blob: ad8dd4e8657e5487bd7668328238c166248176da [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
Venkat Yekkirala7420ed22006-08-04 23:17:57 -070015 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
Linus Torvalds1da177e2005-04-16 15:20:36 -070023#include <linux/module.h>
24#include <linux/init.h>
25#include <linux/kernel.h>
26#include <linux/ptrace.h>
27#include <linux/errno.h>
28#include <linux/sched.h>
29#include <linux/security.h>
30#include <linux/xattr.h>
31#include <linux/capability.h>
32#include <linux/unistd.h>
33#include <linux/mm.h>
34#include <linux/mman.h>
35#include <linux/slab.h>
36#include <linux/pagemap.h>
37#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070038#include <linux/spinlock.h>
39#include <linux/syscalls.h>
40#include <linux/file.h>
41#include <linux/namei.h>
42#include <linux/mount.h>
43#include <linux/ext2_fs.h>
44#include <linux/proc_fs.h>
45#include <linux/kd.h>
46#include <linux/netfilter_ipv4.h>
47#include <linux/netfilter_ipv6.h>
48#include <linux/tty.h>
49#include <net/icmp.h>
50#include <net/ip.h> /* for sysctl_local_port_range[] */
51#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52#include <asm/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070053#include <asm/ioctls.h>
54#include <linux/bitops.h>
55#include <linux/interrupt.h>
56#include <linux/netdevice.h> /* for network interface checks */
57#include <linux/netlink.h>
58#include <linux/tcp.h>
59#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080060#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <linux/quota.h>
62#include <linux/un.h> /* for Unix socket types */
63#include <net/af_unix.h> /* for Unix socket types */
64#include <linux/parser.h>
65#include <linux/nfs_mount.h>
66#include <net/ipv6.h>
67#include <linux/hugetlb.h>
68#include <linux/personality.h>
69#include <linux/sysctl.h>
70#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070071#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070072#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070073#include <linux/mutex.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070074
75#include "avc.h"
76#include "objsec.h"
77#include "netif.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080078#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050079#include "netlabel.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070080
81#define XATTR_SELINUX_SUFFIX "selinux"
82#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
83
84extern unsigned int policydb_loaded_version;
85extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
James Morris4e5ab4c2006-06-09 00:33:33 -070086extern int selinux_compat_net;
Linus Torvalds1da177e2005-04-16 15:20:36 -070087
88#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
89int selinux_enforcing = 0;
90
91static int __init enforcing_setup(char *str)
92{
93 selinux_enforcing = simple_strtol(str,NULL,0);
94 return 1;
95}
96__setup("enforcing=", enforcing_setup);
97#endif
98
99#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
100int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
101
102static int __init selinux_enabled_setup(char *str)
103{
104 selinux_enabled = simple_strtol(str, NULL, 0);
105 return 1;
106}
107__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400108#else
109int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110#endif
111
112/* Original (dummy) security module. */
113static struct security_operations *original_ops = NULL;
114
115/* Minimal support for a secondary security module,
116 just to allow the use of the dummy or capability modules.
117 The owlsm module can alternatively be used as a secondary
118 module as long as CONFIG_OWLSM_FD is not enabled. */
119static struct security_operations *secondary_ops = NULL;
120
121/* Lists of inode and superblock security structures initialized
122 before the policy was loaded. */
123static LIST_HEAD(superblock_security_head);
124static DEFINE_SPINLOCK(sb_security_lock);
125
Christoph Lametere18b8902006-12-06 20:33:20 -0800126static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800127
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000128/* Return security context for a given sid or just the context
129 length if the buffer is null or length is 0 */
130static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
131{
132 char *context;
133 unsigned len;
134 int rc;
135
136 rc = security_sid_to_context(sid, &context, &len);
137 if (rc)
138 return rc;
139
140 if (!buffer || !size)
141 goto getsecurity_exit;
142
143 if (size < len) {
144 len = -ERANGE;
145 goto getsecurity_exit;
146 }
147 memcpy(buffer, context, len);
148
149getsecurity_exit:
150 kfree(context);
151 return len;
152}
153
Linus Torvalds1da177e2005-04-16 15:20:36 -0700154/* Allocate and free functions for each kind of security blob. */
155
156static int task_alloc_security(struct task_struct *task)
157{
158 struct task_security_struct *tsec;
159
James Morris89d155e2005-10-30 14:59:21 -0800160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700161 if (!tsec)
162 return -ENOMEM;
163
Linus Torvalds1da177e2005-04-16 15:20:36 -0700164 tsec->task = task;
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
167
168 return 0;
169}
170
171static void task_free_security(struct task_struct *task)
172{
173 struct task_security_struct *tsec = task->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 task->security = NULL;
175 kfree(tsec);
176}
177
178static int inode_alloc_security(struct inode *inode)
179{
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
182
Robert P. J. Dayc3762222007-02-10 01:45:03 -0800183 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184 if (!isec)
185 return -ENOMEM;
186
Eric Paris23970742006-09-25 23:32:01 -0700187 mutex_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700189 isec->inode = inode;
190 isec->sid = SECINITSID_UNLABELED;
191 isec->sclass = SECCLASS_FILE;
Stephen Smalley9ac49d22006-02-01 03:05:56 -0800192 isec->task_sid = tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700193 inode->i_security = isec;
194
195 return 0;
196}
197
198static void inode_free_security(struct inode *inode)
199{
200 struct inode_security_struct *isec = inode->i_security;
201 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
202
Linus Torvalds1da177e2005-04-16 15:20:36 -0700203 spin_lock(&sbsec->isec_lock);
204 if (!list_empty(&isec->list))
205 list_del_init(&isec->list);
206 spin_unlock(&sbsec->isec_lock);
207
208 inode->i_security = NULL;
James Morris7cae7e22006-03-22 00:09:22 -0800209 kmem_cache_free(sel_inode_cache, isec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210}
211
212static int file_alloc_security(struct file *file)
213{
214 struct task_security_struct *tsec = current->security;
215 struct file_security_struct *fsec;
216
Stephen Smalley26d2a4b2006-02-01 03:05:55 -0800217 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 if (!fsec)
219 return -ENOMEM;
220
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 fsec->file = file;
Stephen Smalley9ac49d22006-02-01 03:05:56 -0800222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700224 file->f_security = fsec;
225
226 return 0;
227}
228
229static void file_free_security(struct file *file)
230{
231 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700232 file->f_security = NULL;
233 kfree(fsec);
234}
235
236static int superblock_alloc_security(struct super_block *sb)
237{
238 struct superblock_security_struct *sbsec;
239
James Morris89d155e2005-10-30 14:59:21 -0800240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700241 if (!sbsec)
242 return -ENOMEM;
243
Eric Parisbc7e9822006-09-25 23:32:02 -0700244 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 sb->s_security = sbsec;
253
254 return 0;
255}
256
257static void superblock_free_security(struct super_block *sb)
258{
259 struct superblock_security_struct *sbsec = sb->s_security;
260
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268}
269
Al Viro7d877f32005-10-21 03:20:43 -0400270static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700271{
272 struct sk_security_struct *ssec;
273
James Morris89d155e2005-10-30 14:59:21 -0800274 ssec = kzalloc(sizeof(*ssec), priority);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275 if (!ssec)
276 return -ENOMEM;
277
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
Venkat Yekkirala892c1412006-08-04 23:08:56 -0700280 ssec->sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700281 sk->sk_security = ssec;
282
Paul Moore99f59ed2006-08-29 17:53:48 -0700283 selinux_netlbl_sk_security_init(ssec, family);
284
Linus Torvalds1da177e2005-04-16 15:20:36 -0700285 return 0;
286}
287
288static void sk_free_security(struct sock *sk)
289{
290 struct sk_security_struct *ssec = sk->sk_security;
291
Linus Torvalds1da177e2005-04-16 15:20:36 -0700292 sk->sk_security = NULL;
293 kfree(ssec);
294}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700295
296/* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298extern int ss_initialized;
299
300/* The file system's label must be initialized prior to use. */
301
302static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309};
310
311static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313static inline int inode_doinit(struct inode *inode)
314{
315 return inode_doinit_with_dentry(inode, NULL);
316}
317
318enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
Eric Paris08089252006-07-10 04:43:55 -0700322 Opt_rootcontext = 8,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700323};
324
325static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
Eric Paris08089252006-07-10 04:43:55 -0700329 {Opt_rootcontext, "rootcontext=%s"},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700330};
331
332#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333
Eric Parisc312feb2006-07-10 04:43:53 -0700334static int may_context_mount_sb_relabel(u32 sid,
335 struct superblock_security_struct *sbsec,
336 struct task_security_struct *tsec)
337{
338 int rc;
339
340 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
341 FILESYSTEM__RELABELFROM, NULL);
342 if (rc)
343 return rc;
344
345 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELTO, NULL);
347 return rc;
348}
349
Eric Paris08089252006-07-10 04:43:55 -0700350static int may_context_mount_inode_relabel(u32 sid,
351 struct superblock_security_struct *sbsec,
352 struct task_security_struct *tsec)
353{
354 int rc;
355 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
356 FILESYSTEM__RELABELFROM, NULL);
357 if (rc)
358 return rc;
359
360 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
361 FILESYSTEM__ASSOCIATE, NULL);
362 return rc;
363}
364
Linus Torvalds1da177e2005-04-16 15:20:36 -0700365static int try_context_mount(struct super_block *sb, void *data)
366{
367 char *context = NULL, *defcontext = NULL;
Eric Paris08089252006-07-10 04:43:55 -0700368 char *fscontext = NULL, *rootcontext = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369 const char *name;
370 u32 sid;
371 int alloc = 0, rc = 0, seen = 0;
372 struct task_security_struct *tsec = current->security;
373 struct superblock_security_struct *sbsec = sb->s_security;
374
375 if (!data)
376 goto out;
377
378 name = sb->s_type->name;
379
380 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
381
382 /* NFS we understand. */
383 if (!strcmp(name, "nfs")) {
384 struct nfs_mount_data *d = data;
385
386 if (d->version < NFS_MOUNT_VERSION)
387 goto out;
388
389 if (d->context[0]) {
390 context = d->context;
391 seen |= Opt_context;
392 }
393 } else
394 goto out;
395
396 } else {
397 /* Standard string-based options. */
398 char *p, *options = data;
399
Cory Olmo3528a952006-09-29 01:58:44 -0700400 while ((p = strsep(&options, "|")) != NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401 int token;
402 substring_t args[MAX_OPT_ARGS];
403
404 if (!*p)
405 continue;
406
407 token = match_token(p, tokens, args);
408
409 switch (token) {
410 case Opt_context:
Eric Parisc312feb2006-07-10 04:43:53 -0700411 if (seen & (Opt_context|Opt_defcontext)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700412 rc = -EINVAL;
413 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
414 goto out_free;
415 }
416 context = match_strdup(&args[0]);
417 if (!context) {
418 rc = -ENOMEM;
419 goto out_free;
420 }
421 if (!alloc)
422 alloc = 1;
423 seen |= Opt_context;
424 break;
425
426 case Opt_fscontext:
Eric Parisc312feb2006-07-10 04:43:53 -0700427 if (seen & Opt_fscontext) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700428 rc = -EINVAL;
429 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
430 goto out_free;
431 }
Eric Parisc312feb2006-07-10 04:43:53 -0700432 fscontext = match_strdup(&args[0]);
433 if (!fscontext) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700434 rc = -ENOMEM;
435 goto out_free;
436 }
437 if (!alloc)
438 alloc = 1;
439 seen |= Opt_fscontext;
440 break;
441
Eric Paris08089252006-07-10 04:43:55 -0700442 case Opt_rootcontext:
443 if (seen & Opt_rootcontext) {
444 rc = -EINVAL;
445 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
446 goto out_free;
447 }
448 rootcontext = match_strdup(&args[0]);
449 if (!rootcontext) {
450 rc = -ENOMEM;
451 goto out_free;
452 }
453 if (!alloc)
454 alloc = 1;
455 seen |= Opt_rootcontext;
456 break;
457
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458 case Opt_defcontext:
459 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
460 rc = -EINVAL;
461 printk(KERN_WARNING "SELinux: "
462 "defcontext option is invalid "
463 "for this filesystem type\n");
464 goto out_free;
465 }
466 if (seen & (Opt_context|Opt_defcontext)) {
467 rc = -EINVAL;
468 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
469 goto out_free;
470 }
471 defcontext = match_strdup(&args[0]);
472 if (!defcontext) {
473 rc = -ENOMEM;
474 goto out_free;
475 }
476 if (!alloc)
477 alloc = 1;
478 seen |= Opt_defcontext;
479 break;
480
481 default:
482 rc = -EINVAL;
483 printk(KERN_WARNING "SELinux: unknown mount "
484 "option\n");
485 goto out_free;
486
487 }
488 }
489 }
490
491 if (!seen)
492 goto out;
493
Eric Parisc312feb2006-07-10 04:43:53 -0700494 /* sets the context of the superblock for the fs being mounted. */
495 if (fscontext) {
496 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
497 if (rc) {
498 printk(KERN_WARNING "SELinux: security_context_to_sid"
499 "(%s) failed for (dev %s, type %s) errno=%d\n",
500 fscontext, sb->s_id, name, rc);
501 goto out_free;
502 }
503
504 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
505 if (rc)
506 goto out_free;
507
508 sbsec->sid = sid;
509 }
510
511 /*
512 * Switch to using mount point labeling behavior.
513 * sets the label used on all file below the mountpoint, and will set
514 * the superblock context if not already set.
515 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700516 if (context) {
517 rc = security_context_to_sid(context, strlen(context), &sid);
518 if (rc) {
519 printk(KERN_WARNING "SELinux: security_context_to_sid"
520 "(%s) failed for (dev %s, type %s) errno=%d\n",
521 context, sb->s_id, name, rc);
522 goto out_free;
523 }
524
Eric Parisb04ea3c2006-07-14 00:24:33 -0700525 if (!fscontext) {
526 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
527 if (rc)
528 goto out_free;
Eric Parisc312feb2006-07-10 04:43:53 -0700529 sbsec->sid = sid;
Eric Parisb04ea3c2006-07-14 00:24:33 -0700530 } else {
531 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
532 if (rc)
533 goto out_free;
534 }
Eric Parisc312feb2006-07-10 04:43:53 -0700535 sbsec->mntpoint_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536
Eric Parisc312feb2006-07-10 04:43:53 -0700537 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700538 }
539
Eric Paris08089252006-07-10 04:43:55 -0700540 if (rootcontext) {
541 struct inode *inode = sb->s_root->d_inode;
542 struct inode_security_struct *isec = inode->i_security;
543 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
544 if (rc) {
545 printk(KERN_WARNING "SELinux: security_context_to_sid"
546 "(%s) failed for (dev %s, type %s) errno=%d\n",
547 rootcontext, sb->s_id, name, rc);
548 goto out_free;
549 }
550
551 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
552 if (rc)
553 goto out_free;
554
555 isec->sid = sid;
556 isec->initialized = 1;
557 }
558
Linus Torvalds1da177e2005-04-16 15:20:36 -0700559 if (defcontext) {
560 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
561 if (rc) {
562 printk(KERN_WARNING "SELinux: security_context_to_sid"
563 "(%s) failed for (dev %s, type %s) errno=%d\n",
564 defcontext, sb->s_id, name, rc);
565 goto out_free;
566 }
567
568 if (sid == sbsec->def_sid)
569 goto out_free;
570
Eric Paris08089252006-07-10 04:43:55 -0700571 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700572 if (rc)
573 goto out_free;
574
575 sbsec->def_sid = sid;
576 }
577
578out_free:
579 if (alloc) {
580 kfree(context);
581 kfree(defcontext);
Eric Parisc312feb2006-07-10 04:43:53 -0700582 kfree(fscontext);
Eric Paris08089252006-07-10 04:43:55 -0700583 kfree(rootcontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700584 }
585out:
586 return rc;
587}
588
589static int superblock_doinit(struct super_block *sb, void *data)
590{
591 struct superblock_security_struct *sbsec = sb->s_security;
592 struct dentry *root = sb->s_root;
593 struct inode *inode = root->d_inode;
594 int rc = 0;
595
Eric Parisbc7e9822006-09-25 23:32:02 -0700596 mutex_lock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700597 if (sbsec->initialized)
598 goto out;
599
600 if (!ss_initialized) {
601 /* Defer initialization until selinux_complete_init,
602 after the initial policy is loaded and the security
603 server is ready to handle calls. */
604 spin_lock(&sb_security_lock);
605 if (list_empty(&sbsec->list))
606 list_add(&sbsec->list, &superblock_security_head);
607 spin_unlock(&sb_security_lock);
608 goto out;
609 }
610
611 /* Determine the labeling behavior to use for this filesystem type. */
612 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
613 if (rc) {
614 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
615 __FUNCTION__, sb->s_type->name, rc);
616 goto out;
617 }
618
619 rc = try_context_mount(sb, data);
620 if (rc)
621 goto out;
622
623 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
624 /* Make sure that the xattr handler exists and that no
625 error other than -ENODATA is returned by getxattr on
626 the root directory. -ENODATA is ok, as this may be
627 the first boot of the SELinux kernel before we have
628 assigned xattr values to the filesystem. */
629 if (!inode->i_op->getxattr) {
630 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
631 "xattr support\n", sb->s_id, sb->s_type->name);
632 rc = -EOPNOTSUPP;
633 goto out;
634 }
635 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
636 if (rc < 0 && rc != -ENODATA) {
637 if (rc == -EOPNOTSUPP)
638 printk(KERN_WARNING "SELinux: (dev %s, type "
639 "%s) has no security xattr handler\n",
640 sb->s_id, sb->s_type->name);
641 else
642 printk(KERN_WARNING "SELinux: (dev %s, type "
643 "%s) getxattr errno %d\n", sb->s_id,
644 sb->s_type->name, -rc);
645 goto out;
646 }
647 }
648
649 if (strcmp(sb->s_type->name, "proc") == 0)
650 sbsec->proc = 1;
651
652 sbsec->initialized = 1;
653
654 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
Eric Parisfadcdb42007-02-22 18:11:31 -0500655 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700656 sb->s_id, sb->s_type->name);
657 }
658 else {
Eric Parisfadcdb42007-02-22 18:11:31 -0500659 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700660 sb->s_id, sb->s_type->name,
661 labeling_behaviors[sbsec->behavior-1]);
662 }
663
664 /* Initialize the root inode. */
665 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
666
667 /* Initialize any other inodes associated with the superblock, e.g.
668 inodes created prior to initial policy load or inodes created
669 during get_sb by a pseudo filesystem that directly
670 populates itself. */
671 spin_lock(&sbsec->isec_lock);
672next_inode:
673 if (!list_empty(&sbsec->isec_head)) {
674 struct inode_security_struct *isec =
675 list_entry(sbsec->isec_head.next,
676 struct inode_security_struct, list);
677 struct inode *inode = isec->inode;
678 spin_unlock(&sbsec->isec_lock);
679 inode = igrab(inode);
680 if (inode) {
681 if (!IS_PRIVATE (inode))
682 inode_doinit(inode);
683 iput(inode);
684 }
685 spin_lock(&sbsec->isec_lock);
686 list_del_init(&isec->list);
687 goto next_inode;
688 }
689 spin_unlock(&sbsec->isec_lock);
690out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700691 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700692 return rc;
693}
694
695static inline u16 inode_mode_to_security_class(umode_t mode)
696{
697 switch (mode & S_IFMT) {
698 case S_IFSOCK:
699 return SECCLASS_SOCK_FILE;
700 case S_IFLNK:
701 return SECCLASS_LNK_FILE;
702 case S_IFREG:
703 return SECCLASS_FILE;
704 case S_IFBLK:
705 return SECCLASS_BLK_FILE;
706 case S_IFDIR:
707 return SECCLASS_DIR;
708 case S_IFCHR:
709 return SECCLASS_CHR_FILE;
710 case S_IFIFO:
711 return SECCLASS_FIFO_FILE;
712
713 }
714
715 return SECCLASS_FILE;
716}
717
James Morris13402582005-09-30 14:24:34 -0400718static inline int default_protocol_stream(int protocol)
719{
720 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
721}
722
723static inline int default_protocol_dgram(int protocol)
724{
725 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
726}
727
Linus Torvalds1da177e2005-04-16 15:20:36 -0700728static inline u16 socket_type_to_security_class(int family, int type, int protocol)
729{
730 switch (family) {
731 case PF_UNIX:
732 switch (type) {
733 case SOCK_STREAM:
734 case SOCK_SEQPACKET:
735 return SECCLASS_UNIX_STREAM_SOCKET;
736 case SOCK_DGRAM:
737 return SECCLASS_UNIX_DGRAM_SOCKET;
738 }
739 break;
740 case PF_INET:
741 case PF_INET6:
742 switch (type) {
743 case SOCK_STREAM:
James Morris13402582005-09-30 14:24:34 -0400744 if (default_protocol_stream(protocol))
745 return SECCLASS_TCP_SOCKET;
746 else
747 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700748 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -0400749 if (default_protocol_dgram(protocol))
750 return SECCLASS_UDP_SOCKET;
751 else
752 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -0800753 case SOCK_DCCP:
754 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -0400755 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700756 return SECCLASS_RAWIP_SOCKET;
757 }
758 break;
759 case PF_NETLINK:
760 switch (protocol) {
761 case NETLINK_ROUTE:
762 return SECCLASS_NETLINK_ROUTE_SOCKET;
763 case NETLINK_FIREWALL:
764 return SECCLASS_NETLINK_FIREWALL_SOCKET;
James Morris216efaa2005-08-15 20:34:48 -0700765 case NETLINK_INET_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700766 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
767 case NETLINK_NFLOG:
768 return SECCLASS_NETLINK_NFLOG_SOCKET;
769 case NETLINK_XFRM:
770 return SECCLASS_NETLINK_XFRM_SOCKET;
771 case NETLINK_SELINUX:
772 return SECCLASS_NETLINK_SELINUX_SOCKET;
773 case NETLINK_AUDIT:
774 return SECCLASS_NETLINK_AUDIT_SOCKET;
775 case NETLINK_IP6_FW:
776 return SECCLASS_NETLINK_IP6FW_SOCKET;
777 case NETLINK_DNRTMSG:
778 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -0700779 case NETLINK_KOBJECT_UEVENT:
780 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700781 default:
782 return SECCLASS_NETLINK_SOCKET;
783 }
784 case PF_PACKET:
785 return SECCLASS_PACKET_SOCKET;
786 case PF_KEY:
787 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -0700788 case PF_APPLETALK:
789 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700790 }
791
792 return SECCLASS_SOCKET;
793}
794
795#ifdef CONFIG_PROC_FS
796static int selinux_proc_get_sid(struct proc_dir_entry *de,
797 u16 tclass,
798 u32 *sid)
799{
800 int buflen, rc;
801 char *buffer, *path, *end;
802
803 buffer = (char*)__get_free_page(GFP_KERNEL);
804 if (!buffer)
805 return -ENOMEM;
806
807 buflen = PAGE_SIZE;
808 end = buffer+buflen;
809 *--end = '\0';
810 buflen--;
811 path = end-1;
812 *path = '/';
813 while (de && de != de->parent) {
814 buflen -= de->namelen + 1;
815 if (buflen < 0)
816 break;
817 end -= de->namelen;
818 memcpy(end, de->name, de->namelen);
819 *--end = '/';
820 path = end;
821 de = de->parent;
822 }
823 rc = security_genfs_sid("proc", path, tclass, sid);
824 free_page((unsigned long)buffer);
825 return rc;
826}
827#else
828static int selinux_proc_get_sid(struct proc_dir_entry *de,
829 u16 tclass,
830 u32 *sid)
831{
832 return -EINVAL;
833}
834#endif
835
836/* The inode's security attributes must be initialized before first use. */
837static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
838{
839 struct superblock_security_struct *sbsec = NULL;
840 struct inode_security_struct *isec = inode->i_security;
841 u32 sid;
842 struct dentry *dentry;
843#define INITCONTEXTLEN 255
844 char *context = NULL;
845 unsigned len = 0;
846 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700847
848 if (isec->initialized)
849 goto out;
850
Eric Paris23970742006-09-25 23:32:01 -0700851 mutex_lock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700852 if (isec->initialized)
Eric Paris23970742006-09-25 23:32:01 -0700853 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700854
855 sbsec = inode->i_sb->s_security;
856 if (!sbsec->initialized) {
857 /* Defer initialization until selinux_complete_init,
858 after the initial policy is loaded and the security
859 server is ready to handle calls. */
860 spin_lock(&sbsec->isec_lock);
861 if (list_empty(&isec->list))
862 list_add(&isec->list, &sbsec->isec_head);
863 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -0700864 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700865 }
866
867 switch (sbsec->behavior) {
868 case SECURITY_FS_USE_XATTR:
869 if (!inode->i_op->getxattr) {
870 isec->sid = sbsec->def_sid;
871 break;
872 }
873
874 /* Need a dentry, since the xattr API requires one.
875 Life would be simpler if we could just pass the inode. */
876 if (opt_dentry) {
877 /* Called from d_instantiate or d_splice_alias. */
878 dentry = dget(opt_dentry);
879 } else {
880 /* Called from selinux_complete_init, try to find a dentry. */
881 dentry = d_find_alias(inode);
882 }
883 if (!dentry) {
884 printk(KERN_WARNING "%s: no dentry for dev=%s "
885 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
886 inode->i_ino);
Eric Paris23970742006-09-25 23:32:01 -0700887 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700888 }
889
890 len = INITCONTEXTLEN;
891 context = kmalloc(len, GFP_KERNEL);
892 if (!context) {
893 rc = -ENOMEM;
894 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -0700895 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700896 }
897 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
898 context, len);
899 if (rc == -ERANGE) {
900 /* Need a larger buffer. Query for the right size. */
901 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
902 NULL, 0);
903 if (rc < 0) {
904 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -0700905 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700906 }
907 kfree(context);
908 len = rc;
909 context = kmalloc(len, GFP_KERNEL);
910 if (!context) {
911 rc = -ENOMEM;
912 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -0700913 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700914 }
915 rc = inode->i_op->getxattr(dentry,
916 XATTR_NAME_SELINUX,
917 context, len);
918 }
919 dput(dentry);
920 if (rc < 0) {
921 if (rc != -ENODATA) {
922 printk(KERN_WARNING "%s: getxattr returned "
923 "%d for dev=%s ino=%ld\n", __FUNCTION__,
924 -rc, inode->i_sb->s_id, inode->i_ino);
925 kfree(context);
Eric Paris23970742006-09-25 23:32:01 -0700926 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700927 }
928 /* Map ENODATA to the default file SID */
929 sid = sbsec->def_sid;
930 rc = 0;
931 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -0700932 rc = security_context_to_sid_default(context, rc, &sid,
933 sbsec->def_sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700934 if (rc) {
935 printk(KERN_WARNING "%s: context_to_sid(%s) "
936 "returned %d for dev=%s ino=%ld\n",
937 __FUNCTION__, context, -rc,
938 inode->i_sb->s_id, inode->i_ino);
939 kfree(context);
940 /* Leave with the unlabeled SID */
941 rc = 0;
942 break;
943 }
944 }
945 kfree(context);
946 isec->sid = sid;
947 break;
948 case SECURITY_FS_USE_TASK:
949 isec->sid = isec->task_sid;
950 break;
951 case SECURITY_FS_USE_TRANS:
952 /* Default to the fs SID. */
953 isec->sid = sbsec->sid;
954
955 /* Try to obtain a transition SID. */
956 isec->sclass = inode_mode_to_security_class(inode->i_mode);
957 rc = security_transition_sid(isec->task_sid,
958 sbsec->sid,
959 isec->sclass,
960 &sid);
961 if (rc)
Eric Paris23970742006-09-25 23:32:01 -0700962 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700963 isec->sid = sid;
964 break;
Eric Parisc312feb2006-07-10 04:43:53 -0700965 case SECURITY_FS_USE_MNTPOINT:
966 isec->sid = sbsec->mntpoint_sid;
967 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700968 default:
Eric Parisc312feb2006-07-10 04:43:53 -0700969 /* Default to the fs superblock SID. */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700970 isec->sid = sbsec->sid;
971
972 if (sbsec->proc) {
973 struct proc_inode *proci = PROC_I(inode);
974 if (proci->pde) {
975 isec->sclass = inode_mode_to_security_class(inode->i_mode);
976 rc = selinux_proc_get_sid(proci->pde,
977 isec->sclass,
978 &sid);
979 if (rc)
Eric Paris23970742006-09-25 23:32:01 -0700980 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700981 isec->sid = sid;
982 }
983 }
984 break;
985 }
986
987 isec->initialized = 1;
988
Eric Paris23970742006-09-25 23:32:01 -0700989out_unlock:
990 mutex_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700991out:
992 if (isec->sclass == SECCLASS_FILE)
993 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700994 return rc;
995}
996
997/* Convert a Linux signal to an access vector. */
998static inline u32 signal_to_av(int sig)
999{
1000 u32 perm = 0;
1001
1002 switch (sig) {
1003 case SIGCHLD:
1004 /* Commonly granted from child to parent. */
1005 perm = PROCESS__SIGCHLD;
1006 break;
1007 case SIGKILL:
1008 /* Cannot be caught or ignored */
1009 perm = PROCESS__SIGKILL;
1010 break;
1011 case SIGSTOP:
1012 /* Cannot be caught or ignored */
1013 perm = PROCESS__SIGSTOP;
1014 break;
1015 default:
1016 /* All other signals. */
1017 perm = PROCESS__SIGNAL;
1018 break;
1019 }
1020
1021 return perm;
1022}
1023
1024/* Check permission betweeen a pair of tasks, e.g. signal checks,
1025 fork check, ptrace check, etc. */
1026static int task_has_perm(struct task_struct *tsk1,
1027 struct task_struct *tsk2,
1028 u32 perms)
1029{
1030 struct task_security_struct *tsec1, *tsec2;
1031
1032 tsec1 = tsk1->security;
1033 tsec2 = tsk2->security;
1034 return avc_has_perm(tsec1->sid, tsec2->sid,
1035 SECCLASS_PROCESS, perms, NULL);
1036}
1037
1038/* Check whether a task is allowed to use a capability. */
1039static int task_has_capability(struct task_struct *tsk,
1040 int cap)
1041{
1042 struct task_security_struct *tsec;
1043 struct avc_audit_data ad;
1044
1045 tsec = tsk->security;
1046
1047 AVC_AUDIT_DATA_INIT(&ad,CAP);
1048 ad.tsk = tsk;
1049 ad.u.cap = cap;
1050
1051 return avc_has_perm(tsec->sid, tsec->sid,
1052 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053}
1054
1055/* Check whether a task is allowed to use a system operation. */
1056static int task_has_system(struct task_struct *tsk,
1057 u32 perms)
1058{
1059 struct task_security_struct *tsec;
1060
1061 tsec = tsk->security;
1062
1063 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064 SECCLASS_SYSTEM, perms, NULL);
1065}
1066
1067/* Check whether a task has a particular permission to an inode.
1068 The 'adp' parameter is optional and allows other audit
1069 data to be passed (e.g. the dentry). */
1070static int inode_has_perm(struct task_struct *tsk,
1071 struct inode *inode,
1072 u32 perms,
1073 struct avc_audit_data *adp)
1074{
1075 struct task_security_struct *tsec;
1076 struct inode_security_struct *isec;
1077 struct avc_audit_data ad;
1078
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001079 if (unlikely (IS_PRIVATE (inode)))
1080 return 0;
1081
Linus Torvalds1da177e2005-04-16 15:20:36 -07001082 tsec = tsk->security;
1083 isec = inode->i_security;
1084
1085 if (!adp) {
1086 adp = &ad;
1087 AVC_AUDIT_DATA_INIT(&ad, FS);
1088 ad.u.fs.inode = inode;
1089 }
1090
1091 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1092}
1093
1094/* Same as inode_has_perm, but pass explicit audit data containing
1095 the dentry to help the auditing code to more easily generate the
1096 pathname if needed. */
1097static inline int dentry_has_perm(struct task_struct *tsk,
1098 struct vfsmount *mnt,
1099 struct dentry *dentry,
1100 u32 av)
1101{
1102 struct inode *inode = dentry->d_inode;
1103 struct avc_audit_data ad;
1104 AVC_AUDIT_DATA_INIT(&ad,FS);
1105 ad.u.fs.mnt = mnt;
1106 ad.u.fs.dentry = dentry;
1107 return inode_has_perm(tsk, inode, av, &ad);
1108}
1109
1110/* Check whether a task can use an open file descriptor to
1111 access an inode in a given way. Check access to the
1112 descriptor itself, and then use dentry_has_perm to
1113 check a particular permission to the file.
1114 Access to the descriptor is implicitly granted if it
1115 has the same SID as the process. If av is zero, then
1116 access to the file is not checked, e.g. for cases
1117 where only the descriptor is affected like seek. */
Arjan van de Ven858119e2006-01-14 13:20:43 -08001118static int file_has_perm(struct task_struct *tsk,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001119 struct file *file,
1120 u32 av)
1121{
1122 struct task_security_struct *tsec = tsk->security;
1123 struct file_security_struct *fsec = file->f_security;
Josef Sipek3d5ff522006-12-08 02:37:38 -08001124 struct vfsmount *mnt = file->f_path.mnt;
1125 struct dentry *dentry = file->f_path.dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001126 struct inode *inode = dentry->d_inode;
1127 struct avc_audit_data ad;
1128 int rc;
1129
1130 AVC_AUDIT_DATA_INIT(&ad, FS);
1131 ad.u.fs.mnt = mnt;
1132 ad.u.fs.dentry = dentry;
1133
1134 if (tsec->sid != fsec->sid) {
1135 rc = avc_has_perm(tsec->sid, fsec->sid,
1136 SECCLASS_FD,
1137 FD__USE,
1138 &ad);
1139 if (rc)
1140 return rc;
1141 }
1142
1143 /* av is zero if only checking access to the descriptor. */
1144 if (av)
1145 return inode_has_perm(tsk, inode, av, &ad);
1146
1147 return 0;
1148}
1149
1150/* Check whether a task can create a file. */
1151static int may_create(struct inode *dir,
1152 struct dentry *dentry,
1153 u16 tclass)
1154{
1155 struct task_security_struct *tsec;
1156 struct inode_security_struct *dsec;
1157 struct superblock_security_struct *sbsec;
1158 u32 newsid;
1159 struct avc_audit_data ad;
1160 int rc;
1161
1162 tsec = current->security;
1163 dsec = dir->i_security;
1164 sbsec = dir->i_sb->s_security;
1165
1166 AVC_AUDIT_DATA_INIT(&ad, FS);
1167 ad.u.fs.dentry = dentry;
1168
1169 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1170 DIR__ADD_NAME | DIR__SEARCH,
1171 &ad);
1172 if (rc)
1173 return rc;
1174
1175 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1176 newsid = tsec->create_sid;
1177 } else {
1178 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179 &newsid);
1180 if (rc)
1181 return rc;
1182 }
1183
1184 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185 if (rc)
1186 return rc;
1187
1188 return avc_has_perm(newsid, sbsec->sid,
1189 SECCLASS_FILESYSTEM,
1190 FILESYSTEM__ASSOCIATE, &ad);
1191}
1192
Michael LeMay4eb582c2006-06-26 00:24:57 -07001193/* Check whether a task can create a key. */
1194static int may_create_key(u32 ksid,
1195 struct task_struct *ctx)
1196{
1197 struct task_security_struct *tsec;
1198
1199 tsec = ctx->security;
1200
1201 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202}
1203
Linus Torvalds1da177e2005-04-16 15:20:36 -07001204#define MAY_LINK 0
1205#define MAY_UNLINK 1
1206#define MAY_RMDIR 2
1207
1208/* Check whether a task can link, unlink, or rmdir a file/directory. */
1209static int may_link(struct inode *dir,
1210 struct dentry *dentry,
1211 int kind)
1212
1213{
1214 struct task_security_struct *tsec;
1215 struct inode_security_struct *dsec, *isec;
1216 struct avc_audit_data ad;
1217 u32 av;
1218 int rc;
1219
1220 tsec = current->security;
1221 dsec = dir->i_security;
1222 isec = dentry->d_inode->i_security;
1223
1224 AVC_AUDIT_DATA_INIT(&ad, FS);
1225 ad.u.fs.dentry = dentry;
1226
1227 av = DIR__SEARCH;
1228 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1229 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1230 if (rc)
1231 return rc;
1232
1233 switch (kind) {
1234 case MAY_LINK:
1235 av = FILE__LINK;
1236 break;
1237 case MAY_UNLINK:
1238 av = FILE__UNLINK;
1239 break;
1240 case MAY_RMDIR:
1241 av = DIR__RMDIR;
1242 break;
1243 default:
1244 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1245 return 0;
1246 }
1247
1248 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249 return rc;
1250}
1251
1252static inline int may_rename(struct inode *old_dir,
1253 struct dentry *old_dentry,
1254 struct inode *new_dir,
1255 struct dentry *new_dentry)
1256{
1257 struct task_security_struct *tsec;
1258 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1259 struct avc_audit_data ad;
1260 u32 av;
1261 int old_is_dir, new_is_dir;
1262 int rc;
1263
1264 tsec = current->security;
1265 old_dsec = old_dir->i_security;
1266 old_isec = old_dentry->d_inode->i_security;
1267 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1268 new_dsec = new_dir->i_security;
1269
1270 AVC_AUDIT_DATA_INIT(&ad, FS);
1271
1272 ad.u.fs.dentry = old_dentry;
1273 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1274 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1275 if (rc)
1276 return rc;
1277 rc = avc_has_perm(tsec->sid, old_isec->sid,
1278 old_isec->sclass, FILE__RENAME, &ad);
1279 if (rc)
1280 return rc;
1281 if (old_is_dir && new_dir != old_dir) {
1282 rc = avc_has_perm(tsec->sid, old_isec->sid,
1283 old_isec->sclass, DIR__REPARENT, &ad);
1284 if (rc)
1285 return rc;
1286 }
1287
1288 ad.u.fs.dentry = new_dentry;
1289 av = DIR__ADD_NAME | DIR__SEARCH;
1290 if (new_dentry->d_inode)
1291 av |= DIR__REMOVE_NAME;
1292 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1293 if (rc)
1294 return rc;
1295 if (new_dentry->d_inode) {
1296 new_isec = new_dentry->d_inode->i_security;
1297 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1298 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299 new_isec->sclass,
1300 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1301 if (rc)
1302 return rc;
1303 }
1304
1305 return 0;
1306}
1307
1308/* Check whether a task can perform a filesystem operation. */
1309static int superblock_has_perm(struct task_struct *tsk,
1310 struct super_block *sb,
1311 u32 perms,
1312 struct avc_audit_data *ad)
1313{
1314 struct task_security_struct *tsec;
1315 struct superblock_security_struct *sbsec;
1316
1317 tsec = tsk->security;
1318 sbsec = sb->s_security;
1319 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320 perms, ad);
1321}
1322
1323/* Convert a Linux mode and permission mask to an access vector. */
1324static inline u32 file_mask_to_av(int mode, int mask)
1325{
1326 u32 av = 0;
1327
1328 if ((mode & S_IFMT) != S_IFDIR) {
1329 if (mask & MAY_EXEC)
1330 av |= FILE__EXECUTE;
1331 if (mask & MAY_READ)
1332 av |= FILE__READ;
1333
1334 if (mask & MAY_APPEND)
1335 av |= FILE__APPEND;
1336 else if (mask & MAY_WRITE)
1337 av |= FILE__WRITE;
1338
1339 } else {
1340 if (mask & MAY_EXEC)
1341 av |= DIR__SEARCH;
1342 if (mask & MAY_WRITE)
1343 av |= DIR__WRITE;
1344 if (mask & MAY_READ)
1345 av |= DIR__READ;
1346 }
1347
1348 return av;
1349}
1350
1351/* Convert a Linux file to an access vector. */
1352static inline u32 file_to_av(struct file *file)
1353{
1354 u32 av = 0;
1355
1356 if (file->f_mode & FMODE_READ)
1357 av |= FILE__READ;
1358 if (file->f_mode & FMODE_WRITE) {
1359 if (file->f_flags & O_APPEND)
1360 av |= FILE__APPEND;
1361 else
1362 av |= FILE__WRITE;
1363 }
1364
1365 return av;
1366}
1367
Linus Torvalds1da177e2005-04-16 15:20:36 -07001368/* Hook functions begin here. */
1369
1370static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371{
1372 struct task_security_struct *psec = parent->security;
1373 struct task_security_struct *csec = child->security;
1374 int rc;
1375
1376 rc = secondary_ops->ptrace(parent,child);
1377 if (rc)
1378 return rc;
1379
1380 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1381 /* Save the SID of the tracing process for later use in apply_creds. */
Stephen Smalley341c2d82006-03-11 03:27:16 -08001382 if (!(child->ptrace & PT_PTRACED) && !rc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001383 csec->ptrace_sid = psec->sid;
1384 return rc;
1385}
1386
1387static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1388 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1389{
1390 int error;
1391
1392 error = task_has_perm(current, target, PROCESS__GETCAP);
1393 if (error)
1394 return error;
1395
1396 return secondary_ops->capget(target, effective, inheritable, permitted);
1397}
1398
1399static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1400 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401{
1402 int error;
1403
1404 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1405 if (error)
1406 return error;
1407
1408 return task_has_perm(current, target, PROCESS__SETCAP);
1409}
1410
1411static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1412 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413{
1414 secondary_ops->capset_set(target, effective, inheritable, permitted);
1415}
1416
1417static int selinux_capable(struct task_struct *tsk, int cap)
1418{
1419 int rc;
1420
1421 rc = secondary_ops->capable(tsk, cap);
1422 if (rc)
1423 return rc;
1424
1425 return task_has_capability(tsk,cap);
1426}
1427
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001428static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1429{
1430 int buflen, rc;
1431 char *buffer, *path, *end;
1432
1433 rc = -ENOMEM;
1434 buffer = (char*)__get_free_page(GFP_KERNEL);
1435 if (!buffer)
1436 goto out;
1437
1438 buflen = PAGE_SIZE;
1439 end = buffer+buflen;
1440 *--end = '\0';
1441 buflen--;
1442 path = end-1;
1443 *path = '/';
1444 while (table) {
1445 const char *name = table->procname;
1446 size_t namelen = strlen(name);
1447 buflen -= namelen + 1;
1448 if (buflen < 0)
1449 goto out_free;
1450 end -= namelen;
1451 memcpy(end, name, namelen);
1452 *--end = '/';
1453 path = end;
1454 table = table->parent;
1455 }
Eric W. Biedermanb599fdf2007-02-14 00:34:15 -08001456 buflen -= 4;
1457 if (buflen < 0)
1458 goto out_free;
1459 end -= 4;
1460 memcpy(end, "/sys", 4);
1461 path = end;
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001462 rc = security_genfs_sid("proc", path, tclass, sid);
1463out_free:
1464 free_page((unsigned long)buffer);
1465out:
1466 return rc;
1467}
1468
Linus Torvalds1da177e2005-04-16 15:20:36 -07001469static int selinux_sysctl(ctl_table *table, int op)
1470{
1471 int error = 0;
1472 u32 av;
1473 struct task_security_struct *tsec;
1474 u32 tsid;
1475 int rc;
1476
1477 rc = secondary_ops->sysctl(table, op);
1478 if (rc)
1479 return rc;
1480
1481 tsec = current->security;
1482
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001483 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1484 SECCLASS_DIR : SECCLASS_FILE, &tsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001485 if (rc) {
1486 /* Default to the well-defined sysctl SID. */
1487 tsid = SECINITSID_SYSCTL;
1488 }
1489
1490 /* The op values are "defined" in sysctl.c, thereby creating
1491 * a bad coupling between this module and sysctl.c */
1492 if(op == 001) {
1493 error = avc_has_perm(tsec->sid, tsid,
1494 SECCLASS_DIR, DIR__SEARCH, NULL);
1495 } else {
1496 av = 0;
1497 if (op & 004)
1498 av |= FILE__READ;
1499 if (op & 002)
1500 av |= FILE__WRITE;
1501 if (av)
1502 error = avc_has_perm(tsec->sid, tsid,
1503 SECCLASS_FILE, av, NULL);
1504 }
1505
1506 return error;
1507}
1508
1509static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1510{
1511 int rc = 0;
1512
1513 if (!sb)
1514 return 0;
1515
1516 switch (cmds) {
1517 case Q_SYNC:
1518 case Q_QUOTAON:
1519 case Q_QUOTAOFF:
1520 case Q_SETINFO:
1521 case Q_SETQUOTA:
1522 rc = superblock_has_perm(current,
1523 sb,
1524 FILESYSTEM__QUOTAMOD, NULL);
1525 break;
1526 case Q_GETFMT:
1527 case Q_GETINFO:
1528 case Q_GETQUOTA:
1529 rc = superblock_has_perm(current,
1530 sb,
1531 FILESYSTEM__QUOTAGET, NULL);
1532 break;
1533 default:
1534 rc = 0; /* let the kernel handle invalid cmds */
1535 break;
1536 }
1537 return rc;
1538}
1539
1540static int selinux_quota_on(struct dentry *dentry)
1541{
1542 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1543}
1544
1545static int selinux_syslog(int type)
1546{
1547 int rc;
1548
1549 rc = secondary_ops->syslog(type);
1550 if (rc)
1551 return rc;
1552
1553 switch (type) {
1554 case 3: /* Read last kernel messages */
1555 case 10: /* Return size of the log buffer */
1556 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1557 break;
1558 case 6: /* Disable logging to console */
1559 case 7: /* Enable logging to console */
1560 case 8: /* Set level of messages printed to console */
1561 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1562 break;
1563 case 0: /* Close log */
1564 case 1: /* Open log */
1565 case 2: /* Read from log */
1566 case 4: /* Read/clear last kernel messages */
1567 case 5: /* Clear ring buffer */
1568 default:
1569 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1570 break;
1571 }
1572 return rc;
1573}
1574
1575/*
1576 * Check that a process has enough memory to allocate a new virtual
1577 * mapping. 0 means there is enough memory for the allocation to
1578 * succeed and -ENOMEM implies there is not.
1579 *
1580 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1581 * if the capability is granted, but __vm_enough_memory requires 1 if
1582 * the capability is granted.
1583 *
1584 * Do not audit the selinux permission check, as this is applied to all
1585 * processes that allocate mappings.
1586 */
1587static int selinux_vm_enough_memory(long pages)
1588{
1589 int rc, cap_sys_admin = 0;
1590 struct task_security_struct *tsec = current->security;
1591
1592 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1593 if (rc == 0)
1594 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1595 SECCLASS_CAPABILITY,
1596 CAP_TO_MASK(CAP_SYS_ADMIN),
1597 NULL);
1598
1599 if (rc == 0)
1600 cap_sys_admin = 1;
1601
1602 return __vm_enough_memory(pages, cap_sys_admin);
1603}
1604
1605/* binprm security operations */
1606
1607static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1608{
1609 struct bprm_security_struct *bsec;
1610
James Morris89d155e2005-10-30 14:59:21 -08001611 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001612 if (!bsec)
1613 return -ENOMEM;
1614
Linus Torvalds1da177e2005-04-16 15:20:36 -07001615 bsec->bprm = bprm;
1616 bsec->sid = SECINITSID_UNLABELED;
1617 bsec->set = 0;
1618
1619 bprm->security = bsec;
1620 return 0;
1621}
1622
1623static int selinux_bprm_set_security(struct linux_binprm *bprm)
1624{
1625 struct task_security_struct *tsec;
Josef Sipek3d5ff522006-12-08 02:37:38 -08001626 struct inode *inode = bprm->file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001627 struct inode_security_struct *isec;
1628 struct bprm_security_struct *bsec;
1629 u32 newsid;
1630 struct avc_audit_data ad;
1631 int rc;
1632
1633 rc = secondary_ops->bprm_set_security(bprm);
1634 if (rc)
1635 return rc;
1636
1637 bsec = bprm->security;
1638
1639 if (bsec->set)
1640 return 0;
1641
1642 tsec = current->security;
1643 isec = inode->i_security;
1644
1645 /* Default to the current task SID. */
1646 bsec->sid = tsec->sid;
1647
Michael LeMay28eba5b2006-06-27 02:53:42 -07001648 /* Reset fs, key, and sock SIDs on execve. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001649 tsec->create_sid = 0;
Michael LeMay28eba5b2006-06-27 02:53:42 -07001650 tsec->keycreate_sid = 0;
Eric Paris42c3e032006-06-26 00:26:03 -07001651 tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001652
1653 if (tsec->exec_sid) {
1654 newsid = tsec->exec_sid;
1655 /* Reset exec SID on execve. */
1656 tsec->exec_sid = 0;
1657 } else {
1658 /* Check for a default transition on this program. */
1659 rc = security_transition_sid(tsec->sid, isec->sid,
1660 SECCLASS_PROCESS, &newsid);
1661 if (rc)
1662 return rc;
1663 }
1664
1665 AVC_AUDIT_DATA_INIT(&ad, FS);
Josef Sipek3d5ff522006-12-08 02:37:38 -08001666 ad.u.fs.mnt = bprm->file->f_path.mnt;
1667 ad.u.fs.dentry = bprm->file->f_path.dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001668
Josef Sipek3d5ff522006-12-08 02:37:38 -08001669 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001670 newsid = tsec->sid;
1671
1672 if (tsec->sid == newsid) {
1673 rc = avc_has_perm(tsec->sid, isec->sid,
1674 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1675 if (rc)
1676 return rc;
1677 } else {
1678 /* Check permissions for the transition. */
1679 rc = avc_has_perm(tsec->sid, newsid,
1680 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1681 if (rc)
1682 return rc;
1683
1684 rc = avc_has_perm(newsid, isec->sid,
1685 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1686 if (rc)
1687 return rc;
1688
1689 /* Clear any possibly unsafe personality bits on exec: */
1690 current->personality &= ~PER_CLEAR_ON_SETID;
1691
1692 /* Set the security field to the new SID. */
1693 bsec->sid = newsid;
1694 }
1695
1696 bsec->set = 1;
1697 return 0;
1698}
1699
1700static int selinux_bprm_check_security (struct linux_binprm *bprm)
1701{
1702 return secondary_ops->bprm_check_security(bprm);
1703}
1704
1705
1706static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1707{
1708 struct task_security_struct *tsec = current->security;
1709 int atsecure = 0;
1710
1711 if (tsec->osid != tsec->sid) {
1712 /* Enable secure mode for SIDs transitions unless
1713 the noatsecure permission is granted between
1714 the two SIDs, i.e. ahp returns 0. */
1715 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1716 SECCLASS_PROCESS,
1717 PROCESS__NOATSECURE, NULL);
1718 }
1719
1720 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1721}
1722
1723static void selinux_bprm_free_security(struct linux_binprm *bprm)
1724{
Jesper Juhl9a5f04b2005-06-25 14:58:51 -07001725 kfree(bprm->security);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001726 bprm->security = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001727}
1728
1729extern struct vfsmount *selinuxfs_mount;
1730extern struct dentry *selinux_null;
1731
1732/* Derived from fs/exec.c:flush_old_files. */
1733static inline void flush_unauthorized_files(struct files_struct * files)
1734{
1735 struct avc_audit_data ad;
1736 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07001737 struct tty_struct *tty;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07001738 struct fdtable *fdt;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001739 long j = -1;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001740 int drop_tty = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001741
Stephen Smalleyb20c8122006-09-25 23:32:03 -07001742 mutex_lock(&tty_mutex);
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001743 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001744 if (tty) {
1745 file_list_lock();
Eric Dumazet2f512012005-10-30 15:02:16 -08001746 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001747 if (file) {
1748 /* Revalidate access to controlling tty.
1749 Use inode_has_perm on the tty inode directly rather
1750 than using file_has_perm, as this particular open
1751 file may belong to another process and we are only
1752 interested in the inode-based check here. */
Josef Sipek3d5ff522006-12-08 02:37:38 -08001753 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001754 if (inode_has_perm(current, inode,
1755 FILE__READ | FILE__WRITE, NULL)) {
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001756 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001757 }
1758 }
1759 file_list_unlock();
1760 }
Stephen Smalleyb20c8122006-09-25 23:32:03 -07001761 mutex_unlock(&tty_mutex);
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07001762 /* Reset controlling tty. */
1763 if (drop_tty)
1764 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001765
1766 /* Revalidate access to inherited open files. */
1767
1768 AVC_AUDIT_DATA_INIT(&ad,FS);
1769
1770 spin_lock(&files->file_lock);
1771 for (;;) {
1772 unsigned long set, i;
1773 int fd;
1774
1775 j++;
1776 i = j * __NFDBITS;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07001777 fdt = files_fdtable(files);
Vadim Lobanovbbea9f62006-12-10 02:21:12 -08001778 if (i >= fdt->max_fds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001779 break;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07001780 set = fdt->open_fds->fds_bits[j];
Linus Torvalds1da177e2005-04-16 15:20:36 -07001781 if (!set)
1782 continue;
1783 spin_unlock(&files->file_lock);
1784 for ( ; set ; i++,set >>= 1) {
1785 if (set & 1) {
1786 file = fget(i);
1787 if (!file)
1788 continue;
1789 if (file_has_perm(current,
1790 file,
1791 file_to_av(file))) {
1792 sys_close(i);
1793 fd = get_unused_fd();
1794 if (fd != i) {
1795 if (fd >= 0)
1796 put_unused_fd(fd);
1797 fput(file);
1798 continue;
1799 }
1800 if (devnull) {
Nick Piggin095975d2006-01-08 01:02:19 -08001801 get_file(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001802 } else {
1803 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
Akinobu Mitafc5d81e2006-11-27 15:16:48 +09001804 if (IS_ERR(devnull)) {
1805 devnull = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001806 put_unused_fd(fd);
1807 fput(file);
1808 continue;
1809 }
1810 }
1811 fd_install(fd, devnull);
1812 }
1813 fput(file);
1814 }
1815 }
1816 spin_lock(&files->file_lock);
1817
1818 }
1819 spin_unlock(&files->file_lock);
1820}
1821
1822static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1823{
1824 struct task_security_struct *tsec;
1825 struct bprm_security_struct *bsec;
1826 u32 sid;
1827 int rc;
1828
1829 secondary_ops->bprm_apply_creds(bprm, unsafe);
1830
1831 tsec = current->security;
1832
1833 bsec = bprm->security;
1834 sid = bsec->sid;
1835
1836 tsec->osid = tsec->sid;
1837 bsec->unsafe = 0;
1838 if (tsec->sid != sid) {
1839 /* Check for shared state. If not ok, leave SID
1840 unchanged and kill. */
1841 if (unsafe & LSM_UNSAFE_SHARE) {
1842 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1843 PROCESS__SHARE, NULL);
1844 if (rc) {
1845 bsec->unsafe = 1;
1846 return;
1847 }
1848 }
1849
1850 /* Check for ptracing, and update the task SID if ok.
1851 Otherwise, leave SID unchanged and kill. */
1852 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1853 rc = avc_has_perm(tsec->ptrace_sid, sid,
1854 SECCLASS_PROCESS, PROCESS__PTRACE,
1855 NULL);
1856 if (rc) {
1857 bsec->unsafe = 1;
1858 return;
1859 }
1860 }
1861 tsec->sid = sid;
1862 }
1863}
1864
1865/*
1866 * called after apply_creds without the task lock held
1867 */
1868static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1869{
1870 struct task_security_struct *tsec;
1871 struct rlimit *rlim, *initrlim;
1872 struct itimerval itimer;
1873 struct bprm_security_struct *bsec;
1874 int rc, i;
1875
1876 tsec = current->security;
1877 bsec = bprm->security;
1878
1879 if (bsec->unsafe) {
1880 force_sig_specific(SIGKILL, current);
1881 return;
1882 }
1883 if (tsec->osid == tsec->sid)
1884 return;
1885
1886 /* Close files for which the new task SID is not authorized. */
1887 flush_unauthorized_files(current->files);
1888
1889 /* Check whether the new SID can inherit signal state
1890 from the old SID. If not, clear itimers to avoid
1891 subsequent signal generation and flush and unblock
1892 signals. This must occur _after_ the task SID has
1893 been updated so that any kill done after the flush
1894 will be checked against the new SID. */
1895 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1896 PROCESS__SIGINH, NULL);
1897 if (rc) {
1898 memset(&itimer, 0, sizeof itimer);
1899 for (i = 0; i < 3; i++)
1900 do_setitimer(i, &itimer, NULL);
1901 flush_signals(current);
1902 spin_lock_irq(&current->sighand->siglock);
1903 flush_signal_handlers(current, 1);
1904 sigemptyset(&current->blocked);
1905 recalc_sigpending();
1906 spin_unlock_irq(&current->sighand->siglock);
1907 }
1908
1909 /* Check whether the new SID can inherit resource limits
1910 from the old SID. If not, reset all soft limits to
1911 the lower of the current task's hard limit and the init
1912 task's soft limit. Note that the setting of hard limits
1913 (even to lower them) can be controlled by the setrlimit
1914 check. The inclusion of the init task's soft limit into
1915 the computation is to avoid resetting soft limits higher
1916 than the default soft limit for cases where the default
1917 is lower than the hard limit, e.g. RLIMIT_CORE or
1918 RLIMIT_STACK.*/
1919 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1920 PROCESS__RLIMITINH, NULL);
1921 if (rc) {
1922 for (i = 0; i < RLIM_NLIMITS; i++) {
1923 rlim = current->signal->rlim + i;
1924 initrlim = init_task.signal->rlim+i;
1925 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1926 }
1927 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1928 /*
1929 * This will cause RLIMIT_CPU calculations
1930 * to be refigured.
1931 */
1932 current->it_prof_expires = jiffies_to_cputime(1);
1933 }
1934 }
1935
1936 /* Wake up the parent if it is waiting so that it can
1937 recheck wait permission to the new task SID. */
1938 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1939}
1940
1941/* superblock security operations */
1942
1943static int selinux_sb_alloc_security(struct super_block *sb)
1944{
1945 return superblock_alloc_security(sb);
1946}
1947
1948static void selinux_sb_free_security(struct super_block *sb)
1949{
1950 superblock_free_security(sb);
1951}
1952
1953static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1954{
1955 if (plen > olen)
1956 return 0;
1957
1958 return !memcmp(prefix, option, plen);
1959}
1960
1961static inline int selinux_option(char *option, int len)
1962{
1963 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1964 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
Eric Paris08089252006-07-10 04:43:55 -07001965 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1966 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001967}
1968
1969static inline void take_option(char **to, char *from, int *first, int len)
1970{
1971 if (!*first) {
1972 **to = ',';
1973 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07001974 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07001975 *first = 0;
1976 memcpy(*to, from, len);
1977 *to += len;
1978}
1979
Cory Olmo3528a952006-09-29 01:58:44 -07001980static inline void take_selinux_option(char **to, char *from, int *first,
1981 int len)
1982{
1983 int current_size = 0;
1984
1985 if (!*first) {
1986 **to = '|';
1987 *to += 1;
1988 }
1989 else
1990 *first = 0;
1991
1992 while (current_size < len) {
1993 if (*from != '"') {
1994 **to = *from;
1995 *to += 1;
1996 }
1997 from += 1;
1998 current_size += 1;
1999 }
2000}
2001
Linus Torvalds1da177e2005-04-16 15:20:36 -07002002static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2003{
2004 int fnosec, fsec, rc = 0;
2005 char *in_save, *in_curr, *in_end;
2006 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002007 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002008
2009 in_curr = orig;
2010 sec_curr = copy;
2011
2012 /* Binary mount data: just copy */
2013 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2014 copy_page(sec_curr, in_curr);
2015 goto out;
2016 }
2017
2018 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2019 if (!nosec) {
2020 rc = -ENOMEM;
2021 goto out;
2022 }
2023
2024 nosec_save = nosec;
2025 fnosec = fsec = 1;
2026 in_save = in_end = orig;
2027
2028 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002029 if (*in_end == '"')
2030 open_quote = !open_quote;
2031 if ((*in_end == ',' && open_quote == 0) ||
2032 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002033 int len = in_end - in_curr;
2034
2035 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002036 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002037 else
2038 take_option(&nosec, in_curr, &fnosec, len);
2039
2040 in_curr = in_end + 1;
2041 }
2042 } while (*in_end++);
2043
Eric Paris6931dfc2005-06-30 02:58:51 -07002044 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002045 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046out:
2047 return rc;
2048}
2049
2050static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2051{
2052 struct avc_audit_data ad;
2053 int rc;
2054
2055 rc = superblock_doinit(sb, data);
2056 if (rc)
2057 return rc;
2058
2059 AVC_AUDIT_DATA_INIT(&ad,FS);
2060 ad.u.fs.dentry = sb->s_root;
2061 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2062}
2063
David Howells726c3342006-06-23 02:02:58 -07002064static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002065{
2066 struct avc_audit_data ad;
2067
2068 AVC_AUDIT_DATA_INIT(&ad,FS);
David Howells726c3342006-06-23 02:02:58 -07002069 ad.u.fs.dentry = dentry->d_sb->s_root;
2070 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002071}
2072
2073static int selinux_mount(char * dev_name,
2074 struct nameidata *nd,
2075 char * type,
2076 unsigned long flags,
2077 void * data)
2078{
2079 int rc;
2080
2081 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2082 if (rc)
2083 return rc;
2084
2085 if (flags & MS_REMOUNT)
2086 return superblock_has_perm(current, nd->mnt->mnt_sb,
2087 FILESYSTEM__REMOUNT, NULL);
2088 else
2089 return dentry_has_perm(current, nd->mnt, nd->dentry,
2090 FILE__MOUNTON);
2091}
2092
2093static int selinux_umount(struct vfsmount *mnt, int flags)
2094{
2095 int rc;
2096
2097 rc = secondary_ops->sb_umount(mnt, flags);
2098 if (rc)
2099 return rc;
2100
2101 return superblock_has_perm(current,mnt->mnt_sb,
2102 FILESYSTEM__UNMOUNT,NULL);
2103}
2104
2105/* inode security operations */
2106
2107static int selinux_inode_alloc_security(struct inode *inode)
2108{
2109 return inode_alloc_security(inode);
2110}
2111
2112static void selinux_inode_free_security(struct inode *inode)
2113{
2114 inode_free_security(inode);
2115}
2116
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002117static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2118 char **name, void **value,
2119 size_t *len)
2120{
2121 struct task_security_struct *tsec;
2122 struct inode_security_struct *dsec;
2123 struct superblock_security_struct *sbsec;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002124 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002125 int rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002126 char *namep = NULL, *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002127
2128 tsec = current->security;
2129 dsec = dir->i_security;
2130 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002131
2132 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2133 newsid = tsec->create_sid;
2134 } else {
2135 rc = security_transition_sid(tsec->sid, dsec->sid,
2136 inode_mode_to_security_class(inode->i_mode),
2137 &newsid);
2138 if (rc) {
2139 printk(KERN_WARNING "%s: "
2140 "security_transition_sid failed, rc=%d (dev=%s "
2141 "ino=%ld)\n",
2142 __FUNCTION__,
2143 -rc, inode->i_sb->s_id, inode->i_ino);
2144 return rc;
2145 }
2146 }
2147
Eric Paris296fddf2006-09-25 23:32:00 -07002148 /* Possibly defer initialization to selinux_complete_init. */
2149 if (sbsec->initialized) {
2150 struct inode_security_struct *isec = inode->i_security;
2151 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2152 isec->sid = newsid;
2153 isec->initialized = 1;
2154 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002155
Stephen Smalley8aad3872006-03-22 00:09:13 -08002156 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
Stephen Smalley25a74f32005-11-08 21:34:33 -08002157 return -EOPNOTSUPP;
2158
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002159 if (name) {
2160 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2161 if (!namep)
2162 return -ENOMEM;
2163 *name = namep;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002164 }
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002165
2166 if (value && len) {
2167 rc = security_sid_to_context(newsid, &context, &clen);
2168 if (rc) {
2169 kfree(namep);
2170 return rc;
2171 }
2172 *value = context;
2173 *len = clen;
2174 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002175
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002176 return 0;
2177}
2178
Linus Torvalds1da177e2005-04-16 15:20:36 -07002179static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2180{
2181 return may_create(dir, dentry, SECCLASS_FILE);
2182}
2183
Linus Torvalds1da177e2005-04-16 15:20:36 -07002184static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2185{
2186 int rc;
2187
2188 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2189 if (rc)
2190 return rc;
2191 return may_link(dir, old_dentry, MAY_LINK);
2192}
2193
Linus Torvalds1da177e2005-04-16 15:20:36 -07002194static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2195{
2196 int rc;
2197
2198 rc = secondary_ops->inode_unlink(dir, dentry);
2199 if (rc)
2200 return rc;
2201 return may_link(dir, dentry, MAY_UNLINK);
2202}
2203
2204static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2205{
2206 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2207}
2208
Linus Torvalds1da177e2005-04-16 15:20:36 -07002209static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2210{
2211 return may_create(dir, dentry, SECCLASS_DIR);
2212}
2213
Linus Torvalds1da177e2005-04-16 15:20:36 -07002214static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2215{
2216 return may_link(dir, dentry, MAY_RMDIR);
2217}
2218
2219static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2220{
2221 int rc;
2222
2223 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2224 if (rc)
2225 return rc;
2226
2227 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2228}
2229
Linus Torvalds1da177e2005-04-16 15:20:36 -07002230static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2231 struct inode *new_inode, struct dentry *new_dentry)
2232{
2233 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2234}
2235
Linus Torvalds1da177e2005-04-16 15:20:36 -07002236static int selinux_inode_readlink(struct dentry *dentry)
2237{
2238 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2239}
2240
2241static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2242{
2243 int rc;
2244
2245 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2246 if (rc)
2247 return rc;
2248 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2249}
2250
2251static int selinux_inode_permission(struct inode *inode, int mask,
2252 struct nameidata *nd)
2253{
2254 int rc;
2255
2256 rc = secondary_ops->inode_permission(inode, mask, nd);
2257 if (rc)
2258 return rc;
2259
2260 if (!mask) {
2261 /* No permission to check. Existence test. */
2262 return 0;
2263 }
2264
2265 return inode_has_perm(current, inode,
2266 file_mask_to_av(inode->i_mode, mask), NULL);
2267}
2268
2269static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2270{
2271 int rc;
2272
2273 rc = secondary_ops->inode_setattr(dentry, iattr);
2274 if (rc)
2275 return rc;
2276
2277 if (iattr->ia_valid & ATTR_FORCE)
2278 return 0;
2279
2280 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2281 ATTR_ATIME_SET | ATTR_MTIME_SET))
2282 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2283
2284 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2285}
2286
2287static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2288{
2289 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2290}
2291
2292static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2293{
2294 struct task_security_struct *tsec = current->security;
2295 struct inode *inode = dentry->d_inode;
2296 struct inode_security_struct *isec = inode->i_security;
2297 struct superblock_security_struct *sbsec;
2298 struct avc_audit_data ad;
2299 u32 newsid;
2300 int rc = 0;
2301
2302 if (strcmp(name, XATTR_NAME_SELINUX)) {
2303 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2304 sizeof XATTR_SECURITY_PREFIX - 1) &&
2305 !capable(CAP_SYS_ADMIN)) {
2306 /* A different attribute in the security namespace.
2307 Restrict to administrator. */
2308 return -EPERM;
2309 }
2310
2311 /* Not an attribute we recognize, so just check the
2312 ordinary setattr permission. */
2313 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2314 }
2315
2316 sbsec = inode->i_sb->s_security;
2317 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2318 return -EOPNOTSUPP;
2319
2320 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2321 return -EPERM;
2322
2323 AVC_AUDIT_DATA_INIT(&ad,FS);
2324 ad.u.fs.dentry = dentry;
2325
2326 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2327 FILE__RELABELFROM, &ad);
2328 if (rc)
2329 return rc;
2330
2331 rc = security_context_to_sid(value, size, &newsid);
2332 if (rc)
2333 return rc;
2334
2335 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2336 FILE__RELABELTO, &ad);
2337 if (rc)
2338 return rc;
2339
2340 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2341 isec->sclass);
2342 if (rc)
2343 return rc;
2344
2345 return avc_has_perm(newsid,
2346 sbsec->sid,
2347 SECCLASS_FILESYSTEM,
2348 FILESYSTEM__ASSOCIATE,
2349 &ad);
2350}
2351
2352static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2353 void *value, size_t size, int flags)
2354{
2355 struct inode *inode = dentry->d_inode;
2356 struct inode_security_struct *isec = inode->i_security;
2357 u32 newsid;
2358 int rc;
2359
2360 if (strcmp(name, XATTR_NAME_SELINUX)) {
2361 /* Not an attribute we recognize, so nothing to do. */
2362 return;
2363 }
2364
2365 rc = security_context_to_sid(value, size, &newsid);
2366 if (rc) {
2367 printk(KERN_WARNING "%s: unable to obtain SID for context "
2368 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2369 return;
2370 }
2371
2372 isec->sid = newsid;
2373 return;
2374}
2375
2376static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2377{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002378 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2379}
2380
2381static int selinux_inode_listxattr (struct dentry *dentry)
2382{
2383 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2384}
2385
2386static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2387{
2388 if (strcmp(name, XATTR_NAME_SELINUX)) {
2389 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2390 sizeof XATTR_SECURITY_PREFIX - 1) &&
2391 !capable(CAP_SYS_ADMIN)) {
2392 /* A different attribute in the security namespace.
2393 Restrict to administrator. */
2394 return -EPERM;
2395 }
2396
2397 /* Not an attribute we recognize, so just check the
2398 ordinary setattr permission. Might want a separate
2399 permission for removexattr. */
2400 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2401 }
2402
2403 /* No one is allowed to remove a SELinux security label.
2404 You can change the label, but all data must be labeled. */
2405 return -EACCES;
2406}
2407
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002408static const char *selinux_inode_xattr_getsuffix(void)
2409{
2410 return XATTR_SELINUX_SUFFIX;
2411}
2412
James Morrisd381d8a2005-10-30 14:59:22 -08002413/*
2414 * Copy the in-core inode security context value to the user. If the
2415 * getxattr() prior to this succeeded, check to see if we need to
2416 * canonicalize the value to be finally returned to the user.
2417 *
2418 * Permission check is handled by selinux_inode_getxattr hook.
2419 */
Dustin Kirkland7306a0b2005-11-16 15:53:13 +00002420static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002421{
2422 struct inode_security_struct *isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002423
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002424 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2425 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002426
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002427 return selinux_getsecurity(isec->sid, buffer, size);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002428}
2429
2430static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2431 const void *value, size_t size, int flags)
2432{
2433 struct inode_security_struct *isec = inode->i_security;
2434 u32 newsid;
2435 int rc;
2436
2437 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2438 return -EOPNOTSUPP;
2439
2440 if (!value || !size)
2441 return -EACCES;
2442
2443 rc = security_context_to_sid((void*)value, size, &newsid);
2444 if (rc)
2445 return rc;
2446
2447 isec->sid = newsid;
2448 return 0;
2449}
2450
2451static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2452{
2453 const int len = sizeof(XATTR_NAME_SELINUX);
2454 if (buffer && len <= buffer_size)
2455 memcpy(buffer, XATTR_NAME_SELINUX, len);
2456 return len;
2457}
2458
2459/* file security operations */
2460
2461static int selinux_file_permission(struct file *file, int mask)
2462{
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07002463 int rc;
Josef Sipek3d5ff522006-12-08 02:37:38 -08002464 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002465
2466 if (!mask) {
2467 /* No permission to check. Existence test. */
2468 return 0;
2469 }
2470
2471 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2472 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2473 mask |= MAY_APPEND;
2474
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07002475 rc = file_has_perm(current, file,
2476 file_mask_to_av(inode->i_mode, mask));
2477 if (rc)
2478 return rc;
2479
2480 return selinux_netlbl_inode_permission(inode, mask);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002481}
2482
2483static int selinux_file_alloc_security(struct file *file)
2484{
2485 return file_alloc_security(file);
2486}
2487
2488static void selinux_file_free_security(struct file *file)
2489{
2490 file_free_security(file);
2491}
2492
2493static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2494 unsigned long arg)
2495{
2496 int error = 0;
2497
2498 switch (cmd) {
2499 case FIONREAD:
2500 /* fall through */
2501 case FIBMAP:
2502 /* fall through */
2503 case FIGETBSZ:
2504 /* fall through */
2505 case EXT2_IOC_GETFLAGS:
2506 /* fall through */
2507 case EXT2_IOC_GETVERSION:
2508 error = file_has_perm(current, file, FILE__GETATTR);
2509 break;
2510
2511 case EXT2_IOC_SETFLAGS:
2512 /* fall through */
2513 case EXT2_IOC_SETVERSION:
2514 error = file_has_perm(current, file, FILE__SETATTR);
2515 break;
2516
2517 /* sys_ioctl() checks */
2518 case FIONBIO:
2519 /* fall through */
2520 case FIOASYNC:
2521 error = file_has_perm(current, file, 0);
2522 break;
2523
2524 case KDSKBENT:
2525 case KDSKBSENT:
2526 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2527 break;
2528
2529 /* default case assumes that the command will go
2530 * to the file's ioctl() function.
2531 */
2532 default:
2533 error = file_has_perm(current, file, FILE__IOCTL);
2534
2535 }
2536 return error;
2537}
2538
2539static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2540{
2541#ifndef CONFIG_PPC32
2542 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2543 /*
2544 * We are making executable an anonymous mapping or a
2545 * private file mapping that will also be writable.
2546 * This has an additional check.
2547 */
2548 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2549 if (rc)
2550 return rc;
2551 }
2552#endif
2553
2554 if (file) {
2555 /* read access is always possible with a mapping */
2556 u32 av = FILE__READ;
2557
2558 /* write access only matters if the mapping is shared */
2559 if (shared && (prot & PROT_WRITE))
2560 av |= FILE__WRITE;
2561
2562 if (prot & PROT_EXEC)
2563 av |= FILE__EXECUTE;
2564
2565 return file_has_perm(current, file, av);
2566 }
2567 return 0;
2568}
2569
2570static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2571 unsigned long prot, unsigned long flags)
2572{
2573 int rc;
2574
2575 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2576 if (rc)
2577 return rc;
2578
2579 if (selinux_checkreqprot)
2580 prot = reqprot;
2581
2582 return file_map_prot_check(file, prot,
2583 (flags & MAP_TYPE) == MAP_SHARED);
2584}
2585
2586static int selinux_file_mprotect(struct vm_area_struct *vma,
2587 unsigned long reqprot,
2588 unsigned long prot)
2589{
2590 int rc;
2591
2592 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2593 if (rc)
2594 return rc;
2595
2596 if (selinux_checkreqprot)
2597 prot = reqprot;
2598
2599#ifndef CONFIG_PPC32
Stephen Smalleydb4c9642006-02-01 03:05:54 -08002600 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2601 rc = 0;
2602 if (vma->vm_start >= vma->vm_mm->start_brk &&
2603 vma->vm_end <= vma->vm_mm->brk) {
2604 rc = task_has_perm(current, current,
2605 PROCESS__EXECHEAP);
2606 } else if (!vma->vm_file &&
2607 vma->vm_start <= vma->vm_mm->start_stack &&
2608 vma->vm_end >= vma->vm_mm->start_stack) {
2609 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2610 } else if (vma->vm_file && vma->anon_vma) {
2611 /*
2612 * We are making executable a file mapping that has
2613 * had some COW done. Since pages might have been
2614 * written, check ability to execute the possibly
2615 * modified content. This typically should only
2616 * occur for text relocations.
2617 */
2618 rc = file_has_perm(current, vma->vm_file,
2619 FILE__EXECMOD);
2620 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07002621 if (rc)
2622 return rc;
2623 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002624#endif
2625
2626 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2627}
2628
2629static int selinux_file_lock(struct file *file, unsigned int cmd)
2630{
2631 return file_has_perm(current, file, FILE__LOCK);
2632}
2633
2634static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2635 unsigned long arg)
2636{
2637 int err = 0;
2638
2639 switch (cmd) {
2640 case F_SETFL:
Josef Sipek3d5ff522006-12-08 02:37:38 -08002641 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002642 err = -EINVAL;
2643 break;
2644 }
2645
2646 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2647 err = file_has_perm(current, file,FILE__WRITE);
2648 break;
2649 }
2650 /* fall through */
2651 case F_SETOWN:
2652 case F_SETSIG:
2653 case F_GETFL:
2654 case F_GETOWN:
2655 case F_GETSIG:
2656 /* Just check FD__USE permission */
2657 err = file_has_perm(current, file, 0);
2658 break;
2659 case F_GETLK:
2660 case F_SETLK:
2661 case F_SETLKW:
2662#if BITS_PER_LONG == 32
2663 case F_GETLK64:
2664 case F_SETLK64:
2665 case F_SETLKW64:
2666#endif
Josef Sipek3d5ff522006-12-08 02:37:38 -08002667 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002668 err = -EINVAL;
2669 break;
2670 }
2671 err = file_has_perm(current, file, FILE__LOCK);
2672 break;
2673 }
2674
2675 return err;
2676}
2677
2678static int selinux_file_set_fowner(struct file *file)
2679{
2680 struct task_security_struct *tsec;
2681 struct file_security_struct *fsec;
2682
2683 tsec = current->security;
2684 fsec = file->f_security;
2685 fsec->fown_sid = tsec->sid;
2686
2687 return 0;
2688}
2689
2690static int selinux_file_send_sigiotask(struct task_struct *tsk,
2691 struct fown_struct *fown, int signum)
2692{
2693 struct file *file;
2694 u32 perm;
2695 struct task_security_struct *tsec;
2696 struct file_security_struct *fsec;
2697
2698 /* struct fown_struct is never outside the context of a struct file */
Robert P. J. Dayb385a142007-02-10 01:46:25 -08002699 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002700
2701 tsec = tsk->security;
2702 fsec = file->f_security;
2703
2704 if (!signum)
2705 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2706 else
2707 perm = signal_to_av(signum);
2708
2709 return avc_has_perm(fsec->fown_sid, tsec->sid,
2710 SECCLASS_PROCESS, perm, NULL);
2711}
2712
2713static int selinux_file_receive(struct file *file)
2714{
2715 return file_has_perm(current, file, file_to_av(file));
2716}
2717
2718/* task security operations */
2719
2720static int selinux_task_create(unsigned long clone_flags)
2721{
2722 int rc;
2723
2724 rc = secondary_ops->task_create(clone_flags);
2725 if (rc)
2726 return rc;
2727
2728 return task_has_perm(current, current, PROCESS__FORK);
2729}
2730
2731static int selinux_task_alloc_security(struct task_struct *tsk)
2732{
2733 struct task_security_struct *tsec1, *tsec2;
2734 int rc;
2735
2736 tsec1 = current->security;
2737
2738 rc = task_alloc_security(tsk);
2739 if (rc)
2740 return rc;
2741 tsec2 = tsk->security;
2742
2743 tsec2->osid = tsec1->osid;
2744 tsec2->sid = tsec1->sid;
2745
Michael LeMay28eba5b2006-06-27 02:53:42 -07002746 /* Retain the exec, fs, key, and sock SIDs across fork */
Linus Torvalds1da177e2005-04-16 15:20:36 -07002747 tsec2->exec_sid = tsec1->exec_sid;
2748 tsec2->create_sid = tsec1->create_sid;
Michael LeMay28eba5b2006-06-27 02:53:42 -07002749 tsec2->keycreate_sid = tsec1->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07002750 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002751
2752 /* Retain ptracer SID across fork, if any.
2753 This will be reset by the ptrace hook upon any
2754 subsequent ptrace_attach operations. */
2755 tsec2->ptrace_sid = tsec1->ptrace_sid;
2756
2757 return 0;
2758}
2759
2760static void selinux_task_free_security(struct task_struct *tsk)
2761{
2762 task_free_security(tsk);
2763}
2764
2765static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2766{
2767 /* Since setuid only affects the current process, and
2768 since the SELinux controls are not based on the Linux
2769 identity attributes, SELinux does not need to control
2770 this operation. However, SELinux does control the use
2771 of the CAP_SETUID and CAP_SETGID capabilities using the
2772 capable hook. */
2773 return 0;
2774}
2775
2776static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2777{
2778 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2779}
2780
2781static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2782{
2783 /* See the comment for setuid above. */
2784 return 0;
2785}
2786
2787static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2788{
2789 return task_has_perm(current, p, PROCESS__SETPGID);
2790}
2791
2792static int selinux_task_getpgid(struct task_struct *p)
2793{
2794 return task_has_perm(current, p, PROCESS__GETPGID);
2795}
2796
2797static int selinux_task_getsid(struct task_struct *p)
2798{
2799 return task_has_perm(current, p, PROCESS__GETSESSION);
2800}
2801
David Quigleyf9008e42006-06-30 01:55:46 -07002802static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2803{
2804 selinux_get_task_sid(p, secid);
2805}
2806
Linus Torvalds1da177e2005-04-16 15:20:36 -07002807static int selinux_task_setgroups(struct group_info *group_info)
2808{
2809 /* See the comment for setuid above. */
2810 return 0;
2811}
2812
2813static int selinux_task_setnice(struct task_struct *p, int nice)
2814{
2815 int rc;
2816
2817 rc = secondary_ops->task_setnice(p, nice);
2818 if (rc)
2819 return rc;
2820
2821 return task_has_perm(current,p, PROCESS__SETSCHED);
2822}
2823
James Morris03e68062006-06-23 02:03:58 -07002824static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2825{
2826 return task_has_perm(current, p, PROCESS__SETSCHED);
2827}
2828
David Quigleya1836a42006-06-30 01:55:49 -07002829static int selinux_task_getioprio(struct task_struct *p)
2830{
2831 return task_has_perm(current, p, PROCESS__GETSCHED);
2832}
2833
Linus Torvalds1da177e2005-04-16 15:20:36 -07002834static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2835{
2836 struct rlimit *old_rlim = current->signal->rlim + resource;
2837 int rc;
2838
2839 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2840 if (rc)
2841 return rc;
2842
2843 /* Control the ability to change the hard limit (whether
2844 lowering or raising it), so that the hard limit can
2845 later be used as a safe reset point for the soft limit
2846 upon context transitions. See selinux_bprm_apply_creds. */
2847 if (old_rlim->rlim_max != new_rlim->rlim_max)
2848 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2849
2850 return 0;
2851}
2852
2853static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2854{
2855 return task_has_perm(current, p, PROCESS__SETSCHED);
2856}
2857
2858static int selinux_task_getscheduler(struct task_struct *p)
2859{
2860 return task_has_perm(current, p, PROCESS__GETSCHED);
2861}
2862
David Quigley35601542006-06-23 02:04:01 -07002863static int selinux_task_movememory(struct task_struct *p)
2864{
2865 return task_has_perm(current, p, PROCESS__SETSCHED);
2866}
2867
David Quigleyf9008e42006-06-30 01:55:46 -07002868static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2869 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002870{
2871 u32 perm;
2872 int rc;
David Quigleyf9008e42006-06-30 01:55:46 -07002873 struct task_security_struct *tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002874
David Quigleyf9008e42006-06-30 01:55:46 -07002875 rc = secondary_ops->task_kill(p, info, sig, secid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002876 if (rc)
2877 return rc;
2878
Oleg Nesterov621d3122005-10-30 15:03:45 -08002879 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002880 return 0;
2881
2882 if (!sig)
2883 perm = PROCESS__SIGNULL; /* null signal; existence test */
2884 else
2885 perm = signal_to_av(sig);
David Quigleyf9008e42006-06-30 01:55:46 -07002886 tsec = p->security;
2887 if (secid)
2888 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2889 else
2890 rc = task_has_perm(current, p, perm);
2891 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002892}
2893
2894static int selinux_task_prctl(int option,
2895 unsigned long arg2,
2896 unsigned long arg3,
2897 unsigned long arg4,
2898 unsigned long arg5)
2899{
2900 /* The current prctl operations do not appear to require
2901 any SELinux controls since they merely observe or modify
2902 the state of the current process. */
2903 return 0;
2904}
2905
2906static int selinux_task_wait(struct task_struct *p)
2907{
2908 u32 perm;
2909
2910 perm = signal_to_av(p->exit_signal);
2911
2912 return task_has_perm(p, current, perm);
2913}
2914
2915static void selinux_task_reparent_to_init(struct task_struct *p)
2916{
2917 struct task_security_struct *tsec;
2918
2919 secondary_ops->task_reparent_to_init(p);
2920
2921 tsec = p->security;
2922 tsec->osid = tsec->sid;
2923 tsec->sid = SECINITSID_KERNEL;
2924 return;
2925}
2926
2927static void selinux_task_to_inode(struct task_struct *p,
2928 struct inode *inode)
2929{
2930 struct task_security_struct *tsec = p->security;
2931 struct inode_security_struct *isec = inode->i_security;
2932
2933 isec->sid = tsec->sid;
2934 isec->initialized = 1;
2935 return;
2936}
2937
Linus Torvalds1da177e2005-04-16 15:20:36 -07002938/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06002939static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2940 struct avc_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002941{
2942 int offset, ihlen, ret = -EINVAL;
2943 struct iphdr _iph, *ih;
2944
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03002945 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002946 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2947 if (ih == NULL)
2948 goto out;
2949
2950 ihlen = ih->ihl * 4;
2951 if (ihlen < sizeof(_iph))
2952 goto out;
2953
2954 ad->u.net.v4info.saddr = ih->saddr;
2955 ad->u.net.v4info.daddr = ih->daddr;
2956 ret = 0;
2957
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06002958 if (proto)
2959 *proto = ih->protocol;
2960
Linus Torvalds1da177e2005-04-16 15:20:36 -07002961 switch (ih->protocol) {
2962 case IPPROTO_TCP: {
2963 struct tcphdr _tcph, *th;
2964
2965 if (ntohs(ih->frag_off) & IP_OFFSET)
2966 break;
2967
2968 offset += ihlen;
2969 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2970 if (th == NULL)
2971 break;
2972
2973 ad->u.net.sport = th->source;
2974 ad->u.net.dport = th->dest;
2975 break;
2976 }
2977
2978 case IPPROTO_UDP: {
2979 struct udphdr _udph, *uh;
2980
2981 if (ntohs(ih->frag_off) & IP_OFFSET)
2982 break;
2983
2984 offset += ihlen;
2985 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2986 if (uh == NULL)
2987 break;
2988
2989 ad->u.net.sport = uh->source;
2990 ad->u.net.dport = uh->dest;
2991 break;
2992 }
2993
James Morris2ee92d42006-11-13 16:09:01 -08002994 case IPPROTO_DCCP: {
2995 struct dccp_hdr _dccph, *dh;
2996
2997 if (ntohs(ih->frag_off) & IP_OFFSET)
2998 break;
2999
3000 offset += ihlen;
3001 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3002 if (dh == NULL)
3003 break;
3004
3005 ad->u.net.sport = dh->dccph_sport;
3006 ad->u.net.dport = dh->dccph_dport;
3007 break;
3008 }
3009
Linus Torvalds1da177e2005-04-16 15:20:36 -07003010 default:
3011 break;
3012 }
3013out:
3014 return ret;
3015}
3016
3017#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3018
3019/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003020static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3021 struct avc_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003022{
3023 u8 nexthdr;
3024 int ret = -EINVAL, offset;
3025 struct ipv6hdr _ipv6h, *ip6;
3026
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003027 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003028 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3029 if (ip6 == NULL)
3030 goto out;
3031
3032 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3033 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3034 ret = 0;
3035
3036 nexthdr = ip6->nexthdr;
3037 offset += sizeof(_ipv6h);
Herbert Xu0d3d0772005-04-24 20:16:19 -07003038 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003039 if (offset < 0)
3040 goto out;
3041
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003042 if (proto)
3043 *proto = nexthdr;
3044
Linus Torvalds1da177e2005-04-16 15:20:36 -07003045 switch (nexthdr) {
3046 case IPPROTO_TCP: {
3047 struct tcphdr _tcph, *th;
3048
3049 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3050 if (th == NULL)
3051 break;
3052
3053 ad->u.net.sport = th->source;
3054 ad->u.net.dport = th->dest;
3055 break;
3056 }
3057
3058 case IPPROTO_UDP: {
3059 struct udphdr _udph, *uh;
3060
3061 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3062 if (uh == NULL)
3063 break;
3064
3065 ad->u.net.sport = uh->source;
3066 ad->u.net.dport = uh->dest;
3067 break;
3068 }
3069
James Morris2ee92d42006-11-13 16:09:01 -08003070 case IPPROTO_DCCP: {
3071 struct dccp_hdr _dccph, *dh;
3072
3073 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3074 if (dh == NULL)
3075 break;
3076
3077 ad->u.net.sport = dh->dccph_sport;
3078 ad->u.net.dport = dh->dccph_dport;
3079 break;
3080 }
3081
Linus Torvalds1da177e2005-04-16 15:20:36 -07003082 /* includes fragments */
3083 default:
3084 break;
3085 }
3086out:
3087 return ret;
3088}
3089
3090#endif /* IPV6 */
3091
3092static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003093 char **addrp, int *len, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003094{
3095 int ret = 0;
3096
3097 switch (ad->u.net.family) {
3098 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003099 ret = selinux_parse_skb_ipv4(skb, ad, proto);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003100 if (ret || !addrp)
3101 break;
3102 *len = 4;
3103 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3104 &ad->u.net.v4info.daddr);
3105 break;
3106
3107#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3108 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003109 ret = selinux_parse_skb_ipv6(skb, ad, proto);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003110 if (ret || !addrp)
3111 break;
3112 *len = 16;
3113 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3114 &ad->u.net.v6info.daddr);
3115 break;
3116#endif /* IPV6 */
3117 default:
3118 break;
3119 }
3120
3121 return ret;
3122}
3123
Paul Moore4f6a9932007-03-01 14:35:22 -05003124/**
3125 * selinux_skb_extlbl_sid - Determine the external label of a packet
3126 * @skb: the packet
3127 * @base_sid: the SELinux SID to use as a context for MLS only external labels
3128 * @sid: the packet's SID
3129 *
3130 * Description:
3131 * Check the various different forms of external packet labeling and determine
3132 * the external SID for the packet.
3133 *
3134 */
3135static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3136 u32 base_sid,
3137 u32 *sid)
3138{
3139 u32 xfrm_sid;
3140 u32 nlbl_sid;
3141
3142 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3143 if (selinux_netlbl_skbuff_getsid(skb,
3144 (xfrm_sid == SECSID_NULL ?
3145 base_sid : xfrm_sid),
3146 &nlbl_sid) != 0)
3147 nlbl_sid = SECSID_NULL;
3148
3149 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3150}
3151
Linus Torvalds1da177e2005-04-16 15:20:36 -07003152/* socket security operations */
3153static int socket_has_perm(struct task_struct *task, struct socket *sock,
3154 u32 perms)
3155{
3156 struct inode_security_struct *isec;
3157 struct task_security_struct *tsec;
3158 struct avc_audit_data ad;
3159 int err = 0;
3160
3161 tsec = task->security;
3162 isec = SOCK_INODE(sock)->i_security;
3163
3164 if (isec->sid == SECINITSID_KERNEL)
3165 goto out;
3166
3167 AVC_AUDIT_DATA_INIT(&ad,NET);
3168 ad.u.net.sk = sock->sk;
3169 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3170
3171out:
3172 return err;
3173}
3174
3175static int selinux_socket_create(int family, int type,
3176 int protocol, int kern)
3177{
3178 int err = 0;
3179 struct task_security_struct *tsec;
Eric Paris42c3e032006-06-26 00:26:03 -07003180 u32 newsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003181
3182 if (kern)
3183 goto out;
3184
3185 tsec = current->security;
Eric Paris42c3e032006-06-26 00:26:03 -07003186 newsid = tsec->sockcreate_sid ? : tsec->sid;
3187 err = avc_has_perm(tsec->sid, newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003188 socket_type_to_security_class(family, type,
3189 protocol), SOCKET__CREATE, NULL);
3190
3191out:
3192 return err;
3193}
3194
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003195static int selinux_socket_post_create(struct socket *sock, int family,
3196 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003197{
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003198 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003199 struct inode_security_struct *isec;
3200 struct task_security_struct *tsec;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003201 struct sk_security_struct *sksec;
Eric Paris42c3e032006-06-26 00:26:03 -07003202 u32 newsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003203
3204 isec = SOCK_INODE(sock)->i_security;
3205
3206 tsec = current->security;
Eric Paris42c3e032006-06-26 00:26:03 -07003207 newsid = tsec->sockcreate_sid ? : tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003208 isec->sclass = socket_type_to_security_class(family, type, protocol);
Eric Paris42c3e032006-06-26 00:26:03 -07003209 isec->sid = kern ? SECINITSID_KERNEL : newsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003210 isec->initialized = 1;
3211
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003212 if (sock->sk) {
3213 sksec = sock->sk->sk_security;
3214 sksec->sid = isec->sid;
Paul Moore9f2ad662006-11-17 17:38:53 -05003215 err = selinux_netlbl_socket_post_create(sock);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003216 }
3217
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003218 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003219}
3220
3221/* Range of port numbers used to automatically bind.
3222 Need to determine whether we should perform a name_bind
3223 permission check between the socket and the port number. */
3224#define ip_local_port_range_0 sysctl_local_port_range[0]
3225#define ip_local_port_range_1 sysctl_local_port_range[1]
3226
3227static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3228{
3229 u16 family;
3230 int err;
3231
3232 err = socket_has_perm(current, sock, SOCKET__BIND);
3233 if (err)
3234 goto out;
3235
3236 /*
3237 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04003238 * Multiple address binding for SCTP is not supported yet: we just
3239 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003240 */
3241 family = sock->sk->sk_family;
3242 if (family == PF_INET || family == PF_INET6) {
3243 char *addrp;
3244 struct inode_security_struct *isec;
3245 struct task_security_struct *tsec;
3246 struct avc_audit_data ad;
3247 struct sockaddr_in *addr4 = NULL;
3248 struct sockaddr_in6 *addr6 = NULL;
3249 unsigned short snum;
3250 struct sock *sk = sock->sk;
3251 u32 sid, node_perm, addrlen;
3252
3253 tsec = current->security;
3254 isec = SOCK_INODE(sock)->i_security;
3255
3256 if (family == PF_INET) {
3257 addr4 = (struct sockaddr_in *)address;
3258 snum = ntohs(addr4->sin_port);
3259 addrlen = sizeof(addr4->sin_addr.s_addr);
3260 addrp = (char *)&addr4->sin_addr.s_addr;
3261 } else {
3262 addr6 = (struct sockaddr_in6 *)address;
3263 snum = ntohs(addr6->sin6_port);
3264 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3265 addrp = (char *)&addr6->sin6_addr.s6_addr;
3266 }
3267
3268 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3269 snum > ip_local_port_range_1)) {
3270 err = security_port_sid(sk->sk_family, sk->sk_type,
3271 sk->sk_protocol, snum, &sid);
3272 if (err)
3273 goto out;
3274 AVC_AUDIT_DATA_INIT(&ad,NET);
3275 ad.u.net.sport = htons(snum);
3276 ad.u.net.family = family;
3277 err = avc_has_perm(isec->sid, sid,
3278 isec->sclass,
3279 SOCKET__NAME_BIND, &ad);
3280 if (err)
3281 goto out;
3282 }
3283
James Morris13402582005-09-30 14:24:34 -04003284 switch(isec->sclass) {
3285 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003286 node_perm = TCP_SOCKET__NODE_BIND;
3287 break;
3288
James Morris13402582005-09-30 14:24:34 -04003289 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003290 node_perm = UDP_SOCKET__NODE_BIND;
3291 break;
James Morris2ee92d42006-11-13 16:09:01 -08003292
3293 case SECCLASS_DCCP_SOCKET:
3294 node_perm = DCCP_SOCKET__NODE_BIND;
3295 break;
3296
Linus Torvalds1da177e2005-04-16 15:20:36 -07003297 default:
3298 node_perm = RAWIP_SOCKET__NODE_BIND;
3299 break;
3300 }
3301
3302 err = security_node_sid(family, addrp, addrlen, &sid);
3303 if (err)
3304 goto out;
3305
3306 AVC_AUDIT_DATA_INIT(&ad,NET);
3307 ad.u.net.sport = htons(snum);
3308 ad.u.net.family = family;
3309
3310 if (family == PF_INET)
3311 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3312 else
3313 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3314
3315 err = avc_has_perm(isec->sid, sid,
3316 isec->sclass, node_perm, &ad);
3317 if (err)
3318 goto out;
3319 }
3320out:
3321 return err;
3322}
3323
3324static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3325{
3326 struct inode_security_struct *isec;
3327 int err;
3328
3329 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3330 if (err)
3331 return err;
3332
3333 /*
James Morris2ee92d42006-11-13 16:09:01 -08003334 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003335 */
3336 isec = SOCK_INODE(sock)->i_security;
James Morris2ee92d42006-11-13 16:09:01 -08003337 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3338 isec->sclass == SECCLASS_DCCP_SOCKET) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003339 struct sock *sk = sock->sk;
3340 struct avc_audit_data ad;
3341 struct sockaddr_in *addr4 = NULL;
3342 struct sockaddr_in6 *addr6 = NULL;
3343 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08003344 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003345
3346 if (sk->sk_family == PF_INET) {
3347 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003348 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003349 return -EINVAL;
3350 snum = ntohs(addr4->sin_port);
3351 } else {
3352 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003353 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003354 return -EINVAL;
3355 snum = ntohs(addr6->sin6_port);
3356 }
3357
3358 err = security_port_sid(sk->sk_family, sk->sk_type,
3359 sk->sk_protocol, snum, &sid);
3360 if (err)
3361 goto out;
3362
James Morris2ee92d42006-11-13 16:09:01 -08003363 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3364 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3365
Linus Torvalds1da177e2005-04-16 15:20:36 -07003366 AVC_AUDIT_DATA_INIT(&ad,NET);
3367 ad.u.net.dport = htons(snum);
3368 ad.u.net.family = sk->sk_family;
James Morris2ee92d42006-11-13 16:09:01 -08003369 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003370 if (err)
3371 goto out;
3372 }
3373
3374out:
3375 return err;
3376}
3377
3378static int selinux_socket_listen(struct socket *sock, int backlog)
3379{
3380 return socket_has_perm(current, sock, SOCKET__LISTEN);
3381}
3382
3383static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3384{
3385 int err;
3386 struct inode_security_struct *isec;
3387 struct inode_security_struct *newisec;
3388
3389 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3390 if (err)
3391 return err;
3392
3393 newisec = SOCK_INODE(newsock)->i_security;
3394
3395 isec = SOCK_INODE(sock)->i_security;
3396 newisec->sclass = isec->sclass;
3397 newisec->sid = isec->sid;
3398 newisec->initialized = 1;
3399
3400 return 0;
3401}
3402
3403static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3404 int size)
3405{
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003406 int rc;
3407
3408 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3409 if (rc)
3410 return rc;
3411
3412 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003413}
3414
3415static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3416 int size, int flags)
3417{
3418 return socket_has_perm(current, sock, SOCKET__READ);
3419}
3420
3421static int selinux_socket_getsockname(struct socket *sock)
3422{
3423 return socket_has_perm(current, sock, SOCKET__GETATTR);
3424}
3425
3426static int selinux_socket_getpeername(struct socket *sock)
3427{
3428 return socket_has_perm(current, sock, SOCKET__GETATTR);
3429}
3430
3431static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3432{
Paul Mooref8687af2006-10-30 15:22:15 -08003433 int err;
3434
3435 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3436 if (err)
3437 return err;
3438
3439 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003440}
3441
3442static int selinux_socket_getsockopt(struct socket *sock, int level,
3443 int optname)
3444{
3445 return socket_has_perm(current, sock, SOCKET__GETOPT);
3446}
3447
3448static int selinux_socket_shutdown(struct socket *sock, int how)
3449{
3450 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3451}
3452
3453static int selinux_socket_unix_stream_connect(struct socket *sock,
3454 struct socket *other,
3455 struct sock *newsk)
3456{
3457 struct sk_security_struct *ssec;
3458 struct inode_security_struct *isec;
3459 struct inode_security_struct *other_isec;
3460 struct avc_audit_data ad;
3461 int err;
3462
3463 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3464 if (err)
3465 return err;
3466
3467 isec = SOCK_INODE(sock)->i_security;
3468 other_isec = SOCK_INODE(other)->i_security;
3469
3470 AVC_AUDIT_DATA_INIT(&ad,NET);
3471 ad.u.net.sk = other->sk;
3472
3473 err = avc_has_perm(isec->sid, other_isec->sid,
3474 isec->sclass,
3475 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3476 if (err)
3477 return err;
3478
3479 /* connecting socket */
3480 ssec = sock->sk->sk_security;
3481 ssec->peer_sid = other_isec->sid;
3482
3483 /* server child socket */
3484 ssec = newsk->sk_security;
3485 ssec->peer_sid = isec->sid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003486 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3487
3488 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003489}
3490
3491static int selinux_socket_unix_may_send(struct socket *sock,
3492 struct socket *other)
3493{
3494 struct inode_security_struct *isec;
3495 struct inode_security_struct *other_isec;
3496 struct avc_audit_data ad;
3497 int err;
3498
3499 isec = SOCK_INODE(sock)->i_security;
3500 other_isec = SOCK_INODE(other)->i_security;
3501
3502 AVC_AUDIT_DATA_INIT(&ad,NET);
3503 ad.u.net.sk = other->sk;
3504
3505 err = avc_has_perm(isec->sid, other_isec->sid,
3506 isec->sclass, SOCKET__SENDTO, &ad);
3507 if (err)
3508 return err;
3509
3510 return 0;
3511}
3512
James Morris4e5ab4c2006-06-09 00:33:33 -07003513static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003514 struct avc_audit_data *ad, u16 family, char *addrp, int len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003515{
James Morris4e5ab4c2006-06-09 00:33:33 -07003516 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003517 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003518 struct socket *sock;
3519 u16 sock_class = 0;
3520 u32 sock_sid = 0;
3521
3522 read_lock_bh(&sk->sk_callback_lock);
3523 sock = sk->sk_socket;
3524 if (sock) {
3525 struct inode *inode;
3526 inode = SOCK_INODE(sock);
3527 if (inode) {
3528 struct inode_security_struct *isec;
3529 isec = inode->i_security;
3530 sock_sid = isec->sid;
3531 sock_class = isec->sclass;
3532 }
3533 }
3534 read_unlock_bh(&sk->sk_callback_lock);
3535 if (!sock_sid)
3536 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003537
James Morris4e5ab4c2006-06-09 00:33:33 -07003538 if (!skb->dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003539 goto out;
3540
James Morris4e5ab4c2006-06-09 00:33:33 -07003541 err = sel_netif_sids(skb->dev, &if_sid, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003542 if (err)
3543 goto out;
3544
3545 switch (sock_class) {
3546 case SECCLASS_UDP_SOCKET:
3547 netif_perm = NETIF__UDP_RECV;
3548 node_perm = NODE__UDP_RECV;
3549 recv_perm = UDP_SOCKET__RECV_MSG;
3550 break;
3551
3552 case SECCLASS_TCP_SOCKET:
3553 netif_perm = NETIF__TCP_RECV;
3554 node_perm = NODE__TCP_RECV;
3555 recv_perm = TCP_SOCKET__RECV_MSG;
3556 break;
James Morris2ee92d42006-11-13 16:09:01 -08003557
3558 case SECCLASS_DCCP_SOCKET:
3559 netif_perm = NETIF__DCCP_RECV;
3560 node_perm = NODE__DCCP_RECV;
3561 recv_perm = DCCP_SOCKET__RECV_MSG;
3562 break;
3563
Linus Torvalds1da177e2005-04-16 15:20:36 -07003564 default:
3565 netif_perm = NETIF__RAWIP_RECV;
3566 node_perm = NODE__RAWIP_RECV;
3567 break;
3568 }
3569
James Morris4e5ab4c2006-06-09 00:33:33 -07003570 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003571 if (err)
3572 goto out;
3573
Linus Torvalds1da177e2005-04-16 15:20:36 -07003574 err = security_node_sid(family, addrp, len, &node_sid);
3575 if (err)
3576 goto out;
3577
James Morris4e5ab4c2006-06-09 00:33:33 -07003578 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003579 if (err)
3580 goto out;
3581
3582 if (recv_perm) {
3583 u32 port_sid;
3584
Linus Torvalds1da177e2005-04-16 15:20:36 -07003585 err = security_port_sid(sk->sk_family, sk->sk_type,
James Morris4e5ab4c2006-06-09 00:33:33 -07003586 sk->sk_protocol, ntohs(ad->u.net.sport),
Linus Torvalds1da177e2005-04-16 15:20:36 -07003587 &port_sid);
3588 if (err)
3589 goto out;
3590
3591 err = avc_has_perm(sock_sid, port_sid,
James Morris4e5ab4c2006-06-09 00:33:33 -07003592 sock_class, recv_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003593 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003594
James Morris4e5ab4c2006-06-09 00:33:33 -07003595out:
3596 return err;
3597}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003598
James Morris4e5ab4c2006-06-09 00:33:33 -07003599static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3600{
3601 u16 family;
James Morris4e5ab4c2006-06-09 00:33:33 -07003602 char *addrp;
3603 int len, err = 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07003604 struct avc_audit_data ad;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003605 struct sk_security_struct *sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07003606
3607 family = sk->sk_family;
3608 if (family != PF_INET && family != PF_INET6)
3609 goto out;
3610
3611 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00003612 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07003613 family = PF_INET;
3614
James Morris4e5ab4c2006-06-09 00:33:33 -07003615 AVC_AUDIT_DATA_INIT(&ad, NET);
3616 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3617 ad.u.net.family = family;
3618
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003619 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07003620 if (err)
3621 goto out;
3622
3623 if (selinux_compat_net)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003624 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
James Morris4e5ab4c2006-06-09 00:33:33 -07003625 addrp, len);
3626 else
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003627 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
James Morris4e5ab4c2006-06-09 00:33:33 -07003628 PACKET__RECV, &ad);
3629 if (err)
3630 goto out;
3631
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003632 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3633 if (err)
3634 goto out;
3635
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003636 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003637out:
3638 return err;
3639}
3640
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003641static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3642 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003643{
3644 int err = 0;
3645 char *scontext;
3646 u32 scontext_len;
3647 struct sk_security_struct *ssec;
3648 struct inode_security_struct *isec;
Paul Moore3de4bab2006-11-17 17:38:54 -05003649 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003650
3651 isec = SOCK_INODE(sock)->i_security;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003652
Paul Moore3de4bab2006-11-17 17:38:54 -05003653 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3654 isec->sclass == SECCLASS_TCP_SOCKET) {
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003655 ssec = sock->sk->sk_security;
3656 peer_sid = ssec->peer_sid;
3657 }
Paul Moore3de4bab2006-11-17 17:38:54 -05003658 if (peer_sid == SECSID_NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003659 err = -ENOPROTOOPT;
3660 goto out;
3661 }
3662
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003663 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3664
Linus Torvalds1da177e2005-04-16 15:20:36 -07003665 if (err)
3666 goto out;
3667
3668 if (scontext_len > len) {
3669 err = -ERANGE;
3670 goto out_len;
3671 }
3672
3673 if (copy_to_user(optval, scontext, scontext_len))
3674 err = -EFAULT;
3675
3676out_len:
3677 if (put_user(scontext_len, optlen))
3678 err = -EFAULT;
3679
3680 kfree(scontext);
3681out:
3682 return err;
3683}
3684
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003685static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003686{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003687 u32 peer_secid = SECSID_NULL;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003688 int err = 0;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07003689
Paul Moore3de4bab2006-11-17 17:38:54 -05003690 if (sock && sock->sk->sk_family == PF_UNIX)
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003691 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
Paul Moore3de4bab2006-11-17 17:38:54 -05003692 else if (skb)
Paul Moore4f6a9932007-03-01 14:35:22 -05003693 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003694
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003695 if (peer_secid == SECSID_NULL)
3696 err = -EINVAL;
3697 *secid = peer_secid;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003698
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07003699 return err;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08003700}
3701
Al Viro7d877f32005-10-21 03:20:43 -04003702static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003703{
3704 return sk_alloc_security(sk, family, priority);
3705}
3706
3707static void selinux_sk_free_security(struct sock *sk)
3708{
3709 sk_free_security(sk);
3710}
3711
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003712static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3713{
3714 struct sk_security_struct *ssec = sk->sk_security;
3715 struct sk_security_struct *newssec = newsk->sk_security;
3716
3717 newssec->sid = ssec->sid;
3718 newssec->peer_sid = ssec->peer_sid;
Paul Moore99f59ed2006-08-29 17:53:48 -07003719
Paul Moore9f2ad662006-11-17 17:38:53 -05003720 selinux_netlbl_sk_security_clone(ssec, newssec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003721}
3722
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07003723static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003724{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003725 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07003726 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003727 else {
3728 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003729
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07003730 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003731 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003732}
3733
Adrian Bunk9a673e52006-08-15 00:03:53 -07003734static void selinux_sock_graft(struct sock* sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003735{
3736 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3737 struct sk_security_struct *sksec = sk->sk_security;
3738
David Woodhouse2148ccc2006-09-29 15:50:25 -07003739 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3740 sk->sk_family == PF_UNIX)
3741 isec->sid = sksec->sid;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003742
3743 selinux_netlbl_sock_graft(sk, parent);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003744}
3745
Adrian Bunk9a673e52006-08-15 00:03:53 -07003746static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3747 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003748{
3749 struct sk_security_struct *sksec = sk->sk_security;
3750 int err;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003751 u32 newsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003752 u32 peersid;
3753
Paul Moore4f6a9932007-03-01 14:35:22 -05003754 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07003755 if (peersid == SECSID_NULL) {
3756 req->secid = sksec->sid;
Paul Moore3de4bab2006-11-17 17:38:54 -05003757 req->peer_secid = SECSID_NULL;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07003758 return 0;
3759 }
3760
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003761 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3762 if (err)
3763 return err;
3764
3765 req->secid = newsid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003766 req->peer_secid = peersid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003767 return 0;
3768}
3769
Adrian Bunk9a673e52006-08-15 00:03:53 -07003770static void selinux_inet_csk_clone(struct sock *newsk,
3771 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003772{
3773 struct sk_security_struct *newsksec = newsk->sk_security;
3774
3775 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003776 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003777 /* NOTE: Ideally, we should also get the isec->sid for the
3778 new socket in sync, but we don't have the isec available yet.
3779 So we will wait until sock_graft to do it, by which
3780 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07003781
Paul Moore9f2ad662006-11-17 17:38:53 -05003782 /* We don't need to take any sort of lock here as we are the only
3783 * thread with access to newsksec */
3784 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003785}
3786
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003787static void selinux_inet_conn_established(struct sock *sk,
3788 struct sk_buff *skb)
3789{
3790 struct sk_security_struct *sksec = sk->sk_security;
3791
Paul Moore4f6a9932007-03-01 14:35:22 -05003792 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06003793}
3794
Adrian Bunk9a673e52006-08-15 00:03:53 -07003795static void selinux_req_classify_flow(const struct request_sock *req,
3796 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003797{
3798 fl->secid = req->secid;
3799}
3800
Linus Torvalds1da177e2005-04-16 15:20:36 -07003801static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3802{
3803 int err = 0;
3804 u32 perm;
3805 struct nlmsghdr *nlh;
3806 struct socket *sock = sk->sk_socket;
3807 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3808
3809 if (skb->len < NLMSG_SPACE(0)) {
3810 err = -EINVAL;
3811 goto out;
3812 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07003813 nlh = nlmsg_hdr(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003814
3815 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3816 if (err) {
3817 if (err == -EINVAL) {
David Woodhouse9ad9ad32005-06-22 15:04:33 +01003818 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003819 "SELinux: unrecognized netlink message"
3820 " type=%hu for sclass=%hu\n",
3821 nlh->nlmsg_type, isec->sclass);
3822 if (!selinux_enforcing)
3823 err = 0;
3824 }
3825
3826 /* Ignore */
3827 if (err == -ENOENT)
3828 err = 0;
3829 goto out;
3830 }
3831
3832 err = socket_has_perm(current, sock, perm);
3833out:
3834 return err;
3835}
3836
3837#ifdef CONFIG_NETFILTER
3838
James Morris4e5ab4c2006-06-09 00:33:33 -07003839static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
James Morris4e5ab4c2006-06-09 00:33:33 -07003840 struct avc_audit_data *ad,
3841 u16 family, char *addrp, int len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003842{
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003843 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003844 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003845 struct socket *sock;
3846 struct inode *inode;
3847 struct inode_security_struct *isec;
3848
3849 sock = sk->sk_socket;
3850 if (!sock)
3851 goto out;
3852
3853 inode = SOCK_INODE(sock);
3854 if (!inode)
3855 goto out;
3856
3857 isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003858
Linus Torvalds1da177e2005-04-16 15:20:36 -07003859 err = sel_netif_sids(dev, &if_sid, NULL);
3860 if (err)
3861 goto out;
3862
Linus Torvalds1da177e2005-04-16 15:20:36 -07003863 switch (isec->sclass) {
3864 case SECCLASS_UDP_SOCKET:
3865 netif_perm = NETIF__UDP_SEND;
3866 node_perm = NODE__UDP_SEND;
3867 send_perm = UDP_SOCKET__SEND_MSG;
3868 break;
3869
3870 case SECCLASS_TCP_SOCKET:
3871 netif_perm = NETIF__TCP_SEND;
3872 node_perm = NODE__TCP_SEND;
3873 send_perm = TCP_SOCKET__SEND_MSG;
3874 break;
James Morris2ee92d42006-11-13 16:09:01 -08003875
3876 case SECCLASS_DCCP_SOCKET:
3877 netif_perm = NETIF__DCCP_SEND;
3878 node_perm = NODE__DCCP_SEND;
3879 send_perm = DCCP_SOCKET__SEND_MSG;
3880 break;
3881
Linus Torvalds1da177e2005-04-16 15:20:36 -07003882 default:
3883 netif_perm = NETIF__RAWIP_SEND;
3884 node_perm = NODE__RAWIP_SEND;
3885 break;
3886 }
3887
James Morris4e5ab4c2006-06-09 00:33:33 -07003888 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3889 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003890 goto out;
3891
James Morris4e5ab4c2006-06-09 00:33:33 -07003892 err = security_node_sid(family, addrp, len, &node_sid);
3893 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003894 goto out;
3895
James Morris4e5ab4c2006-06-09 00:33:33 -07003896 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3897 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003898 goto out;
3899
3900 if (send_perm) {
3901 u32 port_sid;
3902
Linus Torvalds1da177e2005-04-16 15:20:36 -07003903 err = security_port_sid(sk->sk_family,
3904 sk->sk_type,
3905 sk->sk_protocol,
James Morris4e5ab4c2006-06-09 00:33:33 -07003906 ntohs(ad->u.net.dport),
3907 &port_sid);
3908 if (err)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003909 goto out;
3910
3911 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
James Morris4e5ab4c2006-06-09 00:33:33 -07003912 send_perm, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003913 }
James Morris4e5ab4c2006-06-09 00:33:33 -07003914out:
3915 return err;
3916}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003917
James Morris4e5ab4c2006-06-09 00:33:33 -07003918static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3919 struct sk_buff **pskb,
3920 const struct net_device *in,
3921 const struct net_device *out,
3922 int (*okfn)(struct sk_buff *),
3923 u16 family)
3924{
3925 char *addrp;
3926 int len, err = 0;
3927 struct sock *sk;
James Morris4e5ab4c2006-06-09 00:33:33 -07003928 struct sk_buff *skb = *pskb;
James Morris4e5ab4c2006-06-09 00:33:33 -07003929 struct avc_audit_data ad;
3930 struct net_device *dev = (struct net_device *)out;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003931 struct sk_security_struct *sksec;
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003932 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07003933
3934 sk = skb->sk;
3935 if (!sk)
3936 goto out;
3937
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003938 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07003939
3940 AVC_AUDIT_DATA_INIT(&ad, NET);
3941 ad.u.net.netif = dev->name;
3942 ad.u.net.family = family;
3943
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003944 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
James Morris4e5ab4c2006-06-09 00:33:33 -07003945 if (err)
3946 goto out;
3947
3948 if (selinux_compat_net)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003949 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
James Morris4e5ab4c2006-06-09 00:33:33 -07003950 family, addrp, len);
3951 else
Venkat Yekkirala4237c752006-07-24 23:32:50 -07003952 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
James Morris4e5ab4c2006-06-09 00:33:33 -07003953 PACKET__SEND, &ad);
3954
3955 if (err)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08003956 goto out;
3957
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003958 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003959out:
James Morris4e5ab4c2006-06-09 00:33:33 -07003960 return err ? NF_DROP : NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003961}
3962
3963static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3964 struct sk_buff **pskb,
3965 const struct net_device *in,
3966 const struct net_device *out,
3967 int (*okfn)(struct sk_buff *))
3968{
3969 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3970}
3971
3972#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3973
3974static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3975 struct sk_buff **pskb,
3976 const struct net_device *in,
3977 const struct net_device *out,
3978 int (*okfn)(struct sk_buff *))
3979{
3980 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3981}
3982
3983#endif /* IPV6 */
3984
3985#endif /* CONFIG_NETFILTER */
3986
Linus Torvalds1da177e2005-04-16 15:20:36 -07003987static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3988{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003989 int err;
3990
3991 err = secondary_ops->netlink_send(sk, skb);
3992 if (err)
3993 return err;
3994
Linus Torvalds1da177e2005-04-16 15:20:36 -07003995 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3996 err = selinux_nlmsg_perm(sk, skb);
3997
3998 return err;
3999}
4000
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004001static int selinux_netlink_recv(struct sk_buff *skb, int capability)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004002{
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004003 int err;
4004 struct avc_audit_data ad;
4005
4006 err = secondary_ops->netlink_recv(skb, capability);
4007 if (err)
4008 return err;
4009
4010 AVC_AUDIT_DATA_INIT(&ad, CAP);
4011 ad.u.cap = capability;
4012
4013 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4014 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004015}
4016
4017static int ipc_alloc_security(struct task_struct *task,
4018 struct kern_ipc_perm *perm,
4019 u16 sclass)
4020{
4021 struct task_security_struct *tsec = task->security;
4022 struct ipc_security_struct *isec;
4023
James Morris89d155e2005-10-30 14:59:21 -08004024 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004025 if (!isec)
4026 return -ENOMEM;
4027
Linus Torvalds1da177e2005-04-16 15:20:36 -07004028 isec->sclass = sclass;
4029 isec->ipc_perm = perm;
Stephen Smalley9ac49d22006-02-01 03:05:56 -08004030 isec->sid = tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004031 perm->security = isec;
4032
4033 return 0;
4034}
4035
4036static void ipc_free_security(struct kern_ipc_perm *perm)
4037{
4038 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004039 perm->security = NULL;
4040 kfree(isec);
4041}
4042
4043static int msg_msg_alloc_security(struct msg_msg *msg)
4044{
4045 struct msg_security_struct *msec;
4046
James Morris89d155e2005-10-30 14:59:21 -08004047 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004048 if (!msec)
4049 return -ENOMEM;
4050
Linus Torvalds1da177e2005-04-16 15:20:36 -07004051 msec->msg = msg;
4052 msec->sid = SECINITSID_UNLABELED;
4053 msg->security = msec;
4054
4055 return 0;
4056}
4057
4058static void msg_msg_free_security(struct msg_msg *msg)
4059{
4060 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004061
4062 msg->security = NULL;
4063 kfree(msec);
4064}
4065
4066static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07004067 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004068{
4069 struct task_security_struct *tsec;
4070 struct ipc_security_struct *isec;
4071 struct avc_audit_data ad;
4072
4073 tsec = current->security;
4074 isec = ipc_perms->security;
4075
4076 AVC_AUDIT_DATA_INIT(&ad, IPC);
4077 ad.u.ipc_id = ipc_perms->key;
4078
Stephen Smalley6af963f2005-05-01 08:58:39 -07004079 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004080}
4081
4082static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4083{
4084 return msg_msg_alloc_security(msg);
4085}
4086
4087static void selinux_msg_msg_free_security(struct msg_msg *msg)
4088{
4089 msg_msg_free_security(msg);
4090}
4091
4092/* message queue security operations */
4093static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4094{
4095 struct task_security_struct *tsec;
4096 struct ipc_security_struct *isec;
4097 struct avc_audit_data ad;
4098 int rc;
4099
4100 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4101 if (rc)
4102 return rc;
4103
4104 tsec = current->security;
4105 isec = msq->q_perm.security;
4106
4107 AVC_AUDIT_DATA_INIT(&ad, IPC);
4108 ad.u.ipc_id = msq->q_perm.key;
4109
4110 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4111 MSGQ__CREATE, &ad);
4112 if (rc) {
4113 ipc_free_security(&msq->q_perm);
4114 return rc;
4115 }
4116 return 0;
4117}
4118
4119static void selinux_msg_queue_free_security(struct msg_queue *msq)
4120{
4121 ipc_free_security(&msq->q_perm);
4122}
4123
4124static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4125{
4126 struct task_security_struct *tsec;
4127 struct ipc_security_struct *isec;
4128 struct avc_audit_data ad;
4129
4130 tsec = current->security;
4131 isec = msq->q_perm.security;
4132
4133 AVC_AUDIT_DATA_INIT(&ad, IPC);
4134 ad.u.ipc_id = msq->q_perm.key;
4135
4136 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4137 MSGQ__ASSOCIATE, &ad);
4138}
4139
4140static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4141{
4142 int err;
4143 int perms;
4144
4145 switch(cmd) {
4146 case IPC_INFO:
4147 case MSG_INFO:
4148 /* No specific object, just general system-wide information. */
4149 return task_has_system(current, SYSTEM__IPC_INFO);
4150 case IPC_STAT:
4151 case MSG_STAT:
4152 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4153 break;
4154 case IPC_SET:
4155 perms = MSGQ__SETATTR;
4156 break;
4157 case IPC_RMID:
4158 perms = MSGQ__DESTROY;
4159 break;
4160 default:
4161 return 0;
4162 }
4163
Stephen Smalley6af963f2005-05-01 08:58:39 -07004164 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004165 return err;
4166}
4167
4168static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4169{
4170 struct task_security_struct *tsec;
4171 struct ipc_security_struct *isec;
4172 struct msg_security_struct *msec;
4173 struct avc_audit_data ad;
4174 int rc;
4175
4176 tsec = current->security;
4177 isec = msq->q_perm.security;
4178 msec = msg->security;
4179
4180 /*
4181 * First time through, need to assign label to the message
4182 */
4183 if (msec->sid == SECINITSID_UNLABELED) {
4184 /*
4185 * Compute new sid based on current process and
4186 * message queue this message will be stored in
4187 */
4188 rc = security_transition_sid(tsec->sid,
4189 isec->sid,
4190 SECCLASS_MSG,
4191 &msec->sid);
4192 if (rc)
4193 return rc;
4194 }
4195
4196 AVC_AUDIT_DATA_INIT(&ad, IPC);
4197 ad.u.ipc_id = msq->q_perm.key;
4198
4199 /* Can this process write to the queue? */
4200 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4201 MSGQ__WRITE, &ad);
4202 if (!rc)
4203 /* Can this process send the message */
4204 rc = avc_has_perm(tsec->sid, msec->sid,
4205 SECCLASS_MSG, MSG__SEND, &ad);
4206 if (!rc)
4207 /* Can the message be put in the queue? */
4208 rc = avc_has_perm(msec->sid, isec->sid,
4209 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4210
4211 return rc;
4212}
4213
4214static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4215 struct task_struct *target,
4216 long type, int mode)
4217{
4218 struct task_security_struct *tsec;
4219 struct ipc_security_struct *isec;
4220 struct msg_security_struct *msec;
4221 struct avc_audit_data ad;
4222 int rc;
4223
4224 tsec = target->security;
4225 isec = msq->q_perm.security;
4226 msec = msg->security;
4227
4228 AVC_AUDIT_DATA_INIT(&ad, IPC);
4229 ad.u.ipc_id = msq->q_perm.key;
4230
4231 rc = avc_has_perm(tsec->sid, isec->sid,
4232 SECCLASS_MSGQ, MSGQ__READ, &ad);
4233 if (!rc)
4234 rc = avc_has_perm(tsec->sid, msec->sid,
4235 SECCLASS_MSG, MSG__RECEIVE, &ad);
4236 return rc;
4237}
4238
4239/* Shared Memory security operations */
4240static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4241{
4242 struct task_security_struct *tsec;
4243 struct ipc_security_struct *isec;
4244 struct avc_audit_data ad;
4245 int rc;
4246
4247 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4248 if (rc)
4249 return rc;
4250
4251 tsec = current->security;
4252 isec = shp->shm_perm.security;
4253
4254 AVC_AUDIT_DATA_INIT(&ad, IPC);
4255 ad.u.ipc_id = shp->shm_perm.key;
4256
4257 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4258 SHM__CREATE, &ad);
4259 if (rc) {
4260 ipc_free_security(&shp->shm_perm);
4261 return rc;
4262 }
4263 return 0;
4264}
4265
4266static void selinux_shm_free_security(struct shmid_kernel *shp)
4267{
4268 ipc_free_security(&shp->shm_perm);
4269}
4270
4271static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4272{
4273 struct task_security_struct *tsec;
4274 struct ipc_security_struct *isec;
4275 struct avc_audit_data ad;
4276
4277 tsec = current->security;
4278 isec = shp->shm_perm.security;
4279
4280 AVC_AUDIT_DATA_INIT(&ad, IPC);
4281 ad.u.ipc_id = shp->shm_perm.key;
4282
4283 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4284 SHM__ASSOCIATE, &ad);
4285}
4286
4287/* Note, at this point, shp is locked down */
4288static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4289{
4290 int perms;
4291 int err;
4292
4293 switch(cmd) {
4294 case IPC_INFO:
4295 case SHM_INFO:
4296 /* No specific object, just general system-wide information. */
4297 return task_has_system(current, SYSTEM__IPC_INFO);
4298 case IPC_STAT:
4299 case SHM_STAT:
4300 perms = SHM__GETATTR | SHM__ASSOCIATE;
4301 break;
4302 case IPC_SET:
4303 perms = SHM__SETATTR;
4304 break;
4305 case SHM_LOCK:
4306 case SHM_UNLOCK:
4307 perms = SHM__LOCK;
4308 break;
4309 case IPC_RMID:
4310 perms = SHM__DESTROY;
4311 break;
4312 default:
4313 return 0;
4314 }
4315
Stephen Smalley6af963f2005-05-01 08:58:39 -07004316 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004317 return err;
4318}
4319
4320static int selinux_shm_shmat(struct shmid_kernel *shp,
4321 char __user *shmaddr, int shmflg)
4322{
4323 u32 perms;
4324 int rc;
4325
4326 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4327 if (rc)
4328 return rc;
4329
4330 if (shmflg & SHM_RDONLY)
4331 perms = SHM__READ;
4332 else
4333 perms = SHM__READ | SHM__WRITE;
4334
Stephen Smalley6af963f2005-05-01 08:58:39 -07004335 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004336}
4337
4338/* Semaphore security operations */
4339static int selinux_sem_alloc_security(struct sem_array *sma)
4340{
4341 struct task_security_struct *tsec;
4342 struct ipc_security_struct *isec;
4343 struct avc_audit_data ad;
4344 int rc;
4345
4346 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4347 if (rc)
4348 return rc;
4349
4350 tsec = current->security;
4351 isec = sma->sem_perm.security;
4352
4353 AVC_AUDIT_DATA_INIT(&ad, IPC);
4354 ad.u.ipc_id = sma->sem_perm.key;
4355
4356 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4357 SEM__CREATE, &ad);
4358 if (rc) {
4359 ipc_free_security(&sma->sem_perm);
4360 return rc;
4361 }
4362 return 0;
4363}
4364
4365static void selinux_sem_free_security(struct sem_array *sma)
4366{
4367 ipc_free_security(&sma->sem_perm);
4368}
4369
4370static int selinux_sem_associate(struct sem_array *sma, int semflg)
4371{
4372 struct task_security_struct *tsec;
4373 struct ipc_security_struct *isec;
4374 struct avc_audit_data ad;
4375
4376 tsec = current->security;
4377 isec = sma->sem_perm.security;
4378
4379 AVC_AUDIT_DATA_INIT(&ad, IPC);
4380 ad.u.ipc_id = sma->sem_perm.key;
4381
4382 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4383 SEM__ASSOCIATE, &ad);
4384}
4385
4386/* Note, at this point, sma is locked down */
4387static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4388{
4389 int err;
4390 u32 perms;
4391
4392 switch(cmd) {
4393 case IPC_INFO:
4394 case SEM_INFO:
4395 /* No specific object, just general system-wide information. */
4396 return task_has_system(current, SYSTEM__IPC_INFO);
4397 case GETPID:
4398 case GETNCNT:
4399 case GETZCNT:
4400 perms = SEM__GETATTR;
4401 break;
4402 case GETVAL:
4403 case GETALL:
4404 perms = SEM__READ;
4405 break;
4406 case SETVAL:
4407 case SETALL:
4408 perms = SEM__WRITE;
4409 break;
4410 case IPC_RMID:
4411 perms = SEM__DESTROY;
4412 break;
4413 case IPC_SET:
4414 perms = SEM__SETATTR;
4415 break;
4416 case IPC_STAT:
4417 case SEM_STAT:
4418 perms = SEM__GETATTR | SEM__ASSOCIATE;
4419 break;
4420 default:
4421 return 0;
4422 }
4423
Stephen Smalley6af963f2005-05-01 08:58:39 -07004424 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004425 return err;
4426}
4427
4428static int selinux_sem_semop(struct sem_array *sma,
4429 struct sembuf *sops, unsigned nsops, int alter)
4430{
4431 u32 perms;
4432
4433 if (alter)
4434 perms = SEM__READ | SEM__WRITE;
4435 else
4436 perms = SEM__READ;
4437
Stephen Smalley6af963f2005-05-01 08:58:39 -07004438 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004439}
4440
4441static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4442{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004443 u32 av = 0;
4444
Linus Torvalds1da177e2005-04-16 15:20:36 -07004445 av = 0;
4446 if (flag & S_IRUGO)
4447 av |= IPC__UNIX_READ;
4448 if (flag & S_IWUGO)
4449 av |= IPC__UNIX_WRITE;
4450
4451 if (av == 0)
4452 return 0;
4453
Stephen Smalley6af963f2005-05-01 08:58:39 -07004454 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004455}
4456
4457/* module stacking operations */
4458static int selinux_register_security (const char *name, struct security_operations *ops)
4459{
4460 if (secondary_ops != original_ops) {
Eric Parisfadcdb42007-02-22 18:11:31 -05004461 printk(KERN_ERR "%s: There is already a secondary security "
Linus Torvalds1da177e2005-04-16 15:20:36 -07004462 "module registered.\n", __FUNCTION__);
4463 return -EINVAL;
4464 }
4465
4466 secondary_ops = ops;
4467
4468 printk(KERN_INFO "%s: Registering secondary module %s\n",
4469 __FUNCTION__,
4470 name);
4471
4472 return 0;
4473}
4474
4475static int selinux_unregister_security (const char *name, struct security_operations *ops)
4476{
4477 if (ops != secondary_ops) {
Eric Parisfadcdb42007-02-22 18:11:31 -05004478 printk(KERN_ERR "%s: trying to unregister a security module "
Linus Torvalds1da177e2005-04-16 15:20:36 -07004479 "that is not registered.\n", __FUNCTION__);
4480 return -EINVAL;
4481 }
4482
4483 secondary_ops = original_ops;
4484
4485 return 0;
4486}
4487
4488static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4489{
4490 if (inode)
4491 inode_doinit_with_dentry(inode, dentry);
4492}
4493
4494static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00004495 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004496{
4497 struct task_security_struct *tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00004498 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004499 int error;
Al Viro04ff9702007-03-12 16:17:58 +00004500 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004501
4502 if (current != p) {
4503 error = task_has_perm(current, p, PROCESS__GETATTR);
4504 if (error)
4505 return error;
4506 }
4507
Linus Torvalds1da177e2005-04-16 15:20:36 -07004508 tsec = p->security;
4509
4510 if (!strcmp(name, "current"))
4511 sid = tsec->sid;
4512 else if (!strcmp(name, "prev"))
4513 sid = tsec->osid;
4514 else if (!strcmp(name, "exec"))
4515 sid = tsec->exec_sid;
4516 else if (!strcmp(name, "fscreate"))
4517 sid = tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07004518 else if (!strcmp(name, "keycreate"))
4519 sid = tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07004520 else if (!strcmp(name, "sockcreate"))
4521 sid = tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004522 else
4523 return -EINVAL;
4524
4525 if (!sid)
4526 return 0;
4527
Al Viro04ff9702007-03-12 16:17:58 +00004528 error = security_sid_to_context(sid, value, &len);
4529 if (error)
4530 return error;
4531 return len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004532}
4533
4534static int selinux_setprocattr(struct task_struct *p,
4535 char *name, void *value, size_t size)
4536{
4537 struct task_security_struct *tsec;
4538 u32 sid = 0;
4539 int error;
4540 char *str = value;
4541
4542 if (current != p) {
4543 /* SELinux only allows a process to change its own
4544 security attributes. */
4545 return -EACCES;
4546 }
4547
4548 /*
4549 * Basic control over ability to set these attributes at all.
4550 * current == p, but we'll pass them separately in case the
4551 * above restriction is ever removed.
4552 */
4553 if (!strcmp(name, "exec"))
4554 error = task_has_perm(current, p, PROCESS__SETEXEC);
4555 else if (!strcmp(name, "fscreate"))
4556 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07004557 else if (!strcmp(name, "keycreate"))
4558 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07004559 else if (!strcmp(name, "sockcreate"))
4560 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004561 else if (!strcmp(name, "current"))
4562 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4563 else
4564 error = -EINVAL;
4565 if (error)
4566 return error;
4567
4568 /* Obtain a SID for the context, if one was specified. */
4569 if (size && str[1] && str[1] != '\n') {
4570 if (str[size-1] == '\n') {
4571 str[size-1] = 0;
4572 size--;
4573 }
4574 error = security_context_to_sid(value, size, &sid);
4575 if (error)
4576 return error;
4577 }
4578
4579 /* Permission checking based on the specified context is
4580 performed during the actual operation (execve,
4581 open/mkdir/...), when we know the full context of the
4582 operation. See selinux_bprm_set_security for the execve
4583 checks and may_create for the file creation checks. The
4584 operation will then fail if the context is not permitted. */
4585 tsec = p->security;
4586 if (!strcmp(name, "exec"))
4587 tsec->exec_sid = sid;
4588 else if (!strcmp(name, "fscreate"))
4589 tsec->create_sid = sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07004590 else if (!strcmp(name, "keycreate")) {
4591 error = may_create_key(sid, p);
4592 if (error)
4593 return error;
4594 tsec->keycreate_sid = sid;
Eric Paris42c3e032006-06-26 00:26:03 -07004595 } else if (!strcmp(name, "sockcreate"))
4596 tsec->sockcreate_sid = sid;
4597 else if (!strcmp(name, "current")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004598 struct av_decision avd;
4599
4600 if (sid == 0)
4601 return -EINVAL;
4602
4603 /* Only allow single threaded processes to change context */
4604 if (atomic_read(&p->mm->mm_users) != 1) {
4605 struct task_struct *g, *t;
4606 struct mm_struct *mm = p->mm;
4607 read_lock(&tasklist_lock);
4608 do_each_thread(g, t)
4609 if (t->mm == mm && t != p) {
4610 read_unlock(&tasklist_lock);
4611 return -EPERM;
4612 }
4613 while_each_thread(g, t);
4614 read_unlock(&tasklist_lock);
4615 }
4616
4617 /* Check permissions for the transition. */
4618 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4619 PROCESS__DYNTRANSITION, NULL);
4620 if (error)
4621 return error;
4622
4623 /* Check for ptracing, and update the task SID if ok.
4624 Otherwise, leave SID unchanged and fail. */
4625 task_lock(p);
4626 if (p->ptrace & PT_PTRACED) {
4627 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4628 SECCLASS_PROCESS,
4629 PROCESS__PTRACE, &avd);
4630 if (!error)
4631 tsec->sid = sid;
4632 task_unlock(p);
4633 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4634 PROCESS__PTRACE, &avd, error, NULL);
4635 if (error)
4636 return error;
4637 } else {
4638 tsec->sid = sid;
4639 task_unlock(p);
4640 }
4641 }
4642 else
4643 return -EINVAL;
4644
4645 return size;
4646}
4647
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004648static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4649{
4650 return security_sid_to_context(secid, secdata, seclen);
4651}
4652
4653static void selinux_release_secctx(char *secdata, u32 seclen)
4654{
4655 if (secdata)
4656 kfree(secdata);
4657}
4658
Michael LeMayd7200242006-06-22 14:47:17 -07004659#ifdef CONFIG_KEYS
4660
David Howells7e047ef2006-06-26 00:24:50 -07004661static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4662 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07004663{
4664 struct task_security_struct *tsec = tsk->security;
4665 struct key_security_struct *ksec;
4666
4667 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4668 if (!ksec)
4669 return -ENOMEM;
4670
4671 ksec->obj = k;
Michael LeMay4eb582c2006-06-26 00:24:57 -07004672 if (tsec->keycreate_sid)
4673 ksec->sid = tsec->keycreate_sid;
4674 else
4675 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07004676 k->security = ksec;
4677
4678 return 0;
4679}
4680
4681static void selinux_key_free(struct key *k)
4682{
4683 struct key_security_struct *ksec = k->security;
4684
4685 k->security = NULL;
4686 kfree(ksec);
4687}
4688
4689static int selinux_key_permission(key_ref_t key_ref,
4690 struct task_struct *ctx,
4691 key_perm_t perm)
4692{
4693 struct key *key;
4694 struct task_security_struct *tsec;
4695 struct key_security_struct *ksec;
4696
4697 key = key_ref_to_ptr(key_ref);
4698
4699 tsec = ctx->security;
4700 ksec = key->security;
4701
4702 /* if no specific permissions are requested, we skip the
4703 permission check. No serious, additional covert channels
4704 appear to be created. */
4705 if (perm == 0)
4706 return 0;
4707
4708 return avc_has_perm(tsec->sid, ksec->sid,
4709 SECCLASS_KEY, perm, NULL);
4710}
4711
4712#endif
4713
Linus Torvalds1da177e2005-04-16 15:20:36 -07004714static struct security_operations selinux_ops = {
4715 .ptrace = selinux_ptrace,
4716 .capget = selinux_capget,
4717 .capset_check = selinux_capset_check,
4718 .capset_set = selinux_capset_set,
4719 .sysctl = selinux_sysctl,
4720 .capable = selinux_capable,
4721 .quotactl = selinux_quotactl,
4722 .quota_on = selinux_quota_on,
4723 .syslog = selinux_syslog,
4724 .vm_enough_memory = selinux_vm_enough_memory,
4725
4726 .netlink_send = selinux_netlink_send,
4727 .netlink_recv = selinux_netlink_recv,
4728
4729 .bprm_alloc_security = selinux_bprm_alloc_security,
4730 .bprm_free_security = selinux_bprm_free_security,
4731 .bprm_apply_creds = selinux_bprm_apply_creds,
4732 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4733 .bprm_set_security = selinux_bprm_set_security,
4734 .bprm_check_security = selinux_bprm_check_security,
4735 .bprm_secureexec = selinux_bprm_secureexec,
4736
4737 .sb_alloc_security = selinux_sb_alloc_security,
4738 .sb_free_security = selinux_sb_free_security,
4739 .sb_copy_data = selinux_sb_copy_data,
4740 .sb_kern_mount = selinux_sb_kern_mount,
4741 .sb_statfs = selinux_sb_statfs,
4742 .sb_mount = selinux_mount,
4743 .sb_umount = selinux_umount,
4744
4745 .inode_alloc_security = selinux_inode_alloc_security,
4746 .inode_free_security = selinux_inode_free_security,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07004747 .inode_init_security = selinux_inode_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004748 .inode_create = selinux_inode_create,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004749 .inode_link = selinux_inode_link,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004750 .inode_unlink = selinux_inode_unlink,
4751 .inode_symlink = selinux_inode_symlink,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004752 .inode_mkdir = selinux_inode_mkdir,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004753 .inode_rmdir = selinux_inode_rmdir,
4754 .inode_mknod = selinux_inode_mknod,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004755 .inode_rename = selinux_inode_rename,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004756 .inode_readlink = selinux_inode_readlink,
4757 .inode_follow_link = selinux_inode_follow_link,
4758 .inode_permission = selinux_inode_permission,
4759 .inode_setattr = selinux_inode_setattr,
4760 .inode_getattr = selinux_inode_getattr,
4761 .inode_setxattr = selinux_inode_setxattr,
4762 .inode_post_setxattr = selinux_inode_post_setxattr,
4763 .inode_getxattr = selinux_inode_getxattr,
4764 .inode_listxattr = selinux_inode_listxattr,
4765 .inode_removexattr = selinux_inode_removexattr,
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00004766 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004767 .inode_getsecurity = selinux_inode_getsecurity,
4768 .inode_setsecurity = selinux_inode_setsecurity,
4769 .inode_listsecurity = selinux_inode_listsecurity,
4770
4771 .file_permission = selinux_file_permission,
4772 .file_alloc_security = selinux_file_alloc_security,
4773 .file_free_security = selinux_file_free_security,
4774 .file_ioctl = selinux_file_ioctl,
4775 .file_mmap = selinux_file_mmap,
4776 .file_mprotect = selinux_file_mprotect,
4777 .file_lock = selinux_file_lock,
4778 .file_fcntl = selinux_file_fcntl,
4779 .file_set_fowner = selinux_file_set_fowner,
4780 .file_send_sigiotask = selinux_file_send_sigiotask,
4781 .file_receive = selinux_file_receive,
4782
4783 .task_create = selinux_task_create,
4784 .task_alloc_security = selinux_task_alloc_security,
4785 .task_free_security = selinux_task_free_security,
4786 .task_setuid = selinux_task_setuid,
4787 .task_post_setuid = selinux_task_post_setuid,
4788 .task_setgid = selinux_task_setgid,
4789 .task_setpgid = selinux_task_setpgid,
4790 .task_getpgid = selinux_task_getpgid,
4791 .task_getsid = selinux_task_getsid,
David Quigleyf9008e42006-06-30 01:55:46 -07004792 .task_getsecid = selinux_task_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004793 .task_setgroups = selinux_task_setgroups,
4794 .task_setnice = selinux_task_setnice,
James Morris03e68062006-06-23 02:03:58 -07004795 .task_setioprio = selinux_task_setioprio,
David Quigleya1836a42006-06-30 01:55:49 -07004796 .task_getioprio = selinux_task_getioprio,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004797 .task_setrlimit = selinux_task_setrlimit,
4798 .task_setscheduler = selinux_task_setscheduler,
4799 .task_getscheduler = selinux_task_getscheduler,
David Quigley35601542006-06-23 02:04:01 -07004800 .task_movememory = selinux_task_movememory,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004801 .task_kill = selinux_task_kill,
4802 .task_wait = selinux_task_wait,
4803 .task_prctl = selinux_task_prctl,
4804 .task_reparent_to_init = selinux_task_reparent_to_init,
4805 .task_to_inode = selinux_task_to_inode,
4806
4807 .ipc_permission = selinux_ipc_permission,
4808
4809 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4810 .msg_msg_free_security = selinux_msg_msg_free_security,
4811
4812 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4813 .msg_queue_free_security = selinux_msg_queue_free_security,
4814 .msg_queue_associate = selinux_msg_queue_associate,
4815 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4816 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4817 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4818
4819 .shm_alloc_security = selinux_shm_alloc_security,
4820 .shm_free_security = selinux_shm_free_security,
4821 .shm_associate = selinux_shm_associate,
4822 .shm_shmctl = selinux_shm_shmctl,
4823 .shm_shmat = selinux_shm_shmat,
4824
4825 .sem_alloc_security = selinux_sem_alloc_security,
4826 .sem_free_security = selinux_sem_free_security,
4827 .sem_associate = selinux_sem_associate,
4828 .sem_semctl = selinux_sem_semctl,
4829 .sem_semop = selinux_sem_semop,
4830
4831 .register_security = selinux_register_security,
4832 .unregister_security = selinux_unregister_security,
4833
4834 .d_instantiate = selinux_d_instantiate,
4835
4836 .getprocattr = selinux_getprocattr,
4837 .setprocattr = selinux_setprocattr,
4838
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004839 .secid_to_secctx = selinux_secid_to_secctx,
4840 .release_secctx = selinux_release_secctx,
4841
Linus Torvalds1da177e2005-04-16 15:20:36 -07004842 .unix_stream_connect = selinux_socket_unix_stream_connect,
4843 .unix_may_send = selinux_socket_unix_may_send,
4844
4845 .socket_create = selinux_socket_create,
4846 .socket_post_create = selinux_socket_post_create,
4847 .socket_bind = selinux_socket_bind,
4848 .socket_connect = selinux_socket_connect,
4849 .socket_listen = selinux_socket_listen,
4850 .socket_accept = selinux_socket_accept,
4851 .socket_sendmsg = selinux_socket_sendmsg,
4852 .socket_recvmsg = selinux_socket_recvmsg,
4853 .socket_getsockname = selinux_socket_getsockname,
4854 .socket_getpeername = selinux_socket_getpeername,
4855 .socket_getsockopt = selinux_socket_getsockopt,
4856 .socket_setsockopt = selinux_socket_setsockopt,
4857 .socket_shutdown = selinux_socket_shutdown,
4858 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004859 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4860 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004861 .sk_alloc_security = selinux_sk_alloc_security,
4862 .sk_free_security = selinux_sk_free_security,
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004863 .sk_clone_security = selinux_sk_clone_security,
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004864 .sk_getsecid = selinux_sk_getsecid,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004865 .sock_graft = selinux_sock_graft,
4866 .inet_conn_request = selinux_inet_conn_request,
4867 .inet_csk_clone = selinux_inet_csk_clone,
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004868 .inet_conn_established = selinux_inet_conn_established,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004869 .req_classify_flow = selinux_req_classify_flow,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004870
4871#ifdef CONFIG_SECURITY_NETWORK_XFRM
4872 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4873 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4874 .xfrm_policy_free_security = selinux_xfrm_policy_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07004875 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004876 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4877 .xfrm_state_free_security = selinux_xfrm_state_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07004878 .xfrm_state_delete_security = selinux_xfrm_state_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004879 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07004880 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07004881 .xfrm_decode_session = selinux_xfrm_decode_session,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004882#endif
Michael LeMayd7200242006-06-22 14:47:17 -07004883
4884#ifdef CONFIG_KEYS
4885 .key_alloc = selinux_key_alloc,
4886 .key_free = selinux_key_free,
4887 .key_permission = selinux_key_permission,
4888#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004889};
4890
4891static __init int selinux_init(void)
4892{
4893 struct task_security_struct *tsec;
4894
4895 if (!selinux_enabled) {
4896 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4897 return 0;
4898 }
4899
4900 printk(KERN_INFO "SELinux: Initializing.\n");
4901
4902 /* Set the security state for the initial task. */
4903 if (task_alloc_security(current))
4904 panic("SELinux: Failed to initialize initial task.\n");
4905 tsec = current->security;
4906 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4907
James Morris7cae7e22006-03-22 00:09:22 -08004908 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4909 sizeof(struct inode_security_struct),
4910 0, SLAB_PANIC, NULL, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004911 avc_init();
4912
4913 original_ops = secondary_ops = security_ops;
4914 if (!secondary_ops)
4915 panic ("SELinux: No initial security operations\n");
4916 if (register_security (&selinux_ops))
4917 panic("SELinux: Unable to register with kernel.\n");
4918
4919 if (selinux_enforcing) {
Eric Parisfadcdb42007-02-22 18:11:31 -05004920 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004921 } else {
Eric Parisfadcdb42007-02-22 18:11:31 -05004922 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004923 }
Michael LeMayd7200242006-06-22 14:47:17 -07004924
4925#ifdef CONFIG_KEYS
4926 /* Add security information to initial keyrings */
Michael LeMay4eb582c2006-06-26 00:24:57 -07004927 selinux_key_alloc(&root_user_keyring, current,
4928 KEY_ALLOC_NOT_IN_QUOTA);
4929 selinux_key_alloc(&root_session_keyring, current,
4930 KEY_ALLOC_NOT_IN_QUOTA);
Michael LeMayd7200242006-06-22 14:47:17 -07004931#endif
4932
Linus Torvalds1da177e2005-04-16 15:20:36 -07004933 return 0;
4934}
4935
4936void selinux_complete_init(void)
4937{
Eric Parisfadcdb42007-02-22 18:11:31 -05004938 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004939
4940 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05004941 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004942 spin_lock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004943 spin_lock(&sb_security_lock);
4944next_sb:
4945 if (!list_empty(&superblock_security_head)) {
4946 struct superblock_security_struct *sbsec =
4947 list_entry(superblock_security_head.next,
4948 struct superblock_security_struct,
4949 list);
4950 struct super_block *sb = sbsec->sb;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004951 sb->s_count++;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004952 spin_unlock(&sb_security_lock);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004953 spin_unlock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004954 down_read(&sb->s_umount);
4955 if (sb->s_root)
4956 superblock_doinit(sb, NULL);
4957 drop_super(sb);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004958 spin_lock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004959 spin_lock(&sb_security_lock);
4960 list_del_init(&sbsec->list);
4961 goto next_sb;
4962 }
4963 spin_unlock(&sb_security_lock);
Stephen Smalleyba0c19e2006-06-04 02:51:30 -07004964 spin_unlock(&sb_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004965}
4966
4967/* SELinux requires early initialization in order to label
4968 all processes and objects when they are created. */
4969security_initcall(selinux_init);
4970
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08004971#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004972
4973static struct nf_hook_ops selinux_ipv4_op = {
4974 .hook = selinux_ipv4_postroute_last,
4975 .owner = THIS_MODULE,
4976 .pf = PF_INET,
4977 .hooknum = NF_IP_POST_ROUTING,
4978 .priority = NF_IP_PRI_SELINUX_LAST,
4979};
4980
4981#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4982
4983static struct nf_hook_ops selinux_ipv6_op = {
4984 .hook = selinux_ipv6_postroute_last,
4985 .owner = THIS_MODULE,
4986 .pf = PF_INET6,
4987 .hooknum = NF_IP6_POST_ROUTING,
4988 .priority = NF_IP6_PRI_SELINUX_LAST,
4989};
4990
4991#endif /* IPV6 */
4992
4993static int __init selinux_nf_ip_init(void)
4994{
4995 int err = 0;
4996
4997 if (!selinux_enabled)
4998 goto out;
Eric Parisfadcdb42007-02-22 18:11:31 -05004999
5000 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5001
Linus Torvalds1da177e2005-04-16 15:20:36 -07005002 err = nf_register_hook(&selinux_ipv4_op);
5003 if (err)
5004 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5005
5006#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5007
5008 err = nf_register_hook(&selinux_ipv6_op);
5009 if (err)
5010 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5011
5012#endif /* IPV6 */
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005013
Linus Torvalds1da177e2005-04-16 15:20:36 -07005014out:
5015 return err;
5016}
5017
5018__initcall(selinux_nf_ip_init);
5019
5020#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5021static void selinux_nf_ip_exit(void)
5022{
Eric Parisfadcdb42007-02-22 18:11:31 -05005023 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005024
5025 nf_unregister_hook(&selinux_ipv4_op);
5026#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5027 nf_unregister_hook(&selinux_ipv6_op);
5028#endif /* IPV6 */
5029}
5030#endif
5031
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005032#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005033
5034#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5035#define selinux_nf_ip_exit()
5036#endif
5037
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005038#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005039
5040#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5041int selinux_disable(void)
5042{
5043 extern void exit_sel_fs(void);
5044 static int selinux_disabled = 0;
5045
5046 if (ss_initialized) {
5047 /* Not permitted after initial policy load. */
5048 return -EINVAL;
5049 }
5050
5051 if (selinux_disabled) {
5052 /* Only do this once. */
5053 return -EINVAL;
5054 }
5055
5056 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5057
5058 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04005059 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005060
5061 /* Reset security_ops to the secondary module, dummy or capability. */
5062 security_ops = secondary_ops;
5063
5064 /* Unregister netfilter hooks. */
5065 selinux_nf_ip_exit();
5066
5067 /* Unregister selinuxfs. */
5068 exit_sel_fs();
5069
5070 return 0;
5071}
5072#endif
5073
5074