blob: 78c3f98fcdcfa94b2bf72a2bbcc7158b11756eba [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
Venkat Yekkirala7420ed22006-08-04 23:17:57 -070015 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
Linus Torvalds1da177e2005-04-16 15:20:36 -070023#include <linux/module.h>
24#include <linux/init.h>
25#include <linux/kernel.h>
26#include <linux/ptrace.h>
27#include <linux/errno.h>
28#include <linux/sched.h>
29#include <linux/security.h>
30#include <linux/xattr.h>
31#include <linux/capability.h>
32#include <linux/unistd.h>
33#include <linux/mm.h>
34#include <linux/mman.h>
35#include <linux/slab.h>
36#include <linux/pagemap.h>
37#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070038#include <linux/spinlock.h>
39#include <linux/syscalls.h>
40#include <linux/file.h>
41#include <linux/namei.h>
42#include <linux/mount.h>
43#include <linux/ext2_fs.h>
44#include <linux/proc_fs.h>
45#include <linux/kd.h>
46#include <linux/netfilter_ipv4.h>
47#include <linux/netfilter_ipv6.h>
48#include <linux/tty.h>
49#include <net/icmp.h>
50#include <net/ip.h> /* for sysctl_local_port_range[] */
51#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52#include <asm/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070053#include <asm/ioctls.h>
54#include <linux/bitops.h>
55#include <linux/interrupt.h>
56#include <linux/netdevice.h> /* for network interface checks */
57#include <linux/netlink.h>
58#include <linux/tcp.h>
59#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080060#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <linux/quota.h>
62#include <linux/un.h> /* for Unix socket types */
63#include <net/af_unix.h> /* for Unix socket types */
64#include <linux/parser.h>
65#include <linux/nfs_mount.h>
66#include <net/ipv6.h>
67#include <linux/hugetlb.h>
68#include <linux/personality.h>
69#include <linux/sysctl.h>
70#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070071#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070072#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070073#include <linux/mutex.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070074
75#include "avc.h"
76#include "objsec.h"
77#include "netif.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080078#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050079#include "netlabel.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070080
81#define XATTR_SELINUX_SUFFIX "selinux"
82#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
83
84extern unsigned int policydb_loaded_version;
85extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
James Morris4e5ab4c2006-06-09 00:33:33 -070086extern int selinux_compat_net;
Linus Torvalds1da177e2005-04-16 15:20:36 -070087
88#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
89int selinux_enforcing = 0;
90
91static int __init enforcing_setup(char *str)
92{
93 selinux_enforcing = simple_strtol(str,NULL,0);
94 return 1;
95}
96__setup("enforcing=", enforcing_setup);
97#endif
98
99#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
100int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
101
102static int __init selinux_enabled_setup(char *str)
103{
104 selinux_enabled = simple_strtol(str, NULL, 0);
105 return 1;
106}
107__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400108#else
109int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110#endif
111
112/* Original (dummy) security module. */
113static struct security_operations *original_ops = NULL;
114
115/* Minimal support for a secondary security module,
116 just to allow the use of the dummy or capability modules.
117 The owlsm module can alternatively be used as a secondary
118 module as long as CONFIG_OWLSM_FD is not enabled. */
119static struct security_operations *secondary_ops = NULL;
120
121/* Lists of inode and superblock security structures initialized
122 before the policy was loaded. */
123static LIST_HEAD(superblock_security_head);
124static DEFINE_SPINLOCK(sb_security_lock);
125
Christoph Lametere18b8902006-12-06 20:33:20 -0800126static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800127
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000128/* Return security context for a given sid or just the context
129 length if the buffer is null or length is 0 */
130static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
131{
132 char *context;
133 unsigned len;
134 int rc;
135
136 rc = security_sid_to_context(sid, &context, &len);
137 if (rc)
138 return rc;
139
140 if (!buffer || !size)
141 goto getsecurity_exit;
142
143 if (size < len) {
144 len = -ERANGE;
145 goto getsecurity_exit;
146 }
147 memcpy(buffer, context, len);
148
149getsecurity_exit:
150 kfree(context);
151 return len;
152}
153
Linus Torvalds1da177e2005-04-16 15:20:36 -0700154/* Allocate and free functions for each kind of security blob. */
155
156static int task_alloc_security(struct task_struct *task)
157{
158 struct task_security_struct *tsec;
159
James Morris89d155e2005-10-30 14:59:21 -0800160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700161 if (!tsec)
162 return -ENOMEM;
163
Linus Torvalds1da177e2005-04-16 15:20:36 -0700164 tsec->task = task;
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
167
168 return 0;
169}
170
171static void task_free_security(struct task_struct *task)
172{
173 struct task_security_struct *tsec = task->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 task->security = NULL;
175 kfree(tsec);
176}
177
178static int inode_alloc_security(struct inode *inode)
179{
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
182
Robert P. J. Dayc3762222007-02-10 01:45:03 -0800183 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184 if (!isec)
185 return -ENOMEM;
186
Eric Paris23970742006-09-25 23:32:01 -0700187 mutex_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700189 isec->inode = inode;
190 isec->sid = SECINITSID_UNLABELED;
191 isec->sclass = SECCLASS_FILE;
Stephen Smalley9ac49d22006-02-01 03:05:56 -0800192 isec->task_sid = tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700193 inode->i_security = isec;
194
195 return 0;
196}
197
198static void inode_free_security(struct inode *inode)
199{
200 struct inode_security_struct *isec = inode->i_security;
201 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
202
Linus Torvalds1da177e2005-04-16 15:20:36 -0700203 spin_lock(&sbsec->isec_lock);
204 if (!list_empty(&isec->list))
205 list_del_init(&isec->list);
206 spin_unlock(&sbsec->isec_lock);
207
208 inode->i_security = NULL;
James Morris7cae7e22006-03-22 00:09:22 -0800209 kmem_cache_free(sel_inode_cache, isec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210}
211
212static int file_alloc_security(struct file *file)
213{
214 struct task_security_struct *tsec = current->security;
215 struct file_security_struct *fsec;
216
Stephen Smalley26d2a4b2006-02-01 03:05:55 -0800217 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 if (!fsec)
219 return -ENOMEM;
220
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 fsec->file = file;
Stephen Smalley9ac49d22006-02-01 03:05:56 -0800222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700224 file->f_security = fsec;
225
226 return 0;
227}
228
229static void file_free_security(struct file *file)
230{
231 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700232 file->f_security = NULL;
233 kfree(fsec);
234}
235
236static int superblock_alloc_security(struct super_block *sb)
237{
238 struct superblock_security_struct *sbsec;
239
James Morris89d155e2005-10-30 14:59:21 -0800240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700241 if (!sbsec)
242 return -ENOMEM;
243
Eric Parisbc7e9822006-09-25 23:32:02 -0700244 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 sb->s_security = sbsec;
253
254 return 0;
255}
256
257static void superblock_free_security(struct super_block *sb)
258{
259 struct superblock_security_struct *sbsec = sb->s_security;
260
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268}
269
Al Viro7d877f32005-10-21 03:20:43 -0400270static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700271{
272 struct sk_security_struct *ssec;
273
James Morris89d155e2005-10-30 14:59:21 -0800274 ssec = kzalloc(sizeof(*ssec), priority);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275 if (!ssec)
276 return -ENOMEM;
277
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
Venkat Yekkirala892c1412006-08-04 23:08:56 -0700280 ssec->sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700281 sk->sk_security = ssec;
282
Paul Moore99f59ed2006-08-29 17:53:48 -0700283 selinux_netlbl_sk_security_init(ssec, family);
284
Linus Torvalds1da177e2005-04-16 15:20:36 -0700285 return 0;
286}
287
288static void sk_free_security(struct sock *sk)
289{
290 struct sk_security_struct *ssec = sk->sk_security;
291
Linus Torvalds1da177e2005-04-16 15:20:36 -0700292 sk->sk_security = NULL;
293 kfree(ssec);
294}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700295
296/* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298extern int ss_initialized;
299
300/* The file system's label must be initialized prior to use. */
301
302static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309};
310
311static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313static inline int inode_doinit(struct inode *inode)
314{
315 return inode_doinit_with_dentry(inode, NULL);
316}
317
318enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
Eric Paris08089252006-07-10 04:43:55 -0700322 Opt_rootcontext = 8,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700323};
324
325static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
Eric Paris08089252006-07-10 04:43:55 -0700329 {Opt_rootcontext, "rootcontext=%s"},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700330};
331
332#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333
Eric Parisc312feb2006-07-10 04:43:53 -0700334static int may_context_mount_sb_relabel(u32 sid,
335 struct superblock_security_struct *sbsec,
336 struct task_security_struct *tsec)
337{
338 int rc;
339
340 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
341 FILESYSTEM__RELABELFROM, NULL);
342 if (rc)
343 return rc;
344
345 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELTO, NULL);
347 return rc;
348}
349
Eric Paris08089252006-07-10 04:43:55 -0700350static int may_context_mount_inode_relabel(u32 sid,
351 struct superblock_security_struct *sbsec,
352 struct task_security_struct *tsec)
353{
354 int rc;
355 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
356 FILESYSTEM__RELABELFROM, NULL);
357 if (rc)
358 return rc;
359
360 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
361 FILESYSTEM__ASSOCIATE, NULL);
362 return rc;
363}
364
Linus Torvalds1da177e2005-04-16 15:20:36 -0700365static int try_context_mount(struct super_block *sb, void *data)
366{
367 char *context = NULL, *defcontext = NULL;
Eric Paris08089252006-07-10 04:43:55 -0700368 char *fscontext = NULL, *rootcontext = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369 const char *name;
370 u32 sid;
371 int alloc = 0, rc = 0, seen = 0;
372 struct task_security_struct *tsec = current->security;
373 struct superblock_security_struct *sbsec = sb->s_security;
374
375 if (!data)
376 goto out;
377
378 name = sb->s_type->name;
379
380 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
381
382 /* NFS we understand. */
383 if (!strcmp(name, "nfs")) {
384 struct nfs_mount_data *d = data;
385
386 if (d->version < NFS_MOUNT_VERSION)
387 goto out;
388
389 if (d->context[0]) {
390 context = d->context;
391 seen |= Opt_context;
392 }
393 } else
394 goto out;
395
396 } else {
397 /* Standard string-based options. */
398 char *p, *options = data;
399
Cory Olmo3528a952006-09-29 01:58:44 -0700400 while ((p = strsep(&options, "|")) != NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401 int token;
402 substring_t args[MAX_OPT_ARGS];
403
404 if (!*p)
405 continue;
406
407 token = match_token(p, tokens, args);
408
409 switch (token) {
410 case Opt_context:
Eric Parisc312feb2006-07-10 04:43:53 -0700411 if (seen & (Opt_context|Opt_defcontext)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700412 rc = -EINVAL;
413 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
414 goto out_free;
415 }
416 context = match_strdup(&args[0]);
417 if (!context) {
418 rc = -ENOMEM;
419 goto out_free;
420 }
421 if (!alloc)
422 alloc = 1;
423 seen |= Opt_context;
424 break;
425
426 case Opt_fscontext:
Eric Parisc312feb2006-07-10 04:43:53 -0700427 if (seen & Opt_fscontext) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700428 rc = -EINVAL;
429 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
430 goto out_free;
431 }
Eric Parisc312feb2006-07-10 04:43:53 -0700432 fscontext = match_strdup(&args[0]);
433 if (!fscontext) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700434 rc = -ENOMEM;
435 goto out_free;
436 }
437 if (!alloc)
438 alloc = 1;
439 seen |= Opt_fscontext;
440 break;
441
Eric Paris08089252006-07-10 04:43:55 -0700442 case Opt_rootcontext:
443 if (seen & Opt_rootcontext) {
444 rc = -EINVAL;
445 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
446 goto out_free;
447 }
448 rootcontext = match_strdup(&args[0]);
449 if (!rootcontext) {
450 rc = -ENOMEM;
451 goto out_free;
452 }
453 if (!alloc)
454 alloc = 1;
455 seen |= Opt_rootcontext;
456 break;
457
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458 case Opt_defcontext:
459 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
460 rc = -EINVAL;
461 printk(KERN_WARNING "SELinux: "
462 "defcontext option is invalid "
463 "for this filesystem type\n");
464 goto out_free;
465 }
466 if (seen & (Opt_context|Opt_defcontext)) {
467 rc = -EINVAL;
468 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
469 goto out_free;
470 }
471 defcontext = match_strdup(&args[0]);
472 if (!defcontext) {
473 rc = -ENOMEM;
474 goto out_free;
475 }
476 if (!alloc)
477 alloc = 1;
478 seen |= Opt_defcontext;
479 break;
480
481 default:
482 rc = -EINVAL;
483 printk(KERN_WARNING "SELinux: unknown mount "
484 "option\n");
485 goto out_free;
486
487 }
488 }
489 }
490
491 if (!seen)
492 goto out;
493
Eric Parisc312feb2006-07-10 04:43:53 -0700494 /* sets the context of the superblock for the fs being mounted. */
495 if (fscontext) {
496 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
497 if (rc) {
498 printk(KERN_WARNING "SELinux: security_context_to_sid"
499 "(%s) failed for (dev %s, type %s) errno=%d\n",
500 fscontext, sb->s_id, name, rc);
501 goto out_free;
502 }
503
504 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
505 if (rc)
506 goto out_free;
507
508 sbsec->sid = sid;
509 }
510
511 /*
512 * Switch to using mount point labeling behavior.
513 * sets the label used on all file below the mountpoint, and will set
514 * the superblock context if not already set.
515 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700516 if (context) {
517 rc = security_context_to_sid(context, strlen(context), &sid);
518 if (rc) {
519 printk(KERN_WARNING "SELinux: security_context_to_sid"
520 "(%s) failed for (dev %s, type %s) errno=%d\n",
521 context, sb->s_id, name, rc);
522 goto out_free;
523 }
524
Eric Parisb04ea3c2006-07-14 00:24:33 -0700525 if (!fscontext) {
526 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
527 if (rc)
528 goto out_free;
Eric Parisc312feb2006-07-10 04:43:53 -0700529 sbsec->sid = sid;
Eric Parisb04ea3c2006-07-14 00:24:33 -0700530 } else {
531 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
532 if (rc)
533 goto out_free;
534 }
Eric Parisc312feb2006-07-10 04:43:53 -0700535 sbsec->mntpoint_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536
Eric Parisc312feb2006-07-10 04:43:53 -0700537 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700538 }
539
Eric Paris08089252006-07-10 04:43:55 -0700540 if (rootcontext) {
541 struct inode *inode = sb->s_root->d_inode;
542 struct inode_security_struct *isec = inode->i_security;
543 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
544 if (rc) {
545 printk(KERN_WARNING "SELinux: security_context_to_sid"
546 "(%s) failed for (dev %s, type %s) errno=%d\n",
547 rootcontext, sb->s_id, name, rc);
548 goto out_free;
549 }
550
551 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
552 if (rc)
553 goto out_free;
554
555 isec->sid = sid;
556 isec->initialized = 1;
557 }
558
Linus Torvalds1da177e2005-04-16 15:20:36 -0700559 if (defcontext) {
560 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
561 if (rc) {
562 printk(KERN_WARNING "SELinux: security_context_to_sid"
563 "(%s) failed for (dev %s, type %s) errno=%d\n",
564 defcontext, sb->s_id, name, rc);
565 goto out_free;
566 }
567
568 if (sid == sbsec->def_sid)
569 goto out_free;
570
Eric Paris08089252006-07-10 04:43:55 -0700571 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700572 if (rc)
573 goto out_free;
574
575 sbsec->def_sid = sid;
576 }
577
578out_free:
579 if (alloc) {
580 kfree(context);
581 kfree(defcontext);
Eric Parisc312feb2006-07-10 04:43:53 -0700582 kfree(fscontext);
Eric Paris08089252006-07-10 04:43:55 -0700583 kfree(rootcontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700584 }
585out:
586 return rc;
587}
588
589static int superblock_doinit(struct super_block *sb, void *data)
590{
591 struct superblock_security_struct *sbsec = sb->s_security;
592 struct dentry *root = sb->s_root;
593 struct inode *inode = root->d_inode;
594 int rc = 0;
595
Eric Parisbc7e9822006-09-25 23:32:02 -0700596 mutex_lock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700597 if (sbsec->initialized)
598 goto out;
599
600 if (!ss_initialized) {
601 /* Defer initialization until selinux_complete_init,
602 after the initial policy is loaded and the security
603 server is ready to handle calls. */
604 spin_lock(&sb_security_lock);
605 if (list_empty(&sbsec->list))
606 list_add(&sbsec->list, &superblock_security_head);
607 spin_unlock(&sb_security_lock);
608 goto out;
609 }
610
611 /* Determine the labeling behavior to use for this filesystem type. */
612 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
613 if (rc) {
614 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
615 __FUNCTION__, sb->s_type->name, rc);
616 goto out;
617 }
618
619 rc = try_context_mount(sb, data);
620 if (rc)
621 goto out;
622
623 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
624 /* Make sure that the xattr handler exists and that no
625 error other than -ENODATA is returned by getxattr on
626 the root directory. -ENODATA is ok, as this may be
627 the first boot of the SELinux kernel before we have
628 assigned xattr values to the filesystem. */
629 if (!inode->i_op->getxattr) {
630 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
631 "xattr support\n", sb->s_id, sb->s_type->name);
632 rc = -EOPNOTSUPP;
633 goto out;
634 }
635 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
636 if (rc < 0 && rc != -ENODATA) {
637 if (rc == -EOPNOTSUPP)
638 printk(KERN_WARNING "SELinux: (dev %s, type "
639 "%s) has no security xattr handler\n",
640 sb->s_id, sb->s_type->name);
641 else
642 printk(KERN_WARNING "SELinux: (dev %s, type "
643 "%s) getxattr errno %d\n", sb->s_id,
644 sb->s_type->name, -rc);
645 goto out;
646 }
647 }
648
649 if (strcmp(sb->s_type->name, "proc") == 0)
650 sbsec->proc = 1;
651
652 sbsec->initialized = 1;
653
654 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
Eric Parisfadcdb42007-02-22 18:11:31 -0500655 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700656 sb->s_id, sb->s_type->name);
657 }
658 else {
Eric Parisfadcdb42007-02-22 18:11:31 -0500659 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700660 sb->s_id, sb->s_type->name,
661 labeling_behaviors[sbsec->behavior-1]);
662 }
663
664 /* Initialize the root inode. */
665 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
666
667 /* Initialize any other inodes associated with the superblock, e.g.
668 inodes created prior to initial policy load or inodes created
669 during get_sb by a pseudo filesystem that directly
670 populates itself. */
671 spin_lock(&sbsec->isec_lock);
672next_inode:
673 if (!list_empty(&sbsec->isec_head)) {
674 struct inode_security_struct *isec =
675 list_entry(sbsec->isec_head.next,
676 struct inode_security_struct, list);
677 struct inode *inode = isec->inode;
678 spin_unlock(&sbsec->isec_lock);
679 inode = igrab(inode);
680 if (inode) {
681 if (!IS_PRIVATE (inode))
682 inode_doinit(inode);
683 iput(inode);
684 }
685 spin_lock(&sbsec->isec_lock);
686 list_del_init(&isec->list);
687 goto next_inode;
688 }
689 spin_unlock(&sbsec->isec_lock);
690out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700691 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700692 return rc;
693}
694
695static inline u16 inode_mode_to_security_class(umode_t mode)
696{
697 switch (mode & S_IFMT) {
698 case S_IFSOCK:
699 return SECCLASS_SOCK_FILE;
700 case S_IFLNK:
701 return SECCLASS_LNK_FILE;
702 case S_IFREG:
703 return SECCLASS_FILE;
704 case S_IFBLK:
705 return SECCLASS_BLK_FILE;
706 case S_IFDIR:
707 return SECCLASS_DIR;
708 case S_IFCHR:
709 return SECCLASS_CHR_FILE;
710 case S_IFIFO:
711 return SECCLASS_FIFO_FILE;
712
713 }
714
715 return SECCLASS_FILE;
716}
717
James Morris13402582005-09-30 14:24:34 -0400718static inline int default_protocol_stream(int protocol)
719{
720 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
721}
722
723static inline int default_protocol_dgram(int protocol)
724{
725 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
726}
727
Linus Torvalds1da177e2005-04-16 15:20:36 -0700728static inline u16 socket_type_to_security_class(int family, int type, int protocol)
729{
730 switch (family) {
731 case PF_UNIX:
732 switch (type) {
733 case SOCK_STREAM:
734 case SOCK_SEQPACKET:
735 return SECCLASS_UNIX_STREAM_SOCKET;
736 case SOCK_DGRAM:
737 return SECCLASS_UNIX_DGRAM_SOCKET;
738 }
739 break;
740 case PF_INET:
741 case PF_INET6:
742 switch (type) {
743 case SOCK_STREAM:
James Morris13402582005-09-30 14:24:34 -0400744 if (default_protocol_stream(protocol))
745 return SECCLASS_TCP_SOCKET;
746 else
747 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700748 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -0400749 if (default_protocol_dgram(protocol))
750 return SECCLASS_UDP_SOCKET;
751 else
752 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -0800753 case SOCK_DCCP:
754 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -0400755 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700756 return SECCLASS_RAWIP_SOCKET;
757 }
758 break;
759 case PF_NETLINK:
760 switch (protocol) {
761 case NETLINK_ROUTE:
762 return SECCLASS_NETLINK_ROUTE_SOCKET;
763 case NETLINK_FIREWALL:
764 return SECCLASS_NETLINK_FIREWALL_SOCKET;
James Morris216efaa2005-08-15 20:34:48 -0700765 case NETLINK_INET_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700766 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
767 case NETLINK_NFLOG:
768 return SECCLASS_NETLINK_NFLOG_SOCKET;
769 case NETLINK_XFRM:
770 return SECCLASS_NETLINK_XFRM_SOCKET;
771 case NETLINK_SELINUX:
772 return SECCLASS_NETLINK_SELINUX_SOCKET;
773 case NETLINK_AUDIT:
774 return SECCLASS_NETLINK_AUDIT_SOCKET;
775 case NETLINK_IP6_FW:
776 return SECCLASS_NETLINK_IP6FW_SOCKET;
777 case NETLINK_DNRTMSG:
778 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -0700779 case NETLINK_KOBJECT_UEVENT:
780 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700781 default:
782 return SECCLASS_NETLINK_SOCKET;
783 }
784 case PF_PACKET:
785 return SECCLASS_PACKET_SOCKET;
786 case PF_KEY:
787 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -0700788 case PF_APPLETALK:
789 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700790 }
791
792 return SECCLASS_SOCKET;
793}
794
795#ifdef CONFIG_PROC_FS
796static int selinux_proc_get_sid(struct proc_dir_entry *de,
797 u16 tclass,
798 u32 *sid)
799{
800 int buflen, rc;
801 char *buffer, *path, *end;
802
803 buffer = (char*)__get_free_page(GFP_KERNEL);
804 if (!buffer)
805 return -ENOMEM;
806
807 buflen = PAGE_SIZE;
808 end = buffer+buflen;
809 *--end = '\0';
810 buflen--;
811 path = end-1;
812 *path = '/';
813 while (de && de != de->parent) {
814 buflen -= de->namelen + 1;
815 if (buflen < 0)
816 break;
817 end -= de->namelen;
818 memcpy(end, de->name, de->namelen);
819 *--end = '/';
820 path = end;
821 de = de->parent;
822 }
823 rc = security_genfs_sid("proc", path, tclass, sid);
824 free_page((unsigned long)buffer);
825 return rc;
826}
827#else
828static int selinux_proc_get_sid(struct proc_dir_entry *de,
829 u16 tclass,
830 u32 *sid)
831{
832 return -EINVAL;
833}
834#endif
835
836/* The inode's security attributes must be initialized before first use. */
837static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
838{
839 struct superblock_security_struct *sbsec = NULL;
840 struct inode_security_struct *isec = inode->i_security;
841 u32 sid;
842 struct dentry *dentry;
843#define INITCONTEXTLEN 255
844 char *context = NULL;
845 unsigned len = 0;
846 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700847
848 if (isec->initialized)
849 goto out;
850
Eric Paris23970742006-09-25 23:32:01 -0700851 mutex_lock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700852 if (isec->initialized)
Eric Paris23970742006-09-25 23:32:01 -0700853 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700854
855 sbsec = inode->i_sb->s_security;
856 if (!sbsec->initialized) {
857 /* Defer initialization until selinux_complete_init,
858 after the initial policy is loaded and the security
859 server is ready to handle calls. */
860 spin_lock(&sbsec->isec_lock);
861 if (list_empty(&isec->list))
862 list_add(&isec->list, &sbsec->isec_head);
863 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -0700864 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700865 }
866
867 switch (sbsec->behavior) {
868 case SECURITY_FS_USE_XATTR:
869 if (!inode->i_op->getxattr) {
870 isec->sid = sbsec->def_sid;
871 break;
872 }
873
874 /* Need a dentry, since the xattr API requires one.
875 Life would be simpler if we could just pass the inode. */
876 if (opt_dentry) {
877 /* Called from d_instantiate or d_splice_alias. */
878 dentry = dget(opt_dentry);
879 } else {
880 /* Called from selinux_complete_init, try to find a dentry. */
881 dentry = d_find_alias(inode);
882 }
883 if (!dentry) {
884 printk(KERN_WARNING "%s: no dentry for dev=%s "
885 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
886 inode->i_ino);
Eric Paris23970742006-09-25 23:32:01 -0700887 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700888 }
889
890 len = INITCONTEXTLEN;
891 context = kmalloc(len, GFP_KERNEL);
892 if (!context) {
893 rc = -ENOMEM;
894 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -0700895 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700896 }
897 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
898 context, len);
899 if (rc == -ERANGE) {
900 /* Need a larger buffer. Query for the right size. */
901 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
902 NULL, 0);
903 if (rc < 0) {
904 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -0700905 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700906 }
907 kfree(context);
908 len = rc;
909 context = kmalloc(len, GFP_KERNEL);
910 if (!context) {
911 rc = -ENOMEM;
912 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -0700913 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700914 }
915 rc = inode->i_op->getxattr(dentry,
916 XATTR_NAME_SELINUX,
917 context, len);
918 }
919 dput(dentry);
920 if (rc < 0) {
921 if (rc != -ENODATA) {
922 printk(KERN_WARNING "%s: getxattr returned "
923 "%d for dev=%s ino=%ld\n", __FUNCTION__,
924 -rc, inode->i_sb->s_id, inode->i_ino);
925 kfree(context);
Eric Paris23970742006-09-25 23:32:01 -0700926 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700927 }
928 /* Map ENODATA to the default file SID */
929 sid = sbsec->def_sid;
930 rc = 0;
931 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -0700932 rc = security_context_to_sid_default(context, rc, &sid,
933 sbsec->def_sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700934 if (rc) {
935 printk(KERN_WARNING "%s: context_to_sid(%s) "
936 "returned %d for dev=%s ino=%ld\n",
937 __FUNCTION__, context, -rc,
938 inode->i_sb->s_id, inode->i_ino);
939 kfree(context);
940 /* Leave with the unlabeled SID */
941 rc = 0;
942 break;
943 }
944 }
945 kfree(context);
946 isec->sid = sid;
947 break;
948 case SECURITY_FS_USE_TASK:
949 isec->sid = isec->task_sid;
950 break;
951 case SECURITY_FS_USE_TRANS:
952 /* Default to the fs SID. */
953 isec->sid = sbsec->sid;
954
955 /* Try to obtain a transition SID. */
956 isec->sclass = inode_mode_to_security_class(inode->i_mode);
957 rc = security_transition_sid(isec->task_sid,
958 sbsec->sid,
959 isec->sclass,
960 &sid);
961 if (rc)
Eric Paris23970742006-09-25 23:32:01 -0700962 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700963 isec->sid = sid;
964 break;
Eric Parisc312feb2006-07-10 04:43:53 -0700965 case SECURITY_FS_USE_MNTPOINT:
966 isec->sid = sbsec->mntpoint_sid;
967 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700968 default:
Eric Parisc312feb2006-07-10 04:43:53 -0700969 /* Default to the fs superblock SID. */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700970 isec->sid = sbsec->sid;
971
972 if (sbsec->proc) {
973 struct proc_inode *proci = PROC_I(inode);
974 if (proci->pde) {
975 isec->sclass = inode_mode_to_security_class(inode->i_mode);
976 rc = selinux_proc_get_sid(proci->pde,
977 isec->sclass,
978 &sid);
979 if (rc)
Eric Paris23970742006-09-25 23:32:01 -0700980 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700981 isec->sid = sid;
982 }
983 }
984 break;
985 }
986
987 isec->initialized = 1;
988
Eric Paris23970742006-09-25 23:32:01 -0700989out_unlock:
990 mutex_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700991out:
992 if (isec->sclass == SECCLASS_FILE)
993 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700994 return rc;
995}
996
997/* Convert a Linux signal to an access vector. */
998static inline u32 signal_to_av(int sig)
999{
1000 u32 perm = 0;
1001
1002 switch (sig) {
1003 case SIGCHLD:
1004 /* Commonly granted from child to parent. */
1005 perm = PROCESS__SIGCHLD;
1006 break;
1007 case SIGKILL:
1008 /* Cannot be caught or ignored */
1009 perm = PROCESS__SIGKILL;
1010 break;
1011 case SIGSTOP:
1012 /* Cannot be caught or ignored */
1013 perm = PROCESS__SIGSTOP;
1014 break;
1015 default:
1016 /* All other signals. */
1017 perm = PROCESS__SIGNAL;
1018 break;
1019 }
1020
1021 return perm;
1022}
1023
1024/* Check permission betweeen a pair of tasks, e.g. signal checks,
1025 fork check, ptrace check, etc. */
1026static int task_has_perm(struct task_struct *tsk1,
1027 struct task_struct *tsk2,
1028 u32 perms)
1029{
1030 struct task_security_struct *tsec1, *tsec2;
1031
1032 tsec1 = tsk1->security;
1033 tsec2 = tsk2->security;
1034 return avc_has_perm(tsec1->sid, tsec2->sid,
1035 SECCLASS_PROCESS, perms, NULL);
1036}
1037
1038/* Check whether a task is allowed to use a capability. */
1039static int task_has_capability(struct task_struct *tsk,
1040 int cap)
1041{
1042 struct task_security_struct *tsec;
1043 struct avc_audit_data ad;
1044
1045 tsec = tsk->security;
1046
1047 AVC_AUDIT_DATA_INIT(&ad,CAP);
1048 ad.tsk = tsk;
1049 ad.u.cap = cap;
1050
1051 return avc_has_perm(tsec->sid, tsec->sid,
1052 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053}
1054
1055/* Check whether a task is allowed to use a system operation. */
1056static int task_has_system(struct task_struct *tsk,
1057 u32 perms)
1058{
1059 struct task_security_struct *tsec;
1060
1061 tsec = tsk->security;
1062
1063 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064 SECCLASS_SYSTEM, perms, NULL);
1065}
1066
1067/* Check whether a task has a particular permission to an inode.
1068 The 'adp' parameter is optional and allows other audit
1069 data to be passed (e.g. the dentry). */
1070static int inode_has_perm(struct task_struct *tsk,
1071 struct inode *inode,
1072 u32 perms,
1073 struct avc_audit_data *adp)
1074{
1075 struct task_security_struct *tsec;
1076 struct inode_security_struct *isec;
1077 struct avc_audit_data ad;
1078
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001079 if (unlikely (IS_PRIVATE (inode)))
1080 return 0;
1081
Linus Torvalds1da177e2005-04-16 15:20:36 -07001082 tsec = tsk->security;
1083 isec = inode->i_security;
1084
1085 if (!adp) {
1086 adp = &ad;
1087 AVC_AUDIT_DATA_INIT(&ad, FS);
1088 ad.u.fs.inode = inode;
1089 }
1090
1091 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1092}
1093
1094/* Same as inode_has_perm, but pass explicit audit data containing
1095 the dentry to help the auditing code to more easily generate the
1096 pathname if needed. */
1097static inline int dentry_has_perm(struct task_struct *tsk,
1098 struct vfsmount *mnt,
1099 struct dentry *dentry,
1100 u32 av)
1101{
1102 struct inode *inode = dentry->d_inode;
1103 struct avc_audit_data ad;
1104 AVC_AUDIT_DATA_INIT(&ad,FS);
1105 ad.u.fs.mnt = mnt;
1106 ad.u.fs.dentry = dentry;
1107 return inode_has_perm(tsk, inode, av, &ad);
1108}
1109
1110/* Check whether a task can use an open file descriptor to
1111 access an inode in a given way. Check access to the
1112 descriptor itself, and then use dentry_has_perm to
1113 check a particular permission to the file.
1114 Access to the descriptor is implicitly granted if it
1115 has the same SID as the process. If av is zero, then
1116 access to the file is not checked, e.g. for cases
1117 where only the descriptor is affected like seek. */
Arjan van de Ven858119e2006-01-14 13:20:43 -08001118static int file_has_perm(struct task_struct *tsk,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001119 struct file *file,
1120 u32 av)
1121{
1122 struct task_security_struct *tsec = tsk->security;
1123 struct file_security_struct *fsec = file->f_security;
Josef Sipek3d5ff522006-12-08 02:37:38 -08001124 struct vfsmount *mnt = file->f_path.mnt;
1125 struct dentry *dentry = file->f_path.dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001126 struct inode *inode = dentry->d_inode;
1127 struct avc_audit_data ad;
1128 int rc;
1129
1130 AVC_AUDIT_DATA_INIT(&ad, FS);
1131 ad.u.fs.mnt = mnt;
1132 ad.u.fs.dentry = dentry;
1133
1134 if (tsec->sid != fsec->sid) {
1135 rc = avc_has_perm(tsec->sid, fsec->sid,
1136 SECCLASS_FD,
1137 FD__USE,
1138 &ad);
1139 if (rc)
1140 return rc;
1141 }
1142
1143 /* av is zero if only checking access to the descriptor. */
1144 if (av)
1145 return inode_has_perm(tsk, inode, av, &ad);
1146
1147 return 0;
1148}
1149
1150/* Check whether a task can create a file. */
1151static int may_create(struct inode *dir,
1152 struct dentry *dentry,
1153 u16 tclass)
1154{
1155 struct task_security_struct *tsec;
1156 struct inode_security_struct *dsec;
1157 struct superblock_security_struct *sbsec;
1158 u32 newsid;
1159 struct avc_audit_data ad;
1160 int rc;
1161
1162 tsec = current->security;
1163 dsec = dir->i_security;
1164 sbsec = dir->i_sb->s_security;
1165
1166 AVC_AUDIT_DATA_INIT(&ad, FS);
1167 ad.u.fs.dentry = dentry;
1168
1169 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1170 DIR__ADD_NAME | DIR__SEARCH,
1171 &ad);
1172 if (rc)
1173 return rc;
1174
1175 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1176 newsid = tsec->create_sid;
1177 } else {
1178 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179 &newsid);
1180 if (rc)
1181 return rc;
1182 }
1183
1184 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185 if (rc)
1186 return rc;
1187
1188 return avc_has_perm(newsid, sbsec->sid,
1189 SECCLASS_FILESYSTEM,
1190 FILESYSTEM__ASSOCIATE, &ad);
1191}
1192
Michael LeMay4eb582c2006-06-26 00:24:57 -07001193/* Check whether a task can create a key. */
1194static int may_create_key(u32 ksid,
1195 struct task_struct *ctx)
1196{
1197 struct task_security_struct *tsec;
1198
1199 tsec = ctx->security;
1200
1201 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202}
1203
Linus Torvalds1da177e2005-04-16 15:20:36 -07001204#define MAY_LINK 0
1205#define MAY_UNLINK 1
1206#define MAY_RMDIR 2
1207
1208/* Check whether a task can link, unlink, or rmdir a file/directory. */
1209static int may_link(struct inode *dir,
1210 struct dentry *dentry,
1211 int kind)
1212
1213{
1214 struct task_security_struct *tsec;
1215 struct inode_security_struct *dsec, *isec;
1216 struct avc_audit_data ad;
1217 u32 av;
1218 int rc;
1219
1220 tsec = current->security;
1221 dsec = dir->i_security;
1222 isec = dentry->d_inode->i_security;
1223
1224 AVC_AUDIT_DATA_INIT(&ad, FS);
1225 ad.u.fs.dentry = dentry;
1226
1227 av = DIR__SEARCH;
1228 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1229 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1230 if (rc)
1231 return rc;
1232
1233 switch (kind) {
1234 case MAY_LINK:
1235 av = FILE__LINK;
1236 break;
1237 case MAY_UNLINK:
1238 av = FILE__UNLINK;
1239 break;
1240 case MAY_RMDIR:
1241 av = DIR__RMDIR;
1242 break;
1243 default:
1244 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1245 return 0;
1246 }
1247
1248 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249 return rc;
1250}
1251
1252static inline int may_rename(struct inode *old_dir,
1253 struct dentry *old_dentry,
1254 struct inode *new_dir,
1255 struct dentry *new_dentry)
1256{
1257 struct task_security_struct *tsec;
1258 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1259 struct avc_audit_data ad;
1260 u32 av;
1261 int old_is_dir, new_is_dir;
1262 int rc;
1263
1264 tsec = current->security;
1265 old_dsec = old_dir->i_security;
1266 old_isec = old_dentry->d_inode->i_security;
1267 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1268 new_dsec = new_dir->i_security;
1269
1270 AVC_AUDIT_DATA_INIT(&ad, FS);
1271
1272 ad.u.fs.dentry = old_dentry;
1273 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1274 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1275 if (rc)
1276 return rc;
1277 rc = avc_has_perm(tsec->sid, old_isec->sid,
1278 old_isec->sclass, FILE__RENAME, &ad);
1279 if (rc)
1280 return rc;
1281 if (old_is_dir && new_dir != old_dir) {
1282 rc = avc_has_perm(tsec->sid, old_isec->sid,
1283 old_isec->sclass, DIR__REPARENT, &ad);
1284 if (rc)
1285 return rc;
1286 }
1287
1288 ad.u.fs.dentry = new_dentry;
1289 av = DIR__ADD_NAME | DIR__SEARCH;
1290 if (new_dentry->d_inode)
1291 av |= DIR__REMOVE_NAME;
1292 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1293 if (rc)
1294 return rc;
1295 if (new_dentry->d_inode) {
1296 new_isec = new_dentry->d_inode->i_security;
1297 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1298 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299 new_isec->sclass,
1300 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1301 if (rc)
1302 return rc;
1303 }
1304
1305 return 0;
1306}
1307
1308/* Check whether a task can perform a filesystem operation. */
1309static int superblock_has_perm(struct task_struct *tsk,
1310 struct super_block *sb,
1311 u32 perms,
1312 struct avc_audit_data *ad)
1313{
1314 struct task_security_struct *tsec;
1315 struct superblock_security_struct *sbsec;
1316
1317 tsec = tsk->security;
1318 sbsec = sb->s_security;
1319 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320 perms, ad);
1321}
1322
1323/* Convert a Linux mode and permission mask to an access vector. */
1324static inline u32 file_mask_to_av(int mode, int mask)
1325{
1326 u32 av = 0;
1327
1328 if ((mode & S_IFMT) != S_IFDIR) {
1329 if (mask & MAY_EXEC)
1330 av |= FILE__EXECUTE;
1331 if (mask & MAY_READ)
1332 av |= FILE__READ;
1333
1334 if (mask & MAY_APPEND)
1335 av |= FILE__APPEND;
1336 else if (mask & MAY_WRITE)
1337 av |= FILE__WRITE;
1338
1339 } else {
1340 if (mask & MAY_EXEC)
1341 av |= DIR__SEARCH;
1342 if (mask & MAY_WRITE)
1343 av |= DIR__WRITE;
1344 if (mask & MAY_READ)
1345 av |= DIR__READ;
1346 }
1347
1348 return av;
1349}
1350
1351/* Convert a Linux file to an access vector. */
1352static inline u32 file_to_av(struct file *file)
1353{
1354 u32 av = 0;
1355
1356 if (file->f_mode & FMODE_READ)
1357 av |= FILE__READ;
1358 if (file->f_mode & FMODE_WRITE) {
1359 if (file->f_flags & O_APPEND)
1360 av |= FILE__APPEND;
1361 else
1362 av |= FILE__WRITE;
1363 }
1364
1365 return av;
1366}
1367
Linus Torvalds1da177e2005-04-16 15:20:36 -07001368/* Hook functions begin here. */
1369
1370static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371{
1372 struct task_security_struct *psec = parent->security;
1373 struct task_security_struct *csec = child->security;
1374 int rc;
1375
1376 rc = secondary_ops->ptrace(parent,child);
1377 if (rc)
1378 return rc;
1379
1380 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1381 /* Save the SID of the tracing process for later use in apply_creds. */
Stephen Smalley341c2d82006-03-11 03:27:16 -08001382 if (!(child->ptrace & PT_PTRACED) && !rc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001383 csec->ptrace_sid = psec->sid;
1384 return rc;
1385}
1386
1387static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1388 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1389{
1390 int error;
1391
1392 error = task_has_perm(current, target, PROCESS__GETCAP);
1393 if (error)
1394 return error;
1395
1396 return secondary_ops->capget(target, effective, inheritable, permitted);
1397}
1398
1399static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1400 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401{
1402 int error;
1403
1404 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1405 if (error)
1406 return error;
1407
1408 return task_has_perm(current, target, PROCESS__SETCAP);
1409}
1410
1411static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1412 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413{
1414 secondary_ops->capset_set(target, effective, inheritable, permitted);
1415}
1416
1417static int selinux_capable(struct task_struct *tsk, int cap)
1418{
1419 int rc;
1420
1421 rc = secondary_ops->capable(tsk, cap);
1422 if (rc)
1423 return rc;
1424
1425 return task_has_capability(tsk,cap);
1426}
1427
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001428static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1429{
1430 int buflen, rc;
1431 char *buffer, *path, *end;
1432
1433 rc = -ENOMEM;
1434 buffer = (char*)__get_free_page(GFP_KERNEL);
1435 if (!buffer)
1436 goto out;
1437
1438 buflen = PAGE_SIZE;
1439 end = buffer+buflen;
1440 *--end = '\0';
1441 buflen--;
1442 path = end-1;
1443 *path = '/';
1444 while (table) {
1445 const char *name = table->procname;
1446 size_t namelen = strlen(name);
1447 buflen -= namelen + 1;
1448 if (buflen < 0)
1449 goto out_free;
1450 end -= namelen;
1451 memcpy(end, name, namelen);
1452 *--end = '/';
1453 path = end;
1454 table = table->parent;
1455 }
Eric W. Biedermanb599fdf2007-02-14 00:34:15 -08001456 buflen -= 4;
1457 if (buflen < 0)
1458 goto out_free;
1459 end -= 4;
1460 memcpy(end, "/sys", 4);
1461 path = end;
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001462 rc = security_genfs_sid("proc", path, tclass, sid);
1463out_free:
1464 free_page((unsigned long)buffer);
1465out:
1466 return rc;
1467}
1468
Linus Torvalds1da177e2005-04-16 15:20:36 -07001469static int selinux_sysctl(ctl_table *table, int op)
1470{
1471 int error = 0;
1472 u32 av;
1473 struct task_security_struct *tsec;
1474 u32 tsid;
1475 int rc;
1476
1477 rc = secondary_ops->sysctl(table, op);
1478 if (rc)
1479 return rc;
1480
1481 tsec = current->security;
1482
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001483 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1484 SECCLASS_DIR : SECCLASS_FILE, &tsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001485 if (rc) {
1486 /* Default to the well-defined sysctl SID. */
1487 tsid = SECINITSID_SYSCTL;
1488 }
1489
1490 /* The op values are "defined" in sysctl.c, thereby creating
1491 * a bad coupling between this module and sysctl.c */
1492 if(op == 001) {
1493 error = avc_has_perm(tsec->sid, tsid,
1494 SECCLASS_DIR, DIR__SEARCH, NULL);
1495 } else {
1496 av = 0;
1497 if (op & 004)
1498 av |= FILE__READ;
1499 if (op & 002)
1500 av |= FILE__WRITE;
1501 if (av)
1502 error = avc_has_perm(tsec->sid, tsid,
1503 SECCLASS_FILE, av, NULL);
1504 }
1505
1506 return error;
1507}
1508
1509static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1510{
1511 int rc = 0;
1512
1513 if (!sb)
1514 return 0;
1515
1516 switch (cmds) {
1517 case Q_SYNC:
1518 case Q_QUOTAON:
1519 case Q_QUOTAOFF:
1520 case Q_SETINFO:
1521 case Q_SETQUOTA:
1522 rc = superblock_has_perm(current,
1523 sb,
1524 FILESYSTEM__QUOTAMOD, NULL);
1525 break;
1526 case Q_GETFMT:
1527 case Q_GETINFO:
1528 case Q_GETQUOTA:
1529 rc = superblock_has_perm(current,
1530 sb,
1531 FILESYSTEM__QUOTAGET, NULL);
1532 break;
1533 default:
1534 rc = 0; /* let the kernel handle invalid cmds */
1535 break;
1536 }
1537 return rc;
1538}
1539
1540static int selinux_quota_on(struct dentry *dentry)
1541{
1542 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1543}
1544
1545static int selinux_syslog(int type)
1546{
1547 int rc;
1548
1549 rc = secondary_ops->syslog(type);
1550 if (rc)
1551 return rc;
1552
1553 switch (type) {
1554 case 3: /* Read last kernel messages */
1555 case 10: /* Return size of the log buffer */
1556 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1557 break;
1558 case 6: /* Disable logging to console */
1559 case 7: /* Enable logging to console */
1560 case 8: /* Set level of messages printed to console */
1561 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1562 break;
1563 case 0: /* Close log */
1564 case 1: /* Open log */
1565 case 2: /* Read from log */
1566 case 4: /* Read/clear last kernel messages */
1567 case 5: /* Clear ring buffer */
1568 default:
1569 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1570 break;
1571 }
1572 return rc;
1573}
1574
1575/*
1576 * Check that a process has enough memory to allocate a new virtual
1577 * mapping. 0 means there is enough memory for the allocation to
1578 * succeed and -ENOMEM implies there is not.
1579 *
1580 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1581 * if the capability is granted, but __vm_enough_memory requires 1 if
1582 * the capability is granted.
1583 *
1584 * Do not audit the selinux permission check, as this is applied to all
1585 * processes that allocate mappings.
1586 */
1587static int selinux_vm_enough_memory(long pages)
1588{
1589 int rc, cap_sys_admin = 0;
1590 struct task_security_struct *tsec = current->security;
1591
1592 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1593 if (rc == 0)
1594 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
Stephen Smalley2c3c05d2007-06-07 15:34:10 -04001595 SECCLASS_CAPABILITY,
1596 CAP_TO_MASK(CAP_SYS_ADMIN),
1597 0,
1598 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001599
1600 if (rc == 0)
1601 cap_sys_admin = 1;
1602
1603 return __vm_enough_memory(pages, cap_sys_admin);
1604}
1605
1606/* binprm security operations */
1607
1608static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609{
1610 struct bprm_security_struct *bsec;
1611
James Morris89d155e2005-10-30 14:59:21 -08001612 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001613 if (!bsec)
1614 return -ENOMEM;
1615
Linus Torvalds1da177e2005-04-16 15:20:36 -07001616 bsec->bprm = bprm;
1617 bsec->sid = SECINITSID_UNLABELED;
1618 bsec->set = 0;
1619
1620 bprm->security = bsec;
1621 return 0;
1622}
1623
1624static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625{
1626 struct task_security_struct *tsec;
Josef Sipek3d5ff522006-12-08 02:37:38 -08001627 struct inode *inode = bprm->file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001628 struct inode_security_struct *isec;
1629 struct bprm_security_struct *bsec;
1630 u32 newsid;
1631 struct avc_audit_data ad;
1632 int rc;
1633
1634 rc = secondary_ops->bprm_set_security(bprm);
1635 if (rc)
1636 return rc;
1637
1638 bsec = bprm->security;
1639
1640 if (bsec->set)
1641 return 0;
1642
1643 tsec = current->security;
1644 isec = inode->i_security;
1645
1646 /* Default to the current task SID. */
1647 bsec->sid = tsec->sid;
1648
Michael LeMay28eba5b2006-06-27 02:53:42 -07001649 /* Reset fs, key, and sock SIDs on execve. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 tsec->create_sid = 0;
Michael LeMay28eba5b2006-06-27 02:53:42 -07001651 tsec->keycreate_sid = 0;
Eric Paris42c3e032006-06-26 00:26:03 -07001652 tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001653
1654 if (tsec->exec_sid) {
1655 newsid = tsec->exec_sid;
1656 /* Reset exec SID on execve. */
1657 tsec->exec_sid = 0;
1658 } else {
1659 /* Check for a default transition on this program. */
1660 rc = security_transition_sid(tsec->sid, isec->sid,
1661 SECCLASS_PROCESS, &newsid);
1662 if (rc)
1663 return rc;
1664 }
1665
1666 AVC_AUDIT_DATA_INIT(&ad, FS);
Josef Sipek3d5ff522006-12-08 02:37:38 -08001667 ad.u.fs.mnt = bprm->file->f_path.mnt;
1668 ad.u.fs.dentry = bprm->file->f_path.dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001669
Josef Sipek3d5ff522006-12-08 02:37:38 -08001670 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001671 newsid = tsec->sid;
1672
1673 if (tsec->sid == newsid) {
1674 rc = avc_has_perm(tsec->sid, isec->sid,
1675 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676 if (rc)
1677 return rc;
1678 } else {
1679 /* Check permissions for the transition. */
1680 rc = avc_has_perm(tsec->sid, newsid,
1681 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682 if (rc)
1683 return rc;
1684
1685 rc = avc_has_perm(newsid, isec->sid,
1686 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687 if (rc)
1688 return rc;
1689
1690 /* Clear any possibly unsafe personality bits on exec: */
1691 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693 /* Set the security field to the new SID. */
1694 bsec->sid = newsid;
1695 }
1696
1697 bsec->set = 1;
1698 return 0;
1699}
1700
1701static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702{
1703 return secondary_ops->bprm_check_security(bprm);
1704}
1705
1706
1707static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708{
1709 struct task_security_struct *tsec = current->security;
1710 int atsecure = 0;
1711
1712 if (tsec->osid != tsec->sid) {
1713 /* Enable secure mode for SIDs transitions unless
1714 the noatsecure permission is granted between
1715 the two SIDs, i.e. ahp returns 0. */
1716 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717 SECCLASS_PROCESS,
1718 PROCESS__NOATSECURE, NULL);
1719 }
1720
1721 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722}
1723
1724static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725{
Jesper Juhl9a5f04b2005-06-25 14:58:51 -07001726 kfree(bprm->security);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001727 bprm->security = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001728}
1729
1730extern struct vfsmount *selinuxfs_mount;
1731extern struct dentry *selinux_null;
1732
1733/* Derived from fs/exec.c:flush_old_files. */
1734static inline void flush_unauthorized_files(struct files_struct * files)
1735{
1736 struct avc_audit_data ad;
1737 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07001738 struct tty_struct *tty;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07001739 struct fdtable *fdt;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001740 long j = -1;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001741 int drop_tty = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001742
Stephen Smalleyb20c8122006-09-25 23:32:03 -07001743 mutex_lock(&tty_mutex);
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001744 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001745 if (tty) {
1746 file_list_lock();
Eric Dumazet2f512012005-10-30 15:02:16 -08001747 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001748 if (file) {
1749 /* Revalidate access to controlling tty.
1750 Use inode_has_perm on the tty inode directly rather
1751 than using file_has_perm, as this particular open
1752 file may belong to another process and we are only
1753 interested in the inode-based check here. */
Josef Sipek3d5ff522006-12-08 02:37:38 -08001754 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001755 if (inode_has_perm(current, inode,
1756 FILE__READ | FILE__WRITE, NULL)) {
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001757 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001758 }
1759 }
1760 file_list_unlock();
1761 }
Stephen Smalleyb20c8122006-09-25 23:32:03 -07001762 mutex_unlock(&tty_mutex);
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07001763 /* Reset controlling tty. */
1764 if (drop_tty)
1765 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001766
1767 /* Revalidate access to inherited open files. */
1768
1769 AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771 spin_lock(&files->file_lock);
1772 for (;;) {
1773 unsigned long set, i;
1774 int fd;
1775
1776 j++;
1777 i = j * __NFDBITS;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07001778 fdt = files_fdtable(files);
Vadim Lobanovbbea9f62006-12-10 02:21:12 -08001779 if (i >= fdt->max_fds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001780 break;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07001781 set = fdt->open_fds->fds_bits[j];
Linus Torvalds1da177e2005-04-16 15:20:36 -07001782 if (!set)
1783 continue;
1784 spin_unlock(&files->file_lock);
1785 for ( ; set ; i++,set >>= 1) {
1786 if (set & 1) {
1787 file = fget(i);
1788 if (!file)
1789 continue;
1790 if (file_has_perm(current,
1791 file,
1792 file_to_av(file))) {
1793 sys_close(i);
1794 fd = get_unused_fd();
1795 if (fd != i) {
1796 if (fd >= 0)
1797 put_unused_fd(fd);
1798 fput(file);
1799 continue;
1800 }
1801 if (devnull) {
Nick Piggin095975d2006-01-08 01:02:19 -08001802 get_file(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803 } else {
1804 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
Akinobu Mitafc5d81e2006-11-27 15:16:48 +09001805 if (IS_ERR(devnull)) {
1806 devnull = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001807 put_unused_fd(fd);
1808 fput(file);
1809 continue;
1810 }
1811 }
1812 fd_install(fd, devnull);
1813 }
1814 fput(file);
1815 }
1816 }
1817 spin_lock(&files->file_lock);
1818
1819 }
1820 spin_unlock(&files->file_lock);
1821}
1822
1823static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1824{
1825 struct task_security_struct *tsec;
1826 struct bprm_security_struct *bsec;
1827 u32 sid;
1828 int rc;
1829
1830 secondary_ops->bprm_apply_creds(bprm, unsafe);
1831
1832 tsec = current->security;
1833
1834 bsec = bprm->security;
1835 sid = bsec->sid;
1836
1837 tsec->osid = tsec->sid;
1838 bsec->unsafe = 0;
1839 if (tsec->sid != sid) {
1840 /* Check for shared state. If not ok, leave SID
1841 unchanged and kill. */
1842 if (unsafe & LSM_UNSAFE_SHARE) {
1843 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1844 PROCESS__SHARE, NULL);
1845 if (rc) {
1846 bsec->unsafe = 1;
1847 return;
1848 }
1849 }
1850
1851 /* Check for ptracing, and update the task SID if ok.
1852 Otherwise, leave SID unchanged and kill. */
1853 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1854 rc = avc_has_perm(tsec->ptrace_sid, sid,
1855 SECCLASS_PROCESS, PROCESS__PTRACE,
1856 NULL);
1857 if (rc) {
1858 bsec->unsafe = 1;
1859 return;
1860 }
1861 }
1862 tsec->sid = sid;
1863 }
1864}
1865
1866/*
1867 * called after apply_creds without the task lock held
1868 */
1869static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1870{
1871 struct task_security_struct *tsec;
1872 struct rlimit *rlim, *initrlim;
1873 struct itimerval itimer;
1874 struct bprm_security_struct *bsec;
1875 int rc, i;
1876
1877 tsec = current->security;
1878 bsec = bprm->security;
1879
1880 if (bsec->unsafe) {
1881 force_sig_specific(SIGKILL, current);
1882 return;
1883 }
1884 if (tsec->osid == tsec->sid)
1885 return;
1886
1887 /* Close files for which the new task SID is not authorized. */
1888 flush_unauthorized_files(current->files);
1889
1890 /* Check whether the new SID can inherit signal state
1891 from the old SID. If not, clear itimers to avoid
1892 subsequent signal generation and flush and unblock
1893 signals. This must occur _after_ the task SID has
1894 been updated so that any kill done after the flush
1895 will be checked against the new SID. */
1896 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897 PROCESS__SIGINH, NULL);
1898 if (rc) {
1899 memset(&itimer, 0, sizeof itimer);
1900 for (i = 0; i < 3; i++)
1901 do_setitimer(i, &itimer, NULL);
1902 flush_signals(current);
1903 spin_lock_irq(&current->sighand->siglock);
1904 flush_signal_handlers(current, 1);
1905 sigemptyset(&current->blocked);
1906 recalc_sigpending();
1907 spin_unlock_irq(&current->sighand->siglock);
1908 }
1909
1910 /* Check whether the new SID can inherit resource limits
1911 from the old SID. If not, reset all soft limits to
1912 the lower of the current task's hard limit and the init
1913 task's soft limit. Note that the setting of hard limits
1914 (even to lower them) can be controlled by the setrlimit
1915 check. The inclusion of the init task's soft limit into
1916 the computation is to avoid resetting soft limits higher
1917 than the default soft limit for cases where the default
1918 is lower than the hard limit, e.g. RLIMIT_CORE or
1919 RLIMIT_STACK.*/
1920 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1921 PROCESS__RLIMITINH, NULL);
1922 if (rc) {
1923 for (i = 0; i < RLIM_NLIMITS; i++) {
1924 rlim = current->signal->rlim + i;
1925 initrlim = init_task.signal->rlim+i;
1926 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1927 }
1928 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1929 /*
1930 * This will cause RLIMIT_CPU calculations
1931 * to be refigured.
1932 */
1933 current->it_prof_expires = jiffies_to_cputime(1);
1934 }
1935 }
1936
1937 /* Wake up the parent if it is waiting so that it can
1938 recheck wait permission to the new task SID. */
1939 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1940}
1941
1942/* superblock security operations */
1943
1944static int selinux_sb_alloc_security(struct super_block *sb)
1945{
1946 return superblock_alloc_security(sb);
1947}
1948
1949static void selinux_sb_free_security(struct super_block *sb)
1950{
1951 superblock_free_security(sb);
1952}
1953
1954static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1955{
1956 if (plen > olen)
1957 return 0;
1958
1959 return !memcmp(prefix, option, plen);
1960}
1961
1962static inline int selinux_option(char *option, int len)
1963{
1964 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1965 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
Eric Paris08089252006-07-10 04:43:55 -07001966 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1967 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001968}
1969
1970static inline void take_option(char **to, char *from, int *first, int len)
1971{
1972 if (!*first) {
1973 **to = ',';
1974 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07001975 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07001976 *first = 0;
1977 memcpy(*to, from, len);
1978 *to += len;
1979}
1980
Cory Olmo3528a952006-09-29 01:58:44 -07001981static inline void take_selinux_option(char **to, char *from, int *first,
1982 int len)
1983{
1984 int current_size = 0;
1985
1986 if (!*first) {
1987 **to = '|';
1988 *to += 1;
1989 }
1990 else
1991 *first = 0;
1992
1993 while (current_size < len) {
1994 if (*from != '"') {
1995 **to = *from;
1996 *to += 1;
1997 }
1998 from += 1;
1999 current_size += 1;
2000 }
2001}
2002
Linus Torvalds1da177e2005-04-16 15:20:36 -07002003static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2004{
2005 int fnosec, fsec, rc = 0;
2006 char *in_save, *in_curr, *in_end;
2007 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002008 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002009
2010 in_curr = orig;
2011 sec_curr = copy;
2012
2013 /* Binary mount data: just copy */
2014 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2015 copy_page(sec_curr, in_curr);
2016 goto out;
2017 }
2018
2019 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2020 if (!nosec) {
2021 rc = -ENOMEM;
2022 goto out;
2023 }
2024
2025 nosec_save = nosec;
2026 fnosec = fsec = 1;
2027 in_save = in_end = orig;
2028
2029 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002030 if (*in_end == '"')
2031 open_quote = !open_quote;
2032 if ((*in_end == ',' && open_quote == 0) ||
2033 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002034 int len = in_end - in_curr;
2035
2036 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002037 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002038 else
2039 take_option(&nosec, in_curr, &fnosec, len);
2040
2041 in_curr = in_end + 1;
2042 }
2043 } while (*in_end++);
2044
Eric Paris6931dfc2005-06-30 02:58:51 -07002045 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002046 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002047out:
2048 return rc;
2049}
2050
2051static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2052{
2053 struct avc_audit_data ad;
2054 int rc;
2055
2056 rc = superblock_doinit(sb, data);
2057 if (rc)
2058 return rc;
2059
2060 AVC_AUDIT_DATA_INIT(&ad,FS);
2061 ad.u.fs.dentry = sb->s_root;
2062 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2063}
2064
David Howells726c3342006-06-23 02:02:58 -07002065static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002066{
2067 struct avc_audit_data ad;
2068
2069 AVC_AUDIT_DATA_INIT(&ad,FS);
David Howells726c3342006-06-23 02:02:58 -07002070 ad.u.fs.dentry = dentry->d_sb->s_root;
2071 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002072}
2073
2074static int selinux_mount(char * dev_name,
2075 struct nameidata *nd,
2076 char * type,
2077 unsigned long flags,
2078 void * data)
2079{
2080 int rc;
2081
2082 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2083 if (rc)
2084 return rc;
2085
2086 if (flags & MS_REMOUNT)
2087 return superblock_has_perm(current, nd->mnt->mnt_sb,
2088 FILESYSTEM__REMOUNT, NULL);
2089 else
2090 return dentry_has_perm(current, nd->mnt, nd->dentry,
2091 FILE__MOUNTON);
2092}
2093
2094static int selinux_umount(struct vfsmount *mnt, int flags)
2095{
2096 int rc;
2097
2098 rc = secondary_ops->sb_umount(mnt, flags);
2099 if (rc)
2100 return rc;
2101
2102 return superblock_has_perm(current,mnt->mnt_sb,
2103 FILESYSTEM__UNMOUNT,NULL);
2104}
2105
2106/* inode security operations */
2107
2108static int selinux_inode_alloc_security(struct inode *inode)
2109{
2110 return inode_alloc_security(inode);
2111}
2112
2113static void selinux_inode_free_security(struct inode *inode)
2114{
2115 inode_free_security(inode);
2116}
2117
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002118static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2119 char **name, void **value,
2120 size_t *len)
2121{
2122 struct task_security_struct *tsec;
2123 struct inode_security_struct *dsec;
2124 struct superblock_security_struct *sbsec;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002125 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002126 int rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002127 char *namep = NULL, *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002128
2129 tsec = current->security;
2130 dsec = dir->i_security;
2131 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002132
2133 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2134 newsid = tsec->create_sid;
2135 } else {
2136 rc = security_transition_sid(tsec->sid, dsec->sid,
2137 inode_mode_to_security_class(inode->i_mode),
2138 &newsid);
2139 if (rc) {
2140 printk(KERN_WARNING "%s: "
2141 "security_transition_sid failed, rc=%d (dev=%s "
2142 "ino=%ld)\n",
2143 __FUNCTION__,
2144 -rc, inode->i_sb->s_id, inode->i_ino);
2145 return rc;
2146 }
2147 }
2148
Eric Paris296fddf2006-09-25 23:32:00 -07002149 /* Possibly defer initialization to selinux_complete_init. */
2150 if (sbsec->initialized) {
2151 struct inode_security_struct *isec = inode->i_security;
2152 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2153 isec->sid = newsid;
2154 isec->initialized = 1;
2155 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002156
Stephen Smalley8aad3872006-03-22 00:09:13 -08002157 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
Stephen Smalley25a74f32005-11-08 21:34:33 -08002158 return -EOPNOTSUPP;
2159
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002160 if (name) {
2161 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2162 if (!namep)
2163 return -ENOMEM;
2164 *name = namep;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002165 }
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002166
2167 if (value && len) {
2168 rc = security_sid_to_context(newsid, &context, &clen);
2169 if (rc) {
2170 kfree(namep);
2171 return rc;
2172 }
2173 *value = context;
2174 *len = clen;
2175 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002176
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002177 return 0;
2178}
2179
Linus Torvalds1da177e2005-04-16 15:20:36 -07002180static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2181{
2182 return may_create(dir, dentry, SECCLASS_FILE);
2183}
2184
Linus Torvalds1da177e2005-04-16 15:20:36 -07002185static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2186{
2187 int rc;
2188
2189 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2190 if (rc)
2191 return rc;
2192 return may_link(dir, old_dentry, MAY_LINK);
2193}
2194
Linus Torvalds1da177e2005-04-16 15:20:36 -07002195static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2196{
2197 int rc;
2198
2199 rc = secondary_ops->inode_unlink(dir, dentry);
2200 if (rc)
2201 return rc;
2202 return may_link(dir, dentry, MAY_UNLINK);
2203}
2204
2205static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2206{
2207 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2208}
2209
Linus Torvalds1da177e2005-04-16 15:20:36 -07002210static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2211{
2212 return may_create(dir, dentry, SECCLASS_DIR);
2213}
2214
Linus Torvalds1da177e2005-04-16 15:20:36 -07002215static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2216{
2217 return may_link(dir, dentry, MAY_RMDIR);
2218}
2219
2220static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2221{
2222 int rc;
2223
2224 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2225 if (rc)
2226 return rc;
2227
2228 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2229}
2230
Linus Torvalds1da177e2005-04-16 15:20:36 -07002231static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2232 struct inode *new_inode, struct dentry *new_dentry)
2233{
2234 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2235}
2236
Linus Torvalds1da177e2005-04-16 15:20:36 -07002237static int selinux_inode_readlink(struct dentry *dentry)
2238{
2239 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2240}
2241
2242static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2243{
2244 int rc;
2245
2246 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2247 if (rc)
2248 return rc;
2249 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2250}
2251
2252static int selinux_inode_permission(struct inode *inode, int mask,
2253 struct nameidata *nd)
2254{
2255 int rc;
2256
2257 rc = secondary_ops->inode_permission(inode, mask, nd);
2258 if (rc)
2259 return rc;
2260
2261 if (!mask) {
2262 /* No permission to check. Existence test. */
2263 return 0;
2264 }
2265
2266 return inode_has_perm(current, inode,
2267 file_mask_to_av(inode->i_mode, mask), NULL);
2268}
2269
2270static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2271{
2272 int rc;
2273
2274 rc = secondary_ops->inode_setattr(dentry, iattr);
2275 if (rc)
2276 return rc;
2277
2278 if (iattr->ia_valid & ATTR_FORCE)
2279 return 0;
2280
2281 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2282 ATTR_ATIME_SET | ATTR_MTIME_SET))
2283 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2284
2285 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2286}
2287
2288static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2289{
2290 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2291}
2292
2293static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2294{
2295 struct task_security_struct *tsec = current->security;
2296 struct inode *inode = dentry->d_inode;
2297 struct inode_security_struct *isec = inode->i_security;
2298 struct superblock_security_struct *sbsec;
2299 struct avc_audit_data ad;
2300 u32 newsid;
2301 int rc = 0;
2302
2303 if (strcmp(name, XATTR_NAME_SELINUX)) {
2304 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2305 sizeof XATTR_SECURITY_PREFIX - 1) &&
2306 !capable(CAP_SYS_ADMIN)) {
2307 /* A different attribute in the security namespace.
2308 Restrict to administrator. */
2309 return -EPERM;
2310 }
2311
2312 /* Not an attribute we recognize, so just check the
2313 ordinary setattr permission. */
2314 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2315 }
2316
2317 sbsec = inode->i_sb->s_security;
2318 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2319 return -EOPNOTSUPP;
2320
2321 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2322 return -EPERM;
2323
2324 AVC_AUDIT_DATA_INIT(&ad,FS);
2325 ad.u.fs.dentry = dentry;
2326
2327 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2328 FILE__RELABELFROM, &ad);
2329 if (rc)
2330 return rc;
2331
2332 rc = security_context_to_sid(value, size, &newsid);
2333 if (rc)
2334 return rc;
2335
2336 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2337 FILE__RELABELTO, &ad);
2338 if (rc)
2339 return rc;
2340
2341 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2342 isec->sclass);
2343 if (rc)
2344 return rc;
2345
2346 return avc_has_perm(newsid,
2347 sbsec->sid,
2348 SECCLASS_FILESYSTEM,
2349 FILESYSTEM__ASSOCIATE,
2350 &ad);
2351}
2352
2353static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2354 void *value, size_t size, int flags)
2355{
2356 struct inode *inode = dentry->d_inode;
2357 struct inode_security_struct *isec = inode->i_security;
2358 u32 newsid;
2359 int rc;
2360
2361 if (strcmp(name, XATTR_NAME_SELINUX)) {
2362 /* Not an attribute we recognize, so nothing to do. */
2363 return;
2364 }
2365
2366 rc = security_context_to_sid(value, size, &newsid);
2367 if (rc) {
2368 printk(KERN_WARNING "%s: unable to obtain SID for context "
2369 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2370 return;
2371 }
2372
2373 isec->sid = newsid;
2374 return;
2375}
2376
2377static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2378{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002379 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2380}
2381
2382static int selinux_inode_listxattr (struct dentry *dentry)
2383{
2384 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2385}
2386
2387static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2388{
2389 if (strcmp(name, XATTR_NAME_SELINUX)) {
2390 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2391 sizeof XATTR_SECURITY_PREFIX - 1) &&
2392 !capable(CAP_SYS_ADMIN)) {
2393 /* A different attribute in the security namespace.
2394 Restrict to administrator. */
2395 return -EPERM;
2396 }
2397
2398 /* Not an attribute we recognize, so just check the
2399 ordinary setattr permission. Might want a separate
2400 permission for removexattr. */
2401 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2402 }
2403
2404 /* No one is allowed to remove a SELinux security label.
2405 You can change the label, but all data must be labeled. */
2406 return -EACCES;
2407}
2408
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002409static const char *selinux_inode_xattr_getsuffix(void)
2410{
2411 return XATTR_SELINUX_SUFFIX;
2412}
2413
James Morrisd381d8a2005-10-30 14:59:22 -08002414/*
2415 * Copy the in-core inode security context value to the user. If the
2416 * getxattr() prior to this succeeded, check to see if we need to
2417 * canonicalize the value to be finally returned to the user.
2418 *
2419 * Permission check is handled by selinux_inode_getxattr hook.
2420 */
Dustin Kirkland7306a0b2005-11-16 15:53:13 +00002421static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002422{
2423 struct inode_security_struct *isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002424
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002425 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2426 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002427
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002428 return selinux_getsecurity(isec->sid, buffer, size);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002429}
2430
2431static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2432 const void *value, size_t size, int flags)
2433{
2434 struct inode_security_struct *isec = inode->i_security;
2435 u32 newsid;
2436 int rc;
2437
2438 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2439 return -EOPNOTSUPP;
2440
2441 if (!value || !size)
2442 return -EACCES;
2443
2444 rc = security_context_to_sid((void*)value, size, &newsid);
2445 if (rc)
2446 return rc;
2447
2448 isec->sid = newsid;
2449 return 0;
2450}
2451
2452static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2453{
2454 const int len = sizeof(XATTR_NAME_SELINUX);
2455 if (buffer && len <= buffer_size)
2456 memcpy(buffer, XATTR_NAME_SELINUX, len);
2457 return len;
2458}
2459
2460/* file security operations */
2461
2462static int selinux_file_permission(struct file *file, int mask)
2463{
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07002464 int rc;
Josef Sipek3d5ff522006-12-08 02:37:38 -08002465 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002466
2467 if (!mask) {
2468 /* No permission to check. Existence test. */
2469 return 0;
2470 }
2471
2472 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2473 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2474 mask |= MAY_APPEND;
2475
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07002476 rc = file_has_perm(current, file,
2477 file_mask_to_av(inode->i_mode, mask));
2478 if (rc)
2479 return rc;
2480
2481 return selinux_netlbl_inode_permission(inode, mask);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002482}
2483
2484static int selinux_file_alloc_security(struct file *file)
2485{
2486 return file_alloc_security(file);
2487}
2488
2489static void selinux_file_free_security(struct file *file)
2490{
2491 file_free_security(file);
2492}
2493
2494static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2495 unsigned long arg)
2496{
2497 int error = 0;
2498
2499 switch (cmd) {
2500 case FIONREAD:
2501 /* fall through */
2502 case FIBMAP:
2503 /* fall through */
2504 case FIGETBSZ:
2505 /* fall through */
2506 case EXT2_IOC_GETFLAGS:
2507 /* fall through */
2508 case EXT2_IOC_GETVERSION:
2509 error = file_has_perm(current, file, FILE__GETATTR);
2510 break;
2511
2512 case EXT2_IOC_SETFLAGS:
2513 /* fall through */
2514 case EXT2_IOC_SETVERSION:
2515 error = file_has_perm(current, file, FILE__SETATTR);
2516 break;
2517
2518 /* sys_ioctl() checks */
2519 case FIONBIO:
2520 /* fall through */
2521 case FIOASYNC:
2522 error = file_has_perm(current, file, 0);
2523 break;
2524
2525 case KDSKBENT:
2526 case KDSKBSENT:
2527 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2528 break;
2529
2530 /* default case assumes that the command will go
2531 * to the file's ioctl() function.
2532 */
2533 default:
2534 error = file_has_perm(current, file, FILE__IOCTL);
2535
2536 }
2537 return error;
2538}
2539
2540static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2541{
2542#ifndef CONFIG_PPC32
2543 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2544 /*
2545 * We are making executable an anonymous mapping or a
2546 * private file mapping that will also be writable.
2547 * This has an additional check.
2548 */
2549 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2550 if (rc)
2551 return rc;
2552 }
2553#endif
2554
2555 if (file) {
2556 /* read access is always possible with a mapping */
2557 u32 av = FILE__READ;
2558
2559 /* write access only matters if the mapping is shared */
2560 if (shared && (prot & PROT_WRITE))
2561 av |= FILE__WRITE;
2562
2563 if (prot & PROT_EXEC)
2564 av |= FILE__EXECUTE;
2565
2566 return file_has_perm(current, file, av);
2567 }
2568 return 0;
2569}
2570
2571static int selinux_file_mmap(struct file *file, unsigned long reqprot,
Eric Parised032182007-06-28 15:55:21 -04002572 unsigned long prot, unsigned long flags,
2573 unsigned long addr, unsigned long addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002574{
Eric Parised032182007-06-28 15:55:21 -04002575 int rc = 0;
2576 u32 sid = ((struct task_security_struct*)(current->security))->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002577
Eric Parised032182007-06-28 15:55:21 -04002578 if (addr < mmap_min_addr)
2579 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2580 MEMPROTECT__MMAP_ZERO, NULL);
2581 if (rc || addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002582 return rc;
2583
2584 if (selinux_checkreqprot)
2585 prot = reqprot;
2586
2587 return file_map_prot_check(file, prot,
2588 (flags & MAP_TYPE) == MAP_SHARED);
2589}
2590
2591static int selinux_file_mprotect(struct vm_area_struct *vma,
2592 unsigned long reqprot,
2593 unsigned long prot)
2594{
2595 int rc;
2596
2597 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2598 if (rc)
2599 return rc;
2600
2601 if (selinux_checkreqprot)
2602 prot = reqprot;
2603
2604#ifndef CONFIG_PPC32
Stephen Smalleydb4c9642006-02-01 03:05:54 -08002605 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2606 rc = 0;
2607 if (vma->vm_start >= vma->vm_mm->start_brk &&
2608 vma->vm_end <= vma->vm_mm->brk) {
2609 rc = task_has_perm(current, current,
2610 PROCESS__EXECHEAP);
2611 } else if (!vma->vm_file &&
2612 vma->vm_start <= vma->vm_mm->start_stack &&
2613 vma->vm_end >= vma->vm_mm->start_stack) {
2614 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2615 } else if (vma->vm_file && vma->anon_vma) {
2616 /*
2617 * We are making executable a file mapping that has
2618 * had some COW done. Since pages might have been
2619 * written, check ability to execute the possibly
2620 * modified content. This typically should only
2621 * occur for text relocations.
2622 */
2623 rc = file_has_perm(current, vma->vm_file,
2624 FILE__EXECMOD);
2625 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07002626 if (rc)
2627 return rc;
2628 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002629#endif
2630
2631 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2632}
2633
2634static int selinux_file_lock(struct file *file, unsigned int cmd)
2635{
2636 return file_has_perm(current, file, FILE__LOCK);
2637}
2638
2639static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2640 unsigned long arg)
2641{
2642 int err = 0;
2643
2644 switch (cmd) {
2645 case F_SETFL:
Josef Sipek3d5ff522006-12-08 02:37:38 -08002646 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002647 err = -EINVAL;
2648 break;
2649 }
2650
2651 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2652 err = file_has_perm(current, file,FILE__WRITE);
2653 break;
2654 }
2655 /* fall through */
2656 case F_SETOWN:
2657 case F_SETSIG:
2658 case F_GETFL:
2659 case F_GETOWN:
2660 case F_GETSIG:
2661 /* Just check FD__USE permission */
2662 err = file_has_perm(current, file, 0);
2663 break;
2664 case F_GETLK:
2665 case F_SETLK:
2666 case F_SETLKW:
2667#if BITS_PER_LONG == 32
2668 case F_GETLK64:
2669 case F_SETLK64:
2670 case F_SETLKW64:
2671#endif
Josef Sipek3d5ff522006-12-08 02:37:38 -08002672 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002673 err = -EINVAL;
2674 break;
2675 }
2676 err = file_has_perm(current, file, FILE__LOCK);
2677 break;
2678 }
2679
2680 return err;
2681}
2682
2683static int selinux_file_set_fowner(struct file *file)
2684{
2685 struct task_security_struct *tsec;
2686 struct file_security_struct *fsec;
2687
2688 tsec = current->security;
2689 fsec = file->f_security;
2690 fsec->fown_sid = tsec->sid;
2691
2692 return 0;
2693}
2694
2695static int selinux_file_send_sigiotask(struct task_struct *tsk,
2696 struct fown_struct *fown, int signum)
2697{
2698 struct file *file;
2699 u32 perm;
2700 struct task_security_struct *tsec;
2701 struct file_security_struct *fsec;
2702
2703 /* struct fown_struct is never outside the context of a struct file */
Robert P. J. Dayb385a142007-02-10 01:46:25 -08002704 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002705
2706 tsec = tsk->security;
2707 fsec = file->f_security;
2708
2709 if (!signum)
2710 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2711 else
2712 perm = signal_to_av(signum);
2713
2714 return avc_has_perm(fsec->fown_sid, tsec->sid,
2715 SECCLASS_PROCESS, perm, NULL);
2716}
2717
2718static int selinux_file_receive(struct file *file)
2719{
2720 return file_has_perm(current, file, file_to_av(file));
2721}
2722
2723/* task security operations */
2724
2725static int selinux_task_create(unsigned long clone_flags)
2726{
2727 int rc;
2728
2729 rc = secondary_ops->task_create(clone_flags);
2730 if (rc)
2731 return rc;
2732
2733 return task_has_perm(current, current, PROCESS__FORK);
2734}
2735
2736static int selinux_task_alloc_security(struct task_struct *tsk)
2737{
2738 struct task_security_struct *tsec1, *tsec2;
2739 int rc;
2740
2741 tsec1 = current->security;
2742
2743 rc = task_alloc_security(tsk);
2744 if (rc)
2745 return rc;
2746 tsec2 = tsk->security;
2747
2748 tsec2->osid = tsec1->osid;
2749 tsec2->sid = tsec1->sid;
2750
Michael LeMay28eba5b2006-06-27 02:53:42 -07002751 /* Retain the exec, fs, key, and sock SIDs across fork */
Linus Torvalds1da177e2005-04-16 15:20:36 -07002752 tsec2->exec_sid = tsec1->exec_sid;
2753 tsec2->create_sid = tsec1->create_sid;
Michael LeMay28eba5b2006-06-27 02:53:42 -07002754 tsec2->keycreate_sid = tsec1->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07002755 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002756
2757 /* Retain ptracer SID across fork, if any.
2758 This will be reset by the ptrace hook upon any
2759 subsequent ptrace_attach operations. */
2760 tsec2->ptrace_sid = tsec1->ptrace_sid;
2761
2762 return 0;
2763}
2764
2765static void selinux_task_free_security(struct task_struct *tsk)
2766{
2767 task_free_security(tsk);
2768}
2769
2770static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2771{
2772 /* Since setuid only affects the current process, and
2773 since the SELinux controls are not based on the Linux
2774 identity attributes, SELinux does not need to control
2775 this operation. However, SELinux does control the use
2776 of the CAP_SETUID and CAP_SETGID capabilities using the
2777 capable hook. */
2778 return 0;
2779}
2780
2781static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2782{
2783 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2784}
2785
2786static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2787{
2788 /* See the comment for setuid above. */
2789 return 0;
2790}
2791
2792static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2793{
2794 return task_has_perm(current, p, PROCESS__SETPGID);
2795}
2796
2797static int selinux_task_getpgid(struct task_struct *p)
2798{
2799 return task_has_perm(current, p, PROCESS__GETPGID);
2800}
2801
2802static int selinux_task_getsid(struct task_struct *p)
2803{
2804 return task_has_perm(current, p, PROCESS__GETSESSION);
2805}
2806
David Quigleyf9008e42006-06-30 01:55:46 -07002807static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2808{
2809 selinux_get_task_sid(p, secid);
2810}
2811
Linus Torvalds1da177e2005-04-16 15:20:36 -07002812static int selinux_task_setgroups(struct group_info *group_info)
2813{
2814 /* See the comment for setuid above. */
2815 return 0;
2816}
2817
2818static int selinux_task_setnice(struct task_struct *p, int nice)
2819{
2820 int rc;
2821
2822 rc = secondary_ops->task_setnice(p, nice);
2823 if (rc)
2824 return rc;
2825
2826 return task_has_perm(current,p, PROCESS__SETSCHED);
2827}
2828
James Morris03e68062006-06-23 02:03:58 -07002829static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2830{
2831 return task_has_perm(current, p, PROCESS__SETSCHED);
2832}
2833
David Quigleya1836a42006-06-30 01:55:49 -07002834static int selinux_task_getioprio(struct task_struct *p)
2835{
2836 return task_has_perm(current, p, PROCESS__GETSCHED);
2837}
2838
Linus Torvalds1da177e2005-04-16 15:20:36 -07002839static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2840{
2841 struct rlimit *old_rlim = current->signal->rlim + resource;
2842 int rc;
2843
2844 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2845 if (rc)
2846 return rc;
2847
2848 /* Control the ability to change the hard limit (whether
2849 lowering or raising it), so that the hard limit can
2850 later be used as a safe reset point for the soft limit
2851 upon context transitions. See selinux_bprm_apply_creds. */
2852 if (old_rlim->rlim_max != new_rlim->rlim_max)
2853 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2854
2855 return 0;
2856}
2857
2858static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2859{
2860 return task_has_perm(current, p, PROCESS__SETSCHED);
2861}
2862
2863static int selinux_task_getscheduler(struct task_struct *p)
2864{
2865 return task_has_perm(current, p, PROCESS__GETSCHED);
2866}
2867
David Quigley35601542006-06-23 02:04:01 -07002868static int selinux_task_movememory(struct task_struct *p)
2869{
2870 return task_has_perm(current, p, PROCESS__SETSCHED);
2871}
2872
David Quigleyf9008e42006-06-30 01:55:46 -07002873static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2874 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002875{
2876 u32 perm;
2877 int rc;
David Quigleyf9008e42006-06-30 01:55:46 -07002878 struct task_security_struct *tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002879
David Quigleyf9008e42006-06-30 01:55:46 -07002880 rc = secondary_ops->task_kill(p, info, sig, secid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002881 if (rc)
2882 return rc;
2883
Oleg Nesterov621d3122005-10-30 15:03:45 -08002884 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002885 return 0;
2886
2887 if (!sig)
2888 perm = PROCESS__SIGNULL; /* null signal; existence test */
2889 else
2890 perm = signal_to_av(sig);
David Quigleyf9008e42006-06-30 01:55:46 -07002891 tsec = p->security;
2892 if (secid)
2893 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2894 else
2895 rc = task_has_perm(current, p, perm);
2896 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002897}
2898
2899static int selinux_task_prctl(int option,
2900 unsigned long arg2,
2901 unsigned long arg3,
2902 unsigned long arg4,
2903 unsigned long arg5)
2904{
2905 /* The current prctl operations do not appear to require
2906 any SELinux controls since they merely observe or modify
2907 the state of the current process. */
2908 return 0;
2909}
2910
2911static int selinux_task_wait(struct task_struct *p)
2912{
2913 u32 perm;
2914
2915 perm = signal_to_av(p->exit_signal);
2916
2917 return task_has_perm(p, current, perm);
2918}
2919
2920static void selinux_task_reparent_to_init(struct task_struct *p)
2921{
2922 struct task_security_struct *tsec;
2923
2924 secondary_ops->task_reparent_to_init(p);
2925
2926 tsec = p->security;
2927 tsec->osid = tsec->sid;
2928 tsec->sid = SECINITSID_KERNEL;
2929 return;
2930}
2931
2932static void selinux_task_to_inode(struct task_struct *p,
2933 struct inode *inode)
2934{
2935 struct task_security_struct *tsec = p->security;
2936 struct inode_security_struct *isec = inode->i_security;
2937
2938 isec->sid = tsec->sid;
2939 isec->initialized = 1;
2940 return;
2941}
2942
Linus Torvalds1da177e2005-04-16 15:20:36 -07002943/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06002944static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2945 struct avc_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002946{
2947 int offset, ihlen, ret = -EINVAL;
2948 struct iphdr _iph, *ih;
2949
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03002950 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002951 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2952 if (ih == NULL)
2953 goto out;
2954
2955 ihlen = ih->ihl * 4;
2956 if (ihlen < sizeof(_iph))
2957 goto out;
2958
2959 ad->u.net.v4info.saddr = ih->saddr;
2960 ad->u.net.v4info.daddr = ih->daddr;
2961 ret = 0;
2962
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06002963 if (proto)
2964 *proto = ih->protocol;
2965
Linus Torvalds1da177e2005-04-16 15:20:36 -07002966 switch (ih->protocol) {
2967 case IPPROTO_TCP: {
2968 struct tcphdr _tcph, *th;
2969
2970 if (ntohs(ih->frag_off) & IP_OFFSET)
2971 break;
2972
2973 offset += ihlen;
2974 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2975 if (th == NULL)
2976 break;
2977
2978 ad->u.net.sport = th->source;
2979 ad->u.net.dport = th->dest;
2980 break;
2981 }
2982
2983 case IPPROTO_UDP: {
2984 struct udphdr _udph, *uh;
2985
2986 if (ntohs(ih->frag_off) & IP_OFFSET)
2987 break;
2988
2989 offset += ihlen;
2990 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2991 if (uh == NULL)
2992 break;
2993
2994 ad->u.net.sport = uh->source;
2995 ad->u.net.dport = uh->dest;
2996 break;
2997 }
2998
James Morris2ee92d42006-11-13 16:09:01 -08002999 case IPPROTO_DCCP: {
3000 struct dccp_hdr _dccph, *dh;
3001
3002 if (ntohs(ih->frag_off) & IP_OFFSET)
3003 break;
3004
3005 offset += ihlen;
3006 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3007 if (dh == NULL)
3008 break;
3009
3010 ad->u.net.sport = dh->dccph_sport;
3011 ad->u.net.dport = dh->dccph_dport;
3012 break;
3013 }
3014
Linus Torvalds1da177e2005-04-16 15:20:36 -07003015 default:
3016 break;
3017 }
3018out:
3019 return ret;
3020}
3021
3022#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3023
3024/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003025static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3026 struct avc_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003027{
3028 u8 nexthdr;
3029 int ret = -EINVAL, offset;
3030 struct ipv6hdr _ipv6h, *ip6;
3031
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003032 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003033 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3034 if (ip6 == NULL)
3035 goto out;
3036
3037 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3038 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3039 ret = 0;
3040
3041 nexthdr = ip6->nexthdr;
3042 offset += sizeof(_ipv6h);
Herbert Xu0d3d0772005-04-24 20:16:19 -07003043 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003044 if (offset < 0)
3045 goto out;
3046
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003047 if (proto)
3048 *proto = nexthdr;
3049
Linus Torvalds1da177e2005-04-16 15:20:36 -07003050 switch (nexthdr) {
3051 case IPPROTO_TCP: {
3052 struct tcphdr _tcph, *th;
3053
3054 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3055 if (th == NULL)
3056 break;
3057
3058 ad->u.net.sport = th->source;
3059 ad->u.net.dport = th->dest;
3060 break;
3061 }
3062
3063 case IPPROTO_UDP: {
3064 struct udphdr _udph, *uh;
3065
3066 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3067 if (uh == NULL)
3068 break;
3069
3070 ad->u.net.sport = uh->source;
3071 ad->u.net.dport = uh->dest;
3072 break;
3073 }
3074
James Morris2ee92d42006-11-13 16:09:01 -08003075 case IPPROTO_DCCP: {
3076 struct dccp_hdr _dccph, *dh;
3077
3078 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3079 if (dh == NULL)
3080 break;
3081
3082 ad->u.net.sport = dh->dccph_sport;
3083 ad->u.net.dport = dh->dccph_dport;
3084 break;
3085 }
3086
Linus Torvalds1da177e2005-04-16 15:20:36 -07003087 /* includes fragments */
3088 default:
3089 break;
3090 }
3091out:
3092 return ret;
3093}
3094
3095#endif /* IPV6 */
3096
3097static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003098 char **addrp, int *len, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003099{
3100 int ret = 0;
3101
3102 switch (ad->u.net.family) {
3103 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003104 ret = selinux_parse_skb_ipv4(skb, ad, proto);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003105 if (ret || !addrp)
3106 break;
3107 *len = 4;
3108 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3109 &ad->u.net.v4info.daddr);
3110 break;
3111
3112#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3113 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003114 ret = selinux_parse_skb_ipv6(skb, ad, proto);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003115 if (ret || !addrp)
3116 break;
3117 *len = 16;
3118 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3119 &ad->u.net.v6info.daddr);
3120 break;
3121#endif /* IPV6 */
3122 default:
3123 break;
3124 }
3125
3126 return ret;
3127}
3128
Paul Moore4f6a9932007-03-01 14:35:22 -05003129/**
3130 * selinux_skb_extlbl_sid - Determine the external label of a packet
3131 * @skb: the packet
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003132 * @base_sid: the SELinux SID to use as a context for MLS only external labels
Paul Moore4f6a9932007-03-01 14:35:22 -05003133 * @sid: the packet's SID
3134 *
3135 * Description:
3136 * Check the various different forms of external packet labeling and determine
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003137 * the external SID for the packet.
Paul Moore4f6a9932007-03-01 14:35:22 -05003138 *
3139 */
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003140static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3141 u32 base_sid,
3142 u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05003143{
3144 u32 xfrm_sid;
3145 u32 nlbl_sid;
3146
3147 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3148 if (selinux_netlbl_skbuff_getsid(skb,
3149 (xfrm_sid == SECSID_NULL ?
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003150 base_sid : xfrm_sid),
Paul Moore4f6a9932007-03-01 14:35:22 -05003151 &nlbl_sid) != 0)
3152 nlbl_sid = SECSID_NULL;
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003153
Paul Moore4f6a9932007-03-01 14:35:22 -05003154 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3155}
3156
Linus Torvalds1da177e2005-04-16 15:20:36 -07003157/* socket security operations */
3158static int socket_has_perm(struct task_struct *task, struct socket *sock,
3159 u32 perms)
3160{
3161 struct inode_security_struct *isec;
3162 struct task_security_struct *tsec;
3163 struct avc_audit_data ad;
3164 int err = 0;
3165
3166 tsec = task->security;
3167 isec = SOCK_INODE(sock)->i_security;
3168
3169 if (isec->sid == SECINITSID_KERNEL)
3170 goto out;
3171
3172 AVC_AUDIT_DATA_INIT(&ad,NET);
3173 ad.u.net.sk = sock->sk;
3174 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3175
3176out:
3177 return err;
3178}
3179
3180static int selinux_socket_create(int family, int type,
3181 int protocol, int kern)
3182{
3183 int err = 0;
3184 struct task_security_struct *tsec;
Eric Paris42c3e032006-06-26 00:26:03 -07003185 u32 newsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003186
3187 if (kern)
3188 goto out;
3189
3190 tsec = current->security;
Eric Paris42c3e032006-06-26 00:26:03 -07003191 newsid = tsec->sockcreate_sid ? : tsec->sid;
3192 err = avc_has_perm(tsec->sid, newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003193 socket_type_to_security_class(family, type,
3194 protocol), SOCKET__CREATE, NULL);
3195
3196out:
3197 return err;
3198}
3199
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003200static int selinux_socket_post_create(struct socket *sock, int family,
3201 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003202{
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003203 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003204 struct inode_security_struct *isec;
3205 struct task_security_struct *tsec;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003206 struct sk_security_struct *sksec;
Eric Paris42c3e032006-06-26 00:26:03 -07003207 u32 newsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003208
3209 isec = SOCK_INODE(sock)->i_security;
3210
3211 tsec = current->security;
Eric Paris42c3e032006-06-26 00:26:03 -07003212 newsid = tsec->sockcreate_sid ? : tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003213 isec->sclass = socket_type_to_security_class(family, type, protocol);
Eric Paris42c3e032006-06-26 00:26:03 -07003214 isec->sid = kern ? SECINITSID_KERNEL : newsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003215 isec->initialized = 1;
3216
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003217 if (sock->sk) {
3218 sksec = sock->sk->sk_security;
3219 sksec->sid = isec->sid;
Paul Moore9f2ad662006-11-17 17:38:53 -05003220 err = selinux_netlbl_socket_post_create(sock);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003221 }
3222
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003223 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003224}
3225
3226/* Range of port numbers used to automatically bind.
3227 Need to determine whether we should perform a name_bind
3228 permission check between the socket and the port number. */
3229#define ip_local_port_range_0 sysctl_local_port_range[0]
3230#define ip_local_port_range_1 sysctl_local_port_range[1]
3231
3232static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3233{
3234 u16 family;
3235 int err;
3236
3237 err = socket_has_perm(current, sock, SOCKET__BIND);
3238 if (err)
3239 goto out;
3240
3241 /*
3242 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04003243 * Multiple address binding for SCTP is not supported yet: we just
3244 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003245 */
3246 family = sock->sk->sk_family;
3247 if (family == PF_INET || family == PF_INET6) {
3248 char *addrp;
3249 struct inode_security_struct *isec;
3250 struct task_security_struct *tsec;
3251 struct avc_audit_data ad;
3252 struct sockaddr_in *addr4 = NULL;
3253 struct sockaddr_in6 *addr6 = NULL;
3254 unsigned short snum;
3255 struct sock *sk = sock->sk;
3256 u32 sid, node_perm, addrlen;
3257
3258 tsec = current->security;
3259 isec = SOCK_INODE(sock)->i_security;
3260
3261 if (family == PF_INET) {
3262 addr4 = (struct sockaddr_in *)address;
3263 snum = ntohs(addr4->sin_port);
3264 addrlen = sizeof(addr4->sin_addr.s_addr);
3265 addrp = (char *)&addr4->sin_addr.s_addr;
3266 } else {
3267 addr6 = (struct sockaddr_in6 *)address;
3268 snum = ntohs(addr6->sin6_port);
3269 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3270 addrp = (char *)&addr6->sin6_addr.s6_addr;
3271 }
3272
3273 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3274 snum > ip_local_port_range_1)) {
3275 err = security_port_sid(sk->sk_family, sk->sk_type,
3276 sk->sk_protocol, snum, &sid);
3277 if (err)
3278 goto out;
3279 AVC_AUDIT_DATA_INIT(&ad,NET);
3280 ad.u.net.sport = htons(snum);
3281 ad.u.net.family = family;
3282 err = avc_has_perm(isec->sid, sid,
3283 isec->sclass,
3284 SOCKET__NAME_BIND, &ad);
3285 if (err)
3286 goto out;
3287 }
3288
James Morris13402582005-09-30 14:24:34 -04003289 switch(isec->sclass) {
3290 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003291 node_perm = TCP_SOCKET__NODE_BIND;
3292 break;
3293
James Morris13402582005-09-30 14:24:34 -04003294 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003295 node_perm = UDP_SOCKET__NODE_BIND;
3296 break;
James Morris2ee92d42006-11-13 16:09:01 -08003297
3298 case SECCLASS_DCCP_SOCKET:
3299 node_perm = DCCP_SOCKET__NODE_BIND;
3300 break;
3301
Linus Torvalds1da177e2005-04-16 15:20:36 -07003302 default:
3303 node_perm = RAWIP_SOCKET__NODE_BIND;
3304 break;
3305 }
3306
3307 err = security_node_sid(family, addrp, addrlen, &sid);
3308 if (err)
3309 goto out;
3310
3311 AVC_AUDIT_DATA_INIT(&ad,NET);
3312 ad.u.net.sport = htons(snum);
3313 ad.u.net.family = family;
3314
3315 if (family == PF_INET)
3316 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3317 else
3318 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3319
3320 err = avc_has_perm(isec->sid, sid,
3321 isec->sclass, node_perm, &ad);
3322 if (err)
3323 goto out;
3324 }
3325out:
3326 return err;
3327}
3328
3329static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3330{
3331 struct inode_security_struct *isec;
3332 int err;
3333
3334 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3335 if (err)
3336 return err;
3337
3338 /*
James Morris2ee92d42006-11-13 16:09:01 -08003339 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003340 */
3341 isec = SOCK_INODE(sock)->i_security;
James Morris2ee92d42006-11-13 16:09:01 -08003342 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3343 isec->sclass == SECCLASS_DCCP_SOCKET) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003344 struct sock *sk = sock->sk;
3345 struct avc_audit_data ad;
3346 struct sockaddr_in *addr4 = NULL;
3347 struct sockaddr_in6 *addr6 = NULL;
3348 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08003349 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003350
3351 if (sk->sk_family == PF_INET) {
3352 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003353 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003354 return -EINVAL;
3355 snum = ntohs(addr4->sin_port);
3356 } else {
3357 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003358 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003359 return -EINVAL;
3360 snum = ntohs(addr6->sin6_port);
3361 }
3362
3363 err = security_port_sid(sk->sk_family, sk->sk_type,
3364 sk->sk_protocol, snum, &sid);
3365 if (err)
3366 goto out;
3367
James Morris2ee92d42006-11-13 16:09:01 -08003368 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3369 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3370
Linus Torvalds1da177e2005-04-16 15:20:36 -07003371 AVC_AUDIT_DATA_INIT(&ad,NET);
3372 ad.u.net.dport = htons(snum);
3373 ad.u.net.family = sk->sk_family;
James Morris2ee92d42006-11-13 16:09:01 -08003374 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003375 if (err)
3376 goto out;
3377 }
3378
3379out:
3380 return err;
3381}
3382
3383static int selinux_socket_listen(struct socket *sock, int backlog)
3384{
3385 return socket_has_perm(current, sock, SOCKET__LISTEN);
3386}
3387
3388static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3389{
3390 int err;
3391 struct inode_security_struct *isec;
3392 struct inode_security_struct *newisec;
3393
3394 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3395 if (err)
3396 return err;
3397
3398 newisec = SOCK_INODE(newsock)->i_security;
3399
3400 isec = SOCK_INODE(sock)->i_security;
3401 newisec->sclass = isec->sclass;
3402 newisec->sid = isec->sid;
3403 newisec->initialized = 1;
3404
3405 return 0;
3406}
3407
3408static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3409 int size)
3410{
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003411 int rc;
3412
3413 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3414 if (rc)
3415 return rc;
3416
3417 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003418}
3419
3420static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3421 int size, int flags)
3422{
3423 return socket_has_perm(current, sock, SOCKET__READ);
3424}
3425
3426static int selinux_socket_getsockname(struct socket *sock)
3427{
3428 return socket_has_perm(current, sock, SOCKET__GETATTR);
3429}
3430
3431static int selinux_socket_getpeername(struct socket *sock)
3432{
3433 return socket_has_perm(current, sock, SOCKET__GETATTR);
3434}
3435
3436static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3437{
Paul Mooref8687af2006-10-30 15:22:15 -08003438 int err;
3439
3440 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3441 if (err)
3442 return err;
3443
3444 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003445}
3446
3447static int selinux_socket_getsockopt(struct socket *sock, int level,
3448 int optname)
3449{
3450 return socket_has_perm(current, sock, SOCKET__GETOPT);
3451}
3452
3453static int selinux_socket_shutdown(struct socket *sock, int how)
3454{
3455 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3456}
3457
3458static int selinux_socket_unix_stream_connect(struct socket *sock,
3459 struct socket *other,
3460 struct sock *newsk)
3461{
3462 struct sk_security_struct *ssec;
3463 struct inode_security_struct *isec;
3464 struct inode_security_struct *other_isec;
3465 struct avc_audit_data ad;
3466 int err;
3467
3468 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3469 if (err)
3470 return err;
3471
3472 isec = SOCK_INODE(sock)->i_security;
3473 other_isec = SOCK_INODE(other)->i_security;
3474
3475 AVC_AUDIT_DATA_INIT(&ad,NET);
3476 ad.u.net.sk = other->sk;
3477
3478 err = avc_has_perm(isec->sid, other_isec->sid,
3479 isec->sclass,
3480 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3481 if (err)
3482 return err;
3483
3484 /* connecting socket */
3485 ssec = sock->sk->sk_security;
3486 ssec->peer_sid = other_isec->sid;
3487
3488 /* server child socket */
3489 ssec = newsk->sk_security;
3490 ssec->peer_sid = isec->sid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003491 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3492
3493 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003494}
3495
3496static int selinux_socket_unix_may_send(struct socket *sock,
3497 struct socket *other)
3498{
3499 struct inode_security_struct *isec;
3500 struct inode_security_struct *other_isec;
3501 struct avc_audit_data ad;
3502 int err;
3503
3504 isec = SOCK_INODE(sock)->i_security;
3505 other_isec = SOCK_INODE(other)->i_security;
3506
3507 AVC_AUDIT_DATA_INIT(&ad,NET);
3508 ad.u.net.sk = other->sk;
3509
3510 err = avc_has_perm(isec->sid, other_isec->sid,
3511 isec->sclass, SOCKET__SENDTO, &ad);
3512 if (err)
3513 return err;
3514
3515 return 0;
3516}
3517
James Morris4e5ab4c2006-06-09 00:33:33 -07003518static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003519 struct avc_audit_data *ad, u16 family, char *addrp, int len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003520{
James Morris4e5ab4c2006-06-09 00:33:33 -07003521 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003522 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003523 struct socket *sock;
3524 u16 sock_class = 0;
3525 u32 sock_sid = 0;
3526
3527 read_lock_bh(&sk->sk_callback_lock);
3528 sock = sk->sk_socket;
3529 if (sock) {
3530 struct inode *inode;
3531 inode = SOCK_INODE(sock);
3532 if (inode) {
3533 struct inode_security_struct *isec;
3534 isec = inode->i_security;
3535 sock_sid = isec->sid;
3536 sock_class = isec->sclass;
3537 }
3538 }
3539 read_unlock_bh(&sk->sk_callback_lock);
3540 if (!sock_sid)
3541 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003542
James Morris4e5ab4c2006-06-09 00:33:33 -07003543 if (!skb->dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003544 goto out;
3545
James Morris4e5ab4c2006-06-09 00:33:33 -07003546 err = sel_netif_sids(skb->dev, &if_sid, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003547 if (err)
3548 goto out;
3549
3550 switch (sock_class) {
3551 case SECCLASS_UDP_SOCKET:
3552 netif_perm = NETIF__UDP_RECV;
3553 node_perm = NODE__UDP_RECV;
3554 recv_perm = UDP_SOCKET__RECV_MSG;
3555 break;
3556
3557 case SECCLASS_TCP_SOCKET:
3558 netif_perm = NETIF__TCP_RECV;
3559 node_perm = NODE__TCP_RECV;
3560 recv_perm = TCP_SOCKET__RECV_MSG;
3561 break;
James Morris2ee92d42006-11-13 16:09:01 -08003562
3563 case SECCLASS_DCCP_SOCKET:
3564 netif_perm = NETIF__DCCP_RECV;
3565 node_perm = NODE__DCCP_RECV;
3566 recv_perm = DCCP_SOCKET__RECV_MSG;
3567 break;
3568
Linus Torvalds1da177e2005-04-16 15:20:36 -07003569 default:
3570 netif_perm = NETIF__RAWIP_RECV;
3571 node_perm = NODE__RAWIP_RECV;
3572 break;
3573 }
3574
James Morris4e5ab4c2006-06-09 00:33:33 -07003575 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003576 if (err)
3577 goto out;
3578
Linus Torvalds1da177e2005-04-16 15:20:36 -07003579 err = security_node_sid(family, addrp, len, &node_sid);
3580 if (err)
3581 goto out;
3582
James Morris4e5ab4c2006-06-09 00:33:33 -07003583 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003584 if (err)
3585 goto out;
3586
3587 if (recv_perm) {
3588 u32 port_sid;
3589
Linus Torvalds1da177e2005-04-16 15:20:36 -07003590 err = security_port_sid(sk->sk_family, sk->sk_type,
James Morris4e5ab4c2006-06-09 00:33:33 -07003591 sk->sk_protocol, ntohs(ad->u.net.sport),
Linus Torvalds1da177e2005-04-16 15:20:36 -07003592 &port_sid);
3593 if (err)
3594 goto out;
3595
3596 err = avc_has_perm(sock_sid, port_sid,
James Morris4e5ab4c2006-06-09 00:33:33 -07003597 sock_class, recv_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003598 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003599
James Morris4e5ab4c2006-06-09 00:33:33 -07003600out:
3601 return err;
3602}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003603
James Morris4e5ab4c2006-06-09 00:33:33 -07003604static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3605{
3606 u16 family;
James Morris4e5ab4c2006-06-09 00:33:33 -07003607 char *addrp;
3608 int len, err = 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07003609 struct avc_audit_data ad;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003610 struct sk_security_struct *sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07003611
3612 family = sk->sk_family;
3613 if (family != PF_INET && family != PF_INET6)
3614 goto out;
3615
3616 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00003617 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07003618 family = PF_INET;
3619
James Morris4e5ab4c2006-06-09 00:33:33 -07003620 AVC_AUDIT_DATA_INIT(&ad, NET);
3621 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3622 ad.u.net.family = family;
3623
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003624 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07003625 if (err)
3626 goto out;
3627
3628 if (selinux_compat_net)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003629 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
James Morris4e5ab4c2006-06-09 00:33:33 -07003630 addrp, len);
3631 else
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003632 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
James Morris4e5ab4c2006-06-09 00:33:33 -07003633 PACKET__RECV, &ad);
3634 if (err)
3635 goto out;
3636
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003637 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3638 if (err)
3639 goto out;
3640
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003641 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003642out:
3643 return err;
3644}
3645
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003646static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3647 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003648{
3649 int err = 0;
3650 char *scontext;
3651 u32 scontext_len;
3652 struct sk_security_struct *ssec;
3653 struct inode_security_struct *isec;
Paul Moore3de4bab2006-11-17 17:38:54 -05003654 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003655
3656 isec = SOCK_INODE(sock)->i_security;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003657
Paul Moore3de4bab2006-11-17 17:38:54 -05003658 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3659 isec->sclass == SECCLASS_TCP_SOCKET) {
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003660 ssec = sock->sk->sk_security;
3661 peer_sid = ssec->peer_sid;
3662 }
Paul Moore3de4bab2006-11-17 17:38:54 -05003663 if (peer_sid == SECSID_NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003664 err = -ENOPROTOOPT;
3665 goto out;
3666 }
3667
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003668 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3669
Linus Torvalds1da177e2005-04-16 15:20:36 -07003670 if (err)
3671 goto out;
3672
3673 if (scontext_len > len) {
3674 err = -ERANGE;
3675 goto out_len;
3676 }
3677
3678 if (copy_to_user(optval, scontext, scontext_len))
3679 err = -EFAULT;
3680
3681out_len:
3682 if (put_user(scontext_len, optlen))
3683 err = -EFAULT;
3684
3685 kfree(scontext);
3686out:
3687 return err;
3688}
3689
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003690static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003691{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003692 u32 peer_secid = SECSID_NULL;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003693 int err = 0;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07003694
Paul Moore3de4bab2006-11-17 17:38:54 -05003695 if (sock && sock->sk->sk_family == PF_UNIX)
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003696 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
Paul Moore3de4bab2006-11-17 17:38:54 -05003697 else if (skb)
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003698 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003699
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003700 if (peer_secid == SECSID_NULL)
3701 err = -EINVAL;
3702 *secid = peer_secid;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003703
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003704 return err;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003705}
3706
Al Viro7d877f32005-10-21 03:20:43 -04003707static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003708{
3709 return sk_alloc_security(sk, family, priority);
3710}
3711
3712static void selinux_sk_free_security(struct sock *sk)
3713{
3714 sk_free_security(sk);
3715}
3716
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003717static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3718{
3719 struct sk_security_struct *ssec = sk->sk_security;
3720 struct sk_security_struct *newssec = newsk->sk_security;
3721
3722 newssec->sid = ssec->sid;
3723 newssec->peer_sid = ssec->peer_sid;
Paul Moore99f59ed2006-08-29 17:53:48 -07003724
Paul Moore9f2ad662006-11-17 17:38:53 -05003725 selinux_netlbl_sk_security_clone(ssec, newssec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003726}
3727
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07003728static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003729{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003730 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07003731 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003732 else {
3733 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003734
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07003735 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003736 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003737}
3738
Adrian Bunk9a673e52006-08-15 00:03:53 -07003739static void selinux_sock_graft(struct sock* sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003740{
3741 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3742 struct sk_security_struct *sksec = sk->sk_security;
3743
David Woodhouse2148ccc2006-09-29 15:50:25 -07003744 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3745 sk->sk_family == PF_UNIX)
3746 isec->sid = sksec->sid;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003747
3748 selinux_netlbl_sock_graft(sk, parent);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003749}
3750
Adrian Bunk9a673e52006-08-15 00:03:53 -07003751static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3752 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003753{
3754 struct sk_security_struct *sksec = sk->sk_security;
3755 int err;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003756 u32 newsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003757 u32 peersid;
3758
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003759 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07003760 if (peersid == SECSID_NULL) {
3761 req->secid = sksec->sid;
Paul Moore3de4bab2006-11-17 17:38:54 -05003762 req->peer_secid = SECSID_NULL;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07003763 return 0;
3764 }
3765
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003766 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3767 if (err)
3768 return err;
3769
3770 req->secid = newsid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003771 req->peer_secid = peersid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003772 return 0;
3773}
3774
Adrian Bunk9a673e52006-08-15 00:03:53 -07003775static void selinux_inet_csk_clone(struct sock *newsk,
3776 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003777{
3778 struct sk_security_struct *newsksec = newsk->sk_security;
3779
3780 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003781 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003782 /* NOTE: Ideally, we should also get the isec->sid for the
3783 new socket in sync, but we don't have the isec available yet.
3784 So we will wait until sock_graft to do it, by which
3785 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07003786
Paul Moore9f2ad662006-11-17 17:38:53 -05003787 /* We don't need to take any sort of lock here as we are the only
3788 * thread with access to newsksec */
3789 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003790}
3791
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003792static void selinux_inet_conn_established(struct sock *sk,
3793 struct sk_buff *skb)
3794{
3795 struct sk_security_struct *sksec = sk->sk_security;
3796
Linus Torvalds8d9107e2007-07-13 16:53:18 -07003797 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003798}
3799
Adrian Bunk9a673e52006-08-15 00:03:53 -07003800static void selinux_req_classify_flow(const struct request_sock *req,
3801 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003802{
3803 fl->secid = req->secid;
3804}
3805
Linus Torvalds1da177e2005-04-16 15:20:36 -07003806static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3807{
3808 int err = 0;
3809 u32 perm;
3810 struct nlmsghdr *nlh;
3811 struct socket *sock = sk->sk_socket;
3812 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3813
3814 if (skb->len < NLMSG_SPACE(0)) {
3815 err = -EINVAL;
3816 goto out;
3817 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07003818 nlh = nlmsg_hdr(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003819
3820 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3821 if (err) {
3822 if (err == -EINVAL) {
David Woodhouse9ad9ad32005-06-22 15:04:33 +01003823 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003824 "SELinux: unrecognized netlink message"
3825 " type=%hu for sclass=%hu\n",
3826 nlh->nlmsg_type, isec->sclass);
3827 if (!selinux_enforcing)
3828 err = 0;
3829 }
3830
3831 /* Ignore */
3832 if (err == -ENOENT)
3833 err = 0;
3834 goto out;
3835 }
3836
3837 err = socket_has_perm(current, sock, perm);
3838out:
3839 return err;
3840}
3841
3842#ifdef CONFIG_NETFILTER
3843
James Morris4e5ab4c2006-06-09 00:33:33 -07003844static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
James Morris4e5ab4c2006-06-09 00:33:33 -07003845 struct avc_audit_data *ad,
3846 u16 family, char *addrp, int len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003847{
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003848 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003849 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003850 struct socket *sock;
3851 struct inode *inode;
3852 struct inode_security_struct *isec;
3853
3854 sock = sk->sk_socket;
3855 if (!sock)
3856 goto out;
3857
3858 inode = SOCK_INODE(sock);
3859 if (!inode)
3860 goto out;
3861
3862 isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003863
Linus Torvalds1da177e2005-04-16 15:20:36 -07003864 err = sel_netif_sids(dev, &if_sid, NULL);
3865 if (err)
3866 goto out;
3867
Linus Torvalds1da177e2005-04-16 15:20:36 -07003868 switch (isec->sclass) {
3869 case SECCLASS_UDP_SOCKET:
3870 netif_perm = NETIF__UDP_SEND;
3871 node_perm = NODE__UDP_SEND;
3872 send_perm = UDP_SOCKET__SEND_MSG;
3873 break;
3874
3875 case SECCLASS_TCP_SOCKET:
3876 netif_perm = NETIF__TCP_SEND;
3877 node_perm = NODE__TCP_SEND;
3878 send_perm = TCP_SOCKET__SEND_MSG;
3879 break;
James Morris2ee92d42006-11-13 16:09:01 -08003880
3881 case SECCLASS_DCCP_SOCKET:
3882 netif_perm = NETIF__DCCP_SEND;
3883 node_perm = NODE__DCCP_SEND;
3884 send_perm = DCCP_SOCKET__SEND_MSG;
3885 break;
3886
Linus Torvalds1da177e2005-04-16 15:20:36 -07003887 default:
3888 netif_perm = NETIF__RAWIP_SEND;
3889 node_perm = NODE__RAWIP_SEND;
3890 break;
3891 }
3892
James Morris4e5ab4c2006-06-09 00:33:33 -07003893 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3894 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003895 goto out;
3896
James Morris4e5ab4c2006-06-09 00:33:33 -07003897 err = security_node_sid(family, addrp, len, &node_sid);
3898 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003899 goto out;
3900
James Morris4e5ab4c2006-06-09 00:33:33 -07003901 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3902 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003903 goto out;
3904
3905 if (send_perm) {
3906 u32 port_sid;
3907
Linus Torvalds1da177e2005-04-16 15:20:36 -07003908 err = security_port_sid(sk->sk_family,
3909 sk->sk_type,
3910 sk->sk_protocol,
James Morris4e5ab4c2006-06-09 00:33:33 -07003911 ntohs(ad->u.net.dport),
3912 &port_sid);
3913 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003914 goto out;
3915
3916 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
James Morris4e5ab4c2006-06-09 00:33:33 -07003917 send_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003918 }
James Morris4e5ab4c2006-06-09 00:33:33 -07003919out:
3920 return err;
3921}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003922
James Morris4e5ab4c2006-06-09 00:33:33 -07003923static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3924 struct sk_buff **pskb,
3925 const struct net_device *in,
3926 const struct net_device *out,
3927 int (*okfn)(struct sk_buff *),
3928 u16 family)
3929{
3930 char *addrp;
3931 int len, err = 0;
3932 struct sock *sk;
James Morris4e5ab4c2006-06-09 00:33:33 -07003933 struct sk_buff *skb = *pskb;
James Morris4e5ab4c2006-06-09 00:33:33 -07003934 struct avc_audit_data ad;
3935 struct net_device *dev = (struct net_device *)out;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003936 struct sk_security_struct *sksec;
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003937 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07003938
3939 sk = skb->sk;
3940 if (!sk)
3941 goto out;
3942
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003943 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07003944
3945 AVC_AUDIT_DATA_INIT(&ad, NET);
3946 ad.u.net.netif = dev->name;
3947 ad.u.net.family = family;
3948
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003949 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
James Morris4e5ab4c2006-06-09 00:33:33 -07003950 if (err)
3951 goto out;
3952
3953 if (selinux_compat_net)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003954 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
James Morris4e5ab4c2006-06-09 00:33:33 -07003955 family, addrp, len);
3956 else
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003957 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
James Morris4e5ab4c2006-06-09 00:33:33 -07003958 PACKET__SEND, &ad);
3959
3960 if (err)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003961 goto out;
3962
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003963 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003964out:
James Morris4e5ab4c2006-06-09 00:33:33 -07003965 return err ? NF_DROP : NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003966}
3967
3968static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3969 struct sk_buff **pskb,
3970 const struct net_device *in,
3971 const struct net_device *out,
3972 int (*okfn)(struct sk_buff *))
3973{
3974 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3975}
3976
3977#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3978
3979static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3980 struct sk_buff **pskb,
3981 const struct net_device *in,
3982 const struct net_device *out,
3983 int (*okfn)(struct sk_buff *))
3984{
3985 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3986}
3987
3988#endif /* IPV6 */
3989
3990#endif /* CONFIG_NETFILTER */
3991
Linus Torvalds1da177e2005-04-16 15:20:36 -07003992static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3993{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003994 int err;
3995
3996 err = secondary_ops->netlink_send(sk, skb);
3997 if (err)
3998 return err;
3999
Linus Torvalds1da177e2005-04-16 15:20:36 -07004000 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4001 err = selinux_nlmsg_perm(sk, skb);
4002
4003 return err;
4004}
4005
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004006static int selinux_netlink_recv(struct sk_buff *skb, int capability)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004007{
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004008 int err;
4009 struct avc_audit_data ad;
4010
4011 err = secondary_ops->netlink_recv(skb, capability);
4012 if (err)
4013 return err;
4014
4015 AVC_AUDIT_DATA_INIT(&ad, CAP);
4016 ad.u.cap = capability;
4017
4018 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4019 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004020}
4021
4022static int ipc_alloc_security(struct task_struct *task,
4023 struct kern_ipc_perm *perm,
4024 u16 sclass)
4025{
4026 struct task_security_struct *tsec = task->security;
4027 struct ipc_security_struct *isec;
4028
James Morris89d155e2005-10-30 14:59:21 -08004029 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004030 if (!isec)
4031 return -ENOMEM;
4032
Linus Torvalds1da177e2005-04-16 15:20:36 -07004033 isec->sclass = sclass;
4034 isec->ipc_perm = perm;
Stephen Smalley9ac49d22006-02-01 03:05:56 -08004035 isec->sid = tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004036 perm->security = isec;
4037
4038 return 0;
4039}
4040
4041static void ipc_free_security(struct kern_ipc_perm *perm)
4042{
4043 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004044 perm->security = NULL;
4045 kfree(isec);
4046}
4047
4048static int msg_msg_alloc_security(struct msg_msg *msg)
4049{
4050 struct msg_security_struct *msec;
4051
James Morris89d155e2005-10-30 14:59:21 -08004052 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004053 if (!msec)
4054 return -ENOMEM;
4055
Linus Torvalds1da177e2005-04-16 15:20:36 -07004056 msec->msg = msg;
4057 msec->sid = SECINITSID_UNLABELED;
4058 msg->security = msec;
4059
4060 return 0;
4061}
4062
4063static void msg_msg_free_security(struct msg_msg *msg)
4064{
4065 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004066
4067 msg->security = NULL;
4068 kfree(msec);
4069}
4070
4071static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07004072 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004073{
4074 struct task_security_struct *tsec;
4075 struct ipc_security_struct *isec;
4076 struct avc_audit_data ad;
4077
4078 tsec = current->security;
4079 isec = ipc_perms->security;
4080
4081 AVC_AUDIT_DATA_INIT(&ad, IPC);
4082 ad.u.ipc_id = ipc_perms->key;
4083
Stephen Smalley6af963f2005-05-01 08:58:39 -07004084 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004085}
4086
4087static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4088{
4089 return msg_msg_alloc_security(msg);
4090}
4091
4092static void selinux_msg_msg_free_security(struct msg_msg *msg)
4093{
4094 msg_msg_free_security(msg);
4095}
4096
4097/* message queue security operations */
4098static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4099{
4100 struct task_security_struct *tsec;
4101 struct ipc_security_struct *isec;
4102 struct avc_audit_data ad;
4103 int rc;
4104
4105 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4106 if (rc)
4107 return rc;
4108
4109 tsec = current->security;
4110 isec = msq->q_perm.security;
4111
4112 AVC_AUDIT_DATA_INIT(&ad, IPC);
4113 ad.u.ipc_id = msq->q_perm.key;
4114
4115 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4116 MSGQ__CREATE, &ad);
4117 if (rc) {
4118 ipc_free_security(&msq->q_perm);
4119 return rc;
4120 }
4121 return 0;
4122}
4123
4124static void selinux_msg_queue_free_security(struct msg_queue *msq)
4125{
4126 ipc_free_security(&msq->q_perm);
4127}
4128
4129static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4130{
4131 struct task_security_struct *tsec;
4132 struct ipc_security_struct *isec;
4133 struct avc_audit_data ad;
4134
4135 tsec = current->security;
4136 isec = msq->q_perm.security;
4137
4138 AVC_AUDIT_DATA_INIT(&ad, IPC);
4139 ad.u.ipc_id = msq->q_perm.key;
4140
4141 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4142 MSGQ__ASSOCIATE, &ad);
4143}
4144
4145static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4146{
4147 int err;
4148 int perms;
4149
4150 switch(cmd) {
4151 case IPC_INFO:
4152 case MSG_INFO:
4153 /* No specific object, just general system-wide information. */
4154 return task_has_system(current, SYSTEM__IPC_INFO);
4155 case IPC_STAT:
4156 case MSG_STAT:
4157 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4158 break;
4159 case IPC_SET:
4160 perms = MSGQ__SETATTR;
4161 break;
4162 case IPC_RMID:
4163 perms = MSGQ__DESTROY;
4164 break;
4165 default:
4166 return 0;
4167 }
4168
Stephen Smalley6af963f2005-05-01 08:58:39 -07004169 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004170 return err;
4171}
4172
4173static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4174{
4175 struct task_security_struct *tsec;
4176 struct ipc_security_struct *isec;
4177 struct msg_security_struct *msec;
4178 struct avc_audit_data ad;
4179 int rc;
4180
4181 tsec = current->security;
4182 isec = msq->q_perm.security;
4183 msec = msg->security;
4184
4185 /*
4186 * First time through, need to assign label to the message
4187 */
4188 if (msec->sid == SECINITSID_UNLABELED) {
4189 /*
4190 * Compute new sid based on current process and
4191 * message queue this message will be stored in
4192 */
4193 rc = security_transition_sid(tsec->sid,
4194 isec->sid,
4195 SECCLASS_MSG,
4196 &msec->sid);
4197 if (rc)
4198 return rc;
4199 }
4200
4201 AVC_AUDIT_DATA_INIT(&ad, IPC);
4202 ad.u.ipc_id = msq->q_perm.key;
4203
4204 /* Can this process write to the queue? */
4205 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4206 MSGQ__WRITE, &ad);
4207 if (!rc)
4208 /* Can this process send the message */
4209 rc = avc_has_perm(tsec->sid, msec->sid,
4210 SECCLASS_MSG, MSG__SEND, &ad);
4211 if (!rc)
4212 /* Can the message be put in the queue? */
4213 rc = avc_has_perm(msec->sid, isec->sid,
4214 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4215
4216 return rc;
4217}
4218
4219static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4220 struct task_struct *target,
4221 long type, int mode)
4222{
4223 struct task_security_struct *tsec;
4224 struct ipc_security_struct *isec;
4225 struct msg_security_struct *msec;
4226 struct avc_audit_data ad;
4227 int rc;
4228
4229 tsec = target->security;
4230 isec = msq->q_perm.security;
4231 msec = msg->security;
4232
4233 AVC_AUDIT_DATA_INIT(&ad, IPC);
4234 ad.u.ipc_id = msq->q_perm.key;
4235
4236 rc = avc_has_perm(tsec->sid, isec->sid,
4237 SECCLASS_MSGQ, MSGQ__READ, &ad);
4238 if (!rc)
4239 rc = avc_has_perm(tsec->sid, msec->sid,
4240 SECCLASS_MSG, MSG__RECEIVE, &ad);
4241 return rc;
4242}
4243
4244/* Shared Memory security operations */
4245static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4246{
4247 struct task_security_struct *tsec;
4248 struct ipc_security_struct *isec;
4249 struct avc_audit_data ad;
4250 int rc;
4251
4252 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4253 if (rc)
4254 return rc;
4255
4256 tsec = current->security;
4257 isec = shp->shm_perm.security;
4258
4259 AVC_AUDIT_DATA_INIT(&ad, IPC);
4260 ad.u.ipc_id = shp->shm_perm.key;
4261
4262 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4263 SHM__CREATE, &ad);
4264 if (rc) {
4265 ipc_free_security(&shp->shm_perm);
4266 return rc;
4267 }
4268 return 0;
4269}
4270
4271static void selinux_shm_free_security(struct shmid_kernel *shp)
4272{
4273 ipc_free_security(&shp->shm_perm);
4274}
4275
4276static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4277{
4278 struct task_security_struct *tsec;
4279 struct ipc_security_struct *isec;
4280 struct avc_audit_data ad;
4281
4282 tsec = current->security;
4283 isec = shp->shm_perm.security;
4284
4285 AVC_AUDIT_DATA_INIT(&ad, IPC);
4286 ad.u.ipc_id = shp->shm_perm.key;
4287
4288 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4289 SHM__ASSOCIATE, &ad);
4290}
4291
4292/* Note, at this point, shp is locked down */
4293static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4294{
4295 int perms;
4296 int err;
4297
4298 switch(cmd) {
4299 case IPC_INFO:
4300 case SHM_INFO:
4301 /* No specific object, just general system-wide information. */
4302 return task_has_system(current, SYSTEM__IPC_INFO);
4303 case IPC_STAT:
4304 case SHM_STAT:
4305 perms = SHM__GETATTR | SHM__ASSOCIATE;
4306 break;
4307 case IPC_SET:
4308 perms = SHM__SETATTR;
4309 break;
4310 case SHM_LOCK:
4311 case SHM_UNLOCK:
4312 perms = SHM__LOCK;
4313 break;
4314 case IPC_RMID:
4315 perms = SHM__DESTROY;
4316 break;
4317 default:
4318 return 0;
4319 }
4320
Stephen Smalley6af963f2005-05-01 08:58:39 -07004321 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004322 return err;
4323}
4324
4325static int selinux_shm_shmat(struct shmid_kernel *shp,
4326 char __user *shmaddr, int shmflg)
4327{
4328 u32 perms;
4329 int rc;
4330
4331 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4332 if (rc)
4333 return rc;
4334
4335 if (shmflg & SHM_RDONLY)
4336 perms = SHM__READ;
4337 else
4338 perms = SHM__READ | SHM__WRITE;
4339
Stephen Smalley6af963f2005-05-01 08:58:39 -07004340 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004341}
4342
4343/* Semaphore security operations */
4344static int selinux_sem_alloc_security(struct sem_array *sma)
4345{
4346 struct task_security_struct *tsec;
4347 struct ipc_security_struct *isec;
4348 struct avc_audit_data ad;
4349 int rc;
4350
4351 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4352 if (rc)
4353 return rc;
4354
4355 tsec = current->security;
4356 isec = sma->sem_perm.security;
4357
4358 AVC_AUDIT_DATA_INIT(&ad, IPC);
4359 ad.u.ipc_id = sma->sem_perm.key;
4360
4361 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4362 SEM__CREATE, &ad);
4363 if (rc) {
4364 ipc_free_security(&sma->sem_perm);
4365 return rc;
4366 }
4367 return 0;
4368}
4369
4370static void selinux_sem_free_security(struct sem_array *sma)
4371{
4372 ipc_free_security(&sma->sem_perm);
4373}
4374
4375static int selinux_sem_associate(struct sem_array *sma, int semflg)
4376{
4377 struct task_security_struct *tsec;
4378 struct ipc_security_struct *isec;
4379 struct avc_audit_data ad;
4380
4381 tsec = current->security;
4382 isec = sma->sem_perm.security;
4383
4384 AVC_AUDIT_DATA_INIT(&ad, IPC);
4385 ad.u.ipc_id = sma->sem_perm.key;
4386
4387 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4388 SEM__ASSOCIATE, &ad);
4389}
4390
4391/* Note, at this point, sma is locked down */
4392static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4393{
4394 int err;
4395 u32 perms;
4396
4397 switch(cmd) {
4398 case IPC_INFO:
4399 case SEM_INFO:
4400 /* No specific object, just general system-wide information. */
4401 return task_has_system(current, SYSTEM__IPC_INFO);
4402 case GETPID:
4403 case GETNCNT:
4404 case GETZCNT:
4405 perms = SEM__GETATTR;
4406 break;
4407 case GETVAL:
4408 case GETALL:
4409 perms = SEM__READ;
4410 break;
4411 case SETVAL:
4412 case SETALL:
4413 perms = SEM__WRITE;
4414 break;
4415 case IPC_RMID:
4416 perms = SEM__DESTROY;
4417 break;
4418 case IPC_SET:
4419 perms = SEM__SETATTR;
4420 break;
4421 case IPC_STAT:
4422 case SEM_STAT:
4423 perms = SEM__GETATTR | SEM__ASSOCIATE;
4424 break;
4425 default:
4426 return 0;
4427 }
4428
Stephen Smalley6af963f2005-05-01 08:58:39 -07004429 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004430 return err;
4431}
4432
4433static int selinux_sem_semop(struct sem_array *sma,
4434 struct sembuf *sops, unsigned nsops, int alter)
4435{
4436 u32 perms;
4437
4438 if (alter)
4439 perms = SEM__READ | SEM__WRITE;
4440 else
4441 perms = SEM__READ;
4442
Stephen Smalley6af963f2005-05-01 08:58:39 -07004443 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004444}
4445
4446static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4447{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004448 u32 av = 0;
4449
Linus Torvalds1da177e2005-04-16 15:20:36 -07004450 av = 0;
4451 if (flag & S_IRUGO)
4452 av |= IPC__UNIX_READ;
4453 if (flag & S_IWUGO)
4454 av |= IPC__UNIX_WRITE;
4455
4456 if (av == 0)
4457 return 0;
4458
Stephen Smalley6af963f2005-05-01 08:58:39 -07004459 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004460}
4461
4462/* module stacking operations */
4463static int selinux_register_security (const char *name, struct security_operations *ops)
4464{
4465 if (secondary_ops != original_ops) {
Eric Parisfadcdb42007-02-22 18:11:31 -05004466 printk(KERN_ERR "%s: There is already a secondary security "
Linus Torvalds1da177e2005-04-16 15:20:36 -07004467 "module registered.\n", __FUNCTION__);
4468 return -EINVAL;
4469 }
4470
4471 secondary_ops = ops;
4472
4473 printk(KERN_INFO "%s: Registering secondary module %s\n",
4474 __FUNCTION__,
4475 name);
4476
4477 return 0;
4478}
4479
4480static int selinux_unregister_security (const char *name, struct security_operations *ops)
4481{
4482 if (ops != secondary_ops) {
Eric Parisfadcdb42007-02-22 18:11:31 -05004483 printk(KERN_ERR "%s: trying to unregister a security module "
Linus Torvalds1da177e2005-04-16 15:20:36 -07004484 "that is not registered.\n", __FUNCTION__);
4485 return -EINVAL;
4486 }
4487
4488 secondary_ops = original_ops;
4489
4490 return 0;
4491}
4492
4493static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4494{
4495 if (inode)
4496 inode_doinit_with_dentry(inode, dentry);
4497}
4498
4499static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00004500 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004501{
4502 struct task_security_struct *tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00004503 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004504 int error;
Al Viro04ff9702007-03-12 16:17:58 +00004505 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004506
4507 if (current != p) {
4508 error = task_has_perm(current, p, PROCESS__GETATTR);
4509 if (error)
4510 return error;
4511 }
4512
Linus Torvalds1da177e2005-04-16 15:20:36 -07004513 tsec = p->security;
4514
4515 if (!strcmp(name, "current"))
4516 sid = tsec->sid;
4517 else if (!strcmp(name, "prev"))
4518 sid = tsec->osid;
4519 else if (!strcmp(name, "exec"))
4520 sid = tsec->exec_sid;
4521 else if (!strcmp(name, "fscreate"))
4522 sid = tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07004523 else if (!strcmp(name, "keycreate"))
4524 sid = tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07004525 else if (!strcmp(name, "sockcreate"))
4526 sid = tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004527 else
4528 return -EINVAL;
4529
4530 if (!sid)
4531 return 0;
4532
Al Viro04ff9702007-03-12 16:17:58 +00004533 error = security_sid_to_context(sid, value, &len);
4534 if (error)
4535 return error;
4536 return len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004537}
4538
4539static int selinux_setprocattr(struct task_struct *p,
4540 char *name, void *value, size_t size)
4541{
4542 struct task_security_struct *tsec;
4543 u32 sid = 0;
4544 int error;
4545 char *str = value;
4546
4547 if (current != p) {
4548 /* SELinux only allows a process to change its own
4549 security attributes. */
4550 return -EACCES;
4551 }
4552
4553 /*
4554 * Basic control over ability to set these attributes at all.
4555 * current == p, but we'll pass them separately in case the
4556 * above restriction is ever removed.
4557 */
4558 if (!strcmp(name, "exec"))
4559 error = task_has_perm(current, p, PROCESS__SETEXEC);
4560 else if (!strcmp(name, "fscreate"))
4561 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07004562 else if (!strcmp(name, "keycreate"))
4563 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07004564 else if (!strcmp(name, "sockcreate"))
4565 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004566 else if (!strcmp(name, "current"))
4567 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4568 else
4569 error = -EINVAL;
4570 if (error)
4571 return error;
4572
4573 /* Obtain a SID for the context, if one was specified. */
4574 if (size && str[1] && str[1] != '\n') {
4575 if (str[size-1] == '\n') {
4576 str[size-1] = 0;
4577 size--;
4578 }
4579 error = security_context_to_sid(value, size, &sid);
4580 if (error)
4581 return error;
4582 }
4583
4584 /* Permission checking based on the specified context is
4585 performed during the actual operation (execve,
4586 open/mkdir/...), when we know the full context of the
4587 operation. See selinux_bprm_set_security for the execve
4588 checks and may_create for the file creation checks. The
4589 operation will then fail if the context is not permitted. */
4590 tsec = p->security;
4591 if (!strcmp(name, "exec"))
4592 tsec->exec_sid = sid;
4593 else if (!strcmp(name, "fscreate"))
4594 tsec->create_sid = sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07004595 else if (!strcmp(name, "keycreate")) {
4596 error = may_create_key(sid, p);
4597 if (error)
4598 return error;
4599 tsec->keycreate_sid = sid;
Eric Paris42c3e032006-06-26 00:26:03 -07004600 } else if (!strcmp(name, "sockcreate"))
4601 tsec->sockcreate_sid = sid;
4602 else if (!strcmp(name, "current")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004603 struct av_decision avd;
4604
4605 if (sid == 0)
4606 return -EINVAL;
4607
4608 /* Only allow single threaded processes to change context */
4609 if (atomic_read(&p->mm->mm_users) != 1) {
4610 struct task_struct *g, *t;
4611 struct mm_struct *mm = p->mm;
4612 read_lock(&tasklist_lock);
4613 do_each_thread(g, t)
4614 if (t->mm == mm && t != p) {
4615 read_unlock(&tasklist_lock);
4616 return -EPERM;
4617 }
4618 while_each_thread(g, t);
4619 read_unlock(&tasklist_lock);
4620 }
4621
4622 /* Check permissions for the transition. */
4623 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4624 PROCESS__DYNTRANSITION, NULL);
4625 if (error)
4626 return error;
4627
4628 /* Check for ptracing, and update the task SID if ok.
4629 Otherwise, leave SID unchanged and fail. */
4630 task_lock(p);
4631 if (p->ptrace & PT_PTRACED) {
4632 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4633 SECCLASS_PROCESS,
Stephen Smalley2c3c05d2007-06-07 15:34:10 -04004634 PROCESS__PTRACE, 0, &avd);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004635 if (!error)
4636 tsec->sid = sid;
4637 task_unlock(p);
4638 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4639 PROCESS__PTRACE, &avd, error, NULL);
4640 if (error)
4641 return error;
4642 } else {
4643 tsec->sid = sid;
4644 task_unlock(p);
4645 }
4646 }
4647 else
4648 return -EINVAL;
4649
4650 return size;
4651}
4652
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004653static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4654{
4655 return security_sid_to_context(secid, secdata, seclen);
4656}
4657
4658static void selinux_release_secctx(char *secdata, u32 seclen)
4659{
4660 if (secdata)
4661 kfree(secdata);
4662}
4663
Michael LeMayd7200242006-06-22 14:47:17 -07004664#ifdef CONFIG_KEYS
4665
David Howells7e047ef2006-06-26 00:24:50 -07004666static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4667 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07004668{
4669 struct task_security_struct *tsec = tsk->security;
4670 struct key_security_struct *ksec;
4671
4672 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4673 if (!ksec)
4674 return -ENOMEM;
4675
4676 ksec->obj = k;
Michael LeMay4eb582c2006-06-26 00:24:57 -07004677 if (tsec->keycreate_sid)
4678 ksec->sid = tsec->keycreate_sid;
4679 else
4680 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07004681 k->security = ksec;
4682
4683 return 0;
4684}
4685
4686static void selinux_key_free(struct key *k)
4687{
4688 struct key_security_struct *ksec = k->security;
4689
4690 k->security = NULL;
4691 kfree(ksec);
4692}
4693
4694static int selinux_key_permission(key_ref_t key_ref,
4695 struct task_struct *ctx,
4696 key_perm_t perm)
4697{
4698 struct key *key;
4699 struct task_security_struct *tsec;
4700 struct key_security_struct *ksec;
4701
4702 key = key_ref_to_ptr(key_ref);
4703
4704 tsec = ctx->security;
4705 ksec = key->security;
4706
4707 /* if no specific permissions are requested, we skip the
4708 permission check. No serious, additional covert channels
4709 appear to be created. */
4710 if (perm == 0)
4711 return 0;
4712
4713 return avc_has_perm(tsec->sid, ksec->sid,
4714 SECCLASS_KEY, perm, NULL);
4715}
4716
4717#endif
4718
Linus Torvalds1da177e2005-04-16 15:20:36 -07004719static struct security_operations selinux_ops = {
4720 .ptrace = selinux_ptrace,
4721 .capget = selinux_capget,
4722 .capset_check = selinux_capset_check,
4723 .capset_set = selinux_capset_set,
4724 .sysctl = selinux_sysctl,
4725 .capable = selinux_capable,
4726 .quotactl = selinux_quotactl,
4727 .quota_on = selinux_quota_on,
4728 .syslog = selinux_syslog,
4729 .vm_enough_memory = selinux_vm_enough_memory,
4730
4731 .netlink_send = selinux_netlink_send,
4732 .netlink_recv = selinux_netlink_recv,
4733
4734 .bprm_alloc_security = selinux_bprm_alloc_security,
4735 .bprm_free_security = selinux_bprm_free_security,
4736 .bprm_apply_creds = selinux_bprm_apply_creds,
4737 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4738 .bprm_set_security = selinux_bprm_set_security,
4739 .bprm_check_security = selinux_bprm_check_security,
4740 .bprm_secureexec = selinux_bprm_secureexec,
4741
4742 .sb_alloc_security = selinux_sb_alloc_security,
4743 .sb_free_security = selinux_sb_free_security,
4744 .sb_copy_data = selinux_sb_copy_data,
4745 .sb_kern_mount = selinux_sb_kern_mount,
4746 .sb_statfs = selinux_sb_statfs,
4747 .sb_mount = selinux_mount,
4748 .sb_umount = selinux_umount,
4749
4750 .inode_alloc_security = selinux_inode_alloc_security,
4751 .inode_free_security = selinux_inode_free_security,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07004752 .inode_init_security = selinux_inode_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004753 .inode_create = selinux_inode_create,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004754 .inode_link = selinux_inode_link,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004755 .inode_unlink = selinux_inode_unlink,
4756 .inode_symlink = selinux_inode_symlink,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004757 .inode_mkdir = selinux_inode_mkdir,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004758 .inode_rmdir = selinux_inode_rmdir,
4759 .inode_mknod = selinux_inode_mknod,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004760 .inode_rename = selinux_inode_rename,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004761 .inode_readlink = selinux_inode_readlink,
4762 .inode_follow_link = selinux_inode_follow_link,
4763 .inode_permission = selinux_inode_permission,
4764 .inode_setattr = selinux_inode_setattr,
4765 .inode_getattr = selinux_inode_getattr,
4766 .inode_setxattr = selinux_inode_setxattr,
4767 .inode_post_setxattr = selinux_inode_post_setxattr,
4768 .inode_getxattr = selinux_inode_getxattr,
4769 .inode_listxattr = selinux_inode_listxattr,
4770 .inode_removexattr = selinux_inode_removexattr,
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00004771 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004772 .inode_getsecurity = selinux_inode_getsecurity,
4773 .inode_setsecurity = selinux_inode_setsecurity,
4774 .inode_listsecurity = selinux_inode_listsecurity,
4775
4776 .file_permission = selinux_file_permission,
4777 .file_alloc_security = selinux_file_alloc_security,
4778 .file_free_security = selinux_file_free_security,
4779 .file_ioctl = selinux_file_ioctl,
4780 .file_mmap = selinux_file_mmap,
4781 .file_mprotect = selinux_file_mprotect,
4782 .file_lock = selinux_file_lock,
4783 .file_fcntl = selinux_file_fcntl,
4784 .file_set_fowner = selinux_file_set_fowner,
4785 .file_send_sigiotask = selinux_file_send_sigiotask,
4786 .file_receive = selinux_file_receive,
4787
4788 .task_create = selinux_task_create,
4789 .task_alloc_security = selinux_task_alloc_security,
4790 .task_free_security = selinux_task_free_security,
4791 .task_setuid = selinux_task_setuid,
4792 .task_post_setuid = selinux_task_post_setuid,
4793 .task_setgid = selinux_task_setgid,
4794 .task_setpgid = selinux_task_setpgid,
4795 .task_getpgid = selinux_task_getpgid,
4796 .task_getsid = selinux_task_getsid,
David Quigleyf9008e42006-06-30 01:55:46 -07004797 .task_getsecid = selinux_task_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004798 .task_setgroups = selinux_task_setgroups,
4799 .task_setnice = selinux_task_setnice,
James Morris03e68062006-06-23 02:03:58 -07004800 .task_setioprio = selinux_task_setioprio,
David Quigleya1836a42006-06-30 01:55:49 -07004801 .task_getioprio = selinux_task_getioprio,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004802 .task_setrlimit = selinux_task_setrlimit,
4803 .task_setscheduler = selinux_task_setscheduler,
4804 .task_getscheduler = selinux_task_getscheduler,
David Quigley35601542006-06-23 02:04:01 -07004805 .task_movememory = selinux_task_movememory,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004806 .task_kill = selinux_task_kill,
4807 .task_wait = selinux_task_wait,
4808 .task_prctl = selinux_task_prctl,
4809 .task_reparent_to_init = selinux_task_reparent_to_init,
4810 .task_to_inode = selinux_task_to_inode,
4811
4812 .ipc_permission = selinux_ipc_permission,
4813
4814 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4815 .msg_msg_free_security = selinux_msg_msg_free_security,
4816
4817 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4818 .msg_queue_free_security = selinux_msg_queue_free_security,
4819 .msg_queue_associate = selinux_msg_queue_associate,
4820 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4821 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4822 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4823
4824 .shm_alloc_security = selinux_shm_alloc_security,
4825 .shm_free_security = selinux_shm_free_security,
4826 .shm_associate = selinux_shm_associate,
4827 .shm_shmctl = selinux_shm_shmctl,
4828 .shm_shmat = selinux_shm_shmat,
4829
4830 .sem_alloc_security = selinux_sem_alloc_security,
4831 .sem_free_security = selinux_sem_free_security,
4832 .sem_associate = selinux_sem_associate,
4833 .sem_semctl = selinux_sem_semctl,
4834 .sem_semop = selinux_sem_semop,
4835
4836 .register_security = selinux_register_security,
4837 .unregister_security = selinux_unregister_security,
4838
4839 .d_instantiate = selinux_d_instantiate,
4840
4841 .getprocattr = selinux_getprocattr,
4842 .setprocattr = selinux_setprocattr,
4843
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004844 .secid_to_secctx = selinux_secid_to_secctx,
4845 .release_secctx = selinux_release_secctx,
4846
Linus Torvalds1da177e2005-04-16 15:20:36 -07004847 .unix_stream_connect = selinux_socket_unix_stream_connect,
4848 .unix_may_send = selinux_socket_unix_may_send,
4849
4850 .socket_create = selinux_socket_create,
4851 .socket_post_create = selinux_socket_post_create,
4852 .socket_bind = selinux_socket_bind,
4853 .socket_connect = selinux_socket_connect,
4854 .socket_listen = selinux_socket_listen,
4855 .socket_accept = selinux_socket_accept,
4856 .socket_sendmsg = selinux_socket_sendmsg,
4857 .socket_recvmsg = selinux_socket_recvmsg,
4858 .socket_getsockname = selinux_socket_getsockname,
4859 .socket_getpeername = selinux_socket_getpeername,
4860 .socket_getsockopt = selinux_socket_getsockopt,
4861 .socket_setsockopt = selinux_socket_setsockopt,
4862 .socket_shutdown = selinux_socket_shutdown,
4863 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004864 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4865 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004866 .sk_alloc_security = selinux_sk_alloc_security,
4867 .sk_free_security = selinux_sk_free_security,
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004868 .sk_clone_security = selinux_sk_clone_security,
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004869 .sk_getsecid = selinux_sk_getsecid,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004870 .sock_graft = selinux_sock_graft,
4871 .inet_conn_request = selinux_inet_conn_request,
4872 .inet_csk_clone = selinux_inet_csk_clone,
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004873 .inet_conn_established = selinux_inet_conn_established,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004874 .req_classify_flow = selinux_req_classify_flow,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004875
4876#ifdef CONFIG_SECURITY_NETWORK_XFRM
4877 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4878 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4879 .xfrm_policy_free_security = selinux_xfrm_policy_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07004880 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004881 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4882 .xfrm_state_free_security = selinux_xfrm_state_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07004883 .xfrm_state_delete_security = selinux_xfrm_state_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004884 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07004885 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07004886 .xfrm_decode_session = selinux_xfrm_decode_session,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004887#endif
Michael LeMayd7200242006-06-22 14:47:17 -07004888
4889#ifdef CONFIG_KEYS
4890 .key_alloc = selinux_key_alloc,
4891 .key_free = selinux_key_free,
4892 .key_permission = selinux_key_permission,
4893#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004894};
4895
4896static __init int selinux_init(void)
4897{
4898 struct task_security_struct *tsec;
4899
4900 if (!selinux_enabled) {
4901 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4902 return 0;
4903 }
4904
4905 printk(KERN_INFO "SELinux: Initializing.\n");
4906
4907 /* Set the security state for the initial task. */
4908 if (task_alloc_security(current))
4909 panic("SELinux: Failed to initialize initial task.\n");
4910 tsec = current->security;
4911 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4912
James Morris7cae7e22006-03-22 00:09:22 -08004913 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4914 sizeof(struct inode_security_struct),
4915 0, SLAB_PANIC, NULL, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004916 avc_init();
4917
4918 original_ops = secondary_ops = security_ops;
4919 if (!secondary_ops)
4920 panic ("SELinux: No initial security operations\n");
4921 if (register_security (&selinux_ops))
4922 panic("SELinux: Unable to register with kernel.\n");
4923
4924 if (selinux_enforcing) {
Eric Parisfadcdb42007-02-22 18:11:31 -05004925 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004926 } else {
Eric Parisfadcdb42007-02-22 18:11:31 -05004927 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004928 }
Michael LeMayd7200242006-06-22 14:47:17 -07004929
4930#ifdef CONFIG_KEYS
4931 /* Add security information to initial keyrings */
Michael LeMay4eb582c2006-06-26 00:24:57 -07004932 selinux_key_alloc(&root_user_keyring, current,
4933 KEY_ALLOC_NOT_IN_QUOTA);
4934 selinux_key_alloc(&root_session_keyring, current,
4935 KEY_ALLOC_NOT_IN_QUOTA);
Michael LeMayd7200242006-06-22 14:47:17 -07004936#endif
4937
Linus Torvalds1da177e2005-04-16 15:20:36 -07004938 return 0;
4939}
4940
4941void selinux_complete_init(void)
4942{
Eric Parisfadcdb42007-02-22 18:11:31 -05004943 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004944
4945 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05004946 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004947 spin_lock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004948 spin_lock(&sb_security_lock);
4949next_sb:
4950 if (!list_empty(&superblock_security_head)) {
4951 struct superblock_security_struct *sbsec =
4952 list_entry(superblock_security_head.next,
4953 struct superblock_security_struct,
4954 list);
4955 struct super_block *sb = sbsec->sb;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004956 sb->s_count++;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004957 spin_unlock(&sb_security_lock);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004958 spin_unlock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004959 down_read(&sb->s_umount);
4960 if (sb->s_root)
4961 superblock_doinit(sb, NULL);
4962 drop_super(sb);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004963 spin_lock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004964 spin_lock(&sb_security_lock);
4965 list_del_init(&sbsec->list);
4966 goto next_sb;
4967 }
4968 spin_unlock(&sb_security_lock);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004969 spin_unlock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004970}
4971
4972/* SELinux requires early initialization in order to label
4973 all processes and objects when they are created. */
4974security_initcall(selinux_init);
4975
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08004976#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004977
4978static struct nf_hook_ops selinux_ipv4_op = {
4979 .hook = selinux_ipv4_postroute_last,
4980 .owner = THIS_MODULE,
4981 .pf = PF_INET,
4982 .hooknum = NF_IP_POST_ROUTING,
4983 .priority = NF_IP_PRI_SELINUX_LAST,
4984};
4985
4986#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4987
4988static struct nf_hook_ops selinux_ipv6_op = {
4989 .hook = selinux_ipv6_postroute_last,
4990 .owner = THIS_MODULE,
4991 .pf = PF_INET6,
4992 .hooknum = NF_IP6_POST_ROUTING,
4993 .priority = NF_IP6_PRI_SELINUX_LAST,
4994};
4995
4996#endif /* IPV6 */
4997
4998static int __init selinux_nf_ip_init(void)
4999{
5000 int err = 0;
5001
5002 if (!selinux_enabled)
5003 goto out;
Eric Parisfadcdb42007-02-22 18:11:31 -05005004
5005 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5006
Linus Torvalds1da177e2005-04-16 15:20:36 -07005007 err = nf_register_hook(&selinux_ipv4_op);
5008 if (err)
5009 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5010
5011#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5012
5013 err = nf_register_hook(&selinux_ipv6_op);
5014 if (err)
5015 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5016
5017#endif /* IPV6 */
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005018
Linus Torvalds1da177e2005-04-16 15:20:36 -07005019out:
5020 return err;
5021}
5022
5023__initcall(selinux_nf_ip_init);
5024
5025#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5026static void selinux_nf_ip_exit(void)
5027{
Eric Parisfadcdb42007-02-22 18:11:31 -05005028 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005029
5030 nf_unregister_hook(&selinux_ipv4_op);
5031#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5032 nf_unregister_hook(&selinux_ipv6_op);
5033#endif /* IPV6 */
5034}
5035#endif
5036
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005037#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005038
5039#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5040#define selinux_nf_ip_exit()
5041#endif
5042
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005043#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005044
5045#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5046int selinux_disable(void)
5047{
5048 extern void exit_sel_fs(void);
5049 static int selinux_disabled = 0;
5050
5051 if (ss_initialized) {
5052 /* Not permitted after initial policy load. */
5053 return -EINVAL;
5054 }
5055
5056 if (selinux_disabled) {
5057 /* Only do this once. */
5058 return -EINVAL;
5059 }
5060
5061 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5062
5063 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04005064 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005065
5066 /* Reset security_ops to the secondary module, dummy or capability. */
5067 security_ops = secondary_ops;
5068
5069 /* Unregister netfilter hooks. */
5070 selinux_nf_ip_exit();
5071
5072 /* Unregister selinuxfs. */
5073 exit_sel_fs();
5074
5075 return 0;
5076}
5077#endif
5078
5079