blob: 794c3ca49eac92998caa17be71a4bdc472c2e9c8 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050027#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070029#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070030#include <linux/errno.h>
31#include <linux/sched.h>
32#include <linux/security.h>
33#include <linux/xattr.h>
34#include <linux/capability.h>
35#include <linux/unistd.h>
36#include <linux/mm.h>
37#include <linux/mman.h>
38#include <linux/slab.h>
39#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050040#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070041#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070042#include <linux/spinlock.h>
43#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050044#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070045#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040046#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/namei.h>
48#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/netfilter_ipv4.h>
50#include <linux/netfilter_ipv6.h>
51#include <linux/tty.h>
52#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070053#include <net/ip.h> /* for local_port_range[] */
Eric Dumazetca10b9e2013-04-08 17:58:11 +000054#include <net/sock.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070055#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore220deb92008-01-29 08:38:23 -050056#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050057#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040058#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070059#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070060#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <linux/bitops.h>
62#include <linux/interrupt.h>
63#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000064#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070065#include <linux/tcp.h>
66#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080067#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070068#include <linux/quota.h>
69#include <linux/un.h> /* for Unix socket types */
70#include <net/af_unix.h> /* for Unix socket types */
71#include <linux/parser.h>
72#include <linux/nfs_mount.h>
73#include <net/ipv6.h>
74#include <linux/hugetlb.h>
75#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070076#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070077#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070078#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070079#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070080#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080081#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070082#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040083#include <linux/export.h>
David Quigleyeb9ae682013-05-22 12:50:37 -040084#include <linux/security.h>
Al Viro40401532012-02-13 03:58:52 +000085#include <linux/msg.h>
86#include <linux/shm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070087
88#include "avc.h"
89#include "objsec.h"
90#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050091#include "netnode.h"
Paul Moore3e112172008-04-10 10:48:14 -040092#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080093#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050094#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020095#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +100096#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070097
Anand Avati102aefd2013-04-16 18:56:19 -040098#define SB_TYPE_FMT "%s%s%s"
99#define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])
100#define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""
Eric Parisc9180a52007-11-30 13:00:35 -0500101
James Morris20510f22007-10-16 23:31:32 -0700102extern struct security_operations *security_ops;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
Paul Moored621d352008-01-29 08:43:36 -0500104/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000105static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500106
Linus Torvalds1da177e2005-04-16 15:20:36 -0700107#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400108int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109
110static int __init enforcing_setup(char *str)
111{
Eric Parisf5269712008-05-14 11:27:45 -0400112 unsigned long enforcing;
113 if (!strict_strtoul(str, 0, &enforcing))
114 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700115 return 1;
116}
117__setup("enforcing=", enforcing_setup);
118#endif
119
120#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
121int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
122
123static int __init selinux_enabled_setup(char *str)
124{
Eric Parisf5269712008-05-14 11:27:45 -0400125 unsigned long enabled;
126 if (!strict_strtoul(str, 0, &enabled))
127 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700128 return 1;
129}
130__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400131#else
132int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700133#endif
134
Christoph Lametere18b8902006-12-06 20:33:20 -0800135static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800136
Paul Moored621d352008-01-29 08:43:36 -0500137/**
138 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
139 *
140 * Description:
141 * This function checks the SECMARK reference counter to see if any SECMARK
142 * targets are currently configured, if the reference counter is greater than
143 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400144 * enabled, false (0) if SECMARK is disabled. If the always_check_network
145 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500146 *
147 */
148static int selinux_secmark_enabled(void)
149{
Chris PeBenito2be4d742013-05-03 09:05:39 -0400150 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
151}
152
153/**
154 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
155 *
156 * Description:
157 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
158 * (1) if any are enabled or false (0) if neither are enabled. If the
159 * always_check_network policy capability is enabled, peer labeling
160 * is always considered enabled.
161 *
162 */
163static int selinux_peerlbl_enabled(void)
164{
165 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500166}
167
David Howellsd84f4f92008-11-14 10:39:23 +1100168/*
169 * initialise the security for the init task
170 */
171static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700172{
David Howells3b11a1d2008-11-14 10:39:26 +1100173 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 struct task_security_struct *tsec;
175
James Morris89d155e2005-10-30 14:59:21 -0800176 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700177 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100178 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179
David Howellsd84f4f92008-11-14 10:39:23 +1100180 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100181 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700182}
183
David Howells275bb412008-11-14 10:39:19 +1100184/*
David Howells88e67f32008-11-14 10:39:21 +1100185 * get the security ID of a set of credentials
186 */
187static inline u32 cred_sid(const struct cred *cred)
188{
189 const struct task_security_struct *tsec;
190
191 tsec = cred->security;
192 return tsec->sid;
193}
194
195/*
David Howells3b11a1d2008-11-14 10:39:26 +1100196 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100197 */
198static inline u32 task_sid(const struct task_struct *task)
199{
David Howells275bb412008-11-14 10:39:19 +1100200 u32 sid;
201
202 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100203 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100204 rcu_read_unlock();
205 return sid;
206}
207
208/*
David Howells3b11a1d2008-11-14 10:39:26 +1100209 * get the subjective security ID of the current task
David Howells275bb412008-11-14 10:39:19 +1100210 */
211static inline u32 current_sid(void)
212{
Paul Moore5fb49872010-04-22 14:46:19 -0400213 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +1100214
215 return tsec->sid;
216}
217
David Howells88e67f32008-11-14 10:39:21 +1100218/* Allocate and free functions for each kind of security blob. */
219
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220static int inode_alloc_security(struct inode *inode)
221{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100223 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700224
Josef Bacika02fe132008-04-04 09:35:05 +1100225 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700226 if (!isec)
227 return -ENOMEM;
228
Eric Paris23970742006-09-25 23:32:01 -0700229 mutex_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700230 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700231 isec->inode = inode;
232 isec->sid = SECINITSID_UNLABELED;
233 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100234 isec->task_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700235 inode->i_security = isec;
236
237 return 0;
238}
239
240static void inode_free_security(struct inode *inode)
241{
242 struct inode_security_struct *isec = inode->i_security;
243 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
244
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245 spin_lock(&sbsec->isec_lock);
246 if (!list_empty(&isec->list))
247 list_del_init(&isec->list);
248 spin_unlock(&sbsec->isec_lock);
249
250 inode->i_security = NULL;
James Morris7cae7e22006-03-22 00:09:22 -0800251 kmem_cache_free(sel_inode_cache, isec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252}
253
254static int file_alloc_security(struct file *file)
255{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100257 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700258
Stephen Smalley26d2a4b2006-02-01 03:05:55 -0800259 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 if (!fsec)
261 return -ENOMEM;
262
David Howells275bb412008-11-14 10:39:19 +1100263 fsec->sid = sid;
264 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700265 file->f_security = fsec;
266
267 return 0;
268}
269
270static void file_free_security(struct file *file)
271{
272 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700273 file->f_security = NULL;
274 kfree(fsec);
275}
276
277static int superblock_alloc_security(struct super_block *sb)
278{
279 struct superblock_security_struct *sbsec;
280
James Morris89d155e2005-10-30 14:59:21 -0800281 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700282 if (!sbsec)
283 return -ENOMEM;
284
Eric Parisbc7e9822006-09-25 23:32:02 -0700285 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700286 INIT_LIST_HEAD(&sbsec->isec_head);
287 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700288 sbsec->sb = sb;
289 sbsec->sid = SECINITSID_UNLABELED;
290 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700291 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700292 sb->s_security = sbsec;
293
294 return 0;
295}
296
297static void superblock_free_security(struct super_block *sb)
298{
299 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700300 sb->s_security = NULL;
301 kfree(sbsec);
302}
303
Linus Torvalds1da177e2005-04-16 15:20:36 -0700304/* The file system's label must be initialized prior to use. */
305
David Quigleyeb9ae682013-05-22 12:50:37 -0400306static const char *labeling_behaviors[7] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700307 "uses xattr",
308 "uses transition SIDs",
309 "uses task SIDs",
310 "uses genfs_contexts",
311 "not configured for labeling",
312 "uses mountpoint labeling",
David Quigleyeb9ae682013-05-22 12:50:37 -0400313 "uses native labeling",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700314};
315
316static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
317
318static inline int inode_doinit(struct inode *inode)
319{
320 return inode_doinit_with_dentry(inode, NULL);
321}
322
323enum {
Eric Paris31e87932007-09-19 17:19:12 -0400324 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700325 Opt_context = 1,
326 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500327 Opt_defcontext = 3,
328 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500329 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400330 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700331};
332
Eric Parisd355987f2012-08-24 15:58:53 -0400333#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
334
Steven Whitehousea447c092008-10-13 10:46:57 +0100335static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400336 {Opt_context, CONTEXT_STR "%s"},
337 {Opt_fscontext, FSCONTEXT_STR "%s"},
338 {Opt_defcontext, DEFCONTEXT_STR "%s"},
339 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500340 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400341 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700342};
343
344#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
345
Eric Parisc312feb2006-07-10 04:43:53 -0700346static int may_context_mount_sb_relabel(u32 sid,
347 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100348 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700349{
David Howells275bb412008-11-14 10:39:19 +1100350 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700351 int rc;
352
353 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__RELABELFROM, NULL);
355 if (rc)
356 return rc;
357
358 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
359 FILESYSTEM__RELABELTO, NULL);
360 return rc;
361}
362
Eric Paris08089252006-07-10 04:43:55 -0700363static int may_context_mount_inode_relabel(u32 sid,
364 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100365 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700366{
David Howells275bb412008-11-14 10:39:19 +1100367 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700368 int rc;
369 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
370 FILESYSTEM__RELABELFROM, NULL);
371 if (rc)
372 return rc;
373
374 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
375 FILESYSTEM__ASSOCIATE, NULL);
376 return rc;
377}
378
Eric Parisb43e7252012-10-10 14:27:35 -0400379static int selinux_is_sblabel_mnt(struct super_block *sb)
380{
381 struct superblock_security_struct *sbsec = sb->s_security;
382
383 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
384 sbsec->behavior == SECURITY_FS_USE_TRANS ||
385 sbsec->behavior == SECURITY_FS_USE_TASK)
386 return 1;
387
388 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
389 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
390 return 1;
391
392 /*
393 * Special handling for rootfs. Is genfs but supports
394 * setting SELinux context on in-core inodes.
395 */
396 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
397 return 1;
398
399 return 0;
400}
401
Eric Parisc9180a52007-11-30 13:00:35 -0500402static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700403{
404 struct superblock_security_struct *sbsec = sb->s_security;
405 struct dentry *root = sb->s_root;
Eric Parisc9180a52007-11-30 13:00:35 -0500406 struct inode *root_inode = root->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407 int rc = 0;
408
Linus Torvalds1da177e2005-04-16 15:20:36 -0700409 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
410 /* Make sure that the xattr handler exists and that no
411 error other than -ENODATA is returned by getxattr on
412 the root directory. -ENODATA is ok, as this may be
413 the first boot of the SELinux kernel before we have
414 assigned xattr values to the filesystem. */
Eric Parisc9180a52007-11-30 13:00:35 -0500415 if (!root_inode->i_op->getxattr) {
Anand Avati102aefd2013-04-16 18:56:19 -0400416 printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "
417 "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 rc = -EOPNOTSUPP;
419 goto out;
420 }
Eric Parisc9180a52007-11-30 13:00:35 -0500421 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700422 if (rc < 0 && rc != -ENODATA) {
423 if (rc == -EOPNOTSUPP)
424 printk(KERN_WARNING "SELinux: (dev %s, type "
Anand Avati102aefd2013-04-16 18:56:19 -0400425 SB_TYPE_FMT") has no security xattr handler\n",
426 sb->s_id, SB_TYPE_ARGS(sb));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700427 else
428 printk(KERN_WARNING "SELinux: (dev %s, type "
Anand Avati102aefd2013-04-16 18:56:19 -0400429 SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,
430 SB_TYPE_ARGS(sb), -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700431 goto out;
432 }
433 }
434
Eric Parisc9180a52007-11-30 13:00:35 -0500435 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Anand Avati102aefd2013-04-16 18:56:19 -0400436 printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",
437 sb->s_id, SB_TYPE_ARGS(sb));
Eric Parisc9180a52007-11-30 13:00:35 -0500438 else
Anand Avati102aefd2013-04-16 18:56:19 -0400439 printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",
440 sb->s_id, SB_TYPE_ARGS(sb),
Linus Torvalds1da177e2005-04-16 15:20:36 -0700441 labeling_behaviors[sbsec->behavior-1]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700442
Eric Pariseadcabc2012-08-24 15:59:14 -0400443 sbsec->flags |= SE_SBINITIALIZED;
Eric Parisb43e7252012-10-10 14:27:35 -0400444 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400445 sbsec->flags |= SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400446
Linus Torvalds1da177e2005-04-16 15:20:36 -0700447 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500448 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449
450 /* Initialize any other inodes associated with the superblock, e.g.
451 inodes created prior to initial policy load or inodes created
452 during get_sb by a pseudo filesystem that directly
453 populates itself. */
454 spin_lock(&sbsec->isec_lock);
455next_inode:
456 if (!list_empty(&sbsec->isec_head)) {
457 struct inode_security_struct *isec =
458 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500459 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460 struct inode *inode = isec->inode;
461 spin_unlock(&sbsec->isec_lock);
462 inode = igrab(inode);
463 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500464 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700465 inode_doinit(inode);
466 iput(inode);
467 }
468 spin_lock(&sbsec->isec_lock);
469 list_del_init(&isec->list);
470 goto next_inode;
471 }
472 spin_unlock(&sbsec->isec_lock);
473out:
Eric Parisc9180a52007-11-30 13:00:35 -0500474 return rc;
475}
476
477/*
478 * This function should allow an FS to ask what it's mount security
479 * options were so it can use those later for submounts, displaying
480 * mount options, or whatever.
481 */
482static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500483 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500484{
485 int rc = 0, i;
486 struct superblock_security_struct *sbsec = sb->s_security;
487 char *context = NULL;
488 u32 len;
489 char tmp;
490
Eric Parise0007522008-03-05 10:31:54 -0500491 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500492
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500493 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500494 return -EINVAL;
495
496 if (!ss_initialized)
497 return -EINVAL;
498
Eric Parisaf8e50c2012-08-24 15:59:00 -0400499 /* make sure we always check enough bits to cover the mask */
500 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
501
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500502 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500503 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400504 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500505 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500506 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500507 tmp >>= 1;
508 }
David P. Quigley11689d42009-01-16 09:22:03 -0500509 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400510 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500511 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500512
Eric Parise0007522008-03-05 10:31:54 -0500513 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
514 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500515 rc = -ENOMEM;
516 goto out_free;
517 }
518
Eric Parise0007522008-03-05 10:31:54 -0500519 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
520 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500521 rc = -ENOMEM;
522 goto out_free;
523 }
524
525 i = 0;
526 if (sbsec->flags & FSCONTEXT_MNT) {
527 rc = security_sid_to_context(sbsec->sid, &context, &len);
528 if (rc)
529 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500530 opts->mnt_opts[i] = context;
531 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500532 }
533 if (sbsec->flags & CONTEXT_MNT) {
534 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
535 if (rc)
536 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500537 opts->mnt_opts[i] = context;
538 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500539 }
540 if (sbsec->flags & DEFCONTEXT_MNT) {
541 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
542 if (rc)
543 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500544 opts->mnt_opts[i] = context;
545 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500546 }
547 if (sbsec->flags & ROOTCONTEXT_MNT) {
548 struct inode *root = sbsec->sb->s_root->d_inode;
549 struct inode_security_struct *isec = root->i_security;
550
551 rc = security_sid_to_context(isec->sid, &context, &len);
552 if (rc)
553 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500554 opts->mnt_opts[i] = context;
555 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500556 }
Eric Paris12f348b2012-10-09 10:56:25 -0400557 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500558 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400559 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500560 }
Eric Parisc9180a52007-11-30 13:00:35 -0500561
Eric Parise0007522008-03-05 10:31:54 -0500562 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500563
564 return 0;
565
566out_free:
Eric Parise0007522008-03-05 10:31:54 -0500567 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500568 return rc;
569}
570
571static int bad_option(struct superblock_security_struct *sbsec, char flag,
572 u32 old_sid, u32 new_sid)
573{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500574 char mnt_flags = sbsec->flags & SE_MNTMASK;
575
Eric Parisc9180a52007-11-30 13:00:35 -0500576 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500577 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500578 if (!(sbsec->flags & flag) ||
579 (old_sid != new_sid))
580 return 1;
581
582 /* check if we were passed the same options twice,
583 * aka someone passed context=a,context=b
584 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500585 if (!(sbsec->flags & SE_SBINITIALIZED))
586 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500587 return 1;
588 return 0;
589}
Eric Parise0007522008-03-05 10:31:54 -0500590
Eric Parisc9180a52007-11-30 13:00:35 -0500591/*
592 * Allow filesystems with binary mount data to explicitly set mount point
593 * labeling information.
594 */
Eric Parise0007522008-03-05 10:31:54 -0500595static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400596 struct security_mnt_opts *opts,
597 unsigned long kern_flags,
598 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500599{
David Howells275bb412008-11-14 10:39:19 +1100600 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500601 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500602 struct superblock_security_struct *sbsec = sb->s_security;
James Morris089be432008-07-15 18:32:49 +1000603 struct inode *inode = sbsec->sb->s_root->d_inode;
604 struct inode_security_struct *root_isec = inode->i_security;
Eric Parisc9180a52007-11-30 13:00:35 -0500605 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
606 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500607 char **mount_options = opts->mnt_opts;
608 int *flags = opts->mnt_opts_flags;
609 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500610
611 mutex_lock(&sbsec->lock);
612
613 if (!ss_initialized) {
614 if (!num_opts) {
615 /* Defer initialization until selinux_complete_init,
616 after the initial policy is loaded and the security
617 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500618 goto out;
619 }
620 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400621 printk(KERN_WARNING "SELinux: Unable to set superblock options "
622 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500623 goto out;
624 }
David Quigley649f6e72013-05-22 12:50:36 -0400625 if (kern_flags && !set_kern_flags) {
626 /* Specifying internal flags without providing a place to
627 * place the results is not allowed */
628 rc = -EINVAL;
629 goto out;
630 }
Eric Parisc9180a52007-11-30 13:00:35 -0500631
632 /*
Eric Parise0007522008-03-05 10:31:54 -0500633 * Binary mount data FS will come through this function twice. Once
634 * from an explicit call and once from the generic calls from the vfs.
635 * Since the generic VFS calls will not contain any security mount data
636 * we need to skip the double mount verification.
637 *
638 * This does open a hole in which we will not notice if the first
639 * mount using this sb set explict options and a second mount using
640 * this sb does not set any security options. (The first options
641 * will be used for both mounts)
642 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500643 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500644 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400645 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500646
647 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500648 * parse the mount options, check if they are valid sids.
649 * also check if someone is trying to mount the same sb more
650 * than once with different security options.
651 */
652 for (i = 0; i < num_opts; i++) {
653 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500654
Eric Paris12f348b2012-10-09 10:56:25 -0400655 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500656 continue;
Eric Parisc9180a52007-11-30 13:00:35 -0500657 rc = security_context_to_sid(mount_options[i],
658 strlen(mount_options[i]), &sid);
659 if (rc) {
660 printk(KERN_WARNING "SELinux: security_context_to_sid"
Anand Avati102aefd2013-04-16 18:56:19 -0400661 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
662 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500663 goto out;
664 }
665 switch (flags[i]) {
666 case FSCONTEXT_MNT:
667 fscontext_sid = sid;
668
669 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
670 fscontext_sid))
671 goto out_double_mount;
672
673 sbsec->flags |= FSCONTEXT_MNT;
674 break;
675 case CONTEXT_MNT:
676 context_sid = sid;
677
678 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
679 context_sid))
680 goto out_double_mount;
681
682 sbsec->flags |= CONTEXT_MNT;
683 break;
684 case ROOTCONTEXT_MNT:
685 rootcontext_sid = sid;
686
687 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
688 rootcontext_sid))
689 goto out_double_mount;
690
691 sbsec->flags |= ROOTCONTEXT_MNT;
692
693 break;
694 case DEFCONTEXT_MNT:
695 defcontext_sid = sid;
696
697 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
698 defcontext_sid))
699 goto out_double_mount;
700
701 sbsec->flags |= DEFCONTEXT_MNT;
702
703 break;
704 default:
705 rc = -EINVAL;
706 goto out;
707 }
708 }
709
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500710 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500711 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500712 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500713 goto out_double_mount;
714 rc = 0;
715 goto out;
716 }
717
James Morris089be432008-07-15 18:32:49 +1000718 if (strcmp(sb->s_type->name, "proc") == 0)
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500719 sbsec->flags |= SE_SBPROC;
Eric Parisc9180a52007-11-30 13:00:35 -0500720
David Quigleyeb9ae682013-05-22 12:50:37 -0400721 if (!sbsec->behavior) {
722 /*
723 * Determine the labeling behavior to use for this
724 * filesystem type.
725 */
Paul Moore98f700f2013-09-18 13:52:20 -0400726 rc = security_fs_use(sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400727 if (rc) {
728 printk(KERN_WARNING
729 "%s: security_fs_use(%s) returned %d\n",
730 __func__, sb->s_type->name, rc);
731 goto out;
732 }
Eric Parisc9180a52007-11-30 13:00:35 -0500733 }
Eric Parisc9180a52007-11-30 13:00:35 -0500734 /* sets the context of the superblock for the fs being mounted. */
735 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100736 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500737 if (rc)
738 goto out;
739
740 sbsec->sid = fscontext_sid;
741 }
742
743 /*
744 * Switch to using mount point labeling behavior.
745 * sets the label used on all file below the mountpoint, and will set
746 * the superblock context if not already set.
747 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400748 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
749 sbsec->behavior = SECURITY_FS_USE_NATIVE;
750 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
751 }
752
Eric Parisc9180a52007-11-30 13:00:35 -0500753 if (context_sid) {
754 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100755 rc = may_context_mount_sb_relabel(context_sid, sbsec,
756 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500757 if (rc)
758 goto out;
759 sbsec->sid = context_sid;
760 } else {
David Howells275bb412008-11-14 10:39:19 +1100761 rc = may_context_mount_inode_relabel(context_sid, sbsec,
762 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500763 if (rc)
764 goto out;
765 }
766 if (!rootcontext_sid)
767 rootcontext_sid = context_sid;
768
769 sbsec->mntpoint_sid = context_sid;
770 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
771 }
772
773 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100774 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
775 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500776 if (rc)
777 goto out;
778
779 root_isec->sid = rootcontext_sid;
780 root_isec->initialized = 1;
781 }
782
783 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400784 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
785 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500786 rc = -EINVAL;
787 printk(KERN_WARNING "SELinux: defcontext option is "
788 "invalid for this filesystem type\n");
789 goto out;
790 }
791
792 if (defcontext_sid != sbsec->def_sid) {
793 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100794 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500795 if (rc)
796 goto out;
797 }
798
799 sbsec->def_sid = defcontext_sid;
800 }
801
802 rc = sb_finish_set_opts(sb);
803out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700804 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700805 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500806out_double_mount:
807 rc = -EINVAL;
808 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Anand Avati102aefd2013-04-16 18:56:19 -0400809 "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
810 SB_TYPE_ARGS(sb));
Eric Parisc9180a52007-11-30 13:00:35 -0500811 goto out;
812}
813
Jeff Layton094f7b62013-04-01 08:14:24 -0400814static int selinux_cmp_sb_context(const struct super_block *oldsb,
815 const struct super_block *newsb)
816{
817 struct superblock_security_struct *old = oldsb->s_security;
818 struct superblock_security_struct *new = newsb->s_security;
819 char oldflags = old->flags & SE_MNTMASK;
820 char newflags = new->flags & SE_MNTMASK;
821
822 if (oldflags != newflags)
823 goto mismatch;
824 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
825 goto mismatch;
826 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
827 goto mismatch;
828 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
829 goto mismatch;
830 if (oldflags & ROOTCONTEXT_MNT) {
831 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
832 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
833 if (oldroot->sid != newroot->sid)
834 goto mismatch;
835 }
836 return 0;
837mismatch:
838 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
839 "different security settings for (dev %s, "
840 "type %s)\n", newsb->s_id, newsb->s_type->name);
841 return -EBUSY;
842}
843
844static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Eric Parisc9180a52007-11-30 13:00:35 -0500845 struct super_block *newsb)
846{
847 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
848 struct superblock_security_struct *newsbsec = newsb->s_security;
849
850 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
851 int set_context = (oldsbsec->flags & CONTEXT_MNT);
852 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
853
Eric Paris0f5e6422008-04-21 16:24:11 -0400854 /*
855 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400856 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400857 */
Al Viroe8c26252010-03-23 06:36:54 -0400858 if (!ss_initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -0400859 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500860
Eric Parisc9180a52007-11-30 13:00:35 -0500861 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500862 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500863
Jeff Layton094f7b62013-04-01 08:14:24 -0400864 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500865 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -0400866 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -0400867
Eric Parisc9180a52007-11-30 13:00:35 -0500868 mutex_lock(&newsbsec->lock);
869
870 newsbsec->flags = oldsbsec->flags;
871
872 newsbsec->sid = oldsbsec->sid;
873 newsbsec->def_sid = oldsbsec->def_sid;
874 newsbsec->behavior = oldsbsec->behavior;
875
876 if (set_context) {
877 u32 sid = oldsbsec->mntpoint_sid;
878
879 if (!set_fscontext)
880 newsbsec->sid = sid;
881 if (!set_rootcontext) {
882 struct inode *newinode = newsb->s_root->d_inode;
883 struct inode_security_struct *newisec = newinode->i_security;
884 newisec->sid = sid;
885 }
886 newsbsec->mntpoint_sid = sid;
887 }
888 if (set_rootcontext) {
889 const struct inode *oldinode = oldsb->s_root->d_inode;
890 const struct inode_security_struct *oldisec = oldinode->i_security;
891 struct inode *newinode = newsb->s_root->d_inode;
892 struct inode_security_struct *newisec = newinode->i_security;
893
894 newisec->sid = oldisec->sid;
895 }
896
897 sb_finish_set_opts(newsb);
898 mutex_unlock(&newsbsec->lock);
Jeff Layton094f7b62013-04-01 08:14:24 -0400899 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500900}
901
Adrian Bunk2e1479d2008-03-17 22:29:23 +0200902static int selinux_parse_opts_str(char *options,
903 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500904{
Eric Parise0007522008-03-05 10:31:54 -0500905 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -0500906 char *context = NULL, *defcontext = NULL;
907 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -0500908 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500909
Eric Parise0007522008-03-05 10:31:54 -0500910 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500911
912 /* Standard string-based options. */
913 while ((p = strsep(&options, "|")) != NULL) {
914 int token;
915 substring_t args[MAX_OPT_ARGS];
916
917 if (!*p)
918 continue;
919
920 token = match_token(p, tokens, args);
921
922 switch (token) {
923 case Opt_context:
924 if (context || defcontext) {
925 rc = -EINVAL;
926 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
927 goto out_err;
928 }
929 context = match_strdup(&args[0]);
930 if (!context) {
931 rc = -ENOMEM;
932 goto out_err;
933 }
934 break;
935
936 case Opt_fscontext:
937 if (fscontext) {
938 rc = -EINVAL;
939 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
940 goto out_err;
941 }
942 fscontext = match_strdup(&args[0]);
943 if (!fscontext) {
944 rc = -ENOMEM;
945 goto out_err;
946 }
947 break;
948
949 case Opt_rootcontext:
950 if (rootcontext) {
951 rc = -EINVAL;
952 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
953 goto out_err;
954 }
955 rootcontext = match_strdup(&args[0]);
956 if (!rootcontext) {
957 rc = -ENOMEM;
958 goto out_err;
959 }
960 break;
961
962 case Opt_defcontext:
963 if (context || defcontext) {
964 rc = -EINVAL;
965 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
966 goto out_err;
967 }
968 defcontext = match_strdup(&args[0]);
969 if (!defcontext) {
970 rc = -ENOMEM;
971 goto out_err;
972 }
973 break;
David P. Quigley11689d42009-01-16 09:22:03 -0500974 case Opt_labelsupport:
975 break;
Eric Parisc9180a52007-11-30 13:00:35 -0500976 default:
977 rc = -EINVAL;
978 printk(KERN_WARNING "SELinux: unknown mount option\n");
979 goto out_err;
980
981 }
982 }
983
Eric Parise0007522008-03-05 10:31:54 -0500984 rc = -ENOMEM;
985 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
986 if (!opts->mnt_opts)
987 goto out_err;
988
989 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
990 if (!opts->mnt_opts_flags) {
991 kfree(opts->mnt_opts);
992 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -0500993 }
994
Eric Parise0007522008-03-05 10:31:54 -0500995 if (fscontext) {
996 opts->mnt_opts[num_mnt_opts] = fscontext;
997 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
998 }
999 if (context) {
1000 opts->mnt_opts[num_mnt_opts] = context;
1001 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1002 }
1003 if (rootcontext) {
1004 opts->mnt_opts[num_mnt_opts] = rootcontext;
1005 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1006 }
1007 if (defcontext) {
1008 opts->mnt_opts[num_mnt_opts] = defcontext;
1009 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1010 }
1011
1012 opts->num_mnt_opts = num_mnt_opts;
1013 return 0;
1014
Eric Parisc9180a52007-11-30 13:00:35 -05001015out_err:
1016 kfree(context);
1017 kfree(defcontext);
1018 kfree(fscontext);
1019 kfree(rootcontext);
1020 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001021}
Eric Parise0007522008-03-05 10:31:54 -05001022/*
1023 * string mount options parsing and call set the sbsec
1024 */
1025static int superblock_doinit(struct super_block *sb, void *data)
1026{
1027 int rc = 0;
1028 char *options = data;
1029 struct security_mnt_opts opts;
1030
1031 security_init_mnt_opts(&opts);
1032
1033 if (!data)
1034 goto out;
1035
1036 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1037
1038 rc = selinux_parse_opts_str(options, &opts);
1039 if (rc)
1040 goto out_err;
1041
1042out:
David Quigley649f6e72013-05-22 12:50:36 -04001043 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001044
1045out_err:
1046 security_free_mnt_opts(&opts);
1047 return rc;
1048}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001049
Adrian Bunk3583a712008-07-22 20:21:23 +03001050static void selinux_write_opts(struct seq_file *m,
1051 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001052{
1053 int i;
1054 char *prefix;
1055
1056 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001057 char *has_comma;
1058
1059 if (opts->mnt_opts[i])
1060 has_comma = strchr(opts->mnt_opts[i], ',');
1061 else
1062 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001063
1064 switch (opts->mnt_opts_flags[i]) {
1065 case CONTEXT_MNT:
1066 prefix = CONTEXT_STR;
1067 break;
1068 case FSCONTEXT_MNT:
1069 prefix = FSCONTEXT_STR;
1070 break;
1071 case ROOTCONTEXT_MNT:
1072 prefix = ROOTCONTEXT_STR;
1073 break;
1074 case DEFCONTEXT_MNT:
1075 prefix = DEFCONTEXT_STR;
1076 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001077 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001078 seq_putc(m, ',');
1079 seq_puts(m, LABELSUPP_STR);
1080 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001081 default:
1082 BUG();
Eric Parisa35c6c82011-04-20 10:21:28 -04001083 return;
Eric Paris2069f452008-07-04 09:47:13 +10001084 };
1085 /* we need a comma before each option */
1086 seq_putc(m, ',');
1087 seq_puts(m, prefix);
1088 if (has_comma)
1089 seq_putc(m, '\"');
1090 seq_puts(m, opts->mnt_opts[i]);
1091 if (has_comma)
1092 seq_putc(m, '\"');
1093 }
1094}
1095
1096static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1097{
1098 struct security_mnt_opts opts;
1099 int rc;
1100
1101 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001102 if (rc) {
1103 /* before policy load we may get EINVAL, don't show anything */
1104 if (rc == -EINVAL)
1105 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001106 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001107 }
Eric Paris2069f452008-07-04 09:47:13 +10001108
1109 selinux_write_opts(m, &opts);
1110
1111 security_free_mnt_opts(&opts);
1112
1113 return rc;
1114}
1115
Linus Torvalds1da177e2005-04-16 15:20:36 -07001116static inline u16 inode_mode_to_security_class(umode_t mode)
1117{
1118 switch (mode & S_IFMT) {
1119 case S_IFSOCK:
1120 return SECCLASS_SOCK_FILE;
1121 case S_IFLNK:
1122 return SECCLASS_LNK_FILE;
1123 case S_IFREG:
1124 return SECCLASS_FILE;
1125 case S_IFBLK:
1126 return SECCLASS_BLK_FILE;
1127 case S_IFDIR:
1128 return SECCLASS_DIR;
1129 case S_IFCHR:
1130 return SECCLASS_CHR_FILE;
1131 case S_IFIFO:
1132 return SECCLASS_FIFO_FILE;
1133
1134 }
1135
1136 return SECCLASS_FILE;
1137}
1138
James Morris13402582005-09-30 14:24:34 -04001139static inline int default_protocol_stream(int protocol)
1140{
1141 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1142}
1143
1144static inline int default_protocol_dgram(int protocol)
1145{
1146 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1147}
1148
Linus Torvalds1da177e2005-04-16 15:20:36 -07001149static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1150{
1151 switch (family) {
1152 case PF_UNIX:
1153 switch (type) {
1154 case SOCK_STREAM:
1155 case SOCK_SEQPACKET:
1156 return SECCLASS_UNIX_STREAM_SOCKET;
1157 case SOCK_DGRAM:
1158 return SECCLASS_UNIX_DGRAM_SOCKET;
1159 }
1160 break;
1161 case PF_INET:
1162 case PF_INET6:
1163 switch (type) {
1164 case SOCK_STREAM:
James Morris13402582005-09-30 14:24:34 -04001165 if (default_protocol_stream(protocol))
1166 return SECCLASS_TCP_SOCKET;
1167 else
1168 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001169 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001170 if (default_protocol_dgram(protocol))
1171 return SECCLASS_UDP_SOCKET;
1172 else
1173 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001174 case SOCK_DCCP:
1175 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001176 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001177 return SECCLASS_RAWIP_SOCKET;
1178 }
1179 break;
1180 case PF_NETLINK:
1181 switch (protocol) {
1182 case NETLINK_ROUTE:
1183 return SECCLASS_NETLINK_ROUTE_SOCKET;
1184 case NETLINK_FIREWALL:
1185 return SECCLASS_NETLINK_FIREWALL_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001186 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001187 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1188 case NETLINK_NFLOG:
1189 return SECCLASS_NETLINK_NFLOG_SOCKET;
1190 case NETLINK_XFRM:
1191 return SECCLASS_NETLINK_XFRM_SOCKET;
1192 case NETLINK_SELINUX:
1193 return SECCLASS_NETLINK_SELINUX_SOCKET;
1194 case NETLINK_AUDIT:
1195 return SECCLASS_NETLINK_AUDIT_SOCKET;
1196 case NETLINK_IP6_FW:
1197 return SECCLASS_NETLINK_IP6FW_SOCKET;
1198 case NETLINK_DNRTMSG:
1199 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001200 case NETLINK_KOBJECT_UEVENT:
1201 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001202 default:
1203 return SECCLASS_NETLINK_SOCKET;
1204 }
1205 case PF_PACKET:
1206 return SECCLASS_PACKET_SOCKET;
1207 case PF_KEY:
1208 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001209 case PF_APPLETALK:
1210 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001211 }
1212
1213 return SECCLASS_SOCKET;
1214}
1215
1216#ifdef CONFIG_PROC_FS
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001217static int selinux_proc_get_sid(struct dentry *dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001218 u16 tclass,
1219 u32 *sid)
1220{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001221 int rc;
1222 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001223
Eric Paris828dfe12008-04-17 13:17:49 -04001224 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001225 if (!buffer)
1226 return -ENOMEM;
1227
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001228 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1229 if (IS_ERR(path))
1230 rc = PTR_ERR(path);
1231 else {
1232 /* each process gets a /proc/PID/ entry. Strip off the
1233 * PID part to get a valid selinux labeling.
1234 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1235 while (path[1] >= '0' && path[1] <= '9') {
1236 path[1] = '/';
1237 path++;
1238 }
1239 rc = security_genfs_sid("proc", path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001240 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001241 free_page((unsigned long)buffer);
1242 return rc;
1243}
1244#else
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001245static int selinux_proc_get_sid(struct dentry *dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001246 u16 tclass,
1247 u32 *sid)
1248{
1249 return -EINVAL;
1250}
1251#endif
1252
1253/* The inode's security attributes must be initialized before first use. */
1254static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1255{
1256 struct superblock_security_struct *sbsec = NULL;
1257 struct inode_security_struct *isec = inode->i_security;
1258 u32 sid;
1259 struct dentry *dentry;
1260#define INITCONTEXTLEN 255
1261 char *context = NULL;
1262 unsigned len = 0;
1263 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001264
1265 if (isec->initialized)
1266 goto out;
1267
Eric Paris23970742006-09-25 23:32:01 -07001268 mutex_lock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001269 if (isec->initialized)
Eric Paris23970742006-09-25 23:32:01 -07001270 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001271
1272 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001273 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001274 /* Defer initialization until selinux_complete_init,
1275 after the initial policy is loaded and the security
1276 server is ready to handle calls. */
1277 spin_lock(&sbsec->isec_lock);
1278 if (list_empty(&isec->list))
1279 list_add(&isec->list, &sbsec->isec_head);
1280 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001281 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001282 }
1283
1284 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001285 case SECURITY_FS_USE_NATIVE:
1286 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001287 case SECURITY_FS_USE_XATTR:
1288 if (!inode->i_op->getxattr) {
1289 isec->sid = sbsec->def_sid;
1290 break;
1291 }
1292
1293 /* Need a dentry, since the xattr API requires one.
1294 Life would be simpler if we could just pass the inode. */
1295 if (opt_dentry) {
1296 /* Called from d_instantiate or d_splice_alias. */
1297 dentry = dget(opt_dentry);
1298 } else {
1299 /* Called from selinux_complete_init, try to find a dentry. */
1300 dentry = d_find_alias(inode);
1301 }
1302 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001303 /*
1304 * this is can be hit on boot when a file is accessed
1305 * before the policy is loaded. When we load policy we
1306 * may find inodes that have no dentry on the
1307 * sbsec->isec_head list. No reason to complain as these
1308 * will get fixed up the next time we go through
1309 * inode_doinit with a dentry, before these inodes could
1310 * be used again by userspace.
1311 */
Eric Paris23970742006-09-25 23:32:01 -07001312 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001313 }
1314
1315 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001316 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001317 if (!context) {
1318 rc = -ENOMEM;
1319 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001320 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001321 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001322 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001323 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1324 context, len);
1325 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001326 kfree(context);
1327
Linus Torvalds1da177e2005-04-16 15:20:36 -07001328 /* Need a larger buffer. Query for the right size. */
1329 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1330 NULL, 0);
1331 if (rc < 0) {
1332 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001333 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001334 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001335 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001336 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001337 if (!context) {
1338 rc = -ENOMEM;
1339 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001340 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001341 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001342 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001343 rc = inode->i_op->getxattr(dentry,
1344 XATTR_NAME_SELINUX,
1345 context, len);
1346 }
1347 dput(dentry);
1348 if (rc < 0) {
1349 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001350 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001351 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001352 -rc, inode->i_sb->s_id, inode->i_ino);
1353 kfree(context);
Eric Paris23970742006-09-25 23:32:01 -07001354 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001355 }
1356 /* Map ENODATA to the default file SID */
1357 sid = sbsec->def_sid;
1358 rc = 0;
1359 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001360 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001361 sbsec->def_sid,
1362 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001363 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001364 char *dev = inode->i_sb->s_id;
1365 unsigned long ino = inode->i_ino;
1366
1367 if (rc == -EINVAL) {
1368 if (printk_ratelimit())
1369 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1370 "context=%s. This indicates you may need to relabel the inode or the "
1371 "filesystem in question.\n", ino, dev, context);
1372 } else {
1373 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1374 "returned %d for dev=%s ino=%ld\n",
1375 __func__, context, -rc, dev, ino);
1376 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001377 kfree(context);
1378 /* Leave with the unlabeled SID */
1379 rc = 0;
1380 break;
1381 }
1382 }
1383 kfree(context);
1384 isec->sid = sid;
1385 break;
1386 case SECURITY_FS_USE_TASK:
1387 isec->sid = isec->task_sid;
1388 break;
1389 case SECURITY_FS_USE_TRANS:
1390 /* Default to the fs SID. */
1391 isec->sid = sbsec->sid;
1392
1393 /* Try to obtain a transition SID. */
1394 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Eric Paris652bb9b2011-02-01 11:05:40 -05001395 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1396 isec->sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001397 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001398 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001399 isec->sid = sid;
1400 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001401 case SECURITY_FS_USE_MNTPOINT:
1402 isec->sid = sbsec->mntpoint_sid;
1403 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001404 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001405 /* Default to the fs superblock SID. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001406 isec->sid = sbsec->sid;
1407
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001408 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001409 if (opt_dentry) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001410 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001411 rc = selinux_proc_get_sid(opt_dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001412 isec->sclass,
1413 &sid);
1414 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001415 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001416 isec->sid = sid;
1417 }
1418 }
1419 break;
1420 }
1421
1422 isec->initialized = 1;
1423
Eric Paris23970742006-09-25 23:32:01 -07001424out_unlock:
1425 mutex_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001426out:
1427 if (isec->sclass == SECCLASS_FILE)
1428 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001429 return rc;
1430}
1431
1432/* Convert a Linux signal to an access vector. */
1433static inline u32 signal_to_av(int sig)
1434{
1435 u32 perm = 0;
1436
1437 switch (sig) {
1438 case SIGCHLD:
1439 /* Commonly granted from child to parent. */
1440 perm = PROCESS__SIGCHLD;
1441 break;
1442 case SIGKILL:
1443 /* Cannot be caught or ignored */
1444 perm = PROCESS__SIGKILL;
1445 break;
1446 case SIGSTOP:
1447 /* Cannot be caught or ignored */
1448 perm = PROCESS__SIGSTOP;
1449 break;
1450 default:
1451 /* All other signals. */
1452 perm = PROCESS__SIGNAL;
1453 break;
1454 }
1455
1456 return perm;
1457}
1458
David Howells275bb412008-11-14 10:39:19 +11001459/*
David Howellsd84f4f92008-11-14 10:39:23 +11001460 * Check permission between a pair of credentials
1461 * fork check, ptrace check, etc.
1462 */
1463static int cred_has_perm(const struct cred *actor,
1464 const struct cred *target,
1465 u32 perms)
1466{
1467 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1468
1469 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1470}
1471
1472/*
David Howells88e67f32008-11-14 10:39:21 +11001473 * Check permission between a pair of tasks, e.g. signal checks,
David Howells275bb412008-11-14 10:39:19 +11001474 * fork check, ptrace check, etc.
1475 * tsk1 is the actor and tsk2 is the target
David Howells3b11a1d2008-11-14 10:39:26 +11001476 * - this uses the default subjective creds of tsk1
David Howells275bb412008-11-14 10:39:19 +11001477 */
1478static int task_has_perm(const struct task_struct *tsk1,
1479 const struct task_struct *tsk2,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001480 u32 perms)
1481{
David Howells275bb412008-11-14 10:39:19 +11001482 const struct task_security_struct *__tsec1, *__tsec2;
1483 u32 sid1, sid2;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001484
David Howells275bb412008-11-14 10:39:19 +11001485 rcu_read_lock();
1486 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1487 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1488 rcu_read_unlock();
1489 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490}
1491
David Howells3b11a1d2008-11-14 10:39:26 +11001492/*
1493 * Check permission between current and another task, e.g. signal checks,
1494 * fork check, ptrace check, etc.
1495 * current is the actor and tsk2 is the target
1496 * - this uses current's subjective creds
1497 */
1498static int current_has_perm(const struct task_struct *tsk,
1499 u32 perms)
1500{
1501 u32 sid, tsid;
1502
1503 sid = current_sid();
1504 tsid = task_sid(tsk);
1505 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1506}
1507
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001508#if CAP_LAST_CAP > 63
1509#error Fix SELinux to handle capabilities > 63.
1510#endif
1511
Linus Torvalds1da177e2005-04-16 15:20:36 -07001512/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001513static int cred_has_capability(const struct cred *cred,
Eric Paris06112162008-11-11 22:02:50 +11001514 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001515{
Thomas Liu2bf49692009-07-14 12:14:09 -04001516 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001517 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001518 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001519 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001520 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001521 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001522
Eric Paris50c205f2012-04-04 15:01:43 -04001523 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001524 ad.u.cap = cap;
1525
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001526 switch (CAP_TO_INDEX(cap)) {
1527 case 0:
1528 sclass = SECCLASS_CAPABILITY;
1529 break;
1530 case 1:
1531 sclass = SECCLASS_CAPABILITY2;
1532 break;
1533 default:
1534 printk(KERN_ERR
1535 "SELinux: out of range capability %d\n", cap);
1536 BUG();
Eric Parisa35c6c82011-04-20 10:21:28 -04001537 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001538 }
Eric Paris06112162008-11-11 22:02:50 +11001539
David Howells275bb412008-11-14 10:39:19 +11001540 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001541 if (audit == SECURITY_CAP_AUDIT) {
Linus Torvaldsab354062013-10-04 14:05:38 -07001542 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001543 if (rc2)
1544 return rc2;
1545 }
Eric Paris06112162008-11-11 22:02:50 +11001546 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001547}
1548
1549/* Check whether a task is allowed to use a system operation. */
1550static int task_has_system(struct task_struct *tsk,
1551 u32 perms)
1552{
David Howells275bb412008-11-14 10:39:19 +11001553 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001554
David Howells275bb412008-11-14 10:39:19 +11001555 return avc_has_perm(sid, SECINITSID_KERNEL,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 SECCLASS_SYSTEM, perms, NULL);
1557}
1558
1559/* Check whether a task has a particular permission to an inode.
1560 The 'adp' parameter is optional and allows other audit
1561 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001562static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001563 struct inode *inode,
1564 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001565 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001566{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001567 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001568 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001569
David Howellse0e81732009-09-02 09:13:40 +01001570 validate_creds(cred);
1571
Eric Paris828dfe12008-04-17 13:17:49 -04001572 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001573 return 0;
1574
David Howells88e67f32008-11-14 10:39:21 +11001575 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001576 isec = inode->i_security;
1577
Linus Torvalds19e49832013-10-04 12:54:11 -07001578 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001579}
1580
1581/* Same as inode_has_perm, but pass explicit audit data containing
1582 the dentry to help the auditing code to more easily generate the
1583 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001584static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 struct dentry *dentry,
1586 u32 av)
1587{
1588 struct inode *inode = dentry->d_inode;
Thomas Liu2bf49692009-07-14 12:14:09 -04001589 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001590
Eric Paris50c205f2012-04-04 15:01:43 -04001591 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001592 ad.u.dentry = dentry;
Linus Torvalds19e49832013-10-04 12:54:11 -07001593 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001594}
1595
1596/* Same as inode_has_perm, but pass explicit audit data containing
1597 the path to help the auditing code to more easily generate the
1598 pathname if needed. */
1599static inline int path_has_perm(const struct cred *cred,
1600 struct path *path,
1601 u32 av)
1602{
1603 struct inode *inode = path->dentry->d_inode;
1604 struct common_audit_data ad;
1605
Eric Paris50c205f2012-04-04 15:01:43 -04001606 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001607 ad.u.path = *path;
Linus Torvalds19e49832013-10-04 12:54:11 -07001608 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001609}
1610
David Howells13f8e982013-06-13 23:37:55 +01001611/* Same as path_has_perm, but uses the inode from the file struct. */
1612static inline int file_path_has_perm(const struct cred *cred,
1613 struct file *file,
1614 u32 av)
1615{
1616 struct common_audit_data ad;
1617
1618 ad.type = LSM_AUDIT_DATA_PATH;
1619 ad.u.path = file->f_path;
Linus Torvalds19e49832013-10-04 12:54:11 -07001620 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001621}
1622
Linus Torvalds1da177e2005-04-16 15:20:36 -07001623/* Check whether a task can use an open file descriptor to
1624 access an inode in a given way. Check access to the
1625 descriptor itself, and then use dentry_has_perm to
1626 check a particular permission to the file.
1627 Access to the descriptor is implicitly granted if it
1628 has the same SID as the process. If av is zero, then
1629 access to the file is not checked, e.g. for cases
1630 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001631static int file_has_perm(const struct cred *cred,
1632 struct file *file,
1633 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001634{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001635 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001636 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001637 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001638 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001639 int rc;
1640
Eric Paris50c205f2012-04-04 15:01:43 -04001641 ad.type = LSM_AUDIT_DATA_PATH;
Eric Parisf48b7392011-04-25 12:54:27 -04001642 ad.u.path = file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001643
David Howells275bb412008-11-14 10:39:19 +11001644 if (sid != fsec->sid) {
1645 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001646 SECCLASS_FD,
1647 FD__USE,
1648 &ad);
1649 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001650 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001651 }
1652
1653 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001654 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001655 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001656 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001657
David Howells88e67f32008-11-14 10:39:21 +11001658out:
1659 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001660}
1661
1662/* Check whether a task can create a file. */
1663static int may_create(struct inode *dir,
1664 struct dentry *dentry,
1665 u16 tclass)
1666{
Paul Moore5fb49872010-04-22 14:46:19 -04001667 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001668 struct inode_security_struct *dsec;
1669 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001670 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001671 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001672 int rc;
1673
Linus Torvalds1da177e2005-04-16 15:20:36 -07001674 dsec = dir->i_security;
1675 sbsec = dir->i_sb->s_security;
1676
David Howells275bb412008-11-14 10:39:19 +11001677 sid = tsec->sid;
1678 newsid = tsec->create_sid;
1679
Eric Paris50c205f2012-04-04 15:01:43 -04001680 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001681 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001682
David Howells275bb412008-11-14 10:39:19 +11001683 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001684 DIR__ADD_NAME | DIR__SEARCH,
1685 &ad);
1686 if (rc)
1687 return rc;
1688
Eric Paris12f348b2012-10-09 10:56:25 -04001689 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
Eric Pariscb1e9222011-04-28 15:11:21 -04001690 rc = security_transition_sid(sid, dsec->sid, tclass,
1691 &dentry->d_name, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001692 if (rc)
1693 return rc;
1694 }
1695
David Howells275bb412008-11-14 10:39:19 +11001696 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001697 if (rc)
1698 return rc;
1699
1700 return avc_has_perm(newsid, sbsec->sid,
1701 SECCLASS_FILESYSTEM,
1702 FILESYSTEM__ASSOCIATE, &ad);
1703}
1704
Michael LeMay4eb582c2006-06-26 00:24:57 -07001705/* Check whether a task can create a key. */
1706static int may_create_key(u32 ksid,
1707 struct task_struct *ctx)
1708{
David Howells275bb412008-11-14 10:39:19 +11001709 u32 sid = task_sid(ctx);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001710
David Howells275bb412008-11-14 10:39:19 +11001711 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001712}
1713
Eric Paris828dfe12008-04-17 13:17:49 -04001714#define MAY_LINK 0
1715#define MAY_UNLINK 1
1716#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001717
1718/* Check whether a task can link, unlink, or rmdir a file/directory. */
1719static int may_link(struct inode *dir,
1720 struct dentry *dentry,
1721 int kind)
1722
1723{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001724 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001725 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001726 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001727 u32 av;
1728 int rc;
1729
Linus Torvalds1da177e2005-04-16 15:20:36 -07001730 dsec = dir->i_security;
1731 isec = dentry->d_inode->i_security;
1732
Eric Paris50c205f2012-04-04 15:01:43 -04001733 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001734 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001735
1736 av = DIR__SEARCH;
1737 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001738 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001739 if (rc)
1740 return rc;
1741
1742 switch (kind) {
1743 case MAY_LINK:
1744 av = FILE__LINK;
1745 break;
1746 case MAY_UNLINK:
1747 av = FILE__UNLINK;
1748 break;
1749 case MAY_RMDIR:
1750 av = DIR__RMDIR;
1751 break;
1752 default:
Eric Paris744ba352008-04-17 11:52:44 -04001753 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1754 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001755 return 0;
1756 }
1757
David Howells275bb412008-11-14 10:39:19 +11001758 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001759 return rc;
1760}
1761
1762static inline int may_rename(struct inode *old_dir,
1763 struct dentry *old_dentry,
1764 struct inode *new_dir,
1765 struct dentry *new_dentry)
1766{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001767 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001768 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001769 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001770 u32 av;
1771 int old_is_dir, new_is_dir;
1772 int rc;
1773
Linus Torvalds1da177e2005-04-16 15:20:36 -07001774 old_dsec = old_dir->i_security;
1775 old_isec = old_dentry->d_inode->i_security;
1776 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1777 new_dsec = new_dir->i_security;
1778
Eric Paris50c205f2012-04-04 15:01:43 -04001779 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001780
Eric Parisa2694342011-04-25 13:10:27 -04001781 ad.u.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11001782 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001783 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1784 if (rc)
1785 return rc;
David Howells275bb412008-11-14 10:39:19 +11001786 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001787 old_isec->sclass, FILE__RENAME, &ad);
1788 if (rc)
1789 return rc;
1790 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11001791 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001792 old_isec->sclass, DIR__REPARENT, &ad);
1793 if (rc)
1794 return rc;
1795 }
1796
Eric Parisa2694342011-04-25 13:10:27 -04001797 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001798 av = DIR__ADD_NAME | DIR__SEARCH;
1799 if (new_dentry->d_inode)
1800 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11001801 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001802 if (rc)
1803 return rc;
1804 if (new_dentry->d_inode) {
1805 new_isec = new_dentry->d_inode->i_security;
1806 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11001807 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001808 new_isec->sclass,
1809 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1810 if (rc)
1811 return rc;
1812 }
1813
1814 return 0;
1815}
1816
1817/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001818static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001819 struct super_block *sb,
1820 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001821 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001822{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001823 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11001824 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001825
Linus Torvalds1da177e2005-04-16 15:20:36 -07001826 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11001827 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001828}
1829
1830/* Convert a Linux mode and permission mask to an access vector. */
1831static inline u32 file_mask_to_av(int mode, int mask)
1832{
1833 u32 av = 0;
1834
Al Virodba19c62011-07-25 20:49:29 -04001835 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001836 if (mask & MAY_EXEC)
1837 av |= FILE__EXECUTE;
1838 if (mask & MAY_READ)
1839 av |= FILE__READ;
1840
1841 if (mask & MAY_APPEND)
1842 av |= FILE__APPEND;
1843 else if (mask & MAY_WRITE)
1844 av |= FILE__WRITE;
1845
1846 } else {
1847 if (mask & MAY_EXEC)
1848 av |= DIR__SEARCH;
1849 if (mask & MAY_WRITE)
1850 av |= DIR__WRITE;
1851 if (mask & MAY_READ)
1852 av |= DIR__READ;
1853 }
1854
1855 return av;
1856}
1857
1858/* Convert a Linux file to an access vector. */
1859static inline u32 file_to_av(struct file *file)
1860{
1861 u32 av = 0;
1862
1863 if (file->f_mode & FMODE_READ)
1864 av |= FILE__READ;
1865 if (file->f_mode & FMODE_WRITE) {
1866 if (file->f_flags & O_APPEND)
1867 av |= FILE__APPEND;
1868 else
1869 av |= FILE__WRITE;
1870 }
Stephen Smalley0794c662008-03-17 08:55:18 -04001871 if (!av) {
1872 /*
1873 * Special file opened with flags 3 for ioctl-only use.
1874 */
1875 av = FILE__IOCTL;
1876 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001877
1878 return av;
1879}
1880
Eric Paris8b6a5a32008-10-29 17:06:46 -04001881/*
1882 * Convert a file to an access vector and include the correct open
1883 * open permission.
1884 */
1885static inline u32 open_file_to_av(struct file *file)
1886{
1887 u32 av = file_to_av(file);
1888
Eric Paris49b7b8d2010-07-23 11:44:09 -04001889 if (selinux_policycap_openperm)
1890 av |= FILE__OPEN;
1891
Eric Paris8b6a5a32008-10-29 17:06:46 -04001892 return av;
1893}
1894
Linus Torvalds1da177e2005-04-16 15:20:36 -07001895/* Hook functions begin here. */
1896
Ingo Molnar9e488582009-05-07 19:26:19 +10001897static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01001898 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001899{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001900 int rc;
1901
Ingo Molnar9e488582009-05-07 19:26:19 +10001902 rc = cap_ptrace_access_check(child, mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001903 if (rc)
1904 return rc;
1905
Eric Paris69f594a2012-01-03 12:25:15 -05001906 if (mode & PTRACE_MODE_READ) {
David Howells275bb412008-11-14 10:39:19 +11001907 u32 sid = current_sid();
1908 u32 csid = task_sid(child);
1909 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalley006ebb42008-05-19 08:32:49 -04001910 }
1911
David Howells3b11a1d2008-11-14 10:39:26 +11001912 return current_has_perm(child, PROCESS__PTRACE);
David Howells5cd9c582008-08-14 11:37:28 +01001913}
1914
1915static int selinux_ptrace_traceme(struct task_struct *parent)
1916{
1917 int rc;
1918
Eric Paris200ac532009-02-12 15:01:04 -05001919 rc = cap_ptrace_traceme(parent);
David Howells5cd9c582008-08-14 11:37:28 +01001920 if (rc)
1921 return rc;
1922
1923 return task_has_perm(parent, current, PROCESS__PTRACE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001924}
1925
1926static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04001927 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001928{
1929 int error;
1930
David Howells3b11a1d2008-11-14 10:39:26 +11001931 error = current_has_perm(target, PROCESS__GETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001932 if (error)
1933 return error;
1934
Eric Paris200ac532009-02-12 15:01:04 -05001935 return cap_capget(target, effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001936}
1937
David Howellsd84f4f92008-11-14 10:39:23 +11001938static int selinux_capset(struct cred *new, const struct cred *old,
1939 const kernel_cap_t *effective,
1940 const kernel_cap_t *inheritable,
1941 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001942{
1943 int error;
1944
Eric Paris200ac532009-02-12 15:01:04 -05001945 error = cap_capset(new, old,
David Howellsd84f4f92008-11-14 10:39:23 +11001946 effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001947 if (error)
1948 return error;
1949
David Howellsd84f4f92008-11-14 10:39:23 +11001950 return cred_has_perm(old, new, PROCESS__SETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001951}
1952
James Morris5626d3e2009-01-30 10:05:06 +11001953/*
1954 * (This comment used to live with the selinux_task_setuid hook,
1955 * which was removed).
1956 *
1957 * Since setuid only affects the current process, and since the SELinux
1958 * controls are not based on the Linux identity attributes, SELinux does not
1959 * need to control this operation. However, SELinux does control the use of
1960 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1961 */
1962
Eric Paris6a9de492012-01-03 12:25:14 -05001963static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1964 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001965{
1966 int rc;
1967
Eric Paris6a9de492012-01-03 12:25:14 -05001968 rc = cap_capable(cred, ns, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001969 if (rc)
1970 return rc;
1971
Eric Paris6a9de492012-01-03 12:25:14 -05001972 return cred_has_capability(cred, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001973}
1974
Linus Torvalds1da177e2005-04-16 15:20:36 -07001975static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1976{
David Howells88e67f32008-11-14 10:39:21 +11001977 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001978 int rc = 0;
1979
1980 if (!sb)
1981 return 0;
1982
1983 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04001984 case Q_SYNC:
1985 case Q_QUOTAON:
1986 case Q_QUOTAOFF:
1987 case Q_SETINFO:
1988 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001989 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001990 break;
1991 case Q_GETFMT:
1992 case Q_GETINFO:
1993 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001994 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001995 break;
1996 default:
1997 rc = 0; /* let the kernel handle invalid cmds */
1998 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001999 }
2000 return rc;
2001}
2002
2003static int selinux_quota_on(struct dentry *dentry)
2004{
David Howells88e67f32008-11-14 10:39:21 +11002005 const struct cred *cred = current_cred();
2006
Eric Paris2875fa02011-04-28 16:04:24 -04002007 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002008}
2009
Eric Paris12b30522010-11-15 18:36:29 -05002010static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002011{
2012 int rc;
2013
Linus Torvalds1da177e2005-04-16 15:20:36 -07002014 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002015 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2016 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002017 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2018 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002019 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2020 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2021 /* Set level of messages printed to console */
2022 case SYSLOG_ACTION_CONSOLE_LEVEL:
Eric Paris828dfe12008-04-17 13:17:49 -04002023 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2024 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002025 case SYSLOG_ACTION_CLOSE: /* Close log */
2026 case SYSLOG_ACTION_OPEN: /* Open log */
2027 case SYSLOG_ACTION_READ: /* Read from log */
2028 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2029 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002030 default:
2031 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2032 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002033 }
2034 return rc;
2035}
2036
2037/*
2038 * Check that a process has enough memory to allocate a new virtual
2039 * mapping. 0 means there is enough memory for the allocation to
2040 * succeed and -ENOMEM implies there is not.
2041 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002042 * Do not audit the selinux permission check, as this is applied to all
2043 * processes that allocate mappings.
2044 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002045static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046{
2047 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002048
Eric Paris6a9de492012-01-03 12:25:14 -05002049 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
David Howells3699c532009-01-06 22:27:01 +00002050 SECURITY_CAP_NOAUDIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002051 if (rc == 0)
2052 cap_sys_admin = 1;
2053
Alan Cox34b4e4a2007-08-22 14:01:28 -07002054 return __vm_enough_memory(mm, pages, cap_sys_admin);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002055}
2056
2057/* binprm security operations */
2058
David Howellsa6f76f22008-11-14 10:39:24 +11002059static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002060{
David Howellsa6f76f22008-11-14 10:39:24 +11002061 const struct task_security_struct *old_tsec;
2062 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002063 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002064 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002065 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002066 int rc;
2067
Eric Paris200ac532009-02-12 15:01:04 -05002068 rc = cap_bprm_set_creds(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002069 if (rc)
2070 return rc;
2071
David Howellsa6f76f22008-11-14 10:39:24 +11002072 /* SELinux context only depends on initial program or script and not
2073 * the script interpreter */
2074 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002075 return 0;
2076
David Howellsa6f76f22008-11-14 10:39:24 +11002077 old_tsec = current_security();
2078 new_tsec = bprm->cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002079 isec = inode->i_security;
2080
2081 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002082 new_tsec->sid = old_tsec->sid;
2083 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002084
Michael LeMay28eba5b2006-06-27 02:53:42 -07002085 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002086 new_tsec->create_sid = 0;
2087 new_tsec->keycreate_sid = 0;
2088 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002089
David Howellsa6f76f22008-11-14 10:39:24 +11002090 if (old_tsec->exec_sid) {
2091 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002092 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002093 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002094
2095 /*
2096 * Minimize confusion: if no_new_privs and a transition is
2097 * explicitly requested, then fail the exec.
2098 */
2099 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2100 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002101 } else {
2102 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11002103 rc = security_transition_sid(old_tsec->sid, isec->sid,
Eric Paris652bb9b2011-02-01 11:05:40 -05002104 SECCLASS_PROCESS, NULL,
2105 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002106 if (rc)
2107 return rc;
2108 }
2109
Eric Paris50c205f2012-04-04 15:01:43 -04002110 ad.type = LSM_AUDIT_DATA_PATH;
Eric Parisf48b7392011-04-25 12:54:27 -04002111 ad.u.path = bprm->file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002112
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002113 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2114 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
David Howellsa6f76f22008-11-14 10:39:24 +11002115 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002116
David Howellsa6f76f22008-11-14 10:39:24 +11002117 if (new_tsec->sid == old_tsec->sid) {
2118 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002119 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2120 if (rc)
2121 return rc;
2122 } else {
2123 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002124 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002125 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2126 if (rc)
2127 return rc;
2128
David Howellsa6f76f22008-11-14 10:39:24 +11002129 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002130 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2131 if (rc)
2132 return rc;
2133
David Howellsa6f76f22008-11-14 10:39:24 +11002134 /* Check for shared state */
2135 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2136 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2137 SECCLASS_PROCESS, PROCESS__SHARE,
2138 NULL);
2139 if (rc)
2140 return -EPERM;
2141 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002142
David Howellsa6f76f22008-11-14 10:39:24 +11002143 /* Make sure that anyone attempting to ptrace over a task that
2144 * changes its SID has the appropriate permit */
2145 if (bprm->unsafe &
2146 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2147 struct task_struct *tracer;
2148 struct task_security_struct *sec;
2149 u32 ptsid = 0;
2150
2151 rcu_read_lock();
Tejun Heo06d98472011-06-17 16:50:40 +02002152 tracer = ptrace_parent(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002153 if (likely(tracer != NULL)) {
2154 sec = __task_cred(tracer)->security;
2155 ptsid = sec->sid;
2156 }
2157 rcu_read_unlock();
2158
2159 if (ptsid != 0) {
2160 rc = avc_has_perm(ptsid, new_tsec->sid,
2161 SECCLASS_PROCESS,
2162 PROCESS__PTRACE, NULL);
2163 if (rc)
2164 return -EPERM;
2165 }
2166 }
2167
2168 /* Clear any possibly unsafe personality bits on exec: */
2169 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002170 }
2171
Linus Torvalds1da177e2005-04-16 15:20:36 -07002172 return 0;
2173}
2174
Eric Paris828dfe12008-04-17 13:17:49 -04002175static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002176{
Paul Moore5fb49872010-04-22 14:46:19 -04002177 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +11002178 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002179 int atsecure = 0;
2180
David Howells275bb412008-11-14 10:39:19 +11002181 sid = tsec->sid;
2182 osid = tsec->osid;
2183
2184 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002185 /* Enable secure mode for SIDs transitions unless
2186 the noatsecure permission is granted between
2187 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002188 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002189 SECCLASS_PROCESS,
2190 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002191 }
2192
Eric Paris200ac532009-02-12 15:01:04 -05002193 return (atsecure || cap_bprm_secureexec(bprm));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002194}
2195
Al Viroc3c073f2012-08-21 22:32:06 -04002196static int match_file(const void *p, struct file *file, unsigned fd)
2197{
2198 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2199}
2200
Linus Torvalds1da177e2005-04-16 15:20:36 -07002201/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002202static inline void flush_unauthorized_files(const struct cred *cred,
2203 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002204{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002205 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002206 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002207 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002208 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002209
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002210 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002211 if (tty) {
Nick Pigginee2ffa02010-08-18 04:37:35 +10002212 spin_lock(&tty_files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002213 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002214 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002215
Linus Torvalds1da177e2005-04-16 15:20:36 -07002216 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002217 Use file_path_has_perm on the tty path directly
2218 rather than using file_has_perm, as this particular
2219 open file may belong to another process and we are
2220 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002221 file_priv = list_first_entry(&tty->tty_files,
2222 struct tty_file_private, list);
2223 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002224 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002225 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002226 }
Nick Pigginee2ffa02010-08-18 04:37:35 +10002227 spin_unlock(&tty_files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002228 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002229 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002230 /* Reset controlling tty. */
2231 if (drop_tty)
2232 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002233
2234 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002235 n = iterate_fd(files, 0, match_file, cred);
2236 if (!n) /* none found? */
2237 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002238
Al Viroc3c073f2012-08-21 22:32:06 -04002239 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002240 if (IS_ERR(devnull))
2241 devnull = NULL;
2242 /* replace all the matching ones with this */
2243 do {
2244 replace_fd(n - 1, devnull, 0);
2245 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2246 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002247 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002248}
2249
Linus Torvalds1da177e2005-04-16 15:20:36 -07002250/*
David Howellsa6f76f22008-11-14 10:39:24 +11002251 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002252 */
David Howellsa6f76f22008-11-14 10:39:24 +11002253static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002254{
David Howellsa6f76f22008-11-14 10:39:24 +11002255 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002256 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002257 int rc, i;
2258
David Howellsa6f76f22008-11-14 10:39:24 +11002259 new_tsec = bprm->cred->security;
2260 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002261 return;
2262
2263 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002264 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002265
David Howellsa6f76f22008-11-14 10:39:24 +11002266 /* Always clear parent death signal on SID transitions. */
2267 current->pdeath_signal = 0;
2268
2269 /* Check whether the new SID can inherit resource limits from the old
2270 * SID. If not, reset all soft limits to the lower of the current
2271 * task's hard limit and the init task's soft limit.
2272 *
2273 * Note that the setting of hard limits (even to lower them) can be
2274 * controlled by the setrlimit check. The inclusion of the init task's
2275 * soft limit into the computation is to avoid resetting soft limits
2276 * higher than the default soft limit for cases where the default is
2277 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2278 */
2279 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2280 PROCESS__RLIMITINH, NULL);
2281 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002282 /* protect against do_prlimit() */
2283 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002284 for (i = 0; i < RLIM_NLIMITS; i++) {
2285 rlim = current->signal->rlim + i;
2286 initrlim = init_task.signal->rlim + i;
2287 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2288 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002289 task_unlock(current);
2290 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002291 }
2292}
2293
2294/*
2295 * Clean up the process immediately after the installation of new credentials
2296 * due to exec
2297 */
2298static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2299{
2300 const struct task_security_struct *tsec = current_security();
2301 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002302 u32 osid, sid;
2303 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002304
David Howellsa6f76f22008-11-14 10:39:24 +11002305 osid = tsec->osid;
2306 sid = tsec->sid;
2307
2308 if (sid == osid)
2309 return;
2310
2311 /* Check whether the new SID can inherit signal state from the old SID.
2312 * If not, clear itimers to avoid subsequent signal generation and
2313 * flush and unblock signals.
2314 *
2315 * This must occur _after_ the task SID has been updated so that any
2316 * kill done after the flush will be checked against the new SID.
2317 */
2318 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002319 if (rc) {
2320 memset(&itimer, 0, sizeof itimer);
2321 for (i = 0; i < 3; i++)
2322 do_setitimer(i, &itimer, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002323 spin_lock_irq(&current->sighand->siglock);
David Howells3bcac022009-04-29 13:45:05 +01002324 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2325 __flush_signals(current);
2326 flush_signal_handlers(current, 1);
2327 sigemptyset(&current->blocked);
2328 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002329 spin_unlock_irq(&current->sighand->siglock);
2330 }
2331
David Howellsa6f76f22008-11-14 10:39:24 +11002332 /* Wake up the parent if it is waiting so that it can recheck
2333 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002334 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002335 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002336 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002337}
2338
2339/* superblock security operations */
2340
2341static int selinux_sb_alloc_security(struct super_block *sb)
2342{
2343 return superblock_alloc_security(sb);
2344}
2345
2346static void selinux_sb_free_security(struct super_block *sb)
2347{
2348 superblock_free_security(sb);
2349}
2350
2351static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2352{
2353 if (plen > olen)
2354 return 0;
2355
2356 return !memcmp(prefix, option, plen);
2357}
2358
2359static inline int selinux_option(char *option, int len)
2360{
Eric Paris832cbd92008-04-01 13:24:09 -04002361 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2362 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2363 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002364 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2365 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002366}
2367
2368static inline void take_option(char **to, char *from, int *first, int len)
2369{
2370 if (!*first) {
2371 **to = ',';
2372 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002373 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002374 *first = 0;
2375 memcpy(*to, from, len);
2376 *to += len;
2377}
2378
Eric Paris828dfe12008-04-17 13:17:49 -04002379static inline void take_selinux_option(char **to, char *from, int *first,
2380 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002381{
2382 int current_size = 0;
2383
2384 if (!*first) {
2385 **to = '|';
2386 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002387 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002388 *first = 0;
2389
2390 while (current_size < len) {
2391 if (*from != '"') {
2392 **to = *from;
2393 *to += 1;
2394 }
2395 from += 1;
2396 current_size += 1;
2397 }
2398}
2399
Eric Parise0007522008-03-05 10:31:54 -05002400static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002401{
2402 int fnosec, fsec, rc = 0;
2403 char *in_save, *in_curr, *in_end;
2404 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002405 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002406
2407 in_curr = orig;
2408 sec_curr = copy;
2409
Linus Torvalds1da177e2005-04-16 15:20:36 -07002410 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2411 if (!nosec) {
2412 rc = -ENOMEM;
2413 goto out;
2414 }
2415
2416 nosec_save = nosec;
2417 fnosec = fsec = 1;
2418 in_save = in_end = orig;
2419
2420 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002421 if (*in_end == '"')
2422 open_quote = !open_quote;
2423 if ((*in_end == ',' && open_quote == 0) ||
2424 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002425 int len = in_end - in_curr;
2426
2427 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002428 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002429 else
2430 take_option(&nosec, in_curr, &fnosec, len);
2431
2432 in_curr = in_end + 1;
2433 }
2434 } while (*in_end++);
2435
Eric Paris6931dfc2005-06-30 02:58:51 -07002436 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002437 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002438out:
2439 return rc;
2440}
2441
Eric Paris026eb162011-03-03 16:09:14 -05002442static int selinux_sb_remount(struct super_block *sb, void *data)
2443{
2444 int rc, i, *flags;
2445 struct security_mnt_opts opts;
2446 char *secdata, **mount_options;
2447 struct superblock_security_struct *sbsec = sb->s_security;
2448
2449 if (!(sbsec->flags & SE_SBINITIALIZED))
2450 return 0;
2451
2452 if (!data)
2453 return 0;
2454
2455 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2456 return 0;
2457
2458 security_init_mnt_opts(&opts);
2459 secdata = alloc_secdata();
2460 if (!secdata)
2461 return -ENOMEM;
2462 rc = selinux_sb_copy_data(data, secdata);
2463 if (rc)
2464 goto out_free_secdata;
2465
2466 rc = selinux_parse_opts_str(secdata, &opts);
2467 if (rc)
2468 goto out_free_secdata;
2469
2470 mount_options = opts.mnt_opts;
2471 flags = opts.mnt_opts_flags;
2472
2473 for (i = 0; i < opts.num_mnt_opts; i++) {
2474 u32 sid;
2475 size_t len;
2476
Eric Paris12f348b2012-10-09 10:56:25 -04002477 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002478 continue;
2479 len = strlen(mount_options[i]);
2480 rc = security_context_to_sid(mount_options[i], len, &sid);
2481 if (rc) {
2482 printk(KERN_WARNING "SELinux: security_context_to_sid"
Anand Avati102aefd2013-04-16 18:56:19 -04002483 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
2484 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
Eric Paris026eb162011-03-03 16:09:14 -05002485 goto out_free_opts;
2486 }
2487 rc = -EINVAL;
2488 switch (flags[i]) {
2489 case FSCONTEXT_MNT:
2490 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2491 goto out_bad_option;
2492 break;
2493 case CONTEXT_MNT:
2494 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2495 goto out_bad_option;
2496 break;
2497 case ROOTCONTEXT_MNT: {
2498 struct inode_security_struct *root_isec;
2499 root_isec = sb->s_root->d_inode->i_security;
2500
2501 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2502 goto out_bad_option;
2503 break;
2504 }
2505 case DEFCONTEXT_MNT:
2506 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2507 goto out_bad_option;
2508 break;
2509 default:
2510 goto out_free_opts;
2511 }
2512 }
2513
2514 rc = 0;
2515out_free_opts:
2516 security_free_mnt_opts(&opts);
2517out_free_secdata:
2518 free_secdata(secdata);
2519 return rc;
2520out_bad_option:
2521 printk(KERN_WARNING "SELinux: unable to change security options "
Anand Avati102aefd2013-04-16 18:56:19 -04002522 "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
2523 SB_TYPE_ARGS(sb));
Eric Paris026eb162011-03-03 16:09:14 -05002524 goto out_free_opts;
2525}
2526
James Morris12204e22008-12-19 10:44:42 +11002527static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002528{
David Howells88e67f32008-11-14 10:39:21 +11002529 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002530 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002531 int rc;
2532
2533 rc = superblock_doinit(sb, data);
2534 if (rc)
2535 return rc;
2536
James Morris74192242008-12-19 11:41:10 +11002537 /* Allow all mounts performed by the kernel */
2538 if (flags & MS_KERNMOUNT)
2539 return 0;
2540
Eric Paris50c205f2012-04-04 15:01:43 -04002541 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002542 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002543 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002544}
2545
David Howells726c3342006-06-23 02:02:58 -07002546static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002547{
David Howells88e67f32008-11-14 10:39:21 +11002548 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002549 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002550
Eric Paris50c205f2012-04-04 15:01:43 -04002551 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002552 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002553 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002554}
2555
Al Viro808d4e32012-10-11 11:42:01 -04002556static int selinux_mount(const char *dev_name,
Al Virob5266eb2008-03-22 17:48:24 -04002557 struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002558 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002559 unsigned long flags,
2560 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002561{
David Howells88e67f32008-11-14 10:39:21 +11002562 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002563
2564 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002565 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002566 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002567 else
Eric Paris2875fa02011-04-28 16:04:24 -04002568 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002569}
2570
2571static int selinux_umount(struct vfsmount *mnt, int flags)
2572{
David Howells88e67f32008-11-14 10:39:21 +11002573 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002574
David Howells88e67f32008-11-14 10:39:21 +11002575 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002576 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002577}
2578
2579/* inode security operations */
2580
2581static int selinux_inode_alloc_security(struct inode *inode)
2582{
2583 return inode_alloc_security(inode);
2584}
2585
2586static void selinux_inode_free_security(struct inode *inode)
2587{
2588 inode_free_security(inode);
2589}
2590
David Quigleyd47be3d2013-05-22 12:50:34 -04002591static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2592 struct qstr *name, void **ctx,
2593 u32 *ctxlen)
2594{
2595 const struct cred *cred = current_cred();
2596 struct task_security_struct *tsec;
2597 struct inode_security_struct *dsec;
2598 struct superblock_security_struct *sbsec;
2599 struct inode *dir = dentry->d_parent->d_inode;
2600 u32 newsid;
2601 int rc;
2602
2603 tsec = cred->security;
2604 dsec = dir->i_security;
2605 sbsec = dir->i_sb->s_security;
2606
2607 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2608 newsid = tsec->create_sid;
2609 } else {
2610 rc = security_transition_sid(tsec->sid, dsec->sid,
2611 inode_mode_to_security_class(mode),
2612 name,
2613 &newsid);
2614 if (rc) {
2615 printk(KERN_WARNING
2616 "%s: security_transition_sid failed, rc=%d\n",
2617 __func__, -rc);
2618 return rc;
2619 }
2620 }
2621
2622 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2623}
2624
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002625static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002626 const struct qstr *qstr,
2627 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002628 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002629{
Paul Moore5fb49872010-04-22 14:46:19 -04002630 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002631 struct inode_security_struct *dsec;
2632 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002633 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002634 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002635 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002636
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002637 dsec = dir->i_security;
2638 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002639
David Howells275bb412008-11-14 10:39:19 +11002640 sid = tsec->sid;
2641 newsid = tsec->create_sid;
2642
Eric Paris415103f2010-12-02 16:13:40 -05002643 if ((sbsec->flags & SE_SBINITIALIZED) &&
2644 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2645 newsid = sbsec->mntpoint_sid;
Eric Paris12f348b2012-10-09 10:56:25 -04002646 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
David Howells275bb412008-11-14 10:39:19 +11002647 rc = security_transition_sid(sid, dsec->sid,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002648 inode_mode_to_security_class(inode->i_mode),
Eric Paris652bb9b2011-02-01 11:05:40 -05002649 qstr, &newsid);
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002650 if (rc) {
2651 printk(KERN_WARNING "%s: "
2652 "security_transition_sid failed, rc=%d (dev=%s "
2653 "ino=%ld)\n",
Harvey Harrisondd6f9532008-03-06 10:03:59 +11002654 __func__,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002655 -rc, inode->i_sb->s_id, inode->i_ino);
2656 return rc;
2657 }
2658 }
2659
Eric Paris296fddf2006-09-25 23:32:00 -07002660 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002661 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002662 struct inode_security_struct *isec = inode->i_security;
2663 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2664 isec->sid = newsid;
2665 isec->initialized = 1;
2666 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002667
Eric Paris12f348b2012-10-09 10:56:25 -04002668 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002669 return -EOPNOTSUPP;
2670
Tetsuo Handa95489062013-07-25 05:44:02 +09002671 if (name)
2672 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002673
2674 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002675 rc = security_sid_to_context_force(newsid, &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09002676 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002677 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002678 *value = context;
2679 *len = clen;
2680 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002681
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002682 return 0;
2683}
2684
Al Viro4acdaf22011-07-26 01:42:34 -04002685static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002686{
2687 return may_create(dir, dentry, SECCLASS_FILE);
2688}
2689
Linus Torvalds1da177e2005-04-16 15:20:36 -07002690static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2691{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002692 return may_link(dir, old_dentry, MAY_LINK);
2693}
2694
Linus Torvalds1da177e2005-04-16 15:20:36 -07002695static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2696{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002697 return may_link(dir, dentry, MAY_UNLINK);
2698}
2699
2700static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2701{
2702 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2703}
2704
Al Viro18bb1db2011-07-26 01:41:39 -04002705static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002706{
2707 return may_create(dir, dentry, SECCLASS_DIR);
2708}
2709
Linus Torvalds1da177e2005-04-16 15:20:36 -07002710static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2711{
2712 return may_link(dir, dentry, MAY_RMDIR);
2713}
2714
Al Viro1a67aaf2011-07-26 01:52:52 -04002715static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002716{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002717 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2718}
2719
Linus Torvalds1da177e2005-04-16 15:20:36 -07002720static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002721 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002722{
2723 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2724}
2725
Linus Torvalds1da177e2005-04-16 15:20:36 -07002726static int selinux_inode_readlink(struct dentry *dentry)
2727{
David Howells88e67f32008-11-14 10:39:21 +11002728 const struct cred *cred = current_cred();
2729
Eric Paris2875fa02011-04-28 16:04:24 -04002730 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002731}
2732
2733static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2734{
David Howells88e67f32008-11-14 10:39:21 +11002735 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002736
Eric Paris2875fa02011-04-28 16:04:24 -04002737 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002738}
2739
Eric Parisd4cf970d2012-04-04 15:01:42 -04002740static noinline int audit_inode_permission(struct inode *inode,
2741 u32 perms, u32 audited, u32 denied,
2742 unsigned flags)
2743{
2744 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04002745 struct inode_security_struct *isec = inode->i_security;
2746 int rc;
2747
Eric Paris50c205f2012-04-04 15:01:43 -04002748 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04002749 ad.u.inode = inode;
2750
2751 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2752 audited, denied, &ad, flags);
2753 if (rc)
2754 return rc;
2755 return 0;
2756}
2757
Al Viroe74f71e2011-06-20 19:38:15 -04002758static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002759{
David Howells88e67f32008-11-14 10:39:21 +11002760 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04002761 u32 perms;
2762 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04002763 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04002764 struct inode_security_struct *isec;
2765 u32 sid;
2766 struct av_decision avd;
2767 int rc, rc2;
2768 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002769
Eric Parisb782e0a2010-07-23 11:44:03 -04002770 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04002771 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2772
Eric Parisb782e0a2010-07-23 11:44:03 -04002773 /* No permission to check. Existence test. */
2774 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002775 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002776
Eric Paris2e334052012-04-04 15:01:42 -04002777 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04002778
Eric Paris2e334052012-04-04 15:01:42 -04002779 if (unlikely(IS_PRIVATE(inode)))
2780 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04002781
2782 perms = file_mask_to_av(inode->i_mode, mask);
2783
Eric Paris2e334052012-04-04 15:01:42 -04002784 sid = cred_sid(cred);
2785 isec = inode->i_security;
2786
2787 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2788 audited = avc_audit_required(perms, &avd, rc,
2789 from_access ? FILE__AUDIT_ACCESS : 0,
2790 &denied);
2791 if (likely(!audited))
2792 return rc;
2793
Eric Parisd4cf970d2012-04-04 15:01:42 -04002794 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
Eric Paris2e334052012-04-04 15:01:42 -04002795 if (rc2)
2796 return rc2;
2797 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002798}
2799
2800static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2801{
David Howells88e67f32008-11-14 10:39:21 +11002802 const struct cred *cred = current_cred();
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002803 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04002804 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002805
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002806 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2807 if (ia_valid & ATTR_FORCE) {
2808 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2809 ATTR_FORCE);
2810 if (!ia_valid)
2811 return 0;
2812 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002813
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002814 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2815 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04002816 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002817
Eric Paris3d2195c2012-07-06 14:13:30 -04002818 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
Eric Paris95dbf732012-04-04 13:45:34 -04002819 av |= FILE__OPEN;
2820
2821 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002822}
2823
2824static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2825{
David Howells88e67f32008-11-14 10:39:21 +11002826 const struct cred *cred = current_cred();
Eric Paris2875fa02011-04-28 16:04:24 -04002827 struct path path;
David Howells88e67f32008-11-14 10:39:21 +11002828
Eric Paris2875fa02011-04-28 16:04:24 -04002829 path.dentry = dentry;
2830 path.mnt = mnt;
2831
2832 return path_has_perm(cred, &path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002833}
2834
David Howells8f0cfa52008-04-29 00:59:41 -07002835static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07002836{
David Howells88e67f32008-11-14 10:39:21 +11002837 const struct cred *cred = current_cred();
2838
Serge E. Hallynb5376772007-10-16 23:31:36 -07002839 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2840 sizeof XATTR_SECURITY_PREFIX - 1)) {
2841 if (!strcmp(name, XATTR_NAME_CAPS)) {
2842 if (!capable(CAP_SETFCAP))
2843 return -EPERM;
2844 } else if (!capable(CAP_SYS_ADMIN)) {
2845 /* A different attribute in the security namespace.
2846 Restrict to administrator. */
2847 return -EPERM;
2848 }
2849 }
2850
2851 /* Not an attribute we recognize, so just check the
2852 ordinary setattr permission. */
Eric Paris2875fa02011-04-28 16:04:24 -04002853 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07002854}
2855
David Howells8f0cfa52008-04-29 00:59:41 -07002856static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2857 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002858{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002859 struct inode *inode = dentry->d_inode;
2860 struct inode_security_struct *isec = inode->i_security;
2861 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002862 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002863 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002864 int rc = 0;
2865
Serge E. Hallynb5376772007-10-16 23:31:36 -07002866 if (strcmp(name, XATTR_NAME_SELINUX))
2867 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002868
2869 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04002870 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002871 return -EOPNOTSUPP;
2872
Serge E. Hallyn2e149672011-03-23 16:43:26 -07002873 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002874 return -EPERM;
2875
Eric Paris50c205f2012-04-04 15:01:43 -04002876 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002877 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002878
David Howells275bb412008-11-14 10:39:19 +11002879 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002880 FILE__RELABELFROM, &ad);
2881 if (rc)
2882 return rc;
2883
2884 rc = security_context_to_sid(value, size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04002885 if (rc == -EINVAL) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04002886 if (!capable(CAP_MAC_ADMIN)) {
2887 struct audit_buffer *ab;
2888 size_t audit_size;
2889 const char *str;
2890
2891 /* We strip a nul only if it is at the end, otherwise the
2892 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01002893 if (value) {
2894 str = value;
2895 if (str[size - 1] == '\0')
2896 audit_size = size - 1;
2897 else
2898 audit_size = size;
2899 } else {
2900 str = "";
2901 audit_size = 0;
2902 }
Eric Parisd6ea83e2012-04-04 13:45:49 -04002903 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2904 audit_log_format(ab, "op=setxattr invalid_context=");
2905 audit_log_n_untrustedstring(ab, value, audit_size);
2906 audit_log_end(ab);
2907
Stephen Smalley12b29f32008-05-07 13:03:20 -04002908 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04002909 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04002910 rc = security_context_to_sid_force(value, size, &newsid);
2911 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002912 if (rc)
2913 return rc;
2914
David Howells275bb412008-11-14 10:39:19 +11002915 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002916 FILE__RELABELTO, &ad);
2917 if (rc)
2918 return rc;
2919
David Howells275bb412008-11-14 10:39:19 +11002920 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04002921 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002922 if (rc)
2923 return rc;
2924
2925 return avc_has_perm(newsid,
2926 sbsec->sid,
2927 SECCLASS_FILESYSTEM,
2928 FILESYSTEM__ASSOCIATE,
2929 &ad);
2930}
2931
David Howells8f0cfa52008-04-29 00:59:41 -07002932static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04002933 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07002934 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002935{
2936 struct inode *inode = dentry->d_inode;
2937 struct inode_security_struct *isec = inode->i_security;
2938 u32 newsid;
2939 int rc;
2940
2941 if (strcmp(name, XATTR_NAME_SELINUX)) {
2942 /* Not an attribute we recognize, so nothing to do. */
2943 return;
2944 }
2945
Stephen Smalley12b29f32008-05-07 13:03:20 -04002946 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002947 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002948 printk(KERN_ERR "SELinux: unable to map context to SID"
2949 "for (%s, %lu), rc=%d\n",
2950 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002951 return;
2952 }
2953
David Quigleyaa9c2662013-05-22 12:50:44 -04002954 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002955 isec->sid = newsid;
David Quigleyaa9c2662013-05-22 12:50:44 -04002956 isec->initialized = 1;
2957
Linus Torvalds1da177e2005-04-16 15:20:36 -07002958 return;
2959}
2960
David Howells8f0cfa52008-04-29 00:59:41 -07002961static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002962{
David Howells88e67f32008-11-14 10:39:21 +11002963 const struct cred *cred = current_cred();
2964
Eric Paris2875fa02011-04-28 16:04:24 -04002965 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002966}
2967
Eric Paris828dfe12008-04-17 13:17:49 -04002968static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002969{
David Howells88e67f32008-11-14 10:39:21 +11002970 const struct cred *cred = current_cred();
2971
Eric Paris2875fa02011-04-28 16:04:24 -04002972 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002973}
2974
David Howells8f0cfa52008-04-29 00:59:41 -07002975static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002976{
Serge E. Hallynb5376772007-10-16 23:31:36 -07002977 if (strcmp(name, XATTR_NAME_SELINUX))
2978 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002979
2980 /* No one is allowed to remove a SELinux security label.
2981 You can change the label, but all data must be labeled. */
2982 return -EACCES;
2983}
2984
James Morrisd381d8a2005-10-30 14:59:22 -08002985/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002986 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08002987 *
2988 * Permission check is handled by selinux_inode_getxattr hook.
2989 */
David P. Quigley42492592008-02-04 22:29:39 -08002990static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002991{
David P. Quigley42492592008-02-04 22:29:39 -08002992 u32 size;
2993 int error;
2994 char *context = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002995 struct inode_security_struct *isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002996
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002997 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2998 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002999
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003000 /*
3001 * If the caller has CAP_MAC_ADMIN, then get the raw context
3002 * value even if it is not defined by current policy; otherwise,
3003 * use the in-core value under current policy.
3004 * Use the non-auditing forms of the permission checks since
3005 * getxattr may be called by unprivileged processes commonly
3006 * and lack of permission just means that we fall back to the
3007 * in-core context value, not a denial.
3008 */
Eric Paris6a9de492012-01-03 12:25:14 -05003009 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
David Howells3699c532009-01-06 22:27:01 +00003010 SECURITY_CAP_NOAUDIT);
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003011 if (!error)
3012 error = security_sid_to_context_force(isec->sid, &context,
3013 &size);
3014 else
3015 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003016 if (error)
3017 return error;
3018 error = size;
3019 if (alloc) {
3020 *buffer = context;
3021 goto out_nofree;
3022 }
3023 kfree(context);
3024out_nofree:
3025 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003026}
3027
3028static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003029 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003030{
3031 struct inode_security_struct *isec = inode->i_security;
3032 u32 newsid;
3033 int rc;
3034
3035 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3036 return -EOPNOTSUPP;
3037
3038 if (!value || !size)
3039 return -EACCES;
3040
Eric Paris828dfe12008-04-17 13:17:49 -04003041 rc = security_context_to_sid((void *)value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003042 if (rc)
3043 return rc;
3044
David Quigleyaa9c2662013-05-22 12:50:44 -04003045 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003046 isec->sid = newsid;
David P. Quigleyddd29ec2009-09-09 14:25:37 -04003047 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003048 return 0;
3049}
3050
3051static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3052{
3053 const int len = sizeof(XATTR_NAME_SELINUX);
3054 if (buffer && len <= buffer_size)
3055 memcpy(buffer, XATTR_NAME_SELINUX, len);
3056 return len;
3057}
3058
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003059static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3060{
3061 struct inode_security_struct *isec = inode->i_security;
3062 *secid = isec->sid;
3063}
3064
Linus Torvalds1da177e2005-04-16 15:20:36 -07003065/* file security operations */
3066
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003067static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003068{
David Howells88e67f32008-11-14 10:39:21 +11003069 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003070 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003071
Linus Torvalds1da177e2005-04-16 15:20:36 -07003072 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3073 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3074 mask |= MAY_APPEND;
3075
Paul Moore389fb8002009-03-27 17:10:34 -04003076 return file_has_perm(cred, file,
3077 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003078}
3079
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003080static int selinux_file_permission(struct file *file, int mask)
3081{
Al Viro496ad9a2013-01-23 17:07:38 -05003082 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003083 struct file_security_struct *fsec = file->f_security;
3084 struct inode_security_struct *isec = inode->i_security;
3085 u32 sid = current_sid();
3086
Paul Moore389fb8002009-03-27 17:10:34 -04003087 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003088 /* No permission to check. Existence test. */
3089 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003090
Stephen Smalley20dda182009-06-22 14:54:53 -04003091 if (sid == fsec->sid && fsec->isid == isec->sid &&
3092 fsec->pseqno == avc_policy_seqno())
Eric Paris83d49852012-04-04 13:45:40 -04003093 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003094 return 0;
3095
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003096 return selinux_revalidate_file_permission(file, mask);
3097}
3098
Linus Torvalds1da177e2005-04-16 15:20:36 -07003099static int selinux_file_alloc_security(struct file *file)
3100{
3101 return file_alloc_security(file);
3102}
3103
3104static void selinux_file_free_security(struct file *file)
3105{
3106 file_free_security(file);
3107}
3108
3109static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3110 unsigned long arg)
3111{
David Howells88e67f32008-11-14 10:39:21 +11003112 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003113 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003114
Eric Paris0b24dcb2011-02-25 15:39:20 -05003115 switch (cmd) {
3116 case FIONREAD:
3117 /* fall through */
3118 case FIBMAP:
3119 /* fall through */
3120 case FIGETBSZ:
3121 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003122 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003123 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003124 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003125 error = file_has_perm(cred, file, FILE__GETATTR);
3126 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003127
Al Viro2f99c362012-03-23 16:04:05 -04003128 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003129 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003130 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003131 error = file_has_perm(cred, file, FILE__SETATTR);
3132 break;
3133
3134 /* sys_ioctl() checks */
3135 case FIONBIO:
3136 /* fall through */
3137 case FIOASYNC:
3138 error = file_has_perm(cred, file, 0);
3139 break;
3140
3141 case KDSKBENT:
3142 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003143 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3144 SECURITY_CAP_AUDIT);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003145 break;
3146
3147 /* default case assumes that the command will go
3148 * to the file's ioctl() function.
3149 */
3150 default:
3151 error = file_has_perm(cred, file, FILE__IOCTL);
3152 }
3153 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003154}
3155
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003156static int default_noexec;
3157
Linus Torvalds1da177e2005-04-16 15:20:36 -07003158static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3159{
David Howells88e67f32008-11-14 10:39:21 +11003160 const struct cred *cred = current_cred();
David Howellsd84f4f92008-11-14 10:39:23 +11003161 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003162
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003163 if (default_noexec &&
3164 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003165 /*
3166 * We are making executable an anonymous mapping or a
3167 * private file mapping that will also be writable.
3168 * This has an additional check.
3169 */
David Howellsd84f4f92008-11-14 10:39:23 +11003170 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003171 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003172 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003173 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003174
3175 if (file) {
3176 /* read access is always possible with a mapping */
3177 u32 av = FILE__READ;
3178
3179 /* write access only matters if the mapping is shared */
3180 if (shared && (prot & PROT_WRITE))
3181 av |= FILE__WRITE;
3182
3183 if (prot & PROT_EXEC)
3184 av |= FILE__EXECUTE;
3185
David Howells88e67f32008-11-14 10:39:21 +11003186 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003187 }
David Howellsd84f4f92008-11-14 10:39:23 +11003188
3189error:
3190 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003191}
3192
Al Viroe5467852012-05-30 13:30:51 -04003193static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003194{
Eric Parised032182007-06-28 15:55:21 -04003195 int rc = 0;
David Howells275bb412008-11-14 10:39:19 +11003196 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003197
Eric Paris84336d1a2009-07-31 12:54:05 -04003198 /*
3199 * notice that we are intentionally putting the SELinux check before
3200 * the secondary cap_file_mmap check. This is such a likely attempt
3201 * at bad behaviour/exploit that we always want to get the AVC, even
3202 * if DAC would have also denied the operation.
3203 */
Eric Parisa2551df2009-07-31 12:54:11 -04003204 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
Eric Parised032182007-06-28 15:55:21 -04003205 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3206 MEMPROTECT__MMAP_ZERO, NULL);
Eric Paris84336d1a2009-07-31 12:54:05 -04003207 if (rc)
3208 return rc;
3209 }
3210
3211 /* do DAC check on address space usage */
Al Viroe5467852012-05-30 13:30:51 -04003212 return cap_mmap_addr(addr);
3213}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003214
Al Viroe5467852012-05-30 13:30:51 -04003215static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3216 unsigned long prot, unsigned long flags)
3217{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003218 if (selinux_checkreqprot)
3219 prot = reqprot;
3220
3221 return file_map_prot_check(file, prot,
3222 (flags & MAP_TYPE) == MAP_SHARED);
3223}
3224
3225static int selinux_file_mprotect(struct vm_area_struct *vma,
3226 unsigned long reqprot,
3227 unsigned long prot)
3228{
David Howells88e67f32008-11-14 10:39:21 +11003229 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003230
3231 if (selinux_checkreqprot)
3232 prot = reqprot;
3233
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003234 if (default_noexec &&
3235 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003236 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003237 if (vma->vm_start >= vma->vm_mm->start_brk &&
3238 vma->vm_end <= vma->vm_mm->brk) {
David Howellsd84f4f92008-11-14 10:39:23 +11003239 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003240 } else if (!vma->vm_file &&
3241 vma->vm_start <= vma->vm_mm->start_stack &&
3242 vma->vm_end >= vma->vm_mm->start_stack) {
David Howells3b11a1d2008-11-14 10:39:26 +11003243 rc = current_has_perm(current, PROCESS__EXECSTACK);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003244 } else if (vma->vm_file && vma->anon_vma) {
3245 /*
3246 * We are making executable a file mapping that has
3247 * had some COW done. Since pages might have been
3248 * written, check ability to execute the possibly
3249 * modified content. This typically should only
3250 * occur for text relocations.
3251 */
David Howellsd84f4f92008-11-14 10:39:23 +11003252 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003253 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003254 if (rc)
3255 return rc;
3256 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003257
3258 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3259}
3260
3261static int selinux_file_lock(struct file *file, unsigned int cmd)
3262{
David Howells88e67f32008-11-14 10:39:21 +11003263 const struct cred *cred = current_cred();
3264
3265 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003266}
3267
3268static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3269 unsigned long arg)
3270{
David Howells88e67f32008-11-14 10:39:21 +11003271 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003272 int err = 0;
3273
3274 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003275 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003276 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003277 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003278 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003279 }
3280 /* fall through */
3281 case F_SETOWN:
3282 case F_SETSIG:
3283 case F_GETFL:
3284 case F_GETOWN:
3285 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003286 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003287 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003288 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003289 break;
3290 case F_GETLK:
3291 case F_SETLK:
3292 case F_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003293#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003294 case F_GETLK64:
3295 case F_SETLK64:
3296 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003297#endif
David Howells88e67f32008-11-14 10:39:21 +11003298 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003299 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003300 }
3301
3302 return err;
3303}
3304
3305static int selinux_file_set_fowner(struct file *file)
3306{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003307 struct file_security_struct *fsec;
3308
Linus Torvalds1da177e2005-04-16 15:20:36 -07003309 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003310 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003311
3312 return 0;
3313}
3314
3315static int selinux_file_send_sigiotask(struct task_struct *tsk,
3316 struct fown_struct *fown, int signum)
3317{
Eric Paris828dfe12008-04-17 13:17:49 -04003318 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003319 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003320 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003321 struct file_security_struct *fsec;
3322
3323 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003324 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003325
Linus Torvalds1da177e2005-04-16 15:20:36 -07003326 fsec = file->f_security;
3327
3328 if (!signum)
3329 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3330 else
3331 perm = signal_to_av(signum);
3332
David Howells275bb412008-11-14 10:39:19 +11003333 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003334 SECCLASS_PROCESS, perm, NULL);
3335}
3336
3337static int selinux_file_receive(struct file *file)
3338{
David Howells88e67f32008-11-14 10:39:21 +11003339 const struct cred *cred = current_cred();
3340
3341 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003342}
3343
Eric Paris83d49852012-04-04 13:45:40 -04003344static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003345{
3346 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003347 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003348
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003349 fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05003350 isec = file_inode(file)->i_security;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003351 /*
3352 * Save inode label and policy sequence number
3353 * at open-time so that selinux_file_permission
3354 * can determine whether revalidation is necessary.
3355 * Task label is already saved in the file security
3356 * struct as its SID.
3357 */
3358 fsec->isid = isec->sid;
3359 fsec->pseqno = avc_policy_seqno();
3360 /*
3361 * Since the inode label or policy seqno may have changed
3362 * between the selinux_inode_permission check and the saving
3363 * of state above, recheck that access is still permitted.
3364 * Otherwise, access might never be revalidated against the
3365 * new inode label or new policy.
3366 * This check is not redundant - do not remove.
3367 */
David Howells13f8e982013-06-13 23:37:55 +01003368 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003369}
3370
Linus Torvalds1da177e2005-04-16 15:20:36 -07003371/* task security operations */
3372
3373static int selinux_task_create(unsigned long clone_flags)
3374{
David Howells3b11a1d2008-11-14 10:39:26 +11003375 return current_has_perm(current, PROCESS__FORK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003376}
3377
David Howellsf1752ee2008-11-14 10:39:17 +11003378/*
David Howellsee18d642009-09-02 09:14:21 +01003379 * allocate the SELinux part of blank credentials
3380 */
3381static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3382{
3383 struct task_security_struct *tsec;
3384
3385 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3386 if (!tsec)
3387 return -ENOMEM;
3388
3389 cred->security = tsec;
3390 return 0;
3391}
3392
3393/*
David Howellsf1752ee2008-11-14 10:39:17 +11003394 * detach and free the LSM part of a set of credentials
3395 */
3396static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003397{
David Howellsf1752ee2008-11-14 10:39:17 +11003398 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003399
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003400 /*
3401 * cred->security == NULL if security_cred_alloc_blank() or
3402 * security_prepare_creds() returned an error.
3403 */
3404 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003405 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003406 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003407}
3408
David Howellsd84f4f92008-11-14 10:39:23 +11003409/*
3410 * prepare a new set of credentials for modification
3411 */
3412static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3413 gfp_t gfp)
3414{
3415 const struct task_security_struct *old_tsec;
3416 struct task_security_struct *tsec;
3417
3418 old_tsec = old->security;
3419
3420 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3421 if (!tsec)
3422 return -ENOMEM;
3423
3424 new->security = tsec;
3425 return 0;
3426}
3427
3428/*
David Howellsee18d642009-09-02 09:14:21 +01003429 * transfer the SELinux data to a blank set of creds
3430 */
3431static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3432{
3433 const struct task_security_struct *old_tsec = old->security;
3434 struct task_security_struct *tsec = new->security;
3435
3436 *tsec = *old_tsec;
3437}
3438
3439/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003440 * set the security data for a kernel service
3441 * - all the creation contexts are set to unlabelled
3442 */
3443static int selinux_kernel_act_as(struct cred *new, u32 secid)
3444{
3445 struct task_security_struct *tsec = new->security;
3446 u32 sid = current_sid();
3447 int ret;
3448
3449 ret = avc_has_perm(sid, secid,
3450 SECCLASS_KERNEL_SERVICE,
3451 KERNEL_SERVICE__USE_AS_OVERRIDE,
3452 NULL);
3453 if (ret == 0) {
3454 tsec->sid = secid;
3455 tsec->create_sid = 0;
3456 tsec->keycreate_sid = 0;
3457 tsec->sockcreate_sid = 0;
3458 }
3459 return ret;
3460}
3461
3462/*
3463 * set the file creation context in a security record to the same as the
3464 * objective context of the specified inode
3465 */
3466static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3467{
3468 struct inode_security_struct *isec = inode->i_security;
3469 struct task_security_struct *tsec = new->security;
3470 u32 sid = current_sid();
3471 int ret;
3472
3473 ret = avc_has_perm(sid, isec->sid,
3474 SECCLASS_KERNEL_SERVICE,
3475 KERNEL_SERVICE__CREATE_FILES_AS,
3476 NULL);
3477
3478 if (ret == 0)
3479 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003480 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003481}
3482
Eric Parisdd8dbf22009-11-03 16:35:32 +11003483static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003484{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003485 u32 sid;
3486 struct common_audit_data ad;
3487
3488 sid = task_sid(current);
3489
Eric Paris50c205f2012-04-04 15:01:43 -04003490 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003491 ad.u.kmod_name = kmod_name;
3492
3493 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3494 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003495}
3496
Linus Torvalds1da177e2005-04-16 15:20:36 -07003497static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3498{
David Howells3b11a1d2008-11-14 10:39:26 +11003499 return current_has_perm(p, PROCESS__SETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003500}
3501
3502static int selinux_task_getpgid(struct task_struct *p)
3503{
David Howells3b11a1d2008-11-14 10:39:26 +11003504 return current_has_perm(p, PROCESS__GETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003505}
3506
3507static int selinux_task_getsid(struct task_struct *p)
3508{
David Howells3b11a1d2008-11-14 10:39:26 +11003509 return current_has_perm(p, PROCESS__GETSESSION);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003510}
3511
David Quigleyf9008e42006-06-30 01:55:46 -07003512static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3513{
David Howells275bb412008-11-14 10:39:19 +11003514 *secid = task_sid(p);
David Quigleyf9008e42006-06-30 01:55:46 -07003515}
3516
Linus Torvalds1da177e2005-04-16 15:20:36 -07003517static int selinux_task_setnice(struct task_struct *p, int nice)
3518{
3519 int rc;
3520
Eric Paris200ac532009-02-12 15:01:04 -05003521 rc = cap_task_setnice(p, nice);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003522 if (rc)
3523 return rc;
3524
David Howells3b11a1d2008-11-14 10:39:26 +11003525 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003526}
3527
James Morris03e68062006-06-23 02:03:58 -07003528static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3529{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003530 int rc;
3531
Eric Paris200ac532009-02-12 15:01:04 -05003532 rc = cap_task_setioprio(p, ioprio);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003533 if (rc)
3534 return rc;
3535
David Howells3b11a1d2008-11-14 10:39:26 +11003536 return current_has_perm(p, PROCESS__SETSCHED);
James Morris03e68062006-06-23 02:03:58 -07003537}
3538
David Quigleya1836a42006-06-30 01:55:49 -07003539static int selinux_task_getioprio(struct task_struct *p)
3540{
David Howells3b11a1d2008-11-14 10:39:26 +11003541 return current_has_perm(p, PROCESS__GETSCHED);
David Quigleya1836a42006-06-30 01:55:49 -07003542}
3543
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003544static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3545 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003546{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003547 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003548
3549 /* Control the ability to change the hard limit (whether
3550 lowering or raising it), so that the hard limit can
3551 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003552 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003553 if (old_rlim->rlim_max != new_rlim->rlim_max)
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003554 return current_has_perm(p, PROCESS__SETRLIMIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003555
3556 return 0;
3557}
3558
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003559static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003560{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003561 int rc;
3562
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003563 rc = cap_task_setscheduler(p);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003564 if (rc)
3565 return rc;
3566
David Howells3b11a1d2008-11-14 10:39:26 +11003567 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003568}
3569
3570static int selinux_task_getscheduler(struct task_struct *p)
3571{
David Howells3b11a1d2008-11-14 10:39:26 +11003572 return current_has_perm(p, PROCESS__GETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003573}
3574
David Quigley35601542006-06-23 02:04:01 -07003575static int selinux_task_movememory(struct task_struct *p)
3576{
David Howells3b11a1d2008-11-14 10:39:26 +11003577 return current_has_perm(p, PROCESS__SETSCHED);
David Quigley35601542006-06-23 02:04:01 -07003578}
3579
David Quigleyf9008e42006-06-30 01:55:46 -07003580static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3581 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003582{
3583 u32 perm;
3584 int rc;
3585
Linus Torvalds1da177e2005-04-16 15:20:36 -07003586 if (!sig)
3587 perm = PROCESS__SIGNULL; /* null signal; existence test */
3588 else
3589 perm = signal_to_av(sig);
David Quigleyf9008e42006-06-30 01:55:46 -07003590 if (secid)
David Howells275bb412008-11-14 10:39:19 +11003591 rc = avc_has_perm(secid, task_sid(p),
3592 SECCLASS_PROCESS, perm, NULL);
David Quigleyf9008e42006-06-30 01:55:46 -07003593 else
David Howells3b11a1d2008-11-14 10:39:26 +11003594 rc = current_has_perm(p, perm);
David Quigleyf9008e42006-06-30 01:55:46 -07003595 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003596}
3597
Linus Torvalds1da177e2005-04-16 15:20:36 -07003598static int selinux_task_wait(struct task_struct *p)
3599{
Eric Paris8a535142007-10-22 16:10:31 -04003600 return task_has_perm(p, current, PROCESS__SIGCHLD);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003601}
3602
Linus Torvalds1da177e2005-04-16 15:20:36 -07003603static void selinux_task_to_inode(struct task_struct *p,
3604 struct inode *inode)
3605{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003606 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11003607 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003608
David Howells275bb412008-11-14 10:39:19 +11003609 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003610 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003611}
3612
Linus Torvalds1da177e2005-04-16 15:20:36 -07003613/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003614static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003615 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003616{
3617 int offset, ihlen, ret = -EINVAL;
3618 struct iphdr _iph, *ih;
3619
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003620 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003621 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3622 if (ih == NULL)
3623 goto out;
3624
3625 ihlen = ih->ihl * 4;
3626 if (ihlen < sizeof(_iph))
3627 goto out;
3628
Eric Paris48c62af2012-04-02 13:15:44 -04003629 ad->u.net->v4info.saddr = ih->saddr;
3630 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003631 ret = 0;
3632
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003633 if (proto)
3634 *proto = ih->protocol;
3635
Linus Torvalds1da177e2005-04-16 15:20:36 -07003636 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04003637 case IPPROTO_TCP: {
3638 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003639
Eric Paris828dfe12008-04-17 13:17:49 -04003640 if (ntohs(ih->frag_off) & IP_OFFSET)
3641 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003642
3643 offset += ihlen;
3644 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3645 if (th == NULL)
3646 break;
3647
Eric Paris48c62af2012-04-02 13:15:44 -04003648 ad->u.net->sport = th->source;
3649 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003650 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003651 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003652
Eric Paris828dfe12008-04-17 13:17:49 -04003653 case IPPROTO_UDP: {
3654 struct udphdr _udph, *uh;
3655
3656 if (ntohs(ih->frag_off) & IP_OFFSET)
3657 break;
3658
3659 offset += ihlen;
3660 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3661 if (uh == NULL)
3662 break;
3663
Eric Paris48c62af2012-04-02 13:15:44 -04003664 ad->u.net->sport = uh->source;
3665 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04003666 break;
3667 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003668
James Morris2ee92d42006-11-13 16:09:01 -08003669 case IPPROTO_DCCP: {
3670 struct dccp_hdr _dccph, *dh;
3671
3672 if (ntohs(ih->frag_off) & IP_OFFSET)
3673 break;
3674
3675 offset += ihlen;
3676 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3677 if (dh == NULL)
3678 break;
3679
Eric Paris48c62af2012-04-02 13:15:44 -04003680 ad->u.net->sport = dh->dccph_sport;
3681 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08003682 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003683 }
James Morris2ee92d42006-11-13 16:09:01 -08003684
Eric Paris828dfe12008-04-17 13:17:49 -04003685 default:
3686 break;
3687 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003688out:
3689 return ret;
3690}
3691
3692#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3693
3694/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003695static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003696 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003697{
3698 u8 nexthdr;
3699 int ret = -EINVAL, offset;
3700 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08003701 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003702
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003703 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003704 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3705 if (ip6 == NULL)
3706 goto out;
3707
Eric Paris48c62af2012-04-02 13:15:44 -04003708 ad->u.net->v6info.saddr = ip6->saddr;
3709 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003710 ret = 0;
3711
3712 nexthdr = ip6->nexthdr;
3713 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08003714 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003715 if (offset < 0)
3716 goto out;
3717
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003718 if (proto)
3719 *proto = nexthdr;
3720
Linus Torvalds1da177e2005-04-16 15:20:36 -07003721 switch (nexthdr) {
3722 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04003723 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003724
3725 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3726 if (th == NULL)
3727 break;
3728
Eric Paris48c62af2012-04-02 13:15:44 -04003729 ad->u.net->sport = th->source;
3730 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003731 break;
3732 }
3733
3734 case IPPROTO_UDP: {
3735 struct udphdr _udph, *uh;
3736
3737 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3738 if (uh == NULL)
3739 break;
3740
Eric Paris48c62af2012-04-02 13:15:44 -04003741 ad->u.net->sport = uh->source;
3742 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003743 break;
3744 }
3745
James Morris2ee92d42006-11-13 16:09:01 -08003746 case IPPROTO_DCCP: {
3747 struct dccp_hdr _dccph, *dh;
3748
3749 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3750 if (dh == NULL)
3751 break;
3752
Eric Paris48c62af2012-04-02 13:15:44 -04003753 ad->u.net->sport = dh->dccph_sport;
3754 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08003755 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003756 }
James Morris2ee92d42006-11-13 16:09:01 -08003757
Linus Torvalds1da177e2005-04-16 15:20:36 -07003758 /* includes fragments */
3759 default:
3760 break;
3761 }
3762out:
3763 return ret;
3764}
3765
3766#endif /* IPV6 */
3767
Thomas Liu2bf49692009-07-14 12:14:09 -04003768static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10003769 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003770{
David Howellscf9481e2008-07-27 21:31:07 +10003771 char *addrp;
3772 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003773
Eric Paris48c62af2012-04-02 13:15:44 -04003774 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003775 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003776 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003777 if (ret)
3778 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04003779 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3780 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10003781 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003782
3783#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3784 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003785 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003786 if (ret)
3787 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04003788 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3789 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10003790 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003791#endif /* IPV6 */
3792 default:
David Howellscf9481e2008-07-27 21:31:07 +10003793 addrp = NULL;
3794 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003795 }
3796
David Howellscf9481e2008-07-27 21:31:07 +10003797parse_error:
3798 printk(KERN_WARNING
3799 "SELinux: failure in selinux_parse_skb(),"
3800 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07003801 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10003802
3803okay:
3804 if (_addrp)
3805 *_addrp = addrp;
3806 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003807}
3808
Paul Moore4f6a9932007-03-01 14:35:22 -05003809/**
Paul Moore220deb92008-01-29 08:38:23 -05003810 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05003811 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05003812 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05003813 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05003814 *
3815 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05003816 * Check the various different forms of network peer labeling and determine
3817 * the peer label/SID for the packet; most of the magic actually occurs in
3818 * the security server function security_net_peersid_cmp(). The function
3819 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3820 * or -EACCES if @sid is invalid due to inconsistencies with the different
3821 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05003822 *
3823 */
Paul Moore220deb92008-01-29 08:38:23 -05003824static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05003825{
Paul Moore71f1cb02008-01-29 08:51:16 -05003826 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05003827 u32 xfrm_sid;
3828 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05003829 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05003830
Paul Moorebed4d7e2013-07-23 17:38:40 -04003831 err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3832 if (unlikely(err))
3833 return -EACCES;
3834 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3835 if (unlikely(err))
3836 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05003837
Paul Moore71f1cb02008-01-29 08:51:16 -05003838 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3839 if (unlikely(err)) {
3840 printk(KERN_WARNING
3841 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3842 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05003843 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05003844 }
Paul Moore220deb92008-01-29 08:38:23 -05003845
3846 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05003847}
3848
Linus Torvalds1da177e2005-04-16 15:20:36 -07003849/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04003850
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003851static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3852 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04003853{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003854 if (tsec->sockcreate_sid > SECSID_NULL) {
3855 *socksid = tsec->sockcreate_sid;
3856 return 0;
3857 }
3858
3859 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3860 socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04003861}
3862
Paul Moore253bfae2010-04-22 14:46:19 -04003863static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003864{
Paul Moore253bfae2010-04-22 14:46:19 -04003865 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04003866 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04003867 struct lsm_network_audit net = {0,};
Paul Moore253bfae2010-04-22 14:46:19 -04003868 u32 tsid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003869
Paul Moore253bfae2010-04-22 14:46:19 -04003870 if (sksec->sid == SECINITSID_KERNEL)
3871 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003872
Eric Paris50c205f2012-04-04 15:01:43 -04003873 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04003874 ad.u.net = &net;
3875 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003876
Paul Moore253bfae2010-04-22 14:46:19 -04003877 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003878}
3879
3880static int selinux_socket_create(int family, int type,
3881 int protocol, int kern)
3882{
Paul Moore5fb49872010-04-22 14:46:19 -04003883 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04003884 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11003885 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003886 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003887
3888 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04003889 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003890
David Howells275bb412008-11-14 10:39:19 +11003891 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003892 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3893 if (rc)
3894 return rc;
3895
Paul Moored4f2d972010-04-22 14:46:18 -04003896 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003897}
3898
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003899static int selinux_socket_post_create(struct socket *sock, int family,
3900 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003901{
Paul Moore5fb49872010-04-22 14:46:19 -04003902 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04003903 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003904 struct sk_security_struct *sksec;
David Howells275bb412008-11-14 10:39:19 +11003905 int err = 0;
3906
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003907 isec->sclass = socket_type_to_security_class(family, type, protocol);
3908
David Howells275bb412008-11-14 10:39:19 +11003909 if (kern)
3910 isec->sid = SECINITSID_KERNEL;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003911 else {
3912 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3913 if (err)
3914 return err;
3915 }
David Howells275bb412008-11-14 10:39:19 +11003916
Linus Torvalds1da177e2005-04-16 15:20:36 -07003917 isec->initialized = 1;
3918
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003919 if (sock->sk) {
3920 sksec = sock->sk->sk_security;
3921 sksec->sid = isec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05003922 sksec->sclass = isec->sclass;
Paul Moore389fb8002009-03-27 17:10:34 -04003923 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003924 }
3925
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003926 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003927}
3928
3929/* Range of port numbers used to automatically bind.
3930 Need to determine whether we should perform a name_bind
3931 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003932
3933static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3934{
Paul Moore253bfae2010-04-22 14:46:19 -04003935 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003936 u16 family;
3937 int err;
3938
Paul Moore253bfae2010-04-22 14:46:19 -04003939 err = sock_has_perm(current, sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003940 if (err)
3941 goto out;
3942
3943 /*
3944 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04003945 * Multiple address binding for SCTP is not supported yet: we just
3946 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003947 */
Paul Moore253bfae2010-04-22 14:46:19 -04003948 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003949 if (family == PF_INET || family == PF_INET6) {
3950 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04003951 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04003952 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04003953 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07003954 struct sockaddr_in *addr4 = NULL;
3955 struct sockaddr_in6 *addr6 = NULL;
3956 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10003957 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003958
Linus Torvalds1da177e2005-04-16 15:20:36 -07003959 if (family == PF_INET) {
3960 addr4 = (struct sockaddr_in *)address;
3961 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003962 addrp = (char *)&addr4->sin_addr.s_addr;
3963 } else {
3964 addr6 = (struct sockaddr_in6 *)address;
3965 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003966 addrp = (char *)&addr6->sin6_addr.s6_addr;
3967 }
3968
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003969 if (snum) {
3970 int low, high;
3971
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07003972 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003973
3974 if (snum < max(PROT_SOCK, low) || snum > high) {
Paul Moore3e112172008-04-10 10:48:14 -04003975 err = sel_netport_sid(sk->sk_protocol,
3976 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003977 if (err)
3978 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04003979 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04003980 ad.u.net = &net;
3981 ad.u.net->sport = htons(snum);
3982 ad.u.net->family = family;
Paul Moore253bfae2010-04-22 14:46:19 -04003983 err = avc_has_perm(sksec->sid, sid,
3984 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003985 SOCKET__NAME_BIND, &ad);
3986 if (err)
3987 goto out;
3988 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003989 }
Eric Paris828dfe12008-04-17 13:17:49 -04003990
Paul Moore253bfae2010-04-22 14:46:19 -04003991 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04003992 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003993 node_perm = TCP_SOCKET__NODE_BIND;
3994 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003995
James Morris13402582005-09-30 14:24:34 -04003996 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003997 node_perm = UDP_SOCKET__NODE_BIND;
3998 break;
James Morris2ee92d42006-11-13 16:09:01 -08003999
4000 case SECCLASS_DCCP_SOCKET:
4001 node_perm = DCCP_SOCKET__NODE_BIND;
4002 break;
4003
Linus Torvalds1da177e2005-04-16 15:20:36 -07004004 default:
4005 node_perm = RAWIP_SOCKET__NODE_BIND;
4006 break;
4007 }
Eric Paris828dfe12008-04-17 13:17:49 -04004008
Paul Moore224dfbd2008-01-29 08:38:13 -05004009 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004010 if (err)
4011 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004012
Eric Paris50c205f2012-04-04 15:01:43 -04004013 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004014 ad.u.net = &net;
4015 ad.u.net->sport = htons(snum);
4016 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004017
4018 if (family == PF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004019 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004020 else
Eric Paris48c62af2012-04-02 13:15:44 -04004021 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004022
Paul Moore253bfae2010-04-22 14:46:19 -04004023 err = avc_has_perm(sksec->sid, sid,
4024 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004025 if (err)
4026 goto out;
4027 }
4028out:
4029 return err;
4030}
4031
4032static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4033{
Paul Moore014ab192008-10-10 10:16:33 -04004034 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004035 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004036 int err;
4037
Paul Moore253bfae2010-04-22 14:46:19 -04004038 err = sock_has_perm(current, sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004039 if (err)
4040 return err;
4041
4042 /*
James Morris2ee92d42006-11-13 16:09:01 -08004043 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004044 */
Paul Moore253bfae2010-04-22 14:46:19 -04004045 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4046 sksec->sclass == SECCLASS_DCCP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004047 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004048 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004049 struct sockaddr_in *addr4 = NULL;
4050 struct sockaddr_in6 *addr6 = NULL;
4051 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004052 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004053
4054 if (sk->sk_family == PF_INET) {
4055 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004056 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004057 return -EINVAL;
4058 snum = ntohs(addr4->sin_port);
4059 } else {
4060 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004061 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004062 return -EINVAL;
4063 snum = ntohs(addr6->sin6_port);
4064 }
4065
Paul Moore3e112172008-04-10 10:48:14 -04004066 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004067 if (err)
4068 goto out;
4069
Paul Moore253bfae2010-04-22 14:46:19 -04004070 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
James Morris2ee92d42006-11-13 16:09:01 -08004071 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4072
Eric Paris50c205f2012-04-04 15:01:43 -04004073 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004074 ad.u.net = &net;
4075 ad.u.net->dport = htons(snum);
4076 ad.u.net->family = sk->sk_family;
Paul Moore253bfae2010-04-22 14:46:19 -04004077 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004078 if (err)
4079 goto out;
4080 }
4081
Paul Moore014ab192008-10-10 10:16:33 -04004082 err = selinux_netlbl_socket_connect(sk, address);
4083
Linus Torvalds1da177e2005-04-16 15:20:36 -07004084out:
4085 return err;
4086}
4087
4088static int selinux_socket_listen(struct socket *sock, int backlog)
4089{
Paul Moore253bfae2010-04-22 14:46:19 -04004090 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004091}
4092
4093static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4094{
4095 int err;
4096 struct inode_security_struct *isec;
4097 struct inode_security_struct *newisec;
4098
Paul Moore253bfae2010-04-22 14:46:19 -04004099 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004100 if (err)
4101 return err;
4102
4103 newisec = SOCK_INODE(newsock)->i_security;
4104
4105 isec = SOCK_INODE(sock)->i_security;
4106 newisec->sclass = isec->sclass;
4107 newisec->sid = isec->sid;
4108 newisec->initialized = 1;
4109
4110 return 0;
4111}
4112
4113static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004114 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004115{
Paul Moore253bfae2010-04-22 14:46:19 -04004116 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004117}
4118
4119static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4120 int size, int flags)
4121{
Paul Moore253bfae2010-04-22 14:46:19 -04004122 return sock_has_perm(current, sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004123}
4124
4125static int selinux_socket_getsockname(struct socket *sock)
4126{
Paul Moore253bfae2010-04-22 14:46:19 -04004127 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004128}
4129
4130static int selinux_socket_getpeername(struct socket *sock)
4131{
Paul Moore253bfae2010-04-22 14:46:19 -04004132 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004133}
4134
Eric Paris828dfe12008-04-17 13:17:49 -04004135static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004136{
Paul Mooref8687af2006-10-30 15:22:15 -08004137 int err;
4138
Paul Moore253bfae2010-04-22 14:46:19 -04004139 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004140 if (err)
4141 return err;
4142
4143 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004144}
4145
4146static int selinux_socket_getsockopt(struct socket *sock, int level,
4147 int optname)
4148{
Paul Moore253bfae2010-04-22 14:46:19 -04004149 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004150}
4151
4152static int selinux_socket_shutdown(struct socket *sock, int how)
4153{
Paul Moore253bfae2010-04-22 14:46:19 -04004154 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004155}
4156
David S. Miller3610cda2011-01-05 15:38:53 -08004157static int selinux_socket_unix_stream_connect(struct sock *sock,
4158 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004159 struct sock *newsk)
4160{
David S. Miller3610cda2011-01-05 15:38:53 -08004161 struct sk_security_struct *sksec_sock = sock->sk_security;
4162 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004163 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004164 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004165 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004166 int err;
4167
Eric Paris50c205f2012-04-04 15:01:43 -04004168 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004169 ad.u.net = &net;
4170 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004171
Paul Moore4d1e2452010-04-22 14:46:18 -04004172 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4173 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004174 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4175 if (err)
4176 return err;
4177
Linus Torvalds1da177e2005-04-16 15:20:36 -07004178 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004179 sksec_new->peer_sid = sksec_sock->sid;
4180 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4181 &sksec_new->sid);
4182 if (err)
4183 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004184
Paul Moore4d1e2452010-04-22 14:46:18 -04004185 /* connecting socket */
4186 sksec_sock->peer_sid = sksec_new->sid;
4187
4188 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004189}
4190
4191static int selinux_socket_unix_may_send(struct socket *sock,
4192 struct socket *other)
4193{
Paul Moore253bfae2010-04-22 14:46:19 -04004194 struct sk_security_struct *ssec = sock->sk->sk_security;
4195 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004196 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004197 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004198
Eric Paris50c205f2012-04-04 15:01:43 -04004199 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004200 ad.u.net = &net;
4201 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004202
Paul Moore253bfae2010-04-22 14:46:19 -04004203 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4204 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004205}
4206
Paul Mooreeffad8d2008-01-29 08:49:27 -05004207static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4208 u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004209 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004210{
4211 int err;
4212 u32 if_sid;
4213 u32 node_sid;
4214
4215 err = sel_netif_sid(ifindex, &if_sid);
4216 if (err)
4217 return err;
4218 err = avc_has_perm(peer_sid, if_sid,
4219 SECCLASS_NETIF, NETIF__INGRESS, ad);
4220 if (err)
4221 return err;
4222
4223 err = sel_netnode_sid(addrp, family, &node_sid);
4224 if (err)
4225 return err;
4226 return avc_has_perm(peer_sid, node_sid,
4227 SECCLASS_NODE, NODE__RECVFROM, ad);
4228}
4229
Paul Moore220deb92008-01-29 08:38:23 -05004230static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004231 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004232{
Paul Moore277d3422008-12-31 12:54:11 -05004233 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004234 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004235 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004236 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004237 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004238 char *addrp;
4239
Eric Paris50c205f2012-04-04 15:01:43 -04004240 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004241 ad.u.net = &net;
4242 ad.u.net->netif = skb->skb_iif;
4243 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004244 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4245 if (err)
4246 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004247
Paul Moore58bfbb52009-03-27 17:10:41 -04004248 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004249 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004250 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004251 if (err)
4252 return err;
4253 }
Paul Moore220deb92008-01-29 08:38:23 -05004254
Steffen Klassertb9679a72011-02-23 12:55:21 +01004255 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4256 if (err)
4257 return err;
4258 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004259
James Morris4e5ab4c2006-06-09 00:33:33 -07004260 return err;
4261}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004262
James Morris4e5ab4c2006-06-09 00:33:33 -07004263static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4264{
Paul Moore220deb92008-01-29 08:38:23 -05004265 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004266 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004267 u16 family = sk->sk_family;
4268 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004269 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004270 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004271 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004272 u8 secmark_active;
4273 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004274
James Morris4e5ab4c2006-06-09 00:33:33 -07004275 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004276 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004277
4278 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004279 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004280 family = PF_INET;
4281
Paul Moored8395c82008-10-10 10:16:30 -04004282 /* If any sort of compatibility mode is enabled then handoff processing
4283 * to the selinux_sock_rcv_skb_compat() function to deal with the
4284 * special handling. We do this in an attempt to keep this function
4285 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004286 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004287 return selinux_sock_rcv_skb_compat(sk, skb, family);
4288
4289 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004290 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04004291 if (!secmark_active && !peerlbl_active)
4292 return 0;
4293
Eric Paris50c205f2012-04-04 15:01:43 -04004294 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004295 ad.u.net = &net;
4296 ad.u.net->netif = skb->skb_iif;
4297 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004298 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004299 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004300 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004301
Paul Moored8395c82008-10-10 10:16:30 -04004302 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004303 u32 peer_sid;
4304
4305 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4306 if (err)
4307 return err;
Eric Dumazet8964be42009-11-20 15:35:04 -08004308 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004309 peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004310 if (err) {
4311 selinux_netlbl_err(skb, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004312 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004313 }
Paul Moored621d352008-01-29 08:43:36 -05004314 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4315 PEER__RECV, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004316 if (err)
4317 selinux_netlbl_err(skb, err, 0);
Paul Moored621d352008-01-29 08:43:36 -05004318 }
4319
Paul Moored8395c82008-10-10 10:16:30 -04004320 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004321 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4322 PACKET__RECV, &ad);
4323 if (err)
4324 return err;
4325 }
4326
Paul Moored621d352008-01-29 08:43:36 -05004327 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004328}
4329
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004330static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4331 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004332{
4333 int err = 0;
4334 char *scontext;
4335 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004336 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004337 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004338
Paul Moore253bfae2010-04-22 14:46:19 -04004339 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4340 sksec->sclass == SECCLASS_TCP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004341 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004342 if (peer_sid == SECSID_NULL)
4343 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004344
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004345 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004346 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004347 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004348
4349 if (scontext_len > len) {
4350 err = -ERANGE;
4351 goto out_len;
4352 }
4353
4354 if (copy_to_user(optval, scontext, scontext_len))
4355 err = -EFAULT;
4356
4357out_len:
4358 if (put_user(scontext_len, optlen))
4359 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004360 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004361 return err;
4362}
4363
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004364static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004365{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004366 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004367 u16 family;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004368
Paul Mooreaa862902008-10-10 10:16:29 -04004369 if (skb && skb->protocol == htons(ETH_P_IP))
4370 family = PF_INET;
4371 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4372 family = PF_INET6;
4373 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004374 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004375 else
4376 goto out;
4377
4378 if (sock && family == PF_UNIX)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02004379 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
Paul Moore3de4bab2006-11-17 17:38:54 -05004380 else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004381 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004382
Paul Moore75e22912008-01-29 08:38:04 -05004383out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004384 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004385 if (peer_secid == SECSID_NULL)
4386 return -EINVAL;
4387 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004388}
4389
Al Viro7d877f32005-10-21 03:20:43 -04004390static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004391{
Paul Moore84914b72010-04-22 14:46:18 -04004392 struct sk_security_struct *sksec;
4393
4394 sksec = kzalloc(sizeof(*sksec), priority);
4395 if (!sksec)
4396 return -ENOMEM;
4397
4398 sksec->peer_sid = SECINITSID_UNLABELED;
4399 sksec->sid = SECINITSID_UNLABELED;
4400 selinux_netlbl_sk_security_reset(sksec);
4401 sk->sk_security = sksec;
4402
4403 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004404}
4405
4406static void selinux_sk_free_security(struct sock *sk)
4407{
Paul Moore84914b72010-04-22 14:46:18 -04004408 struct sk_security_struct *sksec = sk->sk_security;
4409
4410 sk->sk_security = NULL;
4411 selinux_netlbl_sk_security_free(sksec);
4412 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004413}
4414
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004415static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4416{
Eric Parisdd3e7832010-04-07 15:08:46 -04004417 struct sk_security_struct *sksec = sk->sk_security;
4418 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004419
Eric Parisdd3e7832010-04-07 15:08:46 -04004420 newsksec->sid = sksec->sid;
4421 newsksec->peer_sid = sksec->peer_sid;
4422 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004423
Eric Parisdd3e7832010-04-07 15:08:46 -04004424 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004425}
4426
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004427static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004428{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004429 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004430 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004431 else {
4432 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004433
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004434 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004435 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004436}
4437
Eric Paris828dfe12008-04-17 13:17:49 -04004438static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004439{
4440 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4441 struct sk_security_struct *sksec = sk->sk_security;
4442
David Woodhouse2148ccc2006-09-29 15:50:25 -07004443 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4444 sk->sk_family == PF_UNIX)
4445 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004446 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004447}
4448
Adrian Bunk9a673e52006-08-15 00:03:53 -07004449static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4450 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004451{
4452 struct sk_security_struct *sksec = sk->sk_security;
4453 int err;
Paul Mooreaa862902008-10-10 10:16:29 -04004454 u16 family = sk->sk_family;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004455 u32 newsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004456 u32 peersid;
4457
Paul Mooreaa862902008-10-10 10:16:29 -04004458 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4459 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4460 family = PF_INET;
4461
4462 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004463 if (err)
4464 return err;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004465 if (peersid == SECSID_NULL) {
4466 req->secid = sksec->sid;
Paul Moore3de4bab2006-11-17 17:38:54 -05004467 req->peer_secid = SECSID_NULL;
Paul Moore389fb8002009-03-27 17:10:34 -04004468 } else {
4469 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4470 if (err)
4471 return err;
4472 req->secid = newsid;
4473 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004474 }
4475
Paul Moore389fb8002009-03-27 17:10:34 -04004476 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004477}
4478
Adrian Bunk9a673e52006-08-15 00:03:53 -07004479static void selinux_inet_csk_clone(struct sock *newsk,
4480 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004481{
4482 struct sk_security_struct *newsksec = newsk->sk_security;
4483
4484 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004485 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004486 /* NOTE: Ideally, we should also get the isec->sid for the
4487 new socket in sync, but we don't have the isec available yet.
4488 So we will wait until sock_graft to do it, by which
4489 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004490
Paul Moore9f2ad662006-11-17 17:38:53 -05004491 /* We don't need to take any sort of lock here as we are the only
4492 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04004493 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004494}
4495
Paul Moore014ab192008-10-10 10:16:33 -04004496static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004497{
Paul Mooreaa862902008-10-10 10:16:29 -04004498 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004499 struct sk_security_struct *sksec = sk->sk_security;
4500
Paul Mooreaa862902008-10-10 10:16:29 -04004501 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4502 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4503 family = PF_INET;
4504
4505 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004506}
4507
Eric Dumazetca10b9e2013-04-08 17:58:11 +00004508static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4509{
4510 skb_set_owner_w(skb, sk);
4511}
4512
Eric Paris2606fd12010-10-13 16:24:41 -04004513static int selinux_secmark_relabel_packet(u32 sid)
4514{
4515 const struct task_security_struct *__tsec;
4516 u32 tsid;
4517
4518 __tsec = current_security();
4519 tsid = __tsec->sid;
4520
4521 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4522}
4523
4524static void selinux_secmark_refcount_inc(void)
4525{
4526 atomic_inc(&selinux_secmark_refcount);
4527}
4528
4529static void selinux_secmark_refcount_dec(void)
4530{
4531 atomic_dec(&selinux_secmark_refcount);
4532}
4533
Adrian Bunk9a673e52006-08-15 00:03:53 -07004534static void selinux_req_classify_flow(const struct request_sock *req,
4535 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004536{
David S. Miller1d28f422011-03-12 00:29:39 -05004537 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004538}
4539
Paul Moore5dbbaf22013-01-14 07:12:19 +00004540static int selinux_tun_dev_alloc_security(void **security)
4541{
4542 struct tun_security_struct *tunsec;
4543
4544 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4545 if (!tunsec)
4546 return -ENOMEM;
4547 tunsec->sid = current_sid();
4548
4549 *security = tunsec;
4550 return 0;
4551}
4552
4553static void selinux_tun_dev_free_security(void *security)
4554{
4555 kfree(security);
4556}
4557
Paul Mooreed6d76e2009-08-28 18:12:49 -04004558static int selinux_tun_dev_create(void)
4559{
4560 u32 sid = current_sid();
4561
4562 /* we aren't taking into account the "sockcreate" SID since the socket
4563 * that is being created here is not a socket in the traditional sense,
4564 * instead it is a private sock, accessible only to the kernel, and
4565 * representing a wide range of network traffic spanning multiple
4566 * connections unlike traditional sockets - check the TUN driver to
4567 * get a better understanding of why this socket is special */
4568
4569 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4570 NULL);
4571}
4572
Paul Moore5dbbaf22013-01-14 07:12:19 +00004573static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04004574{
Paul Moore5dbbaf22013-01-14 07:12:19 +00004575 struct tun_security_struct *tunsec = security;
4576
4577 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4578 TUN_SOCKET__ATTACH_QUEUE, NULL);
4579}
4580
4581static int selinux_tun_dev_attach(struct sock *sk, void *security)
4582{
4583 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004584 struct sk_security_struct *sksec = sk->sk_security;
4585
4586 /* we don't currently perform any NetLabel based labeling here and it
4587 * isn't clear that we would want to do so anyway; while we could apply
4588 * labeling without the support of the TUN user the resulting labeled
4589 * traffic from the other end of the connection would almost certainly
4590 * cause confusion to the TUN user that had no idea network labeling
4591 * protocols were being used */
4592
Paul Moore5dbbaf22013-01-14 07:12:19 +00004593 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004594 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00004595
4596 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004597}
4598
Paul Moore5dbbaf22013-01-14 07:12:19 +00004599static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04004600{
Paul Moore5dbbaf22013-01-14 07:12:19 +00004601 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004602 u32 sid = current_sid();
4603 int err;
4604
Paul Moore5dbbaf22013-01-14 07:12:19 +00004605 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04004606 TUN_SOCKET__RELABELFROM, NULL);
4607 if (err)
4608 return err;
4609 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4610 TUN_SOCKET__RELABELTO, NULL);
4611 if (err)
4612 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00004613 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004614
4615 return 0;
4616}
4617
Linus Torvalds1da177e2005-04-16 15:20:36 -07004618static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4619{
4620 int err = 0;
4621 u32 perm;
4622 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04004623 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04004624
Hong zhi guo77954982013-03-27 06:49:35 +00004625 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004626 err = -EINVAL;
4627 goto out;
4628 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07004629 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04004630
Paul Moore253bfae2010-04-22 14:46:19 -04004631 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004632 if (err) {
4633 if (err == -EINVAL) {
David Woodhouse9ad9ad32005-06-22 15:04:33 +01004634 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004635 "SELinux: unrecognized netlink message"
4636 " type=%hu for sclass=%hu\n",
Paul Moore253bfae2010-04-22 14:46:19 -04004637 nlh->nlmsg_type, sksec->sclass);
Eric Paris39c9aed2008-11-05 09:34:42 -05004638 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07004639 err = 0;
4640 }
4641
4642 /* Ignore */
4643 if (err == -ENOENT)
4644 err = 0;
4645 goto out;
4646 }
4647
Paul Moore253bfae2010-04-22 14:46:19 -04004648 err = sock_has_perm(current, sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004649out:
4650 return err;
4651}
4652
4653#ifdef CONFIG_NETFILTER
4654
Paul Mooreeffad8d2008-01-29 08:49:27 -05004655static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4656 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004657{
Paul Mooredfaebe92008-10-10 10:16:31 -04004658 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004659 char *addrp;
4660 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004661 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004662 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05004663 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04004664 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004665 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004666
Paul Mooreeffad8d2008-01-29 08:49:27 -05004667 if (!selinux_policycap_netpeer)
4668 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004669
Paul Mooreeffad8d2008-01-29 08:49:27 -05004670 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04004671 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004672 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05004673 if (!secmark_active && !peerlbl_active)
4674 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004675
Paul Moored8395c82008-10-10 10:16:30 -04004676 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4677 return NF_DROP;
4678
Eric Paris50c205f2012-04-04 15:01:43 -04004679 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004680 ad.u.net = &net;
4681 ad.u.net->netif = ifindex;
4682 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004683 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4684 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004685
Paul Mooredfaebe92008-10-10 10:16:31 -04004686 if (peerlbl_active) {
4687 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4688 peer_sid, &ad);
4689 if (err) {
4690 selinux_netlbl_err(skb, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004691 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04004692 }
4693 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05004694
4695 if (secmark_active)
4696 if (avc_has_perm(peer_sid, skb->secmark,
4697 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4698 return NF_DROP;
4699
Paul Moore948bf852008-10-10 10:16:32 -04004700 if (netlbl_active)
4701 /* we do this in the FORWARD path and not the POST_ROUTING
4702 * path because we want to make sure we apply the necessary
4703 * labeling before IPsec is applied so we can leverage AH
4704 * protection */
4705 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4706 return NF_DROP;
4707
Paul Mooreeffad8d2008-01-29 08:49:27 -05004708 return NF_ACCEPT;
4709}
4710
Patrick McHardy795aa6e2013-10-10 09:21:55 +02004711static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004712 struct sk_buff *skb,
4713 const struct net_device *in,
4714 const struct net_device *out,
4715 int (*okfn)(struct sk_buff *))
4716{
4717 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4718}
4719
4720#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Patrick McHardy795aa6e2013-10-10 09:21:55 +02004721static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004722 struct sk_buff *skb,
4723 const struct net_device *in,
4724 const struct net_device *out,
4725 int (*okfn)(struct sk_buff *))
4726{
4727 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4728}
4729#endif /* IPV6 */
4730
Paul Moore948bf852008-10-10 10:16:32 -04004731static unsigned int selinux_ip_output(struct sk_buff *skb,
4732 u16 family)
4733{
4734 u32 sid;
4735
4736 if (!netlbl_enabled())
4737 return NF_ACCEPT;
4738
4739 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4740 * because we want to make sure we apply the necessary labeling
4741 * before IPsec is applied so we can leverage AH protection */
4742 if (skb->sk) {
4743 struct sk_security_struct *sksec = skb->sk->sk_security;
4744 sid = sksec->sid;
4745 } else
4746 sid = SECINITSID_KERNEL;
4747 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4748 return NF_DROP;
4749
4750 return NF_ACCEPT;
4751}
4752
Patrick McHardy795aa6e2013-10-10 09:21:55 +02004753static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
Paul Moore948bf852008-10-10 10:16:32 -04004754 struct sk_buff *skb,
4755 const struct net_device *in,
4756 const struct net_device *out,
4757 int (*okfn)(struct sk_buff *))
4758{
4759 return selinux_ip_output(skb, PF_INET);
4760}
4761
Paul Mooreeffad8d2008-01-29 08:49:27 -05004762static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4763 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04004764 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07004765{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004766 struct sock *sk = skb->sk;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004767 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004768 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004769 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004770 char *addrp;
4771 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07004772
Paul Mooreeffad8d2008-01-29 08:49:27 -05004773 if (sk == NULL)
4774 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004775 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07004776
Eric Paris50c205f2012-04-04 15:01:43 -04004777 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004778 ad.u.net = &net;
4779 ad.u.net->netif = ifindex;
4780 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004781 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4782 return NF_DROP;
4783
Paul Moore58bfbb52009-03-27 17:10:41 -04004784 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05004785 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04004786 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00004787 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07004788
Steffen Klassertb9679a72011-02-23 12:55:21 +01004789 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4790 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07004791
Paul Mooreeffad8d2008-01-29 08:49:27 -05004792 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004793}
4794
Paul Mooreeffad8d2008-01-29 08:49:27 -05004795static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4796 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004797{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004798 u32 secmark_perm;
4799 u32 peer_sid;
4800 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04004801 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004802 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05004803 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004804 u8 secmark_active;
4805 u8 peerlbl_active;
4806
Paul Mooreeffad8d2008-01-29 08:49:27 -05004807 /* If any sort of compatibility mode is enabled then handoff processing
4808 * to the selinux_ip_postroute_compat() function to deal with the
4809 * special handling. We do this in an attempt to keep this function
4810 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004811 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004812 return selinux_ip_postroute_compat(skb, ifindex, family);
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004813#ifdef CONFIG_XFRM
Paul Mooreeffad8d2008-01-29 08:49:27 -05004814 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4815 * packet transformation so allow the packet to pass without any checks
4816 * since we'll have another chance to perform access control checks
4817 * when the packet is on it's final way out.
4818 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4819 * is NULL, in this case go ahead and apply access control. */
Eric Dumazetadf30902009-06-02 05:19:30 +00004820 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004821 return NF_ACCEPT;
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004822#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05004823 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004824 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05004825 if (!secmark_active && !peerlbl_active)
4826 return NF_ACCEPT;
4827
Paul Moored8395c82008-10-10 10:16:30 -04004828 /* if the packet is being forwarded then get the peer label from the
4829 * packet itself; otherwise check to see if it is from a local
4830 * application or the kernel, if from an application get the peer label
4831 * from the sending socket, otherwise use the kernel's sid */
Paul Mooreeffad8d2008-01-29 08:49:27 -05004832 sk = skb->sk;
Paul Moored8395c82008-10-10 10:16:30 -04004833 if (sk == NULL) {
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004834 if (skb->skb_iif) {
4835 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04004836 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004837 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004838 } else {
4839 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04004840 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004841 }
Paul Moored8395c82008-10-10 10:16:30 -04004842 } else {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004843 struct sk_security_struct *sksec = sk->sk_security;
4844 peer_sid = sksec->sid;
4845 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004846 }
4847
Eric Paris50c205f2012-04-04 15:01:43 -04004848 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004849 ad.u.net = &net;
4850 ad.u.net->netif = ifindex;
4851 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004852 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00004853 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04004854
Paul Mooreeffad8d2008-01-29 08:49:27 -05004855 if (secmark_active)
4856 if (avc_has_perm(peer_sid, skb->secmark,
4857 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004858 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004859
4860 if (peerlbl_active) {
4861 u32 if_sid;
4862 u32 node_sid;
4863
4864 if (sel_netif_sid(ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004865 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004866 if (avc_has_perm(peer_sid, if_sid,
4867 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004868 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004869
4870 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004871 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004872 if (avc_has_perm(peer_sid, node_sid,
4873 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004874 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004875 }
4876
4877 return NF_ACCEPT;
4878}
4879
Patrick McHardy795aa6e2013-10-10 09:21:55 +02004880static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004881 struct sk_buff *skb,
4882 const struct net_device *in,
4883 const struct net_device *out,
4884 int (*okfn)(struct sk_buff *))
4885{
4886 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004887}
4888
4889#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Patrick McHardy795aa6e2013-10-10 09:21:55 +02004890static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004891 struct sk_buff *skb,
4892 const struct net_device *in,
4893 const struct net_device *out,
4894 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004895{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004896 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004897}
Linus Torvalds1da177e2005-04-16 15:20:36 -07004898#endif /* IPV6 */
4899
4900#endif /* CONFIG_NETFILTER */
4901
Linus Torvalds1da177e2005-04-16 15:20:36 -07004902static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4903{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004904 int err;
4905
Eric Paris200ac532009-02-12 15:01:04 -05004906 err = cap_netlink_send(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004907 if (err)
4908 return err;
4909
Stephen Smalley941fc5b2009-10-01 14:48:23 -04004910 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004911}
4912
Linus Torvalds1da177e2005-04-16 15:20:36 -07004913static int ipc_alloc_security(struct task_struct *task,
4914 struct kern_ipc_perm *perm,
4915 u16 sclass)
4916{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004917 struct ipc_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11004918 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004919
James Morris89d155e2005-10-30 14:59:21 -08004920 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004921 if (!isec)
4922 return -ENOMEM;
4923
David Howells275bb412008-11-14 10:39:19 +11004924 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004925 isec->sclass = sclass;
David Howells275bb412008-11-14 10:39:19 +11004926 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004927 perm->security = isec;
4928
4929 return 0;
4930}
4931
4932static void ipc_free_security(struct kern_ipc_perm *perm)
4933{
4934 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004935 perm->security = NULL;
4936 kfree(isec);
4937}
4938
4939static int msg_msg_alloc_security(struct msg_msg *msg)
4940{
4941 struct msg_security_struct *msec;
4942
James Morris89d155e2005-10-30 14:59:21 -08004943 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004944 if (!msec)
4945 return -ENOMEM;
4946
Linus Torvalds1da177e2005-04-16 15:20:36 -07004947 msec->sid = SECINITSID_UNLABELED;
4948 msg->security = msec;
4949
4950 return 0;
4951}
4952
4953static void msg_msg_free_security(struct msg_msg *msg)
4954{
4955 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004956
4957 msg->security = NULL;
4958 kfree(msec);
4959}
4960
4961static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07004962 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004963{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004964 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004965 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004966 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004967
Linus Torvalds1da177e2005-04-16 15:20:36 -07004968 isec = ipc_perms->security;
4969
Eric Paris50c205f2012-04-04 15:01:43 -04004970 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004971 ad.u.ipc_id = ipc_perms->key;
4972
David Howells275bb412008-11-14 10:39:19 +11004973 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004974}
4975
4976static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4977{
4978 return msg_msg_alloc_security(msg);
4979}
4980
4981static void selinux_msg_msg_free_security(struct msg_msg *msg)
4982{
4983 msg_msg_free_security(msg);
4984}
4985
4986/* message queue security operations */
4987static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4988{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004989 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004990 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004991 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004992 int rc;
4993
4994 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4995 if (rc)
4996 return rc;
4997
Linus Torvalds1da177e2005-04-16 15:20:36 -07004998 isec = msq->q_perm.security;
4999
Eric Paris50c205f2012-04-04 15:01:43 -04005000 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005001 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005002
David Howells275bb412008-11-14 10:39:19 +11005003 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005004 MSGQ__CREATE, &ad);
5005 if (rc) {
5006 ipc_free_security(&msq->q_perm);
5007 return rc;
5008 }
5009 return 0;
5010}
5011
5012static void selinux_msg_queue_free_security(struct msg_queue *msq)
5013{
5014 ipc_free_security(&msq->q_perm);
5015}
5016
5017static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5018{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005019 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005020 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005021 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005022
Linus Torvalds1da177e2005-04-16 15:20:36 -07005023 isec = msq->q_perm.security;
5024
Eric Paris50c205f2012-04-04 15:01:43 -04005025 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005026 ad.u.ipc_id = msq->q_perm.key;
5027
David Howells275bb412008-11-14 10:39:19 +11005028 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005029 MSGQ__ASSOCIATE, &ad);
5030}
5031
5032static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5033{
5034 int err;
5035 int perms;
5036
Eric Paris828dfe12008-04-17 13:17:49 -04005037 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005038 case IPC_INFO:
5039 case MSG_INFO:
5040 /* No specific object, just general system-wide information. */
5041 return task_has_system(current, SYSTEM__IPC_INFO);
5042 case IPC_STAT:
5043 case MSG_STAT:
5044 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5045 break;
5046 case IPC_SET:
5047 perms = MSGQ__SETATTR;
5048 break;
5049 case IPC_RMID:
5050 perms = MSGQ__DESTROY;
5051 break;
5052 default:
5053 return 0;
5054 }
5055
Stephen Smalley6af963f2005-05-01 08:58:39 -07005056 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005057 return err;
5058}
5059
5060static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5061{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005062 struct ipc_security_struct *isec;
5063 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005064 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005065 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005066 int rc;
5067
Linus Torvalds1da177e2005-04-16 15:20:36 -07005068 isec = msq->q_perm.security;
5069 msec = msg->security;
5070
5071 /*
5072 * First time through, need to assign label to the message
5073 */
5074 if (msec->sid == SECINITSID_UNLABELED) {
5075 /*
5076 * Compute new sid based on current process and
5077 * message queue this message will be stored in
5078 */
David Howells275bb412008-11-14 10:39:19 +11005079 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Eric Paris652bb9b2011-02-01 11:05:40 -05005080 NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005081 if (rc)
5082 return rc;
5083 }
5084
Eric Paris50c205f2012-04-04 15:01:43 -04005085 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005086 ad.u.ipc_id = msq->q_perm.key;
5087
5088 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11005089 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005090 MSGQ__WRITE, &ad);
5091 if (!rc)
5092 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11005093 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5094 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005095 if (!rc)
5096 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11005097 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5098 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005099
5100 return rc;
5101}
5102
5103static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5104 struct task_struct *target,
5105 long type, int mode)
5106{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005107 struct ipc_security_struct *isec;
5108 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005109 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005110 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005111 int rc;
5112
Linus Torvalds1da177e2005-04-16 15:20:36 -07005113 isec = msq->q_perm.security;
5114 msec = msg->security;
5115
Eric Paris50c205f2012-04-04 15:01:43 -04005116 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005117 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005118
David Howells275bb412008-11-14 10:39:19 +11005119 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005120 SECCLASS_MSGQ, MSGQ__READ, &ad);
5121 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11005122 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005123 SECCLASS_MSG, MSG__RECEIVE, &ad);
5124 return rc;
5125}
5126
5127/* Shared Memory security operations */
5128static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5129{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005130 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005131 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005132 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005133 int rc;
5134
5135 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5136 if (rc)
5137 return rc;
5138
Linus Torvalds1da177e2005-04-16 15:20:36 -07005139 isec = shp->shm_perm.security;
5140
Eric Paris50c205f2012-04-04 15:01:43 -04005141 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005142 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005143
David Howells275bb412008-11-14 10:39:19 +11005144 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005145 SHM__CREATE, &ad);
5146 if (rc) {
5147 ipc_free_security(&shp->shm_perm);
5148 return rc;
5149 }
5150 return 0;
5151}
5152
5153static void selinux_shm_free_security(struct shmid_kernel *shp)
5154{
5155 ipc_free_security(&shp->shm_perm);
5156}
5157
5158static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5159{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005160 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005161 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005162 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005163
Linus Torvalds1da177e2005-04-16 15:20:36 -07005164 isec = shp->shm_perm.security;
5165
Eric Paris50c205f2012-04-04 15:01:43 -04005166 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005167 ad.u.ipc_id = shp->shm_perm.key;
5168
David Howells275bb412008-11-14 10:39:19 +11005169 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005170 SHM__ASSOCIATE, &ad);
5171}
5172
5173/* Note, at this point, shp is locked down */
5174static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5175{
5176 int perms;
5177 int err;
5178
Eric Paris828dfe12008-04-17 13:17:49 -04005179 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005180 case IPC_INFO:
5181 case SHM_INFO:
5182 /* No specific object, just general system-wide information. */
5183 return task_has_system(current, SYSTEM__IPC_INFO);
5184 case IPC_STAT:
5185 case SHM_STAT:
5186 perms = SHM__GETATTR | SHM__ASSOCIATE;
5187 break;
5188 case IPC_SET:
5189 perms = SHM__SETATTR;
5190 break;
5191 case SHM_LOCK:
5192 case SHM_UNLOCK:
5193 perms = SHM__LOCK;
5194 break;
5195 case IPC_RMID:
5196 perms = SHM__DESTROY;
5197 break;
5198 default:
5199 return 0;
5200 }
5201
Stephen Smalley6af963f2005-05-01 08:58:39 -07005202 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005203 return err;
5204}
5205
5206static int selinux_shm_shmat(struct shmid_kernel *shp,
5207 char __user *shmaddr, int shmflg)
5208{
5209 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005210
5211 if (shmflg & SHM_RDONLY)
5212 perms = SHM__READ;
5213 else
5214 perms = SHM__READ | SHM__WRITE;
5215
Stephen Smalley6af963f2005-05-01 08:58:39 -07005216 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005217}
5218
5219/* Semaphore security operations */
5220static int selinux_sem_alloc_security(struct sem_array *sma)
5221{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005222 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005223 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005224 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005225 int rc;
5226
5227 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5228 if (rc)
5229 return rc;
5230
Linus Torvalds1da177e2005-04-16 15:20:36 -07005231 isec = sma->sem_perm.security;
5232
Eric Paris50c205f2012-04-04 15:01:43 -04005233 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005234 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005235
David Howells275bb412008-11-14 10:39:19 +11005236 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005237 SEM__CREATE, &ad);
5238 if (rc) {
5239 ipc_free_security(&sma->sem_perm);
5240 return rc;
5241 }
5242 return 0;
5243}
5244
5245static void selinux_sem_free_security(struct sem_array *sma)
5246{
5247 ipc_free_security(&sma->sem_perm);
5248}
5249
5250static int selinux_sem_associate(struct sem_array *sma, int semflg)
5251{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005252 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005253 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005254 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005255
Linus Torvalds1da177e2005-04-16 15:20:36 -07005256 isec = sma->sem_perm.security;
5257
Eric Paris50c205f2012-04-04 15:01:43 -04005258 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005259 ad.u.ipc_id = sma->sem_perm.key;
5260
David Howells275bb412008-11-14 10:39:19 +11005261 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005262 SEM__ASSOCIATE, &ad);
5263}
5264
5265/* Note, at this point, sma is locked down */
5266static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5267{
5268 int err;
5269 u32 perms;
5270
Eric Paris828dfe12008-04-17 13:17:49 -04005271 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005272 case IPC_INFO:
5273 case SEM_INFO:
5274 /* No specific object, just general system-wide information. */
5275 return task_has_system(current, SYSTEM__IPC_INFO);
5276 case GETPID:
5277 case GETNCNT:
5278 case GETZCNT:
5279 perms = SEM__GETATTR;
5280 break;
5281 case GETVAL:
5282 case GETALL:
5283 perms = SEM__READ;
5284 break;
5285 case SETVAL:
5286 case SETALL:
5287 perms = SEM__WRITE;
5288 break;
5289 case IPC_RMID:
5290 perms = SEM__DESTROY;
5291 break;
5292 case IPC_SET:
5293 perms = SEM__SETATTR;
5294 break;
5295 case IPC_STAT:
5296 case SEM_STAT:
5297 perms = SEM__GETATTR | SEM__ASSOCIATE;
5298 break;
5299 default:
5300 return 0;
5301 }
5302
Stephen Smalley6af963f2005-05-01 08:58:39 -07005303 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005304 return err;
5305}
5306
5307static int selinux_sem_semop(struct sem_array *sma,
5308 struct sembuf *sops, unsigned nsops, int alter)
5309{
5310 u32 perms;
5311
5312 if (alter)
5313 perms = SEM__READ | SEM__WRITE;
5314 else
5315 perms = SEM__READ;
5316
Stephen Smalley6af963f2005-05-01 08:58:39 -07005317 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005318}
5319
5320static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5321{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005322 u32 av = 0;
5323
Linus Torvalds1da177e2005-04-16 15:20:36 -07005324 av = 0;
5325 if (flag & S_IRUGO)
5326 av |= IPC__UNIX_READ;
5327 if (flag & S_IWUGO)
5328 av |= IPC__UNIX_WRITE;
5329
5330 if (av == 0)
5331 return 0;
5332
Stephen Smalley6af963f2005-05-01 08:58:39 -07005333 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005334}
5335
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02005336static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5337{
5338 struct ipc_security_struct *isec = ipcp->security;
5339 *secid = isec->sid;
5340}
5341
Eric Paris828dfe12008-04-17 13:17:49 -04005342static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005343{
5344 if (inode)
5345 inode_doinit_with_dentry(inode, dentry);
5346}
5347
5348static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005349 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005350{
David Howells275bb412008-11-14 10:39:19 +11005351 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005352 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005353 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005354 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005355
5356 if (current != p) {
David Howells3b11a1d2008-11-14 10:39:26 +11005357 error = current_has_perm(p, PROCESS__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005358 if (error)
5359 return error;
5360 }
5361
David Howells275bb412008-11-14 10:39:19 +11005362 rcu_read_lock();
5363 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005364
5365 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005366 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005367 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005368 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005369 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005370 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005371 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005372 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005373 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005374 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005375 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005376 sid = __tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005377 else
David Howells275bb412008-11-14 10:39:19 +11005378 goto invalid;
5379 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005380
5381 if (!sid)
5382 return 0;
5383
Al Viro04ff9702007-03-12 16:17:58 +00005384 error = security_sid_to_context(sid, value, &len);
5385 if (error)
5386 return error;
5387 return len;
David Howells275bb412008-11-14 10:39:19 +11005388
5389invalid:
5390 rcu_read_unlock();
5391 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005392}
5393
5394static int selinux_setprocattr(struct task_struct *p,
5395 char *name, void *value, size_t size)
5396{
5397 struct task_security_struct *tsec;
Roland McGrath03563572008-03-26 15:46:39 -07005398 struct task_struct *tracer;
David Howellsd84f4f92008-11-14 10:39:23 +11005399 struct cred *new;
5400 u32 sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005401 int error;
5402 char *str = value;
5403
5404 if (current != p) {
5405 /* SELinux only allows a process to change its own
5406 security attributes. */
5407 return -EACCES;
5408 }
5409
5410 /*
5411 * Basic control over ability to set these attributes at all.
5412 * current == p, but we'll pass them separately in case the
5413 * above restriction is ever removed.
5414 */
5415 if (!strcmp(name, "exec"))
David Howells3b11a1d2008-11-14 10:39:26 +11005416 error = current_has_perm(p, PROCESS__SETEXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005417 else if (!strcmp(name, "fscreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005418 error = current_has_perm(p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005419 else if (!strcmp(name, "keycreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005420 error = current_has_perm(p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07005421 else if (!strcmp(name, "sockcreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005422 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005423 else if (!strcmp(name, "current"))
David Howells3b11a1d2008-11-14 10:39:26 +11005424 error = current_has_perm(p, PROCESS__SETCURRENT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005425 else
5426 error = -EINVAL;
5427 if (error)
5428 return error;
5429
5430 /* Obtain a SID for the context, if one was specified. */
5431 if (size && str[1] && str[1] != '\n') {
5432 if (str[size-1] == '\n') {
5433 str[size-1] = 0;
5434 size--;
5435 }
5436 error = security_context_to_sid(value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005437 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04005438 if (!capable(CAP_MAC_ADMIN)) {
5439 struct audit_buffer *ab;
5440 size_t audit_size;
5441
5442 /* We strip a nul only if it is at the end, otherwise the
5443 * context contains a nul and we should audit that */
5444 if (str[size - 1] == '\0')
5445 audit_size = size - 1;
5446 else
5447 audit_size = size;
5448 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5449 audit_log_format(ab, "op=fscreate invalid_context=");
5450 audit_log_n_untrustedstring(ab, value, audit_size);
5451 audit_log_end(ab);
5452
Stephen Smalley12b29f32008-05-07 13:03:20 -04005453 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04005454 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04005455 error = security_context_to_sid_force(value, size,
5456 &sid);
5457 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005458 if (error)
5459 return error;
5460 }
5461
David Howellsd84f4f92008-11-14 10:39:23 +11005462 new = prepare_creds();
5463 if (!new)
5464 return -ENOMEM;
5465
Linus Torvalds1da177e2005-04-16 15:20:36 -07005466 /* Permission checking based on the specified context is
5467 performed during the actual operation (execve,
5468 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11005469 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07005470 checks and may_create for the file creation checks. The
5471 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11005472 tsec = new->security;
5473 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005474 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005475 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005476 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005477 } else if (!strcmp(name, "keycreate")) {
Michael LeMay4eb582c2006-06-26 00:24:57 -07005478 error = may_create_key(sid, p);
5479 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005480 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005481 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005482 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07005483 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005484 } else if (!strcmp(name, "current")) {
5485 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005486 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11005487 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09005488
David Howellsd84f4f92008-11-14 10:39:23 +11005489 /* Only allow single threaded processes to change context */
5490 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02005491 if (!current_is_single_threaded()) {
David Howellsd84f4f92008-11-14 10:39:23 +11005492 error = security_bounded_transition(tsec->sid, sid);
5493 if (error)
5494 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04005495 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005496
5497 /* Check permissions for the transition. */
5498 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04005499 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005500 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005501 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005502
5503 /* Check for ptracing, and update the task SID if ok.
5504 Otherwise, leave SID unchanged and fail. */
David Howellsd84f4f92008-11-14 10:39:23 +11005505 ptsid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005506 task_lock(p);
Tejun Heo06d98472011-06-17 16:50:40 +02005507 tracer = ptrace_parent(p);
David Howellsd84f4f92008-11-14 10:39:23 +11005508 if (tracer)
5509 ptsid = task_sid(tracer);
5510 task_unlock(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005511
David Howellsd84f4f92008-11-14 10:39:23 +11005512 if (tracer) {
5513 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5514 PROCESS__PTRACE, NULL);
5515 if (error)
5516 goto abort_change;
5517 }
5518
5519 tsec->sid = sid;
5520 } else {
5521 error = -EINVAL;
5522 goto abort_change;
5523 }
5524
5525 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005526 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11005527
5528abort_change:
5529 abort_creds(new);
5530 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005531}
5532
David Quigley746df9b2013-05-22 12:50:35 -04005533static int selinux_ismaclabel(const char *name)
5534{
5535 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5536}
5537
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005538static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5539{
5540 return security_sid_to_context(secid, secdata, seclen);
5541}
5542
David Howells7bf570d2008-04-29 20:52:51 +01005543static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00005544{
5545 return security_context_to_sid(secdata, seclen, secid);
5546}
5547
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005548static void selinux_release_secctx(char *secdata, u32 seclen)
5549{
Paul Moore088999e2007-08-01 11:12:58 -04005550 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005551}
5552
David P. Quigley1ee65e32009-09-03 14:25:57 -04005553/*
5554 * called with inode->i_mutex locked
5555 */
5556static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5557{
5558 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5559}
5560
5561/*
5562 * called with inode->i_mutex locked
5563 */
5564static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5565{
5566 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5567}
5568
5569static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5570{
5571 int len = 0;
5572 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5573 ctx, true);
5574 if (len < 0)
5575 return len;
5576 *ctxlen = len;
5577 return 0;
5578}
Michael LeMayd7200242006-06-22 14:47:17 -07005579#ifdef CONFIG_KEYS
5580
David Howellsd84f4f92008-11-14 10:39:23 +11005581static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07005582 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07005583{
David Howellsd84f4f92008-11-14 10:39:23 +11005584 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07005585 struct key_security_struct *ksec;
5586
5587 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5588 if (!ksec)
5589 return -ENOMEM;
5590
David Howellsd84f4f92008-11-14 10:39:23 +11005591 tsec = cred->security;
5592 if (tsec->keycreate_sid)
5593 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005594 else
David Howellsd84f4f92008-11-14 10:39:23 +11005595 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005596
David Howells275bb412008-11-14 10:39:19 +11005597 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07005598 return 0;
5599}
5600
5601static void selinux_key_free(struct key *k)
5602{
5603 struct key_security_struct *ksec = k->security;
5604
5605 k->security = NULL;
5606 kfree(ksec);
5607}
5608
5609static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11005610 const struct cred *cred,
5611 key_perm_t perm)
Michael LeMayd7200242006-06-22 14:47:17 -07005612{
5613 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07005614 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11005615 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005616
5617 /* if no specific permissions are requested, we skip the
5618 permission check. No serious, additional covert channels
5619 appear to be created. */
5620 if (perm == 0)
5621 return 0;
5622
David Howellsd84f4f92008-11-14 10:39:23 +11005623 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11005624
5625 key = key_ref_to_ptr(key_ref);
5626 ksec = key->security;
5627
5628 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07005629}
5630
David Howells70a5bb72008-04-29 01:01:26 -07005631static int selinux_key_getsecurity(struct key *key, char **_buffer)
5632{
5633 struct key_security_struct *ksec = key->security;
5634 char *context = NULL;
5635 unsigned len;
5636 int rc;
5637
5638 rc = security_sid_to_context(ksec->sid, &context, &len);
5639 if (!rc)
5640 rc = len;
5641 *_buffer = context;
5642 return rc;
5643}
5644
Michael LeMayd7200242006-06-22 14:47:17 -07005645#endif
5646
Linus Torvalds1da177e2005-04-16 15:20:36 -07005647static struct security_operations selinux_ops = {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005648 .name = "selinux",
5649
Ingo Molnar9e488582009-05-07 19:26:19 +10005650 .ptrace_access_check = selinux_ptrace_access_check,
David Howells5cd9c582008-08-14 11:37:28 +01005651 .ptrace_traceme = selinux_ptrace_traceme,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005652 .capget = selinux_capget,
David Howellsd84f4f92008-11-14 10:39:23 +11005653 .capset = selinux_capset,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005654 .capable = selinux_capable,
5655 .quotactl = selinux_quotactl,
5656 .quota_on = selinux_quota_on,
5657 .syslog = selinux_syslog,
5658 .vm_enough_memory = selinux_vm_enough_memory,
5659
5660 .netlink_send = selinux_netlink_send,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005661
David Howellsa6f76f22008-11-14 10:39:24 +11005662 .bprm_set_creds = selinux_bprm_set_creds,
David Howellsa6f76f22008-11-14 10:39:24 +11005663 .bprm_committing_creds = selinux_bprm_committing_creds,
5664 .bprm_committed_creds = selinux_bprm_committed_creds,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005665 .bprm_secureexec = selinux_bprm_secureexec,
5666
5667 .sb_alloc_security = selinux_sb_alloc_security,
5668 .sb_free_security = selinux_sb_free_security,
5669 .sb_copy_data = selinux_sb_copy_data,
Eric Paris026eb162011-03-03 16:09:14 -05005670 .sb_remount = selinux_sb_remount,
Eric Paris828dfe12008-04-17 13:17:49 -04005671 .sb_kern_mount = selinux_sb_kern_mount,
Eric Paris2069f452008-07-04 09:47:13 +10005672 .sb_show_options = selinux_sb_show_options,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005673 .sb_statfs = selinux_sb_statfs,
5674 .sb_mount = selinux_mount,
5675 .sb_umount = selinux_umount,
Eric Parisc9180a52007-11-30 13:00:35 -05005676 .sb_set_mnt_opts = selinux_set_mnt_opts,
Eric Paris828dfe12008-04-17 13:17:49 -04005677 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
Eric Parise0007522008-03-05 10:31:54 -05005678 .sb_parse_opts_str = selinux_parse_opts_str,
5679
David Quigleyd47be3d2013-05-22 12:50:34 -04005680 .dentry_init_security = selinux_dentry_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005681
5682 .inode_alloc_security = selinux_inode_alloc_security,
5683 .inode_free_security = selinux_inode_free_security,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07005684 .inode_init_security = selinux_inode_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005685 .inode_create = selinux_inode_create,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005686 .inode_link = selinux_inode_link,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005687 .inode_unlink = selinux_inode_unlink,
5688 .inode_symlink = selinux_inode_symlink,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005689 .inode_mkdir = selinux_inode_mkdir,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005690 .inode_rmdir = selinux_inode_rmdir,
5691 .inode_mknod = selinux_inode_mknod,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005692 .inode_rename = selinux_inode_rename,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005693 .inode_readlink = selinux_inode_readlink,
5694 .inode_follow_link = selinux_inode_follow_link,
5695 .inode_permission = selinux_inode_permission,
5696 .inode_setattr = selinux_inode_setattr,
5697 .inode_getattr = selinux_inode_getattr,
5698 .inode_setxattr = selinux_inode_setxattr,
5699 .inode_post_setxattr = selinux_inode_post_setxattr,
5700 .inode_getxattr = selinux_inode_getxattr,
5701 .inode_listxattr = selinux_inode_listxattr,
5702 .inode_removexattr = selinux_inode_removexattr,
Eric Paris828dfe12008-04-17 13:17:49 -04005703 .inode_getsecurity = selinux_inode_getsecurity,
5704 .inode_setsecurity = selinux_inode_setsecurity,
5705 .inode_listsecurity = selinux_inode_listsecurity,
Eric Parisf5269712008-05-14 11:27:45 -04005706 .inode_getsecid = selinux_inode_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005707
5708 .file_permission = selinux_file_permission,
5709 .file_alloc_security = selinux_file_alloc_security,
5710 .file_free_security = selinux_file_free_security,
5711 .file_ioctl = selinux_file_ioctl,
Al Viroe5467852012-05-30 13:30:51 -04005712 .mmap_file = selinux_mmap_file,
5713 .mmap_addr = selinux_mmap_addr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005714 .file_mprotect = selinux_file_mprotect,
5715 .file_lock = selinux_file_lock,
5716 .file_fcntl = selinux_file_fcntl,
5717 .file_set_fowner = selinux_file_set_fowner,
5718 .file_send_sigiotask = selinux_file_send_sigiotask,
5719 .file_receive = selinux_file_receive,
5720
Eric Paris83d49852012-04-04 13:45:40 -04005721 .file_open = selinux_file_open,
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09005722
Linus Torvalds1da177e2005-04-16 15:20:36 -07005723 .task_create = selinux_task_create,
David Howellsee18d642009-09-02 09:14:21 +01005724 .cred_alloc_blank = selinux_cred_alloc_blank,
David Howellsf1752ee2008-11-14 10:39:17 +11005725 .cred_free = selinux_cred_free,
David Howellsd84f4f92008-11-14 10:39:23 +11005726 .cred_prepare = selinux_cred_prepare,
David Howellsee18d642009-09-02 09:14:21 +01005727 .cred_transfer = selinux_cred_transfer,
David Howells3a3b7ce2008-11-14 10:39:28 +11005728 .kernel_act_as = selinux_kernel_act_as,
5729 .kernel_create_files_as = selinux_kernel_create_files_as,
Eric Paris25354c42009-08-13 09:45:03 -04005730 .kernel_module_request = selinux_kernel_module_request,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005731 .task_setpgid = selinux_task_setpgid,
5732 .task_getpgid = selinux_task_getpgid,
Eric Paris828dfe12008-04-17 13:17:49 -04005733 .task_getsid = selinux_task_getsid,
David Quigleyf9008e42006-06-30 01:55:46 -07005734 .task_getsecid = selinux_task_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005735 .task_setnice = selinux_task_setnice,
James Morris03e68062006-06-23 02:03:58 -07005736 .task_setioprio = selinux_task_setioprio,
David Quigleya1836a42006-06-30 01:55:49 -07005737 .task_getioprio = selinux_task_getioprio,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005738 .task_setrlimit = selinux_task_setrlimit,
5739 .task_setscheduler = selinux_task_setscheduler,
5740 .task_getscheduler = selinux_task_getscheduler,
David Quigley35601542006-06-23 02:04:01 -07005741 .task_movememory = selinux_task_movememory,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005742 .task_kill = selinux_task_kill,
5743 .task_wait = selinux_task_wait,
Eric Paris828dfe12008-04-17 13:17:49 -04005744 .task_to_inode = selinux_task_to_inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005745
5746 .ipc_permission = selinux_ipc_permission,
Eric Parisf5269712008-05-14 11:27:45 -04005747 .ipc_getsecid = selinux_ipc_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005748
5749 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5750 .msg_msg_free_security = selinux_msg_msg_free_security,
5751
5752 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5753 .msg_queue_free_security = selinux_msg_queue_free_security,
5754 .msg_queue_associate = selinux_msg_queue_associate,
5755 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5756 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5757 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5758
5759 .shm_alloc_security = selinux_shm_alloc_security,
5760 .shm_free_security = selinux_shm_free_security,
5761 .shm_associate = selinux_shm_associate,
5762 .shm_shmctl = selinux_shm_shmctl,
5763 .shm_shmat = selinux_shm_shmat,
5764
Eric Paris828dfe12008-04-17 13:17:49 -04005765 .sem_alloc_security = selinux_sem_alloc_security,
5766 .sem_free_security = selinux_sem_free_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005767 .sem_associate = selinux_sem_associate,
5768 .sem_semctl = selinux_sem_semctl,
5769 .sem_semop = selinux_sem_semop,
5770
Eric Paris828dfe12008-04-17 13:17:49 -04005771 .d_instantiate = selinux_d_instantiate,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005772
Eric Paris828dfe12008-04-17 13:17:49 -04005773 .getprocattr = selinux_getprocattr,
5774 .setprocattr = selinux_setprocattr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005775
David Quigley746df9b2013-05-22 12:50:35 -04005776 .ismaclabel = selinux_ismaclabel,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005777 .secid_to_secctx = selinux_secid_to_secctx,
David Howells63cb3442008-01-15 23:47:35 +00005778 .secctx_to_secid = selinux_secctx_to_secid,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005779 .release_secctx = selinux_release_secctx,
David P. Quigley1ee65e32009-09-03 14:25:57 -04005780 .inode_notifysecctx = selinux_inode_notifysecctx,
5781 .inode_setsecctx = selinux_inode_setsecctx,
5782 .inode_getsecctx = selinux_inode_getsecctx,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005783
Eric Paris828dfe12008-04-17 13:17:49 -04005784 .unix_stream_connect = selinux_socket_unix_stream_connect,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005785 .unix_may_send = selinux_socket_unix_may_send,
5786
5787 .socket_create = selinux_socket_create,
5788 .socket_post_create = selinux_socket_post_create,
5789 .socket_bind = selinux_socket_bind,
5790 .socket_connect = selinux_socket_connect,
5791 .socket_listen = selinux_socket_listen,
5792 .socket_accept = selinux_socket_accept,
5793 .socket_sendmsg = selinux_socket_sendmsg,
5794 .socket_recvmsg = selinux_socket_recvmsg,
5795 .socket_getsockname = selinux_socket_getsockname,
5796 .socket_getpeername = selinux_socket_getpeername,
5797 .socket_getsockopt = selinux_socket_getsockopt,
5798 .socket_setsockopt = selinux_socket_setsockopt,
5799 .socket_shutdown = selinux_socket_shutdown,
5800 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005801 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5802 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005803 .sk_alloc_security = selinux_sk_alloc_security,
5804 .sk_free_security = selinux_sk_free_security,
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005805 .sk_clone_security = selinux_sk_clone_security,
Eric Paris828dfe12008-04-17 13:17:49 -04005806 .sk_getsecid = selinux_sk_getsecid,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005807 .sock_graft = selinux_sock_graft,
5808 .inet_conn_request = selinux_inet_conn_request,
5809 .inet_csk_clone = selinux_inet_csk_clone,
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005810 .inet_conn_established = selinux_inet_conn_established,
Eric Paris2606fd12010-10-13 16:24:41 -04005811 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5812 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5813 .secmark_refcount_dec = selinux_secmark_refcount_dec,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005814 .req_classify_flow = selinux_req_classify_flow,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005815 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5816 .tun_dev_free_security = selinux_tun_dev_free_security,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005817 .tun_dev_create = selinux_tun_dev_create,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005818 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005819 .tun_dev_attach = selinux_tun_dev_attach,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005820 .tun_dev_open = selinux_tun_dev_open,
Eric Dumazetca10b9e2013-04-08 17:58:11 +00005821 .skb_owned_by = selinux_skb_owned_by,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005822
5823#ifdef CONFIG_SECURITY_NETWORK_XFRM
5824 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5825 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5826 .xfrm_policy_free_security = selinux_xfrm_policy_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005827 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
Paul Moore2e5aa862013-07-23 17:38:38 -04005828 .xfrm_state_alloc = selinux_xfrm_state_alloc,
5829 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005830 .xfrm_state_free_security = selinux_xfrm_state_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005831 .xfrm_state_delete_security = selinux_xfrm_state_delete,
Eric Paris828dfe12008-04-17 13:17:49 -04005832 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005833 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005834 .xfrm_decode_session = selinux_xfrm_decode_session,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005835#endif
Michael LeMayd7200242006-06-22 14:47:17 -07005836
5837#ifdef CONFIG_KEYS
Eric Paris828dfe12008-04-17 13:17:49 -04005838 .key_alloc = selinux_key_alloc,
5839 .key_free = selinux_key_free,
5840 .key_permission = selinux_key_permission,
David Howells70a5bb72008-04-29 01:01:26 -07005841 .key_getsecurity = selinux_key_getsecurity,
Michael LeMayd7200242006-06-22 14:47:17 -07005842#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02005843
5844#ifdef CONFIG_AUDIT
5845 .audit_rule_init = selinux_audit_rule_init,
5846 .audit_rule_known = selinux_audit_rule_known,
5847 .audit_rule_match = selinux_audit_rule_match,
5848 .audit_rule_free = selinux_audit_rule_free,
5849#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07005850};
5851
5852static __init int selinux_init(void)
5853{
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005854 if (!security_module_enable(&selinux_ops)) {
5855 selinux_enabled = 0;
5856 return 0;
5857 }
5858
Linus Torvalds1da177e2005-04-16 15:20:36 -07005859 if (!selinux_enabled) {
5860 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5861 return 0;
5862 }
5863
5864 printk(KERN_INFO "SELinux: Initializing.\n");
5865
5866 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11005867 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005868
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04005869 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5870
James Morris7cae7e22006-03-22 00:09:22 -08005871 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5872 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09005873 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005874 avc_init();
5875
Eric Paris828dfe12008-04-17 13:17:49 -04005876 if (register_security(&selinux_ops))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005877 panic("SELinux: Unable to register with kernel.\n");
5878
Eric Paris828dfe12008-04-17 13:17:49 -04005879 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05005880 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04005881 else
Eric Parisfadcdb42007-02-22 18:11:31 -05005882 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07005883
Linus Torvalds1da177e2005-04-16 15:20:36 -07005884 return 0;
5885}
5886
Al Viroe8c26252010-03-23 06:36:54 -04005887static void delayed_superblock_init(struct super_block *sb, void *unused)
5888{
5889 superblock_doinit(sb, NULL);
5890}
5891
Linus Torvalds1da177e2005-04-16 15:20:36 -07005892void selinux_complete_init(void)
5893{
Eric Parisfadcdb42007-02-22 18:11:31 -05005894 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005895
5896 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05005897 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04005898 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005899}
5900
5901/* SELinux requires early initialization in order to label
5902 all processes and objects when they are created. */
5903security_initcall(selinux_init);
5904
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005905#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005906
Paul Mooreeffad8d2008-01-29 08:49:27 -05005907static struct nf_hook_ops selinux_ipv4_ops[] = {
5908 {
5909 .hook = selinux_ipv4_postroute,
5910 .owner = THIS_MODULE,
Alban Crequy2597a832012-05-14 03:56:39 +00005911 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005912 .hooknum = NF_INET_POST_ROUTING,
5913 .priority = NF_IP_PRI_SELINUX_LAST,
5914 },
5915 {
5916 .hook = selinux_ipv4_forward,
5917 .owner = THIS_MODULE,
Alban Crequy2597a832012-05-14 03:56:39 +00005918 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005919 .hooknum = NF_INET_FORWARD,
5920 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04005921 },
5922 {
5923 .hook = selinux_ipv4_output,
5924 .owner = THIS_MODULE,
Alban Crequy2597a832012-05-14 03:56:39 +00005925 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04005926 .hooknum = NF_INET_LOCAL_OUT,
5927 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005928 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005929};
5930
5931#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5932
Paul Mooreeffad8d2008-01-29 08:49:27 -05005933static struct nf_hook_ops selinux_ipv6_ops[] = {
5934 {
5935 .hook = selinux_ipv6_postroute,
5936 .owner = THIS_MODULE,
Alban Crequy2597a832012-05-14 03:56:39 +00005937 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005938 .hooknum = NF_INET_POST_ROUTING,
5939 .priority = NF_IP6_PRI_SELINUX_LAST,
5940 },
5941 {
5942 .hook = selinux_ipv6_forward,
5943 .owner = THIS_MODULE,
Alban Crequy2597a832012-05-14 03:56:39 +00005944 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005945 .hooknum = NF_INET_FORWARD,
5946 .priority = NF_IP6_PRI_SELINUX_FIRST,
5947 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005948};
5949
5950#endif /* IPV6 */
5951
5952static int __init selinux_nf_ip_init(void)
5953{
5954 int err = 0;
5955
5956 if (!selinux_enabled)
5957 goto out;
Eric Parisfadcdb42007-02-22 18:11:31 -05005958
5959 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5960
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005961 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5962 if (err)
5963 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005964
5965#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005966 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5967 if (err)
5968 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005969#endif /* IPV6 */
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005970
Linus Torvalds1da177e2005-04-16 15:20:36 -07005971out:
5972 return err;
5973}
5974
5975__initcall(selinux_nf_ip_init);
5976
5977#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5978static void selinux_nf_ip_exit(void)
5979{
Eric Parisfadcdb42007-02-22 18:11:31 -05005980 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005981
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005982 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005983#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005984 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005985#endif /* IPV6 */
5986}
5987#endif
5988
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005989#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005990
5991#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5992#define selinux_nf_ip_exit()
5993#endif
5994
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005995#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005996
5997#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04005998static int selinux_disabled;
5999
Linus Torvalds1da177e2005-04-16 15:20:36 -07006000int selinux_disable(void)
6001{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006002 if (ss_initialized) {
6003 /* Not permitted after initial policy load. */
6004 return -EINVAL;
6005 }
6006
6007 if (selinux_disabled) {
6008 /* Only do this once. */
6009 return -EINVAL;
6010 }
6011
6012 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6013
6014 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04006015 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006016
wzt.wzt@gmail.com189b3b12010-02-23 23:15:28 +08006017 reset_security_ops();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006018
Eric Parisaf8ff042009-09-20 21:23:01 -04006019 /* Try to destroy the avc node cache */
6020 avc_disable();
6021
Linus Torvalds1da177e2005-04-16 15:20:36 -07006022 /* Unregister netfilter hooks. */
6023 selinux_nf_ip_exit();
6024
6025 /* Unregister selinuxfs. */
6026 exit_sel_fs();
6027
6028 return 0;
6029}
6030#endif