 -07005019 isec = msq->q_perm.security;
5020 msec = msg->security;
5021
5022 /*
5023 * First time through, need to assign label to the message
5024 */
5025 if (msec->sid == SECINITSID_UNLABELED) {
5026 /*
5027 * Compute new sid based on current process and
5028 * message queue this message will be stored in
5029 */
David Howells275bb412008-11-14 10:39:19 +11005030 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Eric Paris652bb9b2011-02-01 11:05:40 -05005031 NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005032 if (rc)
5033 return rc;
5034 }
5035
Thomas Liu2bf49692009-07-14 12:14:09 -04005036 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07005037 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005038 ad.u.ipc_id = msq->q_perm.key;
5039
5040 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11005041 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005042 MSGQ__WRITE, &ad);
5043 if (!rc)
5044 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11005045 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5046 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005047 if (!rc)
5048 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11005049 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5050 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005051
5052 return rc;
5053}
5054
5055static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5056 struct task_struct *target,
5057 long type, int mode)
5058{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005059 struct ipc_security_struct *isec;
5060 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005061 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07005062 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11005063 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005064 int rc;
5065
Linus Torvalds1da177e2005-04-16 15:20:36 -07005066 isec = msq->q_perm.security;
5067 msec = msg->security;
5068
Thomas Liu2bf49692009-07-14 12:14:09 -04005069 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07005070 ad.selinux_audit_data = &sad;
Eric Paris828dfe12008-04-17 13:17:49 -04005071 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005072
David Howells275bb412008-11-14 10:39:19 +11005073 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005074 SECCLASS_MSGQ, MSGQ__READ, &ad);
5075 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11005076 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005077 SECCLASS_MSG, MSG__RECEIVE, &ad);
5078 return rc;
5079}
5080
5081/* Shared Memory security operations */
5082static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5083{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005084 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005085 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07005086 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11005087 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005088 int rc;
5089
5090 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5091 if (rc)
5092 return rc;
5093
Linus Torvalds1da177e2005-04-16 15:20:36 -07005094 isec = shp->shm_perm.security;
5095
Thomas Liu2bf49692009-07-14 12:14:09 -04005096 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07005097 ad.selinux_audit_data = &sad;
Eric Paris828dfe12008-04-17 13:17:49 -04005098 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005099
David Howells275bb412008-11-14 10:39:19 +11005100 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005101 SHM__CREATE, &ad);
5102 if (rc) {
5103 ipc_free_security(&shp->shm_perm);
5104 return rc;
5105 }
5106 return 0;
5107}
5108
5109static void selinux_shm_free_security(struct shmid_kernel *shp)
5110{
5111 ipc_free_security(&shp->shm_perm);
5112}
5113
5114static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5115{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005116 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005117 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07005118 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11005119 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005120
Linus Torvalds1da177e2005-04-16 15:20:36 -07005121 isec = shp->shm_perm.security;
5122
Thomas Liu2bf49692009-07-14 12:14:09 -04005123 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07005124 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005125 ad.u.ipc_id = shp->shm_perm.key;
5126
David Howells275bb412008-11-14 10:39:19 +11005127 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005128 SHM__ASSOCIATE, &ad);
5129}
5130
5131/* Note, at this point, shp is locked down */
5132static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5133{
5134 int perms;
5135 int err;
5136
Eric Paris828dfe12008-04-17 13:17:49 -04005137 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005138 case IPC_INFO:
5139 case SHM_INFO:
5140 /* No specific object, just general system-wide information. */
5141 return task_has_system(current, SYSTEM__IPC_INFO);
5142 case IPC_STAT:
5143 case SHM_STAT:
5144 perms = SHM__GETATTR | SHM__ASSOCIATE;
5145 break;
5146 case IPC_SET:
5147 perms = SHM__SETATTR;
5148 break;
5149 case SHM_LOCK:
5150 case SHM_UNLOCK:
5151 perms = SHM__LOCK;
5152 break;
5153 case IPC_RMID:
5154 perms = SHM__DESTROY;
5155 break;
5156 default:
5157 return 0;
5158 }
5159
Stephen Smalley6af963f2005-05-01 08:58:39 -07005160 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005161 return err;
5162}
5163
5164static int selinux_shm_shmat(struct shmid_kernel *shp,
5165 char __user *shmaddr, int shmflg)
5166{
5167 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005168
5169 if (shmflg & SHM_RDONLY)
5170 perms = SHM__READ;
5171 else
5172 perms = SHM__READ | SHM__WRITE;
5173
Stephen Smalley6af963f2005-05-01 08:58:39 -07005174 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005175}
5176
5177/* Semaphore security operations */
5178static int selinux_sem_alloc_security(struct sem_array *sma)
5179{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005180 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005181 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07005182 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11005183 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005184 int rc;
5185
5186 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5187 if (rc)
5188 return rc;
5189
Linus Torvalds1da177e2005-04-16 15:20:36 -07005190 isec = sma->sem_perm.security;
5191
Thomas Liu2bf49692009-07-14 12:14:09 -04005192 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07005193 ad.selinux_audit_data = &sad;
Eric Paris828dfe12008-04-17 13:17:49 -04005194 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005195
David Howells275bb412008-11-14 10:39:19 +11005196 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005197 SEM__CREATE, &ad);
5198 if (rc) {
5199 ipc_free_security(&sma->sem_perm);
5200 return rc;
5201 }
5202 return 0;
5203}
5204
5205static void selinux_sem_free_security(struct sem_array *sma)
5206{
5207 ipc_free_security(&sma->sem_perm);
5208}
5209
5210static int selinux_sem_associate(struct sem_array *sma, int semflg)
5211{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005212 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005213 struct common_audit_data ad;
Eric Paris3b3b0e42012-04-03 09:37:02 -07005214 struct selinux_audit_data sad = {0,};
David Howells275bb412008-11-14 10:39:19 +11005215 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005216
Linus Torvalds1da177e2005-04-16 15:20:36 -07005217 isec = sma->sem_perm.security;
5218
Thomas Liu2bf49692009-07-14 12:14:09 -04005219 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris3b3b0e42012-04-03 09:37:02 -07005220 ad.selinux_audit_data = &sad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005221 ad.u.ipc_id = sma->sem_perm.key;
5222
David Howells275bb412008-11-14 10:39:19 +11005223 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005224 SEM__ASSOCIATE, &ad);
5225}
5226
5227/* Note, at this point, sma is locked down */
5228static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5229{
5230 int err;
5231 u32 perms;
5232
Eric Paris828dfe12008-04-17 13:17:49 -04005233 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005234 case IPC_INFO:
5235 case SEM_INFO:
5236 /* No specific object, just general system-wide information. */
5237 return task_has_system(current, SYSTEM__IPC_INFO);
5238 case GETPID:
5239 case GETNCNT:
5240 case GETZCNT:
5241 perms = SEM__GETATTR;
5242 break;
5243 case GETVAL:
5244 case GETALL:
5245 perms = SEM__READ;
5246 break;
5247 case SETVAL:
5248 case SETALL:
5249 perms = SEM__WRITE;
5250 break;
5251 case IPC_RMID:
5252 perms = SEM__DESTROY;
5253 break;
5254 case IPC_SET:
5255 perms = SEM__SETATTR;
5256 break;
5257 case IPC_STAT:
5258 case SEM_STAT:
5259 perms = SEM__GETATTR | SEM__ASSOCIATE;
5260 break;
5261 default:
5262 return 0;
5263 }
5264
Stephen Smalley6af963f2005-05-01 08:58:39 -07005265 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005266 return err;
5267}
5268
5269static int selinux_sem_semop(struct sem_array *sma,
5270 struct sembuf *sops, unsigned nsops, int alter)
5271{
5272 u32 perms;
5273
5274 if (alter)
5275 perms = SEM__READ | SEM__WRITE;
5276 else
5277 perms = SEM__READ;
5278
Stephen Smalley6af963f2005-05-01 08:58:39 -07005279 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005280}
5281
5282static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5283{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005284 u32 av = 0;
5285
Linus Torvalds1da177e2005-04-16 15:20:36 -07005286 av = 0;
5287 if (flag & S_IRUGO)
5288 av |= IPC__UNIX_READ;
5289 if (flag & S_IWUGO)
5290 av |= IPC__UNIX_WRITE;
5291
5292 if (av == 0)
5293 return 0;
5294
Stephen Smalley6af963f2005-05-01 08:58:39 -07005295 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005296}
5297
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02005298static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5299{
5300 struct ipc_security_struct *isec = ipcp->security;
5301 *secid = isec->sid;
5302}
5303
Eric Paris828dfe12008-04-17 13:17:49 -04005304static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005305{
5306 if (inode)
5307 inode_doinit_with_dentry(inode, dentry);
5308}
5309
5310static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005311 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005312{
David Howells275bb412008-11-14 10:39:19 +11005313 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005314 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005315 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005316 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005317
5318 if (current != p) {
David Howells3b11a1d2008-11-14 10:39:26 +11005319 error = current_has_perm(p, PROCESS__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005320 if (error)
5321 return error;
5322 }
5323
David Howells275bb412008-11-14 10:39:19 +11005324 rcu_read_lock();
5325 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005326
5327 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005328 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005329 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005330 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005331 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005332 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005333 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005334 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005335 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005336 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005337 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005338 sid = __tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005339 else
David Howells275bb412008-11-14 10:39:19 +11005340 goto invalid;
5341 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005342
5343 if (!sid)
5344 return 0;
5345
Al Viro04ff9702007-03-12 16:17:58 +00005346 error = security_sid_to_context(sid, value, &len);
5347 if (error)
5348 return error;
5349 return len;
David Howells275bb412008-11-14 10:39:19 +11005350
5351invalid:
5352 rcu_read_unlock();
5353 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005354}
5355
5356static int selinux_setprocattr(struct task_struct *p,
5357 char *name, void *value, size_t size)
5358{
5359 struct task_security_struct *tsec;
Roland McGrath03563572008-03-26 15:46:39 -07005360 struct task_struct *tracer;
David Howellsd84f4f92008-11-14 10:39:23 +11005361 struct cred *new;
5362 u32 sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005363 int error;
5364 char *str = value;
5365
5366 if (current != p) {
5367 /* SELinux only allows a process to change its own
5368 security attributes. */
5369 return -EACCES;
5370 }
5371
5372 /*
5373 * Basic control over ability to set these attributes at all.
5374 * current == p, but we'll pass them separately in case the
5375 * above restriction is ever removed.
5376 */
5377 if (!strcmp(name, "exec"))
David Howells3b11a1d2008-11-14 10:39:26 +11005378 error = current_has_perm(p, PROCESS__SETEXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005379 else if (!strcmp(name, "fscreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005380 error = current_has_perm(p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005381 else if (!strcmp(name, "keycreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005382 error = current_has_perm(p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07005383 else if (!strcmp(name, "sockcreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005384 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005385 else if (!strcmp(name, "current"))
David Howells3b11a1d2008-11-14 10:39:26 +11005386 error = current_has_perm(p, PROCESS__SETCURRENT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005387 else
5388 error = -EINVAL;
5389 if (error)
5390 return error;
5391
5392 /* Obtain a SID for the context, if one was specified. */
5393 if (size && str[1] && str[1] != '\n') {
5394 if (str[size-1] == '\n') {
5395 str[size-1] = 0;
5396 size--;
5397 }
5398 error = security_context_to_sid(value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005399 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5400 if (!capable(CAP_MAC_ADMIN))
5401 return error;
5402 error = security_context_to_sid_force(value, size,
5403 &sid);
5404 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005405 if (error)
5406 return error;
5407 }
5408
David Howellsd84f4f92008-11-14 10:39:23 +11005409 new = prepare_creds();
5410 if (!new)
5411 return -ENOMEM;
5412
Linus Torvalds1da177e2005-04-16 15:20:36 -07005413 /* Permission checking based on the specified context is
5414 performed during the actual operation (execve,
5415 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11005416 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07005417 checks and may_create for the file creation checks. The
5418 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11005419 tsec = new->security;
5420 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005421 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005422 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005423 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005424 } else if (!strcmp(name, "keycreate")) {
Michael LeMay4eb582c2006-06-26 00:24:57 -07005425 error = may_create_key(sid, p);
5426 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005427 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005428 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005429 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07005430 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005431 } else if (!strcmp(name, "current")) {
5432 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005433 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11005434 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09005435
David Howellsd84f4f92008-11-14 10:39:23 +11005436 /* Only allow single threaded processes to change context */
5437 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02005438 if (!current_is_single_threaded()) {
David Howellsd84f4f92008-11-14 10:39:23 +11005439 error = security_bounded_transition(tsec->sid, sid);
5440 if (error)
5441 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04005442 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005443
5444 /* Check permissions for the transition. */
5445 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04005446 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005447 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005448 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005449
5450 /* Check for ptracing, and update the task SID if ok.
5451 Otherwise, leave SID unchanged and fail. */
David Howellsd84f4f92008-11-14 10:39:23 +11005452 ptsid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005453 task_lock(p);
Tejun Heo06d98472011-06-17 16:50:40 +02005454 tracer = ptrace_parent(p);
David Howellsd84f4f92008-11-14 10:39:23 +11005455 if (tracer)
5456 ptsid = task_sid(tracer);
5457 task_unlock(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005458
David Howellsd84f4f92008-11-14 10:39:23 +11005459 if (tracer) {
5460 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5461 PROCESS__PTRACE, NULL);
5462 if (error)
5463 goto abort_change;
5464 }
5465
5466 tsec->sid = sid;
5467 } else {
5468 error = -EINVAL;
5469 goto abort_change;
5470 }
5471
5472 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005473 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11005474
5475abort_change:
5476 abort_creds(new);
5477 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005478}
5479
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005480static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5481{
5482 return security_sid_to_context(secid, secdata, seclen);
5483}
5484
David Howells7bf570d2008-04-29 20:52:51 +01005485static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00005486{
5487 return security_context_to_sid(secdata, seclen, secid);
5488}
5489
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005490static void selinux_release_secctx(char *secdata, u32 seclen)
5491{
Paul Moore088999e2007-08-01 11:12:58 -04005492 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005493}
5494
David P. Quigley1ee65e32009-09-03 14:25:57 -04005495/*
5496 * called with inode->i_mutex locked
5497 */
5498static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5499{
5500 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5501}
5502
5503/*
5504 * called with inode->i_mutex locked
5505 */
5506static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5507{
5508 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5509}
5510
5511static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5512{
5513 int len = 0;
5514 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5515 ctx, true);
5516 if (len < 0)
5517 return len;
5518 *ctxlen = len;
5519 return 0;
5520}
Michael LeMayd7200242006-06-22 14:47:17 -07005521#ifdef CONFIG_KEYS
5522
David Howellsd84f4f92008-11-14 10:39:23 +11005523static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07005524 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07005525{
David Howellsd84f4f92008-11-14 10:39:23 +11005526 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07005527 struct key_security_struct *ksec;
5528
5529 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5530 if (!ksec)
5531 return -ENOMEM;
5532
David Howellsd84f4f92008-11-14 10:39:23 +11005533 tsec = cred->security;
5534 if (tsec->keycreate_sid)
5535 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005536 else
David Howellsd84f4f92008-11-14 10:39:23 +11005537 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005538
David Howells275bb412008-11-14 10:39:19 +11005539 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07005540 return 0;
5541}
5542
5543static void selinux_key_free(struct key *k)
5544{
5545 struct key_security_struct *ksec = k->security;
5546
5547 k->security = NULL;
5548 kfree(ksec);
5549}
5550
5551static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11005552 const struct cred *cred,
5553 key_perm_t perm)
Michael LeMayd7200242006-06-22 14:47:17 -07005554{
5555 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07005556 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11005557 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005558
5559 /* if no specific permissions are requested, we skip the
5560 permission check. No serious, additional covert channels
5561 appear to be created. */
5562 if (perm == 0)
5563 return 0;
5564
David Howellsd84f4f92008-11-14 10:39:23 +11005565 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11005566
5567 key = key_ref_to_ptr(key_ref);
5568 ksec = key->security;
5569
5570 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07005571}
5572
David Howells70a5bb72008-04-29 01:01:26 -07005573static int selinux_key_getsecurity(struct key *key, char **_buffer)
5574{
5575 struct key_security_struct *ksec = key->security;
5576 char *context = NULL;
5577 unsigned len;
5578 int rc;
5579
5580 rc = security_sid_to_context(ksec->sid, &context, &len);
5581 if (!rc)
5582 rc = len;
5583 *_buffer = context;
5584 return rc;
5585}
5586
Michael LeMayd7200242006-06-22 14:47:17 -07005587#endif
5588
Linus Torvalds1da177e2005-04-16 15:20:36 -07005589static struct security_operations selinux_ops = {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005590 .name = "selinux",
5591
Stephen Smalley48a23702012-11-05 08:15:34 -05005592 .binder_set_context_mgr = selinux_binder_set_context_mgr,
5593 .binder_transaction = selinux_binder_transaction,
5594 .binder_transfer_binder = selinux_binder_transfer_binder,
5595 .binder_transfer_file = selinux_binder_transfer_file,
5596
Ingo Molnar9e488582009-05-07 19:26:19 +10005597 .ptrace_access_check = selinux_ptrace_access_check,
David Howells5cd9c582008-08-14 11:37:28 +01005598 .ptrace_traceme = selinux_ptrace_traceme,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005599 .capget = selinux_capget,
David Howellsd84f4f92008-11-14 10:39:23 +11005600 .capset = selinux_capset,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005601 .capable = selinux_capable,
5602 .quotactl = selinux_quotactl,
5603 .quota_on = selinux_quota_on,
5604 .syslog = selinux_syslog,
5605 .vm_enough_memory = selinux_vm_enough_memory,
5606
5607 .netlink_send = selinux_netlink_send,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005608
David Howellsa6f76f22008-11-14 10:39:24 +11005609 .bprm_set_creds = selinux_bprm_set_creds,
David Howellsa6f76f22008-11-14 10:39:24 +11005610 .bprm_committing_creds = selinux_bprm_committing_creds,
5611 .bprm_committed_creds = selinux_bprm_committed_creds,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005612 .bprm_secureexec = selinux_bprm_secureexec,
5613
5614 .sb_alloc_security = selinux_sb_alloc_security,
5615 .sb_free_security = selinux_sb_free_security,
5616 .sb_copy_data = selinux_sb_copy_data,
Eric Paris026eb162011-03-03 16:09:14 -05005617 .sb_remount = selinux_sb_remount,
Eric Paris828dfe12008-04-17 13:17:49 -04005618 .sb_kern_mount = selinux_sb_kern_mount,
Eric Paris2069f452008-07-04 09:47:13 +10005619 .sb_show_options = selinux_sb_show_options,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005620 .sb_statfs = selinux_sb_statfs,
5621 .sb_mount = selinux_mount,
5622 .sb_umount = selinux_umount,
Eric Parisc9180a52007-11-30 13:00:35 -05005623 .sb_set_mnt_opts = selinux_set_mnt_opts,
Eric Paris828dfe12008-04-17 13:17:49 -04005624 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
Eric Parise0007522008-03-05 10:31:54 -05005625 .sb_parse_opts_str = selinux_parse_opts_str,
5626
Linus Torvalds1da177e2005-04-16 15:20:36 -07005627
5628 .inode_alloc_security = selinux_inode_alloc_security,
5629 .inode_free_security = selinux_inode_free_security,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07005630 .inode_init_security = selinux_inode_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005631 .inode_create = selinux_inode_create,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005632 .inode_link = selinux_inode_link,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005633 .inode_unlink = selinux_inode_unlink,
5634 .inode_symlink = selinux_inode_symlink,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005635 .inode_mkdir = selinux_inode_mkdir,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005636 .inode_rmdir = selinux_inode_rmdir,
5637 .inode_mknod = selinux_inode_mknod,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005638 .inode_rename = selinux_inode_rename,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005639 .inode_readlink = selinux_inode_readlink,
5640 .inode_follow_link = selinux_inode_follow_link,
5641 .inode_permission = selinux_inode_permission,
5642 .inode_setattr = selinux_inode_setattr,
5643 .inode_getattr = selinux_inode_getattr,
5644 .inode_setxattr = selinux_inode_setxattr,
5645 .inode_post_setxattr = selinux_inode_post_setxattr,
5646 .inode_getxattr = selinux_inode_getxattr,
5647 .inode_listxattr = selinux_inode_listxattr,
5648 .inode_removexattr = selinux_inode_removexattr,
Eric Paris828dfe12008-04-17 13:17:49 -04005649 .inode_getsecurity = selinux_inode_getsecurity,
5650 .inode_setsecurity = selinux_inode_setsecurity,
5651 .inode_listsecurity = selinux_inode_listsecurity,
Eric Parisf5269712008-05-14 11:27:45 -04005652 .inode_getsecid = selinux_inode_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005653
5654 .file_permission = selinux_file_permission,
5655 .file_alloc_security = selinux_file_alloc_security,
5656 .file_free_security = selinux_file_free_security,
5657 .file_ioctl = selinux_file_ioctl,
5658 .file_mmap = selinux_file_mmap,
5659 .file_mprotect = selinux_file_mprotect,
5660 .file_lock = selinux_file_lock,
5661 .file_fcntl = selinux_file_fcntl,
5662 .file_set_fowner = selinux_file_set_fowner,
5663 .file_send_sigiotask = selinux_file_send_sigiotask,
5664 .file_receive = selinux_file_receive,
5665
Eric Paris828dfe12008-04-17 13:17:49 -04005666 .dentry_open = selinux_dentry_open,
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09005667
Linus Torvalds1da177e2005-04-16 15:20:36 -07005668 .task_create = selinux_task_create,
David Howellsee18d642009-09-02 09:14:21 +01005669 .cred_alloc_blank = selinux_cred_alloc_blank,
David Howellsf1752ee2008-11-14 10:39:17 +11005670 .cred_free = selinux_cred_free,
David Howellsd84f4f92008-11-14 10:39:23 +11005671 .cred_prepare = selinux_cred_prepare,
David Howellsee18d642009-09-02 09:14:21 +01005672 .cred_transfer = selinux_cred_transfer,
David Howells3a3b7ce2008-11-14 10:39:28 +11005673 .kernel_act_as = selinux_kernel_act_as,
5674 .kernel_create_files_as = selinux_kernel_create_files_as,
Eric Paris25354c42009-08-13 09:45:03 -04005675 .kernel_module_request = selinux_kernel_module_request,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005676 .task_setpgid = selinux_task_setpgid,
5677 .task_getpgid = selinux_task_getpgid,
Eric Paris828dfe12008-04-17 13:17:49 -04005678 .task_getsid = selinux_task_getsid,
David Quigleyf9008e42006-06-30 01:55:46 -07005679 .task_getsecid = selinux_task_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005680 .task_setnice = selinux_task_setnice,
James Morris03e68062006-06-23 02:03:58 -07005681 .task_setioprio = selinux_task_setioprio,
David Quigleya1836a42006-06-30 01:55:49 -07005682 .task_getioprio = selinux_task_getioprio,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005683 .task_setrlimit = selinux_task_setrlimit,
5684 .task_setscheduler = selinux_task_setscheduler,
5685 .task_getscheduler = selinux_task_getscheduler,
David Quigley35601542006-06-23 02:04:01 -07005686 .task_movememory = selinux_task_movememory,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005687 .task_kill = selinux_task_kill,
5688 .task_wait = selinux_task_wait,
Eric Paris828dfe12008-04-17 13:17:49 -04005689 .task_to_inode = selinux_task_to_inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005690
5691 .ipc_permission = selinux_ipc_permission,
Eric Parisf5269712008-05-14 11:27:45 -04005692 .ipc_getsecid = selinux_ipc_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005693
5694 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5695 .msg_msg_free_security = selinux_msg_msg_free_security,
5696
5697 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5698 .msg_queue_free_security = selinux_msg_queue_free_security,
5699 .msg_queue_associate = selinux_msg_queue_associate,
5700 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5701 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5702 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5703
5704 .shm_alloc_security = selinux_shm_alloc_security,
5705 .shm_free_security = selinux_shm_free_security,
5706 .shm_associate = selinux_shm_associate,
5707 .shm_shmctl = selinux_shm_shmctl,
5708 .shm_shmat = selinux_shm_shmat,
5709
Eric Paris828dfe12008-04-17 13:17:49 -04005710 .sem_alloc_security = selinux_sem_alloc_security,
5711 .sem_free_security = selinux_sem_free_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005712 .sem_associate = selinux_sem_associate,
5713 .sem_semctl = selinux_sem_semctl,
5714 .sem_semop = selinux_sem_semop,
5715
Eric Paris828dfe12008-04-17 13:17:49 -04005716 .d_instantiate = selinux_d_instantiate,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005717
Eric Paris828dfe12008-04-17 13:17:49 -04005718 .getprocattr = selinux_getprocattr,
5719 .setprocattr = selinux_setprocattr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005720
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005721 .secid_to_secctx = selinux_secid_to_secctx,
David Howells63cb3442008-01-15 23:47:35 +00005722 .secctx_to_secid = selinux_secctx_to_secid,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005723 .release_secctx = selinux_release_secctx,
David P. Quigley1ee65e32009-09-03 14:25:57 -04005724 .inode_notifysecctx = selinux_inode_notifysecctx,
5725 .inode_setsecctx = selinux_inode_setsecctx,
5726 .inode_getsecctx = selinux_inode_getsecctx,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005727
Eric Paris828dfe12008-04-17 13:17:49 -04005728 .unix_stream_connect = selinux_socket_unix_stream_connect,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005729 .unix_may_send = selinux_socket_unix_may_send,
5730
5731 .socket_create = selinux_socket_create,
5732 .socket_post_create = selinux_socket_post_create,
5733 .socket_bind = selinux_socket_bind,
5734 .socket_connect = selinux_socket_connect,
5735 .socket_listen = selinux_socket_listen,
5736 .socket_accept = selinux_socket_accept,
5737 .socket_sendmsg = selinux_socket_sendmsg,
5738 .socket_recvmsg = selinux_socket_recvmsg,
5739 .socket_getsockname = selinux_socket_getsockname,
5740 .socket_getpeername = selinux_socket_getpeername,
5741 .socket_getsockopt = selinux_socket_getsockopt,
5742 .socket_setsockopt = selinux_socket_setsockopt,
5743 .socket_shutdown = selinux_socket_shutdown,
5744 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005745 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5746 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005747 .sk_alloc_security = selinux_sk_alloc_security,
5748 .sk_free_security = selinux_sk_free_security,
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005749 .sk_clone_security = selinux_sk_clone_security,
Eric Paris828dfe12008-04-17 13:17:49 -04005750 .sk_getsecid = selinux_sk_getsecid,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005751 .sock_graft = selinux_sock_graft,
5752 .inet_conn_request = selinux_inet_conn_request,
5753 .inet_csk_clone = selinux_inet_csk_clone,
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005754 .inet_conn_established = selinux_inet_conn_established,
Eric Paris2606fd12010-10-13 16:24:41 -04005755 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5756 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5757 .secmark_refcount_dec = selinux_secmark_refcount_dec,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005758 .req_classify_flow = selinux_req_classify_flow,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005759 .tun_dev_create = selinux_tun_dev_create,
5760 .tun_dev_post_create = selinux_tun_dev_post_create,
5761 .tun_dev_attach = selinux_tun_dev_attach,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005762
5763#ifdef CONFIG_SECURITY_NETWORK_XFRM
5764 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5765 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5766 .xfrm_policy_free_security = selinux_xfrm_policy_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005767 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005768 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5769 .xfrm_state_free_security = selinux_xfrm_state_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005770 .xfrm_state_delete_security = selinux_xfrm_state_delete,
Eric Paris828dfe12008-04-17 13:17:49 -04005771 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005772 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005773 .xfrm_decode_session = selinux_xfrm_decode_session,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005774#endif
Michael LeMayd7200242006-06-22 14:47:17 -07005775
5776#ifdef CONFIG_KEYS
Eric Paris828dfe12008-04-17 13:17:49 -04005777 .key_alloc = selinux_key_alloc,
5778 .key_free = selinux_key_free,
5779 .key_permission = selinux_key_permission,
David Howells70a5bb72008-04-29 01:01:26 -07005780 .key_getsecurity = selinux_key_getsecurity,
Michael LeMayd7200242006-06-22 14:47:17 -07005781#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02005782
5783#ifdef CONFIG_AUDIT
5784 .audit_rule_init = selinux_audit_rule_init,
5785 .audit_rule_known = selinux_audit_rule_known,
5786 .audit_rule_match = selinux_audit_rule_match,
5787 .audit_rule_free = selinux_audit_rule_free,
5788#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07005789};
5790
5791static __init int selinux_init(void)
5792{
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005793 if (!security_module_enable(&selinux_ops)) {
5794 selinux_enabled = 0;
5795 return 0;
5796 }
5797
Linus Torvalds1da177e2005-04-16 15:20:36 -07005798 if (!selinux_enabled) {
5799 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5800 return 0;
5801 }
5802
5803 printk(KERN_INFO "SELinux: Initializing.\n");
5804
5805 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11005806 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005807
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04005808 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5809
James Morris7cae7e22006-03-22 00:09:22 -08005810 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5811 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09005812 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005813 avc_init();
5814
Eric Paris828dfe12008-04-17 13:17:49 -04005815 if (register_security(&selinux_ops))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005816 panic("SELinux: Unable to register with kernel.\n");
5817
Eric Paris828dfe12008-04-17 13:17:49 -04005818 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05005819 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04005820 else
Eric Parisfadcdb42007-02-22 18:11:31 -05005821 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07005822
Linus Torvalds1da177e2005-04-16 15:20:36 -07005823 return 0;
5824}
5825
Al Viroe8c26252010-03-23 06:36:54 -04005826static void delayed_superblock_init(struct super_block *sb, void *unused)
5827{
5828 superblock_doinit(sb, NULL);
5829}
5830
Linus Torvalds1da177e2005-04-16 15:20:36 -07005831void selinux_complete_init(void)
5832{
Eric Parisfadcdb42007-02-22 18:11:31 -05005833 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005834
5835 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05005836 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04005837 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005838}
5839
5840/* SELinux requires early initialization in order to label
5841 all processes and objects when they are created. */
5842security_initcall(selinux_init);
5843
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005844#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005845
Paul Mooreeffad8d2008-01-29 08:49:27 -05005846static struct nf_hook_ops selinux_ipv4_ops[] = {
5847 {
5848 .hook = selinux_ipv4_postroute,
5849 .owner = THIS_MODULE,
5850 .pf = PF_INET,
5851 .hooknum = NF_INET_POST_ROUTING,
5852 .priority = NF_IP_PRI_SELINUX_LAST,
5853 },
5854 {
5855 .hook = selinux_ipv4_forward,
5856 .owner = THIS_MODULE,
5857 .pf = PF_INET,
5858 .hooknum = NF_INET_FORWARD,
5859 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04005860 },
5861 {
5862 .hook = selinux_ipv4_output,
5863 .owner = THIS_MODULE,
5864 .pf = PF_INET,
5865 .hooknum = NF_INET_LOCAL_OUT,
5866 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005867 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005868};
5869
5870#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5871
Paul Mooreeffad8d2008-01-29 08:49:27 -05005872static struct nf_hook_ops selinux_ipv6_ops[] = {
5873 {
5874 .hook = selinux_ipv6_postroute,
5875 .owner = THIS_MODULE,
5876 .pf = PF_INET6,
5877 .hooknum = NF_INET_POST_ROUTING,
5878 .priority = NF_IP6_PRI_SELINUX_LAST,
5879 },
5880 {
5881 .hook = selinux_ipv6_forward,
5882 .owner = THIS_MODULE,
5883 .pf = PF_INET6,
5884 .hooknum = NF_INET_FORWARD,
5885 .priority = NF_IP6_PRI_SELINUX_FIRST,
5886 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005887};
5888
5889#endif /* IPV6 */
5890
5891static int __init selinux_nf_ip_init(void)
5892{
5893 int err = 0;
5894
5895 if (!selinux_enabled)
5896 goto out;
Eric Parisfadcdb42007-02-22 18:11:31 -05005897
5898 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5899
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005900 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5901 if (err)
5902 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005903
5904#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005905 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5906 if (err)
5907 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005908#endif /* IPV6 */
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005909
Linus Torvalds1da177e2005-04-16 15:20:36 -07005910out:
5911 return err;
5912}
5913
5914__initcall(selinux_nf_ip_init);
5915
5916#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5917static void selinux_nf_ip_exit(void)
5918{
Eric Parisfadcdb42007-02-22 18:11:31 -05005919 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005920
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005921 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005922#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005923 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005924#endif /* IPV6 */
5925}
5926#endif
5927
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005928#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005929
5930#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5931#define selinux_nf_ip_exit()
5932#endif
5933
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005934#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005935
5936#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04005937static int selinux_disabled;
5938
Linus Torvalds1da177e2005-04-16 15:20:36 -07005939int selinux_disable(void)
5940{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005941 if (ss_initialized) {
5942 /* Not permitted after initial policy load. */
5943 return -EINVAL;
5944 }
5945
5946 if (selinux_disabled) {
5947 /* Only do this once. */
5948 return -EINVAL;
5949 }
5950
5951 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5952
5953 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04005954 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005955
wzt.wzt@gmail.com189b3b12010-02-23 23:15:28 +08005956 reset_security_ops();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005957
Eric Parisaf8ff042009-09-20 21:23:01 -04005958 /* Try to destroy the avc node cache */
5959 avc_disable();
5960
Linus Torvalds1da177e2005-04-16 15:20:36 -07005961 /* Unregister netfilter hooks. */
5962 selinux_nf_ip_exit();
5963
5964 /* Unregister selinuxfs. */
5965 exit_sel_fs();
5966
5967 return 0;
5968}
5969#endif