blob: 5c9f25ba1c9537faa8e1ea91a482dd8960cb745e [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
27#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070028#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/errno.h>
30#include <linux/sched.h>
31#include <linux/security.h>
32#include <linux/xattr.h>
33#include <linux/capability.h>
34#include <linux/unistd.h>
35#include <linux/mm.h>
36#include <linux/mman.h>
37#include <linux/slab.h>
38#include <linux/pagemap.h>
39#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#include <linux/spinlock.h>
41#include <linux/syscalls.h>
42#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040043#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/namei.h>
45#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070046#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/netfilter_ipv4.h>
48#include <linux/netfilter_ipv6.h>
49#include <linux/tty.h>
50#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070051#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070052#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore220deb92008-01-29 08:38:23 -050053#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050054#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040055#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <asm/ioctls.h>
Paul Moored621d352008-01-29 08:43:36 -050057#include <asm/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070058#include <linux/bitops.h>
59#include <linux/interrupt.h>
60#include <linux/netdevice.h> /* for network interface checks */
61#include <linux/netlink.h>
62#include <linux/tcp.h>
63#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080064#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070065#include <linux/quota.h>
66#include <linux/un.h> /* for Unix socket types */
67#include <net/af_unix.h> /* for Unix socket types */
68#include <linux/parser.h>
69#include <linux/nfs_mount.h>
70#include <net/ipv6.h>
71#include <linux/hugetlb.h>
72#include <linux/personality.h>
73#include <linux/sysctl.h>
74#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070075#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070076#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070077#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070078#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080079#include <linux/syslog.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080
81#include "avc.h"
82#include "objsec.h"
83#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050084#include "netnode.h"
Paul Moore3e112172008-04-10 10:48:14 -040085#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080086#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050087#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020088#include "audit.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070089
90#define XATTR_SELINUX_SUFFIX "selinux"
91#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
92
David P. Quigley11689d42009-01-16 09:22:03 -050093#define NUM_SEL_MNT_OPTS 5
Eric Parisc9180a52007-11-30 13:00:35 -050094
Linus Torvalds1da177e2005-04-16 15:20:36 -070095extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
James Morris20510f22007-10-16 23:31:32 -070096extern struct security_operations *security_ops;
Linus Torvalds1da177e2005-04-16 15:20:36 -070097
Paul Moored621d352008-01-29 08:43:36 -050098/* SECMARK reference count */
99atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
Linus Torvalds1da177e2005-04-16 15:20:36 -0700101#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400102int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
104static int __init enforcing_setup(char *str)
105{
Eric Parisf5269712008-05-14 11:27:45 -0400106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109 return 1;
110}
111__setup("enforcing=", enforcing_setup);
112#endif
113
114#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117static int __init selinux_enabled_setup(char *str)
118{
Eric Parisf5269712008-05-14 11:27:45 -0400119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700122 return 1;
123}
124__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400125#else
126int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127#endif
128
Christoph Lametere18b8902006-12-06 20:33:20 -0800129static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800130
Paul Moored621d352008-01-29 08:43:36 -0500131/**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
139 *
140 */
141static int selinux_secmark_enabled(void)
142{
143 return (atomic_read(&selinux_secmark_refcount) > 0);
144}
145
David Howellsd84f4f92008-11-14 10:39:23 +1100146/*
147 * initialise the security for the init task
148 */
149static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700150{
David Howells3b11a1d2008-11-14 10:39:26 +1100151 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700152 struct task_security_struct *tsec;
153
James Morris89d155e2005-10-30 14:59:21 -0800154 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700155 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100156 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700157
David Howellsd84f4f92008-11-14 10:39:23 +1100158 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100159 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700160}
161
David Howells275bb412008-11-14 10:39:19 +1100162/*
David Howells88e67f32008-11-14 10:39:21 +1100163 * get the security ID of a set of credentials
164 */
165static inline u32 cred_sid(const struct cred *cred)
166{
167 const struct task_security_struct *tsec;
168
169 tsec = cred->security;
170 return tsec->sid;
171}
172
173/*
David Howells3b11a1d2008-11-14 10:39:26 +1100174 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100175 */
176static inline u32 task_sid(const struct task_struct *task)
177{
David Howells275bb412008-11-14 10:39:19 +1100178 u32 sid;
179
180 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100181 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100182 rcu_read_unlock();
183 return sid;
184}
185
186/*
David Howells3b11a1d2008-11-14 10:39:26 +1100187 * get the subjective security ID of the current task
David Howells275bb412008-11-14 10:39:19 +1100188 */
189static inline u32 current_sid(void)
190{
191 const struct task_security_struct *tsec = current_cred()->security;
192
193 return tsec->sid;
194}
195
David Howells88e67f32008-11-14 10:39:21 +1100196/* Allocate and free functions for each kind of security blob. */
197
Linus Torvalds1da177e2005-04-16 15:20:36 -0700198static int inode_alloc_security(struct inode *inode)
199{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700200 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100201 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700202
Josef Bacika02fe132008-04-04 09:35:05 +1100203 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700204 if (!isec)
205 return -ENOMEM;
206
Eric Paris23970742006-09-25 23:32:01 -0700207 mutex_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209 isec->inode = inode;
210 isec->sid = SECINITSID_UNLABELED;
211 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100212 isec->task_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213 inode->i_security = isec;
214
215 return 0;
216}
217
218static void inode_free_security(struct inode *inode)
219{
220 struct inode_security_struct *isec = inode->i_security;
221 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
222
Linus Torvalds1da177e2005-04-16 15:20:36 -0700223 spin_lock(&sbsec->isec_lock);
224 if (!list_empty(&isec->list))
225 list_del_init(&isec->list);
226 spin_unlock(&sbsec->isec_lock);
227
228 inode->i_security = NULL;
James Morris7cae7e22006-03-22 00:09:22 -0800229 kmem_cache_free(sel_inode_cache, isec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700230}
231
232static int file_alloc_security(struct file *file)
233{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100235 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236
Stephen Smalley26d2a4b2006-02-01 03:05:55 -0800237 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700238 if (!fsec)
239 return -ENOMEM;
240
David Howells275bb412008-11-14 10:39:19 +1100241 fsec->sid = sid;
242 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700243 file->f_security = fsec;
244
245 return 0;
246}
247
248static void file_free_security(struct file *file)
249{
250 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251 file->f_security = NULL;
252 kfree(fsec);
253}
254
255static int superblock_alloc_security(struct super_block *sb)
256{
257 struct superblock_security_struct *sbsec;
258
James Morris89d155e2005-10-30 14:59:21 -0800259 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 if (!sbsec)
261 return -ENOMEM;
262
Eric Parisbc7e9822006-09-25 23:32:02 -0700263 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700264 INIT_LIST_HEAD(&sbsec->isec_head);
265 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266 sbsec->sb = sb;
267 sbsec->sid = SECINITSID_UNLABELED;
268 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700269 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700270 sb->s_security = sbsec;
271
272 return 0;
273}
274
275static void superblock_free_security(struct super_block *sb)
276{
277 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278 sb->s_security = NULL;
279 kfree(sbsec);
280}
281
Al Viro7d877f32005-10-21 03:20:43 -0400282static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700283{
Eric Parisdd3e7832010-04-07 15:08:46 -0400284 struct sk_security_struct *sksec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700285
Eric Parisdd3e7832010-04-07 15:08:46 -0400286 sksec = kzalloc(sizeof(*sksec), priority);
287 if (!sksec)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700288 return -ENOMEM;
289
Eric Parisdd3e7832010-04-07 15:08:46 -0400290 sksec->peer_sid = SECINITSID_UNLABELED;
291 sksec->sid = SECINITSID_UNLABELED;
292 sk->sk_security = sksec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700293
Eric Parisdd3e7832010-04-07 15:08:46 -0400294 selinux_netlbl_sk_security_reset(sksec);
Paul Moore99f59ed2006-08-29 17:53:48 -0700295
Linus Torvalds1da177e2005-04-16 15:20:36 -0700296 return 0;
297}
298
299static void sk_free_security(struct sock *sk)
300{
Eric Parisdd3e7832010-04-07 15:08:46 -0400301 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700302
Linus Torvalds1da177e2005-04-16 15:20:36 -0700303 sk->sk_security = NULL;
Eric Parisdd3e7832010-04-07 15:08:46 -0400304 selinux_netlbl_sk_security_free(sksec);
305 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700306}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700307
308/* The security server must be initialized before
309 any labeling or access decisions can be provided. */
310extern int ss_initialized;
311
312/* The file system's label must be initialized prior to use. */
313
Stephen Hemminger634a5392010-03-04 21:59:03 -0800314static const char *labeling_behaviors[6] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700315 "uses xattr",
316 "uses transition SIDs",
317 "uses task SIDs",
318 "uses genfs_contexts",
319 "not configured for labeling",
320 "uses mountpoint labeling",
321};
322
323static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
324
325static inline int inode_doinit(struct inode *inode)
326{
327 return inode_doinit_with_dentry(inode, NULL);
328}
329
330enum {
Eric Paris31e87932007-09-19 17:19:12 -0400331 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700332 Opt_context = 1,
333 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500334 Opt_defcontext = 3,
335 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500336 Opt_labelsupport = 5,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700337};
338
Steven Whitehousea447c092008-10-13 10:46:57 +0100339static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400340 {Opt_context, CONTEXT_STR "%s"},
341 {Opt_fscontext, FSCONTEXT_STR "%s"},
342 {Opt_defcontext, DEFCONTEXT_STR "%s"},
343 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500344 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400345 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700346};
347
348#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
349
Eric Parisc312feb2006-07-10 04:43:53 -0700350static int may_context_mount_sb_relabel(u32 sid,
351 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100352 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700353{
David Howells275bb412008-11-14 10:39:19 +1100354 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700355 int rc;
356
357 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
358 FILESYSTEM__RELABELFROM, NULL);
359 if (rc)
360 return rc;
361
362 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
363 FILESYSTEM__RELABELTO, NULL);
364 return rc;
365}
366
Eric Paris08089252006-07-10 04:43:55 -0700367static int may_context_mount_inode_relabel(u32 sid,
368 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100369 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700370{
David Howells275bb412008-11-14 10:39:19 +1100371 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700372 int rc;
373 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
374 FILESYSTEM__RELABELFROM, NULL);
375 if (rc)
376 return rc;
377
378 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
379 FILESYSTEM__ASSOCIATE, NULL);
380 return rc;
381}
382
Eric Parisc9180a52007-11-30 13:00:35 -0500383static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384{
385 struct superblock_security_struct *sbsec = sb->s_security;
386 struct dentry *root = sb->s_root;
Eric Parisc9180a52007-11-30 13:00:35 -0500387 struct inode *root_inode = root->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 int rc = 0;
389
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
391 /* Make sure that the xattr handler exists and that no
392 error other than -ENODATA is returned by getxattr on
393 the root directory. -ENODATA is ok, as this may be
394 the first boot of the SELinux kernel before we have
395 assigned xattr values to the filesystem. */
Eric Parisc9180a52007-11-30 13:00:35 -0500396 if (!root_inode->i_op->getxattr) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
398 "xattr support\n", sb->s_id, sb->s_type->name);
399 rc = -EOPNOTSUPP;
400 goto out;
401 }
Eric Parisc9180a52007-11-30 13:00:35 -0500402 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700403 if (rc < 0 && rc != -ENODATA) {
404 if (rc == -EOPNOTSUPP)
405 printk(KERN_WARNING "SELinux: (dev %s, type "
406 "%s) has no security xattr handler\n",
407 sb->s_id, sb->s_type->name);
408 else
409 printk(KERN_WARNING "SELinux: (dev %s, type "
410 "%s) getxattr errno %d\n", sb->s_id,
411 sb->s_type->name, -rc);
412 goto out;
413 }
414 }
415
David P. Quigley11689d42009-01-16 09:22:03 -0500416 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700417
Eric Parisc9180a52007-11-30 13:00:35 -0500418 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Eric Parisfadcdb42007-02-22 18:11:31 -0500419 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 sb->s_id, sb->s_type->name);
Eric Parisc9180a52007-11-30 13:00:35 -0500421 else
Eric Parisfadcdb42007-02-22 18:11:31 -0500422 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700423 sb->s_id, sb->s_type->name,
424 labeling_behaviors[sbsec->behavior-1]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700425
David P. Quigley11689d42009-01-16 09:22:03 -0500426 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
427 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
428 sbsec->behavior == SECURITY_FS_USE_NONE ||
429 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
430 sbsec->flags &= ~SE_SBLABELSUPP;
431
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400432 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
433 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
434 sbsec->flags |= SE_SBLABELSUPP;
435
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500437 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700438
439 /* Initialize any other inodes associated with the superblock, e.g.
440 inodes created prior to initial policy load or inodes created
441 during get_sb by a pseudo filesystem that directly
442 populates itself. */
443 spin_lock(&sbsec->isec_lock);
444next_inode:
445 if (!list_empty(&sbsec->isec_head)) {
446 struct inode_security_struct *isec =
447 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500448 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449 struct inode *inode = isec->inode;
450 spin_unlock(&sbsec->isec_lock);
451 inode = igrab(inode);
452 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500453 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454 inode_doinit(inode);
455 iput(inode);
456 }
457 spin_lock(&sbsec->isec_lock);
458 list_del_init(&isec->list);
459 goto next_inode;
460 }
461 spin_unlock(&sbsec->isec_lock);
462out:
Eric Parisc9180a52007-11-30 13:00:35 -0500463 return rc;
464}
465
466/*
467 * This function should allow an FS to ask what it's mount security
468 * options were so it can use those later for submounts, displaying
469 * mount options, or whatever.
470 */
471static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500472 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500473{
474 int rc = 0, i;
475 struct superblock_security_struct *sbsec = sb->s_security;
476 char *context = NULL;
477 u32 len;
478 char tmp;
479
Eric Parise0007522008-03-05 10:31:54 -0500480 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500481
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500482 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500483 return -EINVAL;
484
485 if (!ss_initialized)
486 return -EINVAL;
487
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500488 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500489 /* count the number of mount options for this sb */
490 for (i = 0; i < 8; i++) {
491 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500492 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500493 tmp >>= 1;
494 }
David P. Quigley11689d42009-01-16 09:22:03 -0500495 /* Check if the Label support flag is set */
496 if (sbsec->flags & SE_SBLABELSUPP)
497 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500498
Eric Parise0007522008-03-05 10:31:54 -0500499 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
500 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500501 rc = -ENOMEM;
502 goto out_free;
503 }
504
Eric Parise0007522008-03-05 10:31:54 -0500505 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
506 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500507 rc = -ENOMEM;
508 goto out_free;
509 }
510
511 i = 0;
512 if (sbsec->flags & FSCONTEXT_MNT) {
513 rc = security_sid_to_context(sbsec->sid, &context, &len);
514 if (rc)
515 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500516 opts->mnt_opts[i] = context;
517 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500518 }
519 if (sbsec->flags & CONTEXT_MNT) {
520 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
521 if (rc)
522 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500523 opts->mnt_opts[i] = context;
524 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500525 }
526 if (sbsec->flags & DEFCONTEXT_MNT) {
527 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
528 if (rc)
529 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500530 opts->mnt_opts[i] = context;
531 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500532 }
533 if (sbsec->flags & ROOTCONTEXT_MNT) {
534 struct inode *root = sbsec->sb->s_root->d_inode;
535 struct inode_security_struct *isec = root->i_security;
536
537 rc = security_sid_to_context(isec->sid, &context, &len);
538 if (rc)
539 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500540 opts->mnt_opts[i] = context;
541 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500542 }
David P. Quigley11689d42009-01-16 09:22:03 -0500543 if (sbsec->flags & SE_SBLABELSUPP) {
544 opts->mnt_opts[i] = NULL;
545 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
546 }
Eric Parisc9180a52007-11-30 13:00:35 -0500547
Eric Parise0007522008-03-05 10:31:54 -0500548 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500549
550 return 0;
551
552out_free:
Eric Parise0007522008-03-05 10:31:54 -0500553 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500554 return rc;
555}
556
557static int bad_option(struct superblock_security_struct *sbsec, char flag,
558 u32 old_sid, u32 new_sid)
559{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500560 char mnt_flags = sbsec->flags & SE_MNTMASK;
561
Eric Parisc9180a52007-11-30 13:00:35 -0500562 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500563 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500564 if (!(sbsec->flags & flag) ||
565 (old_sid != new_sid))
566 return 1;
567
568 /* check if we were passed the same options twice,
569 * aka someone passed context=a,context=b
570 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500571 if (!(sbsec->flags & SE_SBINITIALIZED))
572 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500573 return 1;
574 return 0;
575}
Eric Parise0007522008-03-05 10:31:54 -0500576
Eric Parisc9180a52007-11-30 13:00:35 -0500577/*
578 * Allow filesystems with binary mount data to explicitly set mount point
579 * labeling information.
580 */
Eric Parise0007522008-03-05 10:31:54 -0500581static int selinux_set_mnt_opts(struct super_block *sb,
582 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500583{
David Howells275bb412008-11-14 10:39:19 +1100584 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500585 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500586 struct superblock_security_struct *sbsec = sb->s_security;
587 const char *name = sb->s_type->name;
James Morris089be432008-07-15 18:32:49 +1000588 struct inode *inode = sbsec->sb->s_root->d_inode;
589 struct inode_security_struct *root_isec = inode->i_security;
Eric Parisc9180a52007-11-30 13:00:35 -0500590 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
591 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500592 char **mount_options = opts->mnt_opts;
593 int *flags = opts->mnt_opts_flags;
594 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500595
596 mutex_lock(&sbsec->lock);
597
598 if (!ss_initialized) {
599 if (!num_opts) {
600 /* Defer initialization until selinux_complete_init,
601 after the initial policy is loaded and the security
602 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500603 goto out;
604 }
605 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400606 printk(KERN_WARNING "SELinux: Unable to set superblock options "
607 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500608 goto out;
609 }
610
611 /*
Eric Parise0007522008-03-05 10:31:54 -0500612 * Binary mount data FS will come through this function twice. Once
613 * from an explicit call and once from the generic calls from the vfs.
614 * Since the generic VFS calls will not contain any security mount data
615 * we need to skip the double mount verification.
616 *
617 * This does open a hole in which we will not notice if the first
618 * mount using this sb set explict options and a second mount using
619 * this sb does not set any security options. (The first options
620 * will be used for both mounts)
621 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500622 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500623 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400624 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500625
626 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500627 * parse the mount options, check if they are valid sids.
628 * also check if someone is trying to mount the same sb more
629 * than once with different security options.
630 */
631 for (i = 0; i < num_opts; i++) {
632 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500633
634 if (flags[i] == SE_SBLABELSUPP)
635 continue;
Eric Parisc9180a52007-11-30 13:00:35 -0500636 rc = security_context_to_sid(mount_options[i],
637 strlen(mount_options[i]), &sid);
638 if (rc) {
639 printk(KERN_WARNING "SELinux: security_context_to_sid"
640 "(%s) failed for (dev %s, type %s) errno=%d\n",
641 mount_options[i], sb->s_id, name, rc);
642 goto out;
643 }
644 switch (flags[i]) {
645 case FSCONTEXT_MNT:
646 fscontext_sid = sid;
647
648 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
649 fscontext_sid))
650 goto out_double_mount;
651
652 sbsec->flags |= FSCONTEXT_MNT;
653 break;
654 case CONTEXT_MNT:
655 context_sid = sid;
656
657 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
658 context_sid))
659 goto out_double_mount;
660
661 sbsec->flags |= CONTEXT_MNT;
662 break;
663 case ROOTCONTEXT_MNT:
664 rootcontext_sid = sid;
665
666 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
667 rootcontext_sid))
668 goto out_double_mount;
669
670 sbsec->flags |= ROOTCONTEXT_MNT;
671
672 break;
673 case DEFCONTEXT_MNT:
674 defcontext_sid = sid;
675
676 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
677 defcontext_sid))
678 goto out_double_mount;
679
680 sbsec->flags |= DEFCONTEXT_MNT;
681
682 break;
683 default:
684 rc = -EINVAL;
685 goto out;
686 }
687 }
688
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500689 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500690 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500691 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500692 goto out_double_mount;
693 rc = 0;
694 goto out;
695 }
696
James Morris089be432008-07-15 18:32:49 +1000697 if (strcmp(sb->s_type->name, "proc") == 0)
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500698 sbsec->flags |= SE_SBPROC;
Eric Parisc9180a52007-11-30 13:00:35 -0500699
700 /* Determine the labeling behavior to use for this filesystem type. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500701 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
Eric Parisc9180a52007-11-30 13:00:35 -0500702 if (rc) {
703 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
James Morris089be432008-07-15 18:32:49 +1000704 __func__, sb->s_type->name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500705 goto out;
706 }
707
708 /* sets the context of the superblock for the fs being mounted. */
709 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100710 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500711 if (rc)
712 goto out;
713
714 sbsec->sid = fscontext_sid;
715 }
716
717 /*
718 * Switch to using mount point labeling behavior.
719 * sets the label used on all file below the mountpoint, and will set
720 * the superblock context if not already set.
721 */
722 if (context_sid) {
723 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100724 rc = may_context_mount_sb_relabel(context_sid, sbsec,
725 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500726 if (rc)
727 goto out;
728 sbsec->sid = context_sid;
729 } else {
David Howells275bb412008-11-14 10:39:19 +1100730 rc = may_context_mount_inode_relabel(context_sid, sbsec,
731 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500732 if (rc)
733 goto out;
734 }
735 if (!rootcontext_sid)
736 rootcontext_sid = context_sid;
737
738 sbsec->mntpoint_sid = context_sid;
739 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
740 }
741
742 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100743 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
744 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500745 if (rc)
746 goto out;
747
748 root_isec->sid = rootcontext_sid;
749 root_isec->initialized = 1;
750 }
751
752 if (defcontext_sid) {
753 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
754 rc = -EINVAL;
755 printk(KERN_WARNING "SELinux: defcontext option is "
756 "invalid for this filesystem type\n");
757 goto out;
758 }
759
760 if (defcontext_sid != sbsec->def_sid) {
761 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100762 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500763 if (rc)
764 goto out;
765 }
766
767 sbsec->def_sid = defcontext_sid;
768 }
769
770 rc = sb_finish_set_opts(sb);
771out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700772 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700773 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500774out_double_mount:
775 rc = -EINVAL;
776 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
777 "security settings for (dev %s, type %s)\n", sb->s_id, name);
778 goto out;
779}
780
781static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
782 struct super_block *newsb)
783{
784 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
785 struct superblock_security_struct *newsbsec = newsb->s_security;
786
787 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
788 int set_context = (oldsbsec->flags & CONTEXT_MNT);
789 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
790
Eric Paris0f5e6422008-04-21 16:24:11 -0400791 /*
792 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400793 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400794 */
Al Viroe8c26252010-03-23 06:36:54 -0400795 if (!ss_initialized)
Eric Paris0f5e6422008-04-21 16:24:11 -0400796 return;
Eric Parisc9180a52007-11-30 13:00:35 -0500797
Eric Parisc9180a52007-11-30 13:00:35 -0500798 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500799 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500800
Eric Paris5a552612008-04-09 14:08:35 -0400801 /* if fs is reusing a sb, just let its options stand... */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500802 if (newsbsec->flags & SE_SBINITIALIZED)
Eric Paris5a552612008-04-09 14:08:35 -0400803 return;
804
Eric Parisc9180a52007-11-30 13:00:35 -0500805 mutex_lock(&newsbsec->lock);
806
807 newsbsec->flags = oldsbsec->flags;
808
809 newsbsec->sid = oldsbsec->sid;
810 newsbsec->def_sid = oldsbsec->def_sid;
811 newsbsec->behavior = oldsbsec->behavior;
812
813 if (set_context) {
814 u32 sid = oldsbsec->mntpoint_sid;
815
816 if (!set_fscontext)
817 newsbsec->sid = sid;
818 if (!set_rootcontext) {
819 struct inode *newinode = newsb->s_root->d_inode;
820 struct inode_security_struct *newisec = newinode->i_security;
821 newisec->sid = sid;
822 }
823 newsbsec->mntpoint_sid = sid;
824 }
825 if (set_rootcontext) {
826 const struct inode *oldinode = oldsb->s_root->d_inode;
827 const struct inode_security_struct *oldisec = oldinode->i_security;
828 struct inode *newinode = newsb->s_root->d_inode;
829 struct inode_security_struct *newisec = newinode->i_security;
830
831 newisec->sid = oldisec->sid;
832 }
833
834 sb_finish_set_opts(newsb);
835 mutex_unlock(&newsbsec->lock);
836}
837
Adrian Bunk2e1479d2008-03-17 22:29:23 +0200838static int selinux_parse_opts_str(char *options,
839 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500840{
Eric Parise0007522008-03-05 10:31:54 -0500841 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -0500842 char *context = NULL, *defcontext = NULL;
843 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -0500844 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500845
Eric Parise0007522008-03-05 10:31:54 -0500846 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500847
848 /* Standard string-based options. */
849 while ((p = strsep(&options, "|")) != NULL) {
850 int token;
851 substring_t args[MAX_OPT_ARGS];
852
853 if (!*p)
854 continue;
855
856 token = match_token(p, tokens, args);
857
858 switch (token) {
859 case Opt_context:
860 if (context || defcontext) {
861 rc = -EINVAL;
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
863 goto out_err;
864 }
865 context = match_strdup(&args[0]);
866 if (!context) {
867 rc = -ENOMEM;
868 goto out_err;
869 }
870 break;
871
872 case Opt_fscontext:
873 if (fscontext) {
874 rc = -EINVAL;
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
876 goto out_err;
877 }
878 fscontext = match_strdup(&args[0]);
879 if (!fscontext) {
880 rc = -ENOMEM;
881 goto out_err;
882 }
883 break;
884
885 case Opt_rootcontext:
886 if (rootcontext) {
887 rc = -EINVAL;
888 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
889 goto out_err;
890 }
891 rootcontext = match_strdup(&args[0]);
892 if (!rootcontext) {
893 rc = -ENOMEM;
894 goto out_err;
895 }
896 break;
897
898 case Opt_defcontext:
899 if (context || defcontext) {
900 rc = -EINVAL;
901 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
902 goto out_err;
903 }
904 defcontext = match_strdup(&args[0]);
905 if (!defcontext) {
906 rc = -ENOMEM;
907 goto out_err;
908 }
909 break;
David P. Quigley11689d42009-01-16 09:22:03 -0500910 case Opt_labelsupport:
911 break;
Eric Parisc9180a52007-11-30 13:00:35 -0500912 default:
913 rc = -EINVAL;
914 printk(KERN_WARNING "SELinux: unknown mount option\n");
915 goto out_err;
916
917 }
918 }
919
Eric Parise0007522008-03-05 10:31:54 -0500920 rc = -ENOMEM;
921 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
922 if (!opts->mnt_opts)
923 goto out_err;
924
925 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
926 if (!opts->mnt_opts_flags) {
927 kfree(opts->mnt_opts);
928 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -0500929 }
930
Eric Parise0007522008-03-05 10:31:54 -0500931 if (fscontext) {
932 opts->mnt_opts[num_mnt_opts] = fscontext;
933 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
934 }
935 if (context) {
936 opts->mnt_opts[num_mnt_opts] = context;
937 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
938 }
939 if (rootcontext) {
940 opts->mnt_opts[num_mnt_opts] = rootcontext;
941 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
942 }
943 if (defcontext) {
944 opts->mnt_opts[num_mnt_opts] = defcontext;
945 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
946 }
947
948 opts->num_mnt_opts = num_mnt_opts;
949 return 0;
950
Eric Parisc9180a52007-11-30 13:00:35 -0500951out_err:
952 kfree(context);
953 kfree(defcontext);
954 kfree(fscontext);
955 kfree(rootcontext);
956 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700957}
Eric Parise0007522008-03-05 10:31:54 -0500958/*
959 * string mount options parsing and call set the sbsec
960 */
961static int superblock_doinit(struct super_block *sb, void *data)
962{
963 int rc = 0;
964 char *options = data;
965 struct security_mnt_opts opts;
966
967 security_init_mnt_opts(&opts);
968
969 if (!data)
970 goto out;
971
972 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
973
974 rc = selinux_parse_opts_str(options, &opts);
975 if (rc)
976 goto out_err;
977
978out:
979 rc = selinux_set_mnt_opts(sb, &opts);
980
981out_err:
982 security_free_mnt_opts(&opts);
983 return rc;
984}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700985
Adrian Bunk3583a712008-07-22 20:21:23 +0300986static void selinux_write_opts(struct seq_file *m,
987 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +1000988{
989 int i;
990 char *prefix;
991
992 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -0500993 char *has_comma;
994
995 if (opts->mnt_opts[i])
996 has_comma = strchr(opts->mnt_opts[i], ',');
997 else
998 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +1000999
1000 switch (opts->mnt_opts_flags[i]) {
1001 case CONTEXT_MNT:
1002 prefix = CONTEXT_STR;
1003 break;
1004 case FSCONTEXT_MNT:
1005 prefix = FSCONTEXT_STR;
1006 break;
1007 case ROOTCONTEXT_MNT:
1008 prefix = ROOTCONTEXT_STR;
1009 break;
1010 case DEFCONTEXT_MNT:
1011 prefix = DEFCONTEXT_STR;
1012 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001013 case SE_SBLABELSUPP:
1014 seq_putc(m, ',');
1015 seq_puts(m, LABELSUPP_STR);
1016 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001017 default:
1018 BUG();
1019 };
1020 /* we need a comma before each option */
1021 seq_putc(m, ',');
1022 seq_puts(m, prefix);
1023 if (has_comma)
1024 seq_putc(m, '\"');
1025 seq_puts(m, opts->mnt_opts[i]);
1026 if (has_comma)
1027 seq_putc(m, '\"');
1028 }
1029}
1030
1031static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1032{
1033 struct security_mnt_opts opts;
1034 int rc;
1035
1036 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001037 if (rc) {
1038 /* before policy load we may get EINVAL, don't show anything */
1039 if (rc == -EINVAL)
1040 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001041 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001042 }
Eric Paris2069f452008-07-04 09:47:13 +10001043
1044 selinux_write_opts(m, &opts);
1045
1046 security_free_mnt_opts(&opts);
1047
1048 return rc;
1049}
1050
Linus Torvalds1da177e2005-04-16 15:20:36 -07001051static inline u16 inode_mode_to_security_class(umode_t mode)
1052{
1053 switch (mode & S_IFMT) {
1054 case S_IFSOCK:
1055 return SECCLASS_SOCK_FILE;
1056 case S_IFLNK:
1057 return SECCLASS_LNK_FILE;
1058 case S_IFREG:
1059 return SECCLASS_FILE;
1060 case S_IFBLK:
1061 return SECCLASS_BLK_FILE;
1062 case S_IFDIR:
1063 return SECCLASS_DIR;
1064 case S_IFCHR:
1065 return SECCLASS_CHR_FILE;
1066 case S_IFIFO:
1067 return SECCLASS_FIFO_FILE;
1068
1069 }
1070
1071 return SECCLASS_FILE;
1072}
1073
James Morris13402582005-09-30 14:24:34 -04001074static inline int default_protocol_stream(int protocol)
1075{
1076 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1077}
1078
1079static inline int default_protocol_dgram(int protocol)
1080{
1081 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1082}
1083
Linus Torvalds1da177e2005-04-16 15:20:36 -07001084static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1085{
1086 switch (family) {
1087 case PF_UNIX:
1088 switch (type) {
1089 case SOCK_STREAM:
1090 case SOCK_SEQPACKET:
1091 return SECCLASS_UNIX_STREAM_SOCKET;
1092 case SOCK_DGRAM:
1093 return SECCLASS_UNIX_DGRAM_SOCKET;
1094 }
1095 break;
1096 case PF_INET:
1097 case PF_INET6:
1098 switch (type) {
1099 case SOCK_STREAM:
James Morris13402582005-09-30 14:24:34 -04001100 if (default_protocol_stream(protocol))
1101 return SECCLASS_TCP_SOCKET;
1102 else
1103 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001104 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001105 if (default_protocol_dgram(protocol))
1106 return SECCLASS_UDP_SOCKET;
1107 else
1108 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001109 case SOCK_DCCP:
1110 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001111 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001112 return SECCLASS_RAWIP_SOCKET;
1113 }
1114 break;
1115 case PF_NETLINK:
1116 switch (protocol) {
1117 case NETLINK_ROUTE:
1118 return SECCLASS_NETLINK_ROUTE_SOCKET;
1119 case NETLINK_FIREWALL:
1120 return SECCLASS_NETLINK_FIREWALL_SOCKET;
James Morris216efaa2005-08-15 20:34:48 -07001121 case NETLINK_INET_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001122 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1123 case NETLINK_NFLOG:
1124 return SECCLASS_NETLINK_NFLOG_SOCKET;
1125 case NETLINK_XFRM:
1126 return SECCLASS_NETLINK_XFRM_SOCKET;
1127 case NETLINK_SELINUX:
1128 return SECCLASS_NETLINK_SELINUX_SOCKET;
1129 case NETLINK_AUDIT:
1130 return SECCLASS_NETLINK_AUDIT_SOCKET;
1131 case NETLINK_IP6_FW:
1132 return SECCLASS_NETLINK_IP6FW_SOCKET;
1133 case NETLINK_DNRTMSG:
1134 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001135 case NETLINK_KOBJECT_UEVENT:
1136 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001137 default:
1138 return SECCLASS_NETLINK_SOCKET;
1139 }
1140 case PF_PACKET:
1141 return SECCLASS_PACKET_SOCKET;
1142 case PF_KEY:
1143 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001144 case PF_APPLETALK:
1145 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001146 }
1147
1148 return SECCLASS_SOCKET;
1149}
1150
1151#ifdef CONFIG_PROC_FS
1152static int selinux_proc_get_sid(struct proc_dir_entry *de,
1153 u16 tclass,
1154 u32 *sid)
1155{
1156 int buflen, rc;
1157 char *buffer, *path, *end;
1158
Eric Paris828dfe12008-04-17 13:17:49 -04001159 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001160 if (!buffer)
1161 return -ENOMEM;
1162
1163 buflen = PAGE_SIZE;
1164 end = buffer+buflen;
1165 *--end = '\0';
1166 buflen--;
1167 path = end-1;
1168 *path = '/';
1169 while (de && de != de->parent) {
1170 buflen -= de->namelen + 1;
1171 if (buflen < 0)
1172 break;
1173 end -= de->namelen;
1174 memcpy(end, de->name, de->namelen);
1175 *--end = '/';
1176 path = end;
1177 de = de->parent;
1178 }
1179 rc = security_genfs_sid("proc", path, tclass, sid);
1180 free_page((unsigned long)buffer);
1181 return rc;
1182}
1183#else
1184static int selinux_proc_get_sid(struct proc_dir_entry *de,
1185 u16 tclass,
1186 u32 *sid)
1187{
1188 return -EINVAL;
1189}
1190#endif
1191
1192/* The inode's security attributes must be initialized before first use. */
1193static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1194{
1195 struct superblock_security_struct *sbsec = NULL;
1196 struct inode_security_struct *isec = inode->i_security;
1197 u32 sid;
1198 struct dentry *dentry;
1199#define INITCONTEXTLEN 255
1200 char *context = NULL;
1201 unsigned len = 0;
1202 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001203
1204 if (isec->initialized)
1205 goto out;
1206
Eric Paris23970742006-09-25 23:32:01 -07001207 mutex_lock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001208 if (isec->initialized)
Eric Paris23970742006-09-25 23:32:01 -07001209 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001210
1211 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001212 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001213 /* Defer initialization until selinux_complete_init,
1214 after the initial policy is loaded and the security
1215 server is ready to handle calls. */
1216 spin_lock(&sbsec->isec_lock);
1217 if (list_empty(&isec->list))
1218 list_add(&isec->list, &sbsec->isec_head);
1219 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001220 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001221 }
1222
1223 switch (sbsec->behavior) {
1224 case SECURITY_FS_USE_XATTR:
1225 if (!inode->i_op->getxattr) {
1226 isec->sid = sbsec->def_sid;
1227 break;
1228 }
1229
1230 /* Need a dentry, since the xattr API requires one.
1231 Life would be simpler if we could just pass the inode. */
1232 if (opt_dentry) {
1233 /* Called from d_instantiate or d_splice_alias. */
1234 dentry = dget(opt_dentry);
1235 } else {
1236 /* Called from selinux_complete_init, try to find a dentry. */
1237 dentry = d_find_alias(inode);
1238 }
1239 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001240 /*
1241 * this is can be hit on boot when a file is accessed
1242 * before the policy is loaded. When we load policy we
1243 * may find inodes that have no dentry on the
1244 * sbsec->isec_head list. No reason to complain as these
1245 * will get fixed up the next time we go through
1246 * inode_doinit with a dentry, before these inodes could
1247 * be used again by userspace.
1248 */
Eric Paris23970742006-09-25 23:32:01 -07001249 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001250 }
1251
1252 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001253 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001254 if (!context) {
1255 rc = -ENOMEM;
1256 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001257 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001258 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001259 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001260 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1261 context, len);
1262 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001263 kfree(context);
1264
Linus Torvalds1da177e2005-04-16 15:20:36 -07001265 /* Need a larger buffer. Query for the right size. */
1266 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1267 NULL, 0);
1268 if (rc < 0) {
1269 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001270 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001271 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001273 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001274 if (!context) {
1275 rc = -ENOMEM;
1276 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001277 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001278 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001279 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001280 rc = inode->i_op->getxattr(dentry,
1281 XATTR_NAME_SELINUX,
1282 context, len);
1283 }
1284 dput(dentry);
1285 if (rc < 0) {
1286 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001287 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001288 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001289 -rc, inode->i_sb->s_id, inode->i_ino);
1290 kfree(context);
Eric Paris23970742006-09-25 23:32:01 -07001291 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001292 }
1293 /* Map ENODATA to the default file SID */
1294 sid = sbsec->def_sid;
1295 rc = 0;
1296 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001297 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001298 sbsec->def_sid,
1299 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001300 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001301 char *dev = inode->i_sb->s_id;
1302 unsigned long ino = inode->i_ino;
1303
1304 if (rc == -EINVAL) {
1305 if (printk_ratelimit())
1306 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1307 "context=%s. This indicates you may need to relabel the inode or the "
1308 "filesystem in question.\n", ino, dev, context);
1309 } else {
1310 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1311 "returned %d for dev=%s ino=%ld\n",
1312 __func__, context, -rc, dev, ino);
1313 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001314 kfree(context);
1315 /* Leave with the unlabeled SID */
1316 rc = 0;
1317 break;
1318 }
1319 }
1320 kfree(context);
1321 isec->sid = sid;
1322 break;
1323 case SECURITY_FS_USE_TASK:
1324 isec->sid = isec->task_sid;
1325 break;
1326 case SECURITY_FS_USE_TRANS:
1327 /* Default to the fs SID. */
1328 isec->sid = sbsec->sid;
1329
1330 /* Try to obtain a transition SID. */
1331 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1332 rc = security_transition_sid(isec->task_sid,
1333 sbsec->sid,
1334 isec->sclass,
1335 &sid);
1336 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001337 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001338 isec->sid = sid;
1339 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001340 case SECURITY_FS_USE_MNTPOINT:
1341 isec->sid = sbsec->mntpoint_sid;
1342 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001343 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001344 /* Default to the fs superblock SID. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001345 isec->sid = sbsec->sid;
1346
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001347 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001348 struct proc_inode *proci = PROC_I(inode);
1349 if (proci->pde) {
1350 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1351 rc = selinux_proc_get_sid(proci->pde,
1352 isec->sclass,
1353 &sid);
1354 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001355 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001356 isec->sid = sid;
1357 }
1358 }
1359 break;
1360 }
1361
1362 isec->initialized = 1;
1363
Eric Paris23970742006-09-25 23:32:01 -07001364out_unlock:
1365 mutex_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001366out:
1367 if (isec->sclass == SECCLASS_FILE)
1368 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001369 return rc;
1370}
1371
1372/* Convert a Linux signal to an access vector. */
1373static inline u32 signal_to_av(int sig)
1374{
1375 u32 perm = 0;
1376
1377 switch (sig) {
1378 case SIGCHLD:
1379 /* Commonly granted from child to parent. */
1380 perm = PROCESS__SIGCHLD;
1381 break;
1382 case SIGKILL:
1383 /* Cannot be caught or ignored */
1384 perm = PROCESS__SIGKILL;
1385 break;
1386 case SIGSTOP:
1387 /* Cannot be caught or ignored */
1388 perm = PROCESS__SIGSTOP;
1389 break;
1390 default:
1391 /* All other signals. */
1392 perm = PROCESS__SIGNAL;
1393 break;
1394 }
1395
1396 return perm;
1397}
1398
David Howells275bb412008-11-14 10:39:19 +11001399/*
David Howellsd84f4f92008-11-14 10:39:23 +11001400 * Check permission between a pair of credentials
1401 * fork check, ptrace check, etc.
1402 */
1403static int cred_has_perm(const struct cred *actor,
1404 const struct cred *target,
1405 u32 perms)
1406{
1407 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1408
1409 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1410}
1411
1412/*
David Howells88e67f32008-11-14 10:39:21 +11001413 * Check permission between a pair of tasks, e.g. signal checks,
David Howells275bb412008-11-14 10:39:19 +11001414 * fork check, ptrace check, etc.
1415 * tsk1 is the actor and tsk2 is the target
David Howells3b11a1d2008-11-14 10:39:26 +11001416 * - this uses the default subjective creds of tsk1
David Howells275bb412008-11-14 10:39:19 +11001417 */
1418static int task_has_perm(const struct task_struct *tsk1,
1419 const struct task_struct *tsk2,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001420 u32 perms)
1421{
David Howells275bb412008-11-14 10:39:19 +11001422 const struct task_security_struct *__tsec1, *__tsec2;
1423 u32 sid1, sid2;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001424
David Howells275bb412008-11-14 10:39:19 +11001425 rcu_read_lock();
1426 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1427 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1428 rcu_read_unlock();
1429 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001430}
1431
David Howells3b11a1d2008-11-14 10:39:26 +11001432/*
1433 * Check permission between current and another task, e.g. signal checks,
1434 * fork check, ptrace check, etc.
1435 * current is the actor and tsk2 is the target
1436 * - this uses current's subjective creds
1437 */
1438static int current_has_perm(const struct task_struct *tsk,
1439 u32 perms)
1440{
1441 u32 sid, tsid;
1442
1443 sid = current_sid();
1444 tsid = task_sid(tsk);
1445 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1446}
1447
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001448#if CAP_LAST_CAP > 63
1449#error Fix SELinux to handle capabilities > 63.
1450#endif
1451
Linus Torvalds1da177e2005-04-16 15:20:36 -07001452/* Check whether a task is allowed to use a capability. */
1453static int task_has_capability(struct task_struct *tsk,
David Howells3699c532009-01-06 22:27:01 +00001454 const struct cred *cred,
Eric Paris06112162008-11-11 22:02:50 +11001455 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001456{
Thomas Liu2bf49692009-07-14 12:14:09 -04001457 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001458 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001459 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001460 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001461 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001462 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001463
Thomas Liu2bf49692009-07-14 12:14:09 -04001464 COMMON_AUDIT_DATA_INIT(&ad, CAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001465 ad.tsk = tsk;
1466 ad.u.cap = cap;
1467
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001468 switch (CAP_TO_INDEX(cap)) {
1469 case 0:
1470 sclass = SECCLASS_CAPABILITY;
1471 break;
1472 case 1:
1473 sclass = SECCLASS_CAPABILITY2;
1474 break;
1475 default:
1476 printk(KERN_ERR
1477 "SELinux: out of range capability %d\n", cap);
1478 BUG();
1479 }
Eric Paris06112162008-11-11 22:02:50 +11001480
David Howells275bb412008-11-14 10:39:19 +11001481 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris06112162008-11-11 22:02:50 +11001482 if (audit == SECURITY_CAP_AUDIT)
David Howells275bb412008-11-14 10:39:19 +11001483 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
Eric Paris06112162008-11-11 22:02:50 +11001484 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001485}
1486
1487/* Check whether a task is allowed to use a system operation. */
1488static int task_has_system(struct task_struct *tsk,
1489 u32 perms)
1490{
David Howells275bb412008-11-14 10:39:19 +11001491 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001492
David Howells275bb412008-11-14 10:39:19 +11001493 return avc_has_perm(sid, SECINITSID_KERNEL,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001494 SECCLASS_SYSTEM, perms, NULL);
1495}
1496
1497/* Check whether a task has a particular permission to an inode.
1498 The 'adp' parameter is optional and allows other audit
1499 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001500static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001501 struct inode *inode,
1502 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001503 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001504{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001505 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001506 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001507 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001508
David Howellse0e81732009-09-02 09:13:40 +01001509 validate_creds(cred);
1510
Eric Paris828dfe12008-04-17 13:17:49 -04001511 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001512 return 0;
1513
David Howells88e67f32008-11-14 10:39:21 +11001514 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001515 isec = inode->i_security;
1516
1517 if (!adp) {
1518 adp = &ad;
Thomas Liu2bf49692009-07-14 12:14:09 -04001519 COMMON_AUDIT_DATA_INIT(&ad, FS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001520 ad.u.fs.inode = inode;
1521 }
1522
David Howells275bb412008-11-14 10:39:19 +11001523 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001524}
1525
1526/* Same as inode_has_perm, but pass explicit audit data containing
1527 the dentry to help the auditing code to more easily generate the
1528 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001529static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001530 struct vfsmount *mnt,
1531 struct dentry *dentry,
1532 u32 av)
1533{
1534 struct inode *inode = dentry->d_inode;
Thomas Liu2bf49692009-07-14 12:14:09 -04001535 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001536
Thomas Liu2bf49692009-07-14 12:14:09 -04001537 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001538 ad.u.fs.path.mnt = mnt;
1539 ad.u.fs.path.dentry = dentry;
David Howells88e67f32008-11-14 10:39:21 +11001540 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001541}
1542
1543/* Check whether a task can use an open file descriptor to
1544 access an inode in a given way. Check access to the
1545 descriptor itself, and then use dentry_has_perm to
1546 check a particular permission to the file.
1547 Access to the descriptor is implicitly granted if it
1548 has the same SID as the process. If av is zero, then
1549 access to the file is not checked, e.g. for cases
1550 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001551static int file_has_perm(const struct cred *cred,
1552 struct file *file,
1553 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001554{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001555 struct file_security_struct *fsec = file->f_security;
Jan Blunck44707fd2008-02-14 19:38:33 -08001556 struct inode *inode = file->f_path.dentry->d_inode;
Thomas Liu2bf49692009-07-14 12:14:09 -04001557 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001558 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001559 int rc;
1560
Thomas Liu2bf49692009-07-14 12:14:09 -04001561 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001562 ad.u.fs.path = file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001563
David Howells275bb412008-11-14 10:39:19 +11001564 if (sid != fsec->sid) {
1565 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001566 SECCLASS_FD,
1567 FD__USE,
1568 &ad);
1569 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001570 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001571 }
1572
1573 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001574 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001575 if (av)
David Howells88e67f32008-11-14 10:39:21 +11001576 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001577
David Howells88e67f32008-11-14 10:39:21 +11001578out:
1579 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001580}
1581
1582/* Check whether a task can create a file. */
1583static int may_create(struct inode *dir,
1584 struct dentry *dentry,
1585 u16 tclass)
1586{
David Howells275bb412008-11-14 10:39:19 +11001587 const struct cred *cred = current_cred();
1588 const struct task_security_struct *tsec = cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001589 struct inode_security_struct *dsec;
1590 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001591 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001592 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001593 int rc;
1594
Linus Torvalds1da177e2005-04-16 15:20:36 -07001595 dsec = dir->i_security;
1596 sbsec = dir->i_sb->s_security;
1597
David Howells275bb412008-11-14 10:39:19 +11001598 sid = tsec->sid;
1599 newsid = tsec->create_sid;
1600
Thomas Liu2bf49692009-07-14 12:14:09 -04001601 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001602 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001603
David Howells275bb412008-11-14 10:39:19 +11001604 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001605 DIR__ADD_NAME | DIR__SEARCH,
1606 &ad);
1607 if (rc)
1608 return rc;
1609
David P. Quigleycd895962009-01-16 09:22:04 -05001610 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
David Howells275bb412008-11-14 10:39:19 +11001611 rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001612 if (rc)
1613 return rc;
1614 }
1615
David Howells275bb412008-11-14 10:39:19 +11001616 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001617 if (rc)
1618 return rc;
1619
1620 return avc_has_perm(newsid, sbsec->sid,
1621 SECCLASS_FILESYSTEM,
1622 FILESYSTEM__ASSOCIATE, &ad);
1623}
1624
Michael LeMay4eb582c2006-06-26 00:24:57 -07001625/* Check whether a task can create a key. */
1626static int may_create_key(u32 ksid,
1627 struct task_struct *ctx)
1628{
David Howells275bb412008-11-14 10:39:19 +11001629 u32 sid = task_sid(ctx);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001630
David Howells275bb412008-11-14 10:39:19 +11001631 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001632}
1633
Eric Paris828dfe12008-04-17 13:17:49 -04001634#define MAY_LINK 0
1635#define MAY_UNLINK 1
1636#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001637
1638/* Check whether a task can link, unlink, or rmdir a file/directory. */
1639static int may_link(struct inode *dir,
1640 struct dentry *dentry,
1641 int kind)
1642
1643{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001644 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001645 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001646 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001647 u32 av;
1648 int rc;
1649
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 dsec = dir->i_security;
1651 isec = dentry->d_inode->i_security;
1652
Thomas Liu2bf49692009-07-14 12:14:09 -04001653 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001654 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001655
1656 av = DIR__SEARCH;
1657 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001658 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001659 if (rc)
1660 return rc;
1661
1662 switch (kind) {
1663 case MAY_LINK:
1664 av = FILE__LINK;
1665 break;
1666 case MAY_UNLINK:
1667 av = FILE__UNLINK;
1668 break;
1669 case MAY_RMDIR:
1670 av = DIR__RMDIR;
1671 break;
1672 default:
Eric Paris744ba352008-04-17 11:52:44 -04001673 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1674 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001675 return 0;
1676 }
1677
David Howells275bb412008-11-14 10:39:19 +11001678 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001679 return rc;
1680}
1681
1682static inline int may_rename(struct inode *old_dir,
1683 struct dentry *old_dentry,
1684 struct inode *new_dir,
1685 struct dentry *new_dentry)
1686{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001687 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001688 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001689 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001690 u32 av;
1691 int old_is_dir, new_is_dir;
1692 int rc;
1693
Linus Torvalds1da177e2005-04-16 15:20:36 -07001694 old_dsec = old_dir->i_security;
1695 old_isec = old_dentry->d_inode->i_security;
1696 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1697 new_dsec = new_dir->i_security;
1698
Thomas Liu2bf49692009-07-14 12:14:09 -04001699 COMMON_AUDIT_DATA_INIT(&ad, FS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001700
Jan Blunck44707fd2008-02-14 19:38:33 -08001701 ad.u.fs.path.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11001702 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001703 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1704 if (rc)
1705 return rc;
David Howells275bb412008-11-14 10:39:19 +11001706 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001707 old_isec->sclass, FILE__RENAME, &ad);
1708 if (rc)
1709 return rc;
1710 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11001711 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001712 old_isec->sclass, DIR__REPARENT, &ad);
1713 if (rc)
1714 return rc;
1715 }
1716
Jan Blunck44707fd2008-02-14 19:38:33 -08001717 ad.u.fs.path.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001718 av = DIR__ADD_NAME | DIR__SEARCH;
1719 if (new_dentry->d_inode)
1720 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11001721 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001722 if (rc)
1723 return rc;
1724 if (new_dentry->d_inode) {
1725 new_isec = new_dentry->d_inode->i_security;
1726 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11001727 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001728 new_isec->sclass,
1729 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1730 if (rc)
1731 return rc;
1732 }
1733
1734 return 0;
1735}
1736
1737/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001738static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001739 struct super_block *sb,
1740 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001741 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001742{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001743 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11001744 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001745
Linus Torvalds1da177e2005-04-16 15:20:36 -07001746 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11001747 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001748}
1749
1750/* Convert a Linux mode and permission mask to an access vector. */
1751static inline u32 file_mask_to_av(int mode, int mask)
1752{
1753 u32 av = 0;
1754
1755 if ((mode & S_IFMT) != S_IFDIR) {
1756 if (mask & MAY_EXEC)
1757 av |= FILE__EXECUTE;
1758 if (mask & MAY_READ)
1759 av |= FILE__READ;
1760
1761 if (mask & MAY_APPEND)
1762 av |= FILE__APPEND;
1763 else if (mask & MAY_WRITE)
1764 av |= FILE__WRITE;
1765
1766 } else {
1767 if (mask & MAY_EXEC)
1768 av |= DIR__SEARCH;
1769 if (mask & MAY_WRITE)
1770 av |= DIR__WRITE;
1771 if (mask & MAY_READ)
1772 av |= DIR__READ;
1773 }
1774
1775 return av;
1776}
1777
1778/* Convert a Linux file to an access vector. */
1779static inline u32 file_to_av(struct file *file)
1780{
1781 u32 av = 0;
1782
1783 if (file->f_mode & FMODE_READ)
1784 av |= FILE__READ;
1785 if (file->f_mode & FMODE_WRITE) {
1786 if (file->f_flags & O_APPEND)
1787 av |= FILE__APPEND;
1788 else
1789 av |= FILE__WRITE;
1790 }
Stephen Smalley0794c662008-03-17 08:55:18 -04001791 if (!av) {
1792 /*
1793 * Special file opened with flags 3 for ioctl-only use.
1794 */
1795 av = FILE__IOCTL;
1796 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001797
1798 return av;
1799}
1800
Eric Paris8b6a5a32008-10-29 17:06:46 -04001801/*
1802 * Convert a file to an access vector and include the correct open
1803 * open permission.
1804 */
1805static inline u32 open_file_to_av(struct file *file)
1806{
1807 u32 av = file_to_av(file);
1808
1809 if (selinux_policycap_openperm) {
1810 mode_t mode = file->f_path.dentry->d_inode->i_mode;
1811 /*
1812 * lnk files and socks do not really have an 'open'
1813 */
1814 if (S_ISREG(mode))
1815 av |= FILE__OPEN;
1816 else if (S_ISCHR(mode))
1817 av |= CHR_FILE__OPEN;
1818 else if (S_ISBLK(mode))
1819 av |= BLK_FILE__OPEN;
1820 else if (S_ISFIFO(mode))
1821 av |= FIFO_FILE__OPEN;
1822 else if (S_ISDIR(mode))
1823 av |= DIR__OPEN;
Eric Paris6a25b272009-03-05 13:40:35 -05001824 else if (S_ISSOCK(mode))
1825 av |= SOCK_FILE__OPEN;
Eric Paris8b6a5a32008-10-29 17:06:46 -04001826 else
1827 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1828 "unknown mode:%o\n", __func__, mode);
1829 }
1830 return av;
1831}
1832
Linus Torvalds1da177e2005-04-16 15:20:36 -07001833/* Hook functions begin here. */
1834
Ingo Molnar9e488582009-05-07 19:26:19 +10001835static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01001836 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001837{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001838 int rc;
1839
Ingo Molnar9e488582009-05-07 19:26:19 +10001840 rc = cap_ptrace_access_check(child, mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001841 if (rc)
1842 return rc;
1843
Stephen Smalley006ebb42008-05-19 08:32:49 -04001844 if (mode == PTRACE_MODE_READ) {
David Howells275bb412008-11-14 10:39:19 +11001845 u32 sid = current_sid();
1846 u32 csid = task_sid(child);
1847 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalley006ebb42008-05-19 08:32:49 -04001848 }
1849
David Howells3b11a1d2008-11-14 10:39:26 +11001850 return current_has_perm(child, PROCESS__PTRACE);
David Howells5cd9c582008-08-14 11:37:28 +01001851}
1852
1853static int selinux_ptrace_traceme(struct task_struct *parent)
1854{
1855 int rc;
1856
Eric Paris200ac532009-02-12 15:01:04 -05001857 rc = cap_ptrace_traceme(parent);
David Howells5cd9c582008-08-14 11:37:28 +01001858 if (rc)
1859 return rc;
1860
1861 return task_has_perm(parent, current, PROCESS__PTRACE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001862}
1863
1864static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04001865 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001866{
1867 int error;
1868
David Howells3b11a1d2008-11-14 10:39:26 +11001869 error = current_has_perm(target, PROCESS__GETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001870 if (error)
1871 return error;
1872
Eric Paris200ac532009-02-12 15:01:04 -05001873 return cap_capget(target, effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001874}
1875
David Howellsd84f4f92008-11-14 10:39:23 +11001876static int selinux_capset(struct cred *new, const struct cred *old,
1877 const kernel_cap_t *effective,
1878 const kernel_cap_t *inheritable,
1879 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001880{
1881 int error;
1882
Eric Paris200ac532009-02-12 15:01:04 -05001883 error = cap_capset(new, old,
David Howellsd84f4f92008-11-14 10:39:23 +11001884 effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001885 if (error)
1886 return error;
1887
David Howellsd84f4f92008-11-14 10:39:23 +11001888 return cred_has_perm(old, new, PROCESS__SETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001889}
1890
James Morris5626d3e2009-01-30 10:05:06 +11001891/*
1892 * (This comment used to live with the selinux_task_setuid hook,
1893 * which was removed).
1894 *
1895 * Since setuid only affects the current process, and since the SELinux
1896 * controls are not based on the Linux identity attributes, SELinux does not
1897 * need to control this operation. However, SELinux does control the use of
1898 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1899 */
1900
David Howells3699c532009-01-06 22:27:01 +00001901static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1902 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001903{
1904 int rc;
1905
Eric Paris200ac532009-02-12 15:01:04 -05001906 rc = cap_capable(tsk, cred, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001907 if (rc)
1908 return rc;
1909
David Howells3699c532009-01-06 22:27:01 +00001910 return task_has_capability(tsk, cred, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001911}
1912
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001913static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1914{
1915 int buflen, rc;
1916 char *buffer, *path, *end;
1917
1918 rc = -ENOMEM;
Eric Paris828dfe12008-04-17 13:17:49 -04001919 buffer = (char *)__get_free_page(GFP_KERNEL);
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001920 if (!buffer)
1921 goto out;
1922
1923 buflen = PAGE_SIZE;
1924 end = buffer+buflen;
1925 *--end = '\0';
1926 buflen--;
1927 path = end-1;
1928 *path = '/';
1929 while (table) {
1930 const char *name = table->procname;
1931 size_t namelen = strlen(name);
1932 buflen -= namelen + 1;
1933 if (buflen < 0)
1934 goto out_free;
1935 end -= namelen;
1936 memcpy(end, name, namelen);
1937 *--end = '/';
1938 path = end;
1939 table = table->parent;
1940 }
Eric W. Biedermanb599fdf2007-02-14 00:34:15 -08001941 buflen -= 4;
1942 if (buflen < 0)
1943 goto out_free;
1944 end -= 4;
1945 memcpy(end, "/sys", 4);
1946 path = end;
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001947 rc = security_genfs_sid("proc", path, tclass, sid);
1948out_free:
1949 free_page((unsigned long)buffer);
1950out:
1951 return rc;
1952}
1953
Linus Torvalds1da177e2005-04-16 15:20:36 -07001954static int selinux_sysctl(ctl_table *table, int op)
1955{
1956 int error = 0;
1957 u32 av;
David Howells275bb412008-11-14 10:39:19 +11001958 u32 tsid, sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001959 int rc;
1960
David Howells275bb412008-11-14 10:39:19 +11001961 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001962
Eric W. Biederman3fbfa982007-02-14 00:34:14 -08001963 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1964 SECCLASS_DIR : SECCLASS_FILE, &tsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001965 if (rc) {
1966 /* Default to the well-defined sysctl SID. */
1967 tsid = SECINITSID_SYSCTL;
1968 }
1969
1970 /* The op values are "defined" in sysctl.c, thereby creating
1971 * a bad coupling between this module and sysctl.c */
Eric Paris828dfe12008-04-17 13:17:49 -04001972 if (op == 001) {
David Howells275bb412008-11-14 10:39:19 +11001973 error = avc_has_perm(sid, tsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001974 SECCLASS_DIR, DIR__SEARCH, NULL);
1975 } else {
1976 av = 0;
1977 if (op & 004)
1978 av |= FILE__READ;
1979 if (op & 002)
1980 av |= FILE__WRITE;
1981 if (av)
David Howells275bb412008-11-14 10:39:19 +11001982 error = avc_has_perm(sid, tsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001983 SECCLASS_FILE, av, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001984 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001985
1986 return error;
1987}
1988
1989static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1990{
David Howells88e67f32008-11-14 10:39:21 +11001991 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001992 int rc = 0;
1993
1994 if (!sb)
1995 return 0;
1996
1997 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04001998 case Q_SYNC:
1999 case Q_QUOTAON:
2000 case Q_QUOTAOFF:
2001 case Q_SETINFO:
2002 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002003 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002004 break;
2005 case Q_GETFMT:
2006 case Q_GETINFO:
2007 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002008 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002009 break;
2010 default:
2011 rc = 0; /* let the kernel handle invalid cmds */
2012 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002013 }
2014 return rc;
2015}
2016
2017static int selinux_quota_on(struct dentry *dentry)
2018{
David Howells88e67f32008-11-14 10:39:21 +11002019 const struct cred *cred = current_cred();
2020
2021 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002022}
2023
Kees Cook00234592010-02-03 15:36:43 -08002024static int selinux_syslog(int type, bool from_file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002025{
2026 int rc;
2027
Kees Cook00234592010-02-03 15:36:43 -08002028 rc = cap_syslog(type, from_file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002029 if (rc)
2030 return rc;
2031
2032 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002033 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2034 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002035 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2036 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002037 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2038 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2039 /* Set level of messages printed to console */
2040 case SYSLOG_ACTION_CONSOLE_LEVEL:
Eric Paris828dfe12008-04-17 13:17:49 -04002041 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2042 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002043 case SYSLOG_ACTION_CLOSE: /* Close log */
2044 case SYSLOG_ACTION_OPEN: /* Open log */
2045 case SYSLOG_ACTION_READ: /* Read from log */
2046 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2047 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002048 default:
2049 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2050 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002051 }
2052 return rc;
2053}
2054
2055/*
2056 * Check that a process has enough memory to allocate a new virtual
2057 * mapping. 0 means there is enough memory for the allocation to
2058 * succeed and -ENOMEM implies there is not.
2059 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002060 * Do not audit the selinux permission check, as this is applied to all
2061 * processes that allocate mappings.
2062 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002063static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002064{
2065 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002066
David Howells3699c532009-01-06 22:27:01 +00002067 rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
2068 SECURITY_CAP_NOAUDIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002069 if (rc == 0)
2070 cap_sys_admin = 1;
2071
Alan Cox34b4e4a2007-08-22 14:01:28 -07002072 return __vm_enough_memory(mm, pages, cap_sys_admin);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002073}
2074
2075/* binprm security operations */
2076
David Howellsa6f76f22008-11-14 10:39:24 +11002077static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002078{
David Howellsa6f76f22008-11-14 10:39:24 +11002079 const struct task_security_struct *old_tsec;
2080 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002081 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002082 struct common_audit_data ad;
David Howellsa6f76f22008-11-14 10:39:24 +11002083 struct inode *inode = bprm->file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002084 int rc;
2085
Eric Paris200ac532009-02-12 15:01:04 -05002086 rc = cap_bprm_set_creds(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002087 if (rc)
2088 return rc;
2089
David Howellsa6f76f22008-11-14 10:39:24 +11002090 /* SELinux context only depends on initial program or script and not
2091 * the script interpreter */
2092 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002093 return 0;
2094
David Howellsa6f76f22008-11-14 10:39:24 +11002095 old_tsec = current_security();
2096 new_tsec = bprm->cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002097 isec = inode->i_security;
2098
2099 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002100 new_tsec->sid = old_tsec->sid;
2101 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002102
Michael LeMay28eba5b2006-06-27 02:53:42 -07002103 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002104 new_tsec->create_sid = 0;
2105 new_tsec->keycreate_sid = 0;
2106 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002107
David Howellsa6f76f22008-11-14 10:39:24 +11002108 if (old_tsec->exec_sid) {
2109 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002110 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002111 new_tsec->exec_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002112 } else {
2113 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11002114 rc = security_transition_sid(old_tsec->sid, isec->sid,
2115 SECCLASS_PROCESS, &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002116 if (rc)
2117 return rc;
2118 }
2119
Thomas Liu2bf49692009-07-14 12:14:09 -04002120 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002121 ad.u.fs.path = bprm->file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002122
Josef Sipek3d5ff522006-12-08 02:37:38 -08002123 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
David Howellsa6f76f22008-11-14 10:39:24 +11002124 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002125
David Howellsa6f76f22008-11-14 10:39:24 +11002126 if (new_tsec->sid == old_tsec->sid) {
2127 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002128 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2129 if (rc)
2130 return rc;
2131 } else {
2132 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002133 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002134 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2135 if (rc)
2136 return rc;
2137
David Howellsa6f76f22008-11-14 10:39:24 +11002138 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002139 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2140 if (rc)
2141 return rc;
2142
David Howellsa6f76f22008-11-14 10:39:24 +11002143 /* Check for shared state */
2144 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2145 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2146 SECCLASS_PROCESS, PROCESS__SHARE,
2147 NULL);
2148 if (rc)
2149 return -EPERM;
2150 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002151
David Howellsa6f76f22008-11-14 10:39:24 +11002152 /* Make sure that anyone attempting to ptrace over a task that
2153 * changes its SID has the appropriate permit */
2154 if (bprm->unsafe &
2155 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2156 struct task_struct *tracer;
2157 struct task_security_struct *sec;
2158 u32 ptsid = 0;
2159
2160 rcu_read_lock();
2161 tracer = tracehook_tracer_task(current);
2162 if (likely(tracer != NULL)) {
2163 sec = __task_cred(tracer)->security;
2164 ptsid = sec->sid;
2165 }
2166 rcu_read_unlock();
2167
2168 if (ptsid != 0) {
2169 rc = avc_has_perm(ptsid, new_tsec->sid,
2170 SECCLASS_PROCESS,
2171 PROCESS__PTRACE, NULL);
2172 if (rc)
2173 return -EPERM;
2174 }
2175 }
2176
2177 /* Clear any possibly unsafe personality bits on exec: */
2178 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002179 }
2180
Linus Torvalds1da177e2005-04-16 15:20:36 -07002181 return 0;
2182}
2183
Eric Paris828dfe12008-04-17 13:17:49 -04002184static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002185{
David Howells275bb412008-11-14 10:39:19 +11002186 const struct cred *cred = current_cred();
2187 const struct task_security_struct *tsec = cred->security;
2188 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002189 int atsecure = 0;
2190
David Howells275bb412008-11-14 10:39:19 +11002191 sid = tsec->sid;
2192 osid = tsec->osid;
2193
2194 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002195 /* Enable secure mode for SIDs transitions unless
2196 the noatsecure permission is granted between
2197 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002198 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002199 SECCLASS_PROCESS,
2200 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002201 }
2202
Eric Paris200ac532009-02-12 15:01:04 -05002203 return (atsecure || cap_bprm_secureexec(bprm));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002204}
2205
Linus Torvalds1da177e2005-04-16 15:20:36 -07002206extern struct vfsmount *selinuxfs_mount;
2207extern struct dentry *selinux_null;
2208
2209/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002210static inline void flush_unauthorized_files(const struct cred *cred,
2211 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002212{
Thomas Liu2bf49692009-07-14 12:14:09 -04002213 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002214 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002215 struct tty_struct *tty;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002216 struct fdtable *fdt;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002217 long j = -1;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002218 int drop_tty = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002219
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002220 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002221 if (tty) {
2222 file_list_lock();
Eric Paris37dd0bd2008-10-31 17:40:00 -04002223 if (!list_empty(&tty->tty_files)) {
2224 struct inode *inode;
2225
Linus Torvalds1da177e2005-04-16 15:20:36 -07002226 /* Revalidate access to controlling tty.
2227 Use inode_has_perm on the tty inode directly rather
2228 than using file_has_perm, as this particular open
2229 file may belong to another process and we are only
2230 interested in the inode-based check here. */
Eric Paris37dd0bd2008-10-31 17:40:00 -04002231 file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
2232 inode = file->f_path.dentry->d_inode;
David Howells88e67f32008-11-14 10:39:21 +11002233 if (inode_has_perm(cred, inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002234 FILE__READ | FILE__WRITE, NULL)) {
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002235 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002236 }
2237 }
2238 file_list_unlock();
Alan Cox452a00d2008-10-13 10:39:13 +01002239 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002240 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002241 /* Reset controlling tty. */
2242 if (drop_tty)
2243 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002244
2245 /* Revalidate access to inherited open files. */
2246
Thomas Liu2bf49692009-07-14 12:14:09 -04002247 COMMON_AUDIT_DATA_INIT(&ad, FS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002248
2249 spin_lock(&files->file_lock);
2250 for (;;) {
2251 unsigned long set, i;
2252 int fd;
2253
2254 j++;
2255 i = j * __NFDBITS;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002256 fdt = files_fdtable(files);
Vadim Lobanovbbea9f62006-12-10 02:21:12 -08002257 if (i >= fdt->max_fds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002258 break;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002259 set = fdt->open_fds->fds_bits[j];
Linus Torvalds1da177e2005-04-16 15:20:36 -07002260 if (!set)
2261 continue;
2262 spin_unlock(&files->file_lock);
Eric Paris828dfe12008-04-17 13:17:49 -04002263 for ( ; set ; i++, set >>= 1) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002264 if (set & 1) {
2265 file = fget(i);
2266 if (!file)
2267 continue;
David Howells88e67f32008-11-14 10:39:21 +11002268 if (file_has_perm(cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002269 file,
2270 file_to_av(file))) {
2271 sys_close(i);
2272 fd = get_unused_fd();
2273 if (fd != i) {
2274 if (fd >= 0)
2275 put_unused_fd(fd);
2276 fput(file);
2277 continue;
2278 }
2279 if (devnull) {
Nick Piggin095975d2006-01-08 01:02:19 -08002280 get_file(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002281 } else {
David Howells745ca242008-11-14 10:39:22 +11002282 devnull = dentry_open(
2283 dget(selinux_null),
2284 mntget(selinuxfs_mount),
2285 O_RDWR, cred);
Akinobu Mitafc5d81e2006-11-27 15:16:48 +09002286 if (IS_ERR(devnull)) {
2287 devnull = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002288 put_unused_fd(fd);
2289 fput(file);
2290 continue;
2291 }
2292 }
2293 fd_install(fd, devnull);
2294 }
2295 fput(file);
2296 }
2297 }
2298 spin_lock(&files->file_lock);
2299
2300 }
2301 spin_unlock(&files->file_lock);
2302}
2303
Linus Torvalds1da177e2005-04-16 15:20:36 -07002304/*
David Howellsa6f76f22008-11-14 10:39:24 +11002305 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002306 */
David Howellsa6f76f22008-11-14 10:39:24 +11002307static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002308{
David Howellsa6f76f22008-11-14 10:39:24 +11002309 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002310 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002311 int rc, i;
2312
David Howellsa6f76f22008-11-14 10:39:24 +11002313 new_tsec = bprm->cred->security;
2314 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002315 return;
2316
2317 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002318 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002319
David Howellsa6f76f22008-11-14 10:39:24 +11002320 /* Always clear parent death signal on SID transitions. */
2321 current->pdeath_signal = 0;
2322
2323 /* Check whether the new SID can inherit resource limits from the old
2324 * SID. If not, reset all soft limits to the lower of the current
2325 * task's hard limit and the init task's soft limit.
2326 *
2327 * Note that the setting of hard limits (even to lower them) can be
2328 * controlled by the setrlimit check. The inclusion of the init task's
2329 * soft limit into the computation is to avoid resetting soft limits
2330 * higher than the default soft limit for cases where the default is
2331 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2332 */
2333 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2334 PROCESS__RLIMITINH, NULL);
2335 if (rc) {
2336 for (i = 0; i < RLIM_NLIMITS; i++) {
2337 rlim = current->signal->rlim + i;
2338 initrlim = init_task.signal->rlim + i;
2339 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2340 }
Jiri Slaby17740d82009-08-28 10:47:16 +02002341 update_rlimit_cpu(current->signal->rlim[RLIMIT_CPU].rlim_cur);
David Howellsa6f76f22008-11-14 10:39:24 +11002342 }
2343}
2344
2345/*
2346 * Clean up the process immediately after the installation of new credentials
2347 * due to exec
2348 */
2349static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2350{
2351 const struct task_security_struct *tsec = current_security();
2352 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002353 u32 osid, sid;
2354 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002355
David Howellsa6f76f22008-11-14 10:39:24 +11002356 osid = tsec->osid;
2357 sid = tsec->sid;
2358
2359 if (sid == osid)
2360 return;
2361
2362 /* Check whether the new SID can inherit signal state from the old SID.
2363 * If not, clear itimers to avoid subsequent signal generation and
2364 * flush and unblock signals.
2365 *
2366 * This must occur _after_ the task SID has been updated so that any
2367 * kill done after the flush will be checked against the new SID.
2368 */
2369 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002370 if (rc) {
2371 memset(&itimer, 0, sizeof itimer);
2372 for (i = 0; i < 3; i++)
2373 do_setitimer(i, &itimer, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002374 spin_lock_irq(&current->sighand->siglock);
David Howells3bcac022009-04-29 13:45:05 +01002375 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2376 __flush_signals(current);
2377 flush_signal_handlers(current, 1);
2378 sigemptyset(&current->blocked);
2379 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002380 spin_unlock_irq(&current->sighand->siglock);
2381 }
2382
David Howellsa6f76f22008-11-14 10:39:24 +11002383 /* Wake up the parent if it is waiting so that it can recheck
2384 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002385 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002386 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002387 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002388}
2389
2390/* superblock security operations */
2391
2392static int selinux_sb_alloc_security(struct super_block *sb)
2393{
2394 return superblock_alloc_security(sb);
2395}
2396
2397static void selinux_sb_free_security(struct super_block *sb)
2398{
2399 superblock_free_security(sb);
2400}
2401
2402static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2403{
2404 if (plen > olen)
2405 return 0;
2406
2407 return !memcmp(prefix, option, plen);
2408}
2409
2410static inline int selinux_option(char *option, int len)
2411{
Eric Paris832cbd92008-04-01 13:24:09 -04002412 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2413 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2414 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002415 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2416 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002417}
2418
2419static inline void take_option(char **to, char *from, int *first, int len)
2420{
2421 if (!*first) {
2422 **to = ',';
2423 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002424 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002425 *first = 0;
2426 memcpy(*to, from, len);
2427 *to += len;
2428}
2429
Eric Paris828dfe12008-04-17 13:17:49 -04002430static inline void take_selinux_option(char **to, char *from, int *first,
2431 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002432{
2433 int current_size = 0;
2434
2435 if (!*first) {
2436 **to = '|';
2437 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002438 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002439 *first = 0;
2440
2441 while (current_size < len) {
2442 if (*from != '"') {
2443 **to = *from;
2444 *to += 1;
2445 }
2446 from += 1;
2447 current_size += 1;
2448 }
2449}
2450
Eric Parise0007522008-03-05 10:31:54 -05002451static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002452{
2453 int fnosec, fsec, rc = 0;
2454 char *in_save, *in_curr, *in_end;
2455 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002456 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002457
2458 in_curr = orig;
2459 sec_curr = copy;
2460
Linus Torvalds1da177e2005-04-16 15:20:36 -07002461 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2462 if (!nosec) {
2463 rc = -ENOMEM;
2464 goto out;
2465 }
2466
2467 nosec_save = nosec;
2468 fnosec = fsec = 1;
2469 in_save = in_end = orig;
2470
2471 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002472 if (*in_end == '"')
2473 open_quote = !open_quote;
2474 if ((*in_end == ',' && open_quote == 0) ||
2475 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002476 int len = in_end - in_curr;
2477
2478 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002479 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002480 else
2481 take_option(&nosec, in_curr, &fnosec, len);
2482
2483 in_curr = in_end + 1;
2484 }
2485 } while (*in_end++);
2486
Eric Paris6931dfc2005-06-30 02:58:51 -07002487 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002488 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002489out:
2490 return rc;
2491}
2492
James Morris12204e22008-12-19 10:44:42 +11002493static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002494{
David Howells88e67f32008-11-14 10:39:21 +11002495 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002496 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497 int rc;
2498
2499 rc = superblock_doinit(sb, data);
2500 if (rc)
2501 return rc;
2502
James Morris74192242008-12-19 11:41:10 +11002503 /* Allow all mounts performed by the kernel */
2504 if (flags & MS_KERNMOUNT)
2505 return 0;
2506
Thomas Liu2bf49692009-07-14 12:14:09 -04002507 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002508 ad.u.fs.path.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002509 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002510}
2511
David Howells726c3342006-06-23 02:02:58 -07002512static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002513{
David Howells88e67f32008-11-14 10:39:21 +11002514 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002515 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002516
Thomas Liu2bf49692009-07-14 12:14:09 -04002517 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002518 ad.u.fs.path.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002519 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002520}
2521
Eric Paris828dfe12008-04-17 13:17:49 -04002522static int selinux_mount(char *dev_name,
Al Virob5266eb2008-03-22 17:48:24 -04002523 struct path *path,
Eric Paris828dfe12008-04-17 13:17:49 -04002524 char *type,
2525 unsigned long flags,
2526 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002527{
David Howells88e67f32008-11-14 10:39:21 +11002528 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002529
2530 if (flags & MS_REMOUNT)
David Howells88e67f32008-11-14 10:39:21 +11002531 return superblock_has_perm(cred, path->mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002532 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002533 else
David Howells88e67f32008-11-14 10:39:21 +11002534 return dentry_has_perm(cred, path->mnt, path->dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002535 FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002536}
2537
2538static int selinux_umount(struct vfsmount *mnt, int flags)
2539{
David Howells88e67f32008-11-14 10:39:21 +11002540 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002541
David Howells88e67f32008-11-14 10:39:21 +11002542 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002543 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002544}
2545
2546/* inode security operations */
2547
2548static int selinux_inode_alloc_security(struct inode *inode)
2549{
2550 return inode_alloc_security(inode);
2551}
2552
2553static void selinux_inode_free_security(struct inode *inode)
2554{
2555 inode_free_security(inode);
2556}
2557
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002558static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2559 char **name, void **value,
2560 size_t *len)
2561{
David Howells275bb412008-11-14 10:39:19 +11002562 const struct cred *cred = current_cred();
2563 const struct task_security_struct *tsec = cred->security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002564 struct inode_security_struct *dsec;
2565 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002566 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002567 int rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002568 char *namep = NULL, *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002569
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002570 dsec = dir->i_security;
2571 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002572
David Howells275bb412008-11-14 10:39:19 +11002573 sid = tsec->sid;
2574 newsid = tsec->create_sid;
2575
David P. Quigleycd895962009-01-16 09:22:04 -05002576 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
David Howells275bb412008-11-14 10:39:19 +11002577 rc = security_transition_sid(sid, dsec->sid,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002578 inode_mode_to_security_class(inode->i_mode),
2579 &newsid);
2580 if (rc) {
2581 printk(KERN_WARNING "%s: "
2582 "security_transition_sid failed, rc=%d (dev=%s "
2583 "ino=%ld)\n",
Harvey Harrisondd6f9532008-03-06 10:03:59 +11002584 __func__,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002585 -rc, inode->i_sb->s_id, inode->i_ino);
2586 return rc;
2587 }
2588 }
2589
Eric Paris296fddf2006-09-25 23:32:00 -07002590 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002591 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002592 struct inode_security_struct *isec = inode->i_security;
2593 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2594 isec->sid = newsid;
2595 isec->initialized = 1;
2596 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002597
David P. Quigleycd895962009-01-16 09:22:04 -05002598 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002599 return -EOPNOTSUPP;
2600
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002601 if (name) {
Josef Bacika02fe132008-04-04 09:35:05 +11002602 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002603 if (!namep)
2604 return -ENOMEM;
2605 *name = namep;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002606 }
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002607
2608 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002609 rc = security_sid_to_context_force(newsid, &context, &clen);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002610 if (rc) {
2611 kfree(namep);
2612 return rc;
2613 }
2614 *value = context;
2615 *len = clen;
2616 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002617
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002618 return 0;
2619}
2620
Linus Torvalds1da177e2005-04-16 15:20:36 -07002621static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2622{
2623 return may_create(dir, dentry, SECCLASS_FILE);
2624}
2625
Linus Torvalds1da177e2005-04-16 15:20:36 -07002626static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2627{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002628 return may_link(dir, old_dentry, MAY_LINK);
2629}
2630
Linus Torvalds1da177e2005-04-16 15:20:36 -07002631static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2632{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002633 return may_link(dir, dentry, MAY_UNLINK);
2634}
2635
2636static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2637{
2638 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2639}
2640
Linus Torvalds1da177e2005-04-16 15:20:36 -07002641static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2642{
2643 return may_create(dir, dentry, SECCLASS_DIR);
2644}
2645
Linus Torvalds1da177e2005-04-16 15:20:36 -07002646static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2647{
2648 return may_link(dir, dentry, MAY_RMDIR);
2649}
2650
2651static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2652{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002653 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2654}
2655
Linus Torvalds1da177e2005-04-16 15:20:36 -07002656static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002657 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002658{
2659 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2660}
2661
Linus Torvalds1da177e2005-04-16 15:20:36 -07002662static int selinux_inode_readlink(struct dentry *dentry)
2663{
David Howells88e67f32008-11-14 10:39:21 +11002664 const struct cred *cred = current_cred();
2665
2666 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002667}
2668
2669static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2670{
David Howells88e67f32008-11-14 10:39:21 +11002671 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002672
David Howells88e67f32008-11-14 10:39:21 +11002673 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002674}
2675
Al Virob77b0642008-07-17 09:37:02 -04002676static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002677{
David Howells88e67f32008-11-14 10:39:21 +11002678 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002679
2680 if (!mask) {
2681 /* No permission to check. Existence test. */
2682 return 0;
2683 }
2684
David Howells88e67f32008-11-14 10:39:21 +11002685 return inode_has_perm(cred, inode,
Eric Paris8b6a5a32008-10-29 17:06:46 -04002686 file_mask_to_av(inode->i_mode, mask), NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002687}
2688
2689static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2690{
David Howells88e67f32008-11-14 10:39:21 +11002691 const struct cred *cred = current_cred();
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002692 unsigned int ia_valid = iattr->ia_valid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002693
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002694 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2695 if (ia_valid & ATTR_FORCE) {
2696 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2697 ATTR_FORCE);
2698 if (!ia_valid)
2699 return 0;
2700 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002701
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002702 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2703 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
David Howells88e67f32008-11-14 10:39:21 +11002704 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002705
David Howells88e67f32008-11-14 10:39:21 +11002706 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002707}
2708
2709static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2710{
David Howells88e67f32008-11-14 10:39:21 +11002711 const struct cred *cred = current_cred();
2712
2713 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002714}
2715
David Howells8f0cfa52008-04-29 00:59:41 -07002716static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07002717{
David Howells88e67f32008-11-14 10:39:21 +11002718 const struct cred *cred = current_cred();
2719
Serge E. Hallynb5376772007-10-16 23:31:36 -07002720 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2721 sizeof XATTR_SECURITY_PREFIX - 1)) {
2722 if (!strcmp(name, XATTR_NAME_CAPS)) {
2723 if (!capable(CAP_SETFCAP))
2724 return -EPERM;
2725 } else if (!capable(CAP_SYS_ADMIN)) {
2726 /* A different attribute in the security namespace.
2727 Restrict to administrator. */
2728 return -EPERM;
2729 }
2730 }
2731
2732 /* Not an attribute we recognize, so just check the
2733 ordinary setattr permission. */
David Howells88e67f32008-11-14 10:39:21 +11002734 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07002735}
2736
David Howells8f0cfa52008-04-29 00:59:41 -07002737static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2738 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002739{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002740 struct inode *inode = dentry->d_inode;
2741 struct inode_security_struct *isec = inode->i_security;
2742 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002743 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002744 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002745 int rc = 0;
2746
Serge E. Hallynb5376772007-10-16 23:31:36 -07002747 if (strcmp(name, XATTR_NAME_SELINUX))
2748 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002749
2750 sbsec = inode->i_sb->s_security;
David P. Quigleycd895962009-01-16 09:22:04 -05002751 if (!(sbsec->flags & SE_SBLABELSUPP))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002752 return -EOPNOTSUPP;
2753
Satyam Sharma3bd858a2007-07-17 15:00:08 +05302754 if (!is_owner_or_cap(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002755 return -EPERM;
2756
Thomas Liu2bf49692009-07-14 12:14:09 -04002757 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002758 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002759
David Howells275bb412008-11-14 10:39:19 +11002760 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002761 FILE__RELABELFROM, &ad);
2762 if (rc)
2763 return rc;
2764
2765 rc = security_context_to_sid(value, size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04002766 if (rc == -EINVAL) {
2767 if (!capable(CAP_MAC_ADMIN))
2768 return rc;
2769 rc = security_context_to_sid_force(value, size, &newsid);
2770 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002771 if (rc)
2772 return rc;
2773
David Howells275bb412008-11-14 10:39:19 +11002774 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002775 FILE__RELABELTO, &ad);
2776 if (rc)
2777 return rc;
2778
David Howells275bb412008-11-14 10:39:19 +11002779 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04002780 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002781 if (rc)
2782 return rc;
2783
2784 return avc_has_perm(newsid,
2785 sbsec->sid,
2786 SECCLASS_FILESYSTEM,
2787 FILESYSTEM__ASSOCIATE,
2788 &ad);
2789}
2790
David Howells8f0cfa52008-04-29 00:59:41 -07002791static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04002792 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07002793 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002794{
2795 struct inode *inode = dentry->d_inode;
2796 struct inode_security_struct *isec = inode->i_security;
2797 u32 newsid;
2798 int rc;
2799
2800 if (strcmp(name, XATTR_NAME_SELINUX)) {
2801 /* Not an attribute we recognize, so nothing to do. */
2802 return;
2803 }
2804
Stephen Smalley12b29f32008-05-07 13:03:20 -04002805 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002806 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002807 printk(KERN_ERR "SELinux: unable to map context to SID"
2808 "for (%s, %lu), rc=%d\n",
2809 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002810 return;
2811 }
2812
2813 isec->sid = newsid;
2814 return;
2815}
2816
David Howells8f0cfa52008-04-29 00:59:41 -07002817static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002818{
David Howells88e67f32008-11-14 10:39:21 +11002819 const struct cred *cred = current_cred();
2820
2821 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002822}
2823
Eric Paris828dfe12008-04-17 13:17:49 -04002824static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002825{
David Howells88e67f32008-11-14 10:39:21 +11002826 const struct cred *cred = current_cred();
2827
2828 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002829}
2830
David Howells8f0cfa52008-04-29 00:59:41 -07002831static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002832{
Serge E. Hallynb5376772007-10-16 23:31:36 -07002833 if (strcmp(name, XATTR_NAME_SELINUX))
2834 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002835
2836 /* No one is allowed to remove a SELinux security label.
2837 You can change the label, but all data must be labeled. */
2838 return -EACCES;
2839}
2840
James Morrisd381d8a2005-10-30 14:59:22 -08002841/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002842 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08002843 *
2844 * Permission check is handled by selinux_inode_getxattr hook.
2845 */
David P. Quigley42492592008-02-04 22:29:39 -08002846static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002847{
David P. Quigley42492592008-02-04 22:29:39 -08002848 u32 size;
2849 int error;
2850 char *context = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002851 struct inode_security_struct *isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002852
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002853 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2854 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002855
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002856 /*
2857 * If the caller has CAP_MAC_ADMIN, then get the raw context
2858 * value even if it is not defined by current policy; otherwise,
2859 * use the in-core value under current policy.
2860 * Use the non-auditing forms of the permission checks since
2861 * getxattr may be called by unprivileged processes commonly
2862 * and lack of permission just means that we fall back to the
2863 * in-core context value, not a denial.
2864 */
David Howells3699c532009-01-06 22:27:01 +00002865 error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
2866 SECURITY_CAP_NOAUDIT);
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002867 if (!error)
2868 error = security_sid_to_context_force(isec->sid, &context,
2869 &size);
2870 else
2871 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08002872 if (error)
2873 return error;
2874 error = size;
2875 if (alloc) {
2876 *buffer = context;
2877 goto out_nofree;
2878 }
2879 kfree(context);
2880out_nofree:
2881 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002882}
2883
2884static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04002885 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002886{
2887 struct inode_security_struct *isec = inode->i_security;
2888 u32 newsid;
2889 int rc;
2890
2891 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2892 return -EOPNOTSUPP;
2893
2894 if (!value || !size)
2895 return -EACCES;
2896
Eric Paris828dfe12008-04-17 13:17:49 -04002897 rc = security_context_to_sid((void *)value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002898 if (rc)
2899 return rc;
2900
2901 isec->sid = newsid;
David P. Quigleyddd29ec2009-09-09 14:25:37 -04002902 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002903 return 0;
2904}
2905
2906static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2907{
2908 const int len = sizeof(XATTR_NAME_SELINUX);
2909 if (buffer && len <= buffer_size)
2910 memcpy(buffer, XATTR_NAME_SELINUX, len);
2911 return len;
2912}
2913
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02002914static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2915{
2916 struct inode_security_struct *isec = inode->i_security;
2917 *secid = isec->sid;
2918}
2919
Linus Torvalds1da177e2005-04-16 15:20:36 -07002920/* file security operations */
2921
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002922static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002923{
David Howells88e67f32008-11-14 10:39:21 +11002924 const struct cred *cred = current_cred();
Josef Sipek3d5ff522006-12-08 02:37:38 -08002925 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002926
Linus Torvalds1da177e2005-04-16 15:20:36 -07002927 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2928 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2929 mask |= MAY_APPEND;
2930
Paul Moore389fb8002009-03-27 17:10:34 -04002931 return file_has_perm(cred, file,
2932 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002933}
2934
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002935static int selinux_file_permission(struct file *file, int mask)
2936{
Stephen Smalley20dda182009-06-22 14:54:53 -04002937 struct inode *inode = file->f_path.dentry->d_inode;
2938 struct file_security_struct *fsec = file->f_security;
2939 struct inode_security_struct *isec = inode->i_security;
2940 u32 sid = current_sid();
2941
Paul Moore389fb8002009-03-27 17:10:34 -04002942 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002943 /* No permission to check. Existence test. */
2944 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002945
Stephen Smalley20dda182009-06-22 14:54:53 -04002946 if (sid == fsec->sid && fsec->isid == isec->sid &&
2947 fsec->pseqno == avc_policy_seqno())
2948 /* No change since dentry_open check. */
2949 return 0;
2950
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002951 return selinux_revalidate_file_permission(file, mask);
2952}
2953
Linus Torvalds1da177e2005-04-16 15:20:36 -07002954static int selinux_file_alloc_security(struct file *file)
2955{
2956 return file_alloc_security(file);
2957}
2958
2959static void selinux_file_free_security(struct file *file)
2960{
2961 file_free_security(file);
2962}
2963
2964static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2965 unsigned long arg)
2966{
David Howells88e67f32008-11-14 10:39:21 +11002967 const struct cred *cred = current_cred();
Stephen Smalley242631c2008-06-05 09:21:28 -04002968 u32 av = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002969
Stephen Smalley242631c2008-06-05 09:21:28 -04002970 if (_IOC_DIR(cmd) & _IOC_WRITE)
2971 av |= FILE__WRITE;
2972 if (_IOC_DIR(cmd) & _IOC_READ)
2973 av |= FILE__READ;
2974 if (!av)
2975 av = FILE__IOCTL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002976
David Howells88e67f32008-11-14 10:39:21 +11002977 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002978}
2979
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04002980static int default_noexec;
2981
Linus Torvalds1da177e2005-04-16 15:20:36 -07002982static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2983{
David Howells88e67f32008-11-14 10:39:21 +11002984 const struct cred *cred = current_cred();
David Howellsd84f4f92008-11-14 10:39:23 +11002985 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11002986
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04002987 if (default_noexec &&
2988 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002989 /*
2990 * We are making executable an anonymous mapping or a
2991 * private file mapping that will also be writable.
2992 * This has an additional check.
2993 */
David Howellsd84f4f92008-11-14 10:39:23 +11002994 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002995 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11002996 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002997 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002998
2999 if (file) {
3000 /* read access is always possible with a mapping */
3001 u32 av = FILE__READ;
3002
3003 /* write access only matters if the mapping is shared */
3004 if (shared && (prot & PROT_WRITE))
3005 av |= FILE__WRITE;
3006
3007 if (prot & PROT_EXEC)
3008 av |= FILE__EXECUTE;
3009
David Howells88e67f32008-11-14 10:39:21 +11003010 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003011 }
David Howellsd84f4f92008-11-14 10:39:23 +11003012
3013error:
3014 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003015}
3016
3017static int selinux_file_mmap(struct file *file, unsigned long reqprot,
Eric Parised032182007-06-28 15:55:21 -04003018 unsigned long prot, unsigned long flags,
3019 unsigned long addr, unsigned long addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003020{
Eric Parised032182007-06-28 15:55:21 -04003021 int rc = 0;
David Howells275bb412008-11-14 10:39:19 +11003022 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003023
Eric Paris84336d1a2009-07-31 12:54:05 -04003024 /*
3025 * notice that we are intentionally putting the SELinux check before
3026 * the secondary cap_file_mmap check. This is such a likely attempt
3027 * at bad behaviour/exploit that we always want to get the AVC, even
3028 * if DAC would have also denied the operation.
3029 */
Eric Parisa2551df2009-07-31 12:54:11 -04003030 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
Eric Parised032182007-06-28 15:55:21 -04003031 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3032 MEMPROTECT__MMAP_ZERO, NULL);
Eric Paris84336d1a2009-07-31 12:54:05 -04003033 if (rc)
3034 return rc;
3035 }
3036
3037 /* do DAC check on address space usage */
3038 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
Eric Parised032182007-06-28 15:55:21 -04003039 if (rc || addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003040 return rc;
3041
3042 if (selinux_checkreqprot)
3043 prot = reqprot;
3044
3045 return file_map_prot_check(file, prot,
3046 (flags & MAP_TYPE) == MAP_SHARED);
3047}
3048
3049static int selinux_file_mprotect(struct vm_area_struct *vma,
3050 unsigned long reqprot,
3051 unsigned long prot)
3052{
David Howells88e67f32008-11-14 10:39:21 +11003053 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003054
3055 if (selinux_checkreqprot)
3056 prot = reqprot;
3057
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003058 if (default_noexec &&
3059 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003060 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003061 if (vma->vm_start >= vma->vm_mm->start_brk &&
3062 vma->vm_end <= vma->vm_mm->brk) {
David Howellsd84f4f92008-11-14 10:39:23 +11003063 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003064 } else if (!vma->vm_file &&
3065 vma->vm_start <= vma->vm_mm->start_stack &&
3066 vma->vm_end >= vma->vm_mm->start_stack) {
David Howells3b11a1d2008-11-14 10:39:26 +11003067 rc = current_has_perm(current, PROCESS__EXECSTACK);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003068 } else if (vma->vm_file && vma->anon_vma) {
3069 /*
3070 * We are making executable a file mapping that has
3071 * had some COW done. Since pages might have been
3072 * written, check ability to execute the possibly
3073 * modified content. This typically should only
3074 * occur for text relocations.
3075 */
David Howellsd84f4f92008-11-14 10:39:23 +11003076 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003077 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003078 if (rc)
3079 return rc;
3080 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003081
3082 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3083}
3084
3085static int selinux_file_lock(struct file *file, unsigned int cmd)
3086{
David Howells88e67f32008-11-14 10:39:21 +11003087 const struct cred *cred = current_cred();
3088
3089 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003090}
3091
3092static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3093 unsigned long arg)
3094{
David Howells88e67f32008-11-14 10:39:21 +11003095 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003096 int err = 0;
3097
3098 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003099 case F_SETFL:
3100 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3101 err = -EINVAL;
3102 break;
3103 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003104
Eric Paris828dfe12008-04-17 13:17:49 -04003105 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003106 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003107 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003108 }
3109 /* fall through */
3110 case F_SETOWN:
3111 case F_SETSIG:
3112 case F_GETFL:
3113 case F_GETOWN:
3114 case F_GETSIG:
3115 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003116 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003117 break;
3118 case F_GETLK:
3119 case F_SETLK:
3120 case F_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003121#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003122 case F_GETLK64:
3123 case F_SETLK64:
3124 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003125#endif
Eric Paris828dfe12008-04-17 13:17:49 -04003126 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3127 err = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003128 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003129 }
David Howells88e67f32008-11-14 10:39:21 +11003130 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003131 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003132 }
3133
3134 return err;
3135}
3136
3137static int selinux_file_set_fowner(struct file *file)
3138{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003139 struct file_security_struct *fsec;
3140
Linus Torvalds1da177e2005-04-16 15:20:36 -07003141 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003142 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003143
3144 return 0;
3145}
3146
3147static int selinux_file_send_sigiotask(struct task_struct *tsk,
3148 struct fown_struct *fown, int signum)
3149{
Eric Paris828dfe12008-04-17 13:17:49 -04003150 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003151 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003152 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003153 struct file_security_struct *fsec;
3154
3155 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003156 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003157
Linus Torvalds1da177e2005-04-16 15:20:36 -07003158 fsec = file->f_security;
3159
3160 if (!signum)
3161 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3162 else
3163 perm = signal_to_av(signum);
3164
David Howells275bb412008-11-14 10:39:19 +11003165 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003166 SECCLASS_PROCESS, perm, NULL);
3167}
3168
3169static int selinux_file_receive(struct file *file)
3170{
David Howells88e67f32008-11-14 10:39:21 +11003171 const struct cred *cred = current_cred();
3172
3173 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003174}
3175
David Howells745ca242008-11-14 10:39:22 +11003176static int selinux_dentry_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003177{
3178 struct file_security_struct *fsec;
3179 struct inode *inode;
3180 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003181
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003182 inode = file->f_path.dentry->d_inode;
3183 fsec = file->f_security;
3184 isec = inode->i_security;
3185 /*
3186 * Save inode label and policy sequence number
3187 * at open-time so that selinux_file_permission
3188 * can determine whether revalidation is necessary.
3189 * Task label is already saved in the file security
3190 * struct as its SID.
3191 */
3192 fsec->isid = isec->sid;
3193 fsec->pseqno = avc_policy_seqno();
3194 /*
3195 * Since the inode label or policy seqno may have changed
3196 * between the selinux_inode_permission check and the saving
3197 * of state above, recheck that access is still permitted.
3198 * Otherwise, access might never be revalidated against the
3199 * new inode label or new policy.
3200 * This check is not redundant - do not remove.
3201 */
David Howells88e67f32008-11-14 10:39:21 +11003202 return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003203}
3204
Linus Torvalds1da177e2005-04-16 15:20:36 -07003205/* task security operations */
3206
3207static int selinux_task_create(unsigned long clone_flags)
3208{
David Howells3b11a1d2008-11-14 10:39:26 +11003209 return current_has_perm(current, PROCESS__FORK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003210}
3211
David Howellsf1752ee2008-11-14 10:39:17 +11003212/*
David Howellsee18d642009-09-02 09:14:21 +01003213 * allocate the SELinux part of blank credentials
3214 */
3215static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3216{
3217 struct task_security_struct *tsec;
3218
3219 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3220 if (!tsec)
3221 return -ENOMEM;
3222
3223 cred->security = tsec;
3224 return 0;
3225}
3226
3227/*
David Howellsf1752ee2008-11-14 10:39:17 +11003228 * detach and free the LSM part of a set of credentials
3229 */
3230static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003231{
David Howellsf1752ee2008-11-14 10:39:17 +11003232 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003233
3234 BUG_ON((unsigned long) cred->security < PAGE_SIZE);
3235 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003236 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003237}
3238
David Howellsd84f4f92008-11-14 10:39:23 +11003239/*
3240 * prepare a new set of credentials for modification
3241 */
3242static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3243 gfp_t gfp)
3244{
3245 const struct task_security_struct *old_tsec;
3246 struct task_security_struct *tsec;
3247
3248 old_tsec = old->security;
3249
3250 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3251 if (!tsec)
3252 return -ENOMEM;
3253
3254 new->security = tsec;
3255 return 0;
3256}
3257
3258/*
David Howellsee18d642009-09-02 09:14:21 +01003259 * transfer the SELinux data to a blank set of creds
3260 */
3261static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3262{
3263 const struct task_security_struct *old_tsec = old->security;
3264 struct task_security_struct *tsec = new->security;
3265
3266 *tsec = *old_tsec;
3267}
3268
3269/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003270 * set the security data for a kernel service
3271 * - all the creation contexts are set to unlabelled
3272 */
3273static int selinux_kernel_act_as(struct cred *new, u32 secid)
3274{
3275 struct task_security_struct *tsec = new->security;
3276 u32 sid = current_sid();
3277 int ret;
3278
3279 ret = avc_has_perm(sid, secid,
3280 SECCLASS_KERNEL_SERVICE,
3281 KERNEL_SERVICE__USE_AS_OVERRIDE,
3282 NULL);
3283 if (ret == 0) {
3284 tsec->sid = secid;
3285 tsec->create_sid = 0;
3286 tsec->keycreate_sid = 0;
3287 tsec->sockcreate_sid = 0;
3288 }
3289 return ret;
3290}
3291
3292/*
3293 * set the file creation context in a security record to the same as the
3294 * objective context of the specified inode
3295 */
3296static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3297{
3298 struct inode_security_struct *isec = inode->i_security;
3299 struct task_security_struct *tsec = new->security;
3300 u32 sid = current_sid();
3301 int ret;
3302
3303 ret = avc_has_perm(sid, isec->sid,
3304 SECCLASS_KERNEL_SERVICE,
3305 KERNEL_SERVICE__CREATE_FILES_AS,
3306 NULL);
3307
3308 if (ret == 0)
3309 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003310 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003311}
3312
Eric Parisdd8dbf22009-11-03 16:35:32 +11003313static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003314{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003315 u32 sid;
3316 struct common_audit_data ad;
3317
3318 sid = task_sid(current);
3319
3320 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3321 ad.u.kmod_name = kmod_name;
3322
3323 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3324 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003325}
3326
Linus Torvalds1da177e2005-04-16 15:20:36 -07003327static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3328{
David Howells3b11a1d2008-11-14 10:39:26 +11003329 return current_has_perm(p, PROCESS__SETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003330}
3331
3332static int selinux_task_getpgid(struct task_struct *p)
3333{
David Howells3b11a1d2008-11-14 10:39:26 +11003334 return current_has_perm(p, PROCESS__GETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003335}
3336
3337static int selinux_task_getsid(struct task_struct *p)
3338{
David Howells3b11a1d2008-11-14 10:39:26 +11003339 return current_has_perm(p, PROCESS__GETSESSION);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003340}
3341
David Quigleyf9008e42006-06-30 01:55:46 -07003342static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3343{
David Howells275bb412008-11-14 10:39:19 +11003344 *secid = task_sid(p);
David Quigleyf9008e42006-06-30 01:55:46 -07003345}
3346
Linus Torvalds1da177e2005-04-16 15:20:36 -07003347static int selinux_task_setnice(struct task_struct *p, int nice)
3348{
3349 int rc;
3350
Eric Paris200ac532009-02-12 15:01:04 -05003351 rc = cap_task_setnice(p, nice);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003352 if (rc)
3353 return rc;
3354
David Howells3b11a1d2008-11-14 10:39:26 +11003355 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003356}
3357
James Morris03e68062006-06-23 02:03:58 -07003358static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3359{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003360 int rc;
3361
Eric Paris200ac532009-02-12 15:01:04 -05003362 rc = cap_task_setioprio(p, ioprio);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003363 if (rc)
3364 return rc;
3365
David Howells3b11a1d2008-11-14 10:39:26 +11003366 return current_has_perm(p, PROCESS__SETSCHED);
James Morris03e68062006-06-23 02:03:58 -07003367}
3368
David Quigleya1836a42006-06-30 01:55:49 -07003369static int selinux_task_getioprio(struct task_struct *p)
3370{
David Howells3b11a1d2008-11-14 10:39:26 +11003371 return current_has_perm(p, PROCESS__GETSCHED);
David Quigleya1836a42006-06-30 01:55:49 -07003372}
3373
Linus Torvalds1da177e2005-04-16 15:20:36 -07003374static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3375{
3376 struct rlimit *old_rlim = current->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003377
3378 /* Control the ability to change the hard limit (whether
3379 lowering or raising it), so that the hard limit can
3380 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003381 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003382 if (old_rlim->rlim_max != new_rlim->rlim_max)
David Howells3b11a1d2008-11-14 10:39:26 +11003383 return current_has_perm(current, PROCESS__SETRLIMIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003384
3385 return 0;
3386}
3387
3388static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3389{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003390 int rc;
3391
Eric Paris200ac532009-02-12 15:01:04 -05003392 rc = cap_task_setscheduler(p, policy, lp);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003393 if (rc)
3394 return rc;
3395
David Howells3b11a1d2008-11-14 10:39:26 +11003396 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003397}
3398
3399static int selinux_task_getscheduler(struct task_struct *p)
3400{
David Howells3b11a1d2008-11-14 10:39:26 +11003401 return current_has_perm(p, PROCESS__GETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003402}
3403
David Quigley35601542006-06-23 02:04:01 -07003404static int selinux_task_movememory(struct task_struct *p)
3405{
David Howells3b11a1d2008-11-14 10:39:26 +11003406 return current_has_perm(p, PROCESS__SETSCHED);
David Quigley35601542006-06-23 02:04:01 -07003407}
3408
David Quigleyf9008e42006-06-30 01:55:46 -07003409static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3410 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003411{
3412 u32 perm;
3413 int rc;
3414
Linus Torvalds1da177e2005-04-16 15:20:36 -07003415 if (!sig)
3416 perm = PROCESS__SIGNULL; /* null signal; existence test */
3417 else
3418 perm = signal_to_av(sig);
David Quigleyf9008e42006-06-30 01:55:46 -07003419 if (secid)
David Howells275bb412008-11-14 10:39:19 +11003420 rc = avc_has_perm(secid, task_sid(p),
3421 SECCLASS_PROCESS, perm, NULL);
David Quigleyf9008e42006-06-30 01:55:46 -07003422 else
David Howells3b11a1d2008-11-14 10:39:26 +11003423 rc = current_has_perm(p, perm);
David Quigleyf9008e42006-06-30 01:55:46 -07003424 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003425}
3426
Linus Torvalds1da177e2005-04-16 15:20:36 -07003427static int selinux_task_wait(struct task_struct *p)
3428{
Eric Paris8a535142007-10-22 16:10:31 -04003429 return task_has_perm(p, current, PROCESS__SIGCHLD);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003430}
3431
Linus Torvalds1da177e2005-04-16 15:20:36 -07003432static void selinux_task_to_inode(struct task_struct *p,
3433 struct inode *inode)
3434{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003435 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11003436 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003437
David Howells275bb412008-11-14 10:39:19 +11003438 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003439 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003440}
3441
Linus Torvalds1da177e2005-04-16 15:20:36 -07003442/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003443static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003444 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003445{
3446 int offset, ihlen, ret = -EINVAL;
3447 struct iphdr _iph, *ih;
3448
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003449 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003450 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3451 if (ih == NULL)
3452 goto out;
3453
3454 ihlen = ih->ihl * 4;
3455 if (ihlen < sizeof(_iph))
3456 goto out;
3457
3458 ad->u.net.v4info.saddr = ih->saddr;
3459 ad->u.net.v4info.daddr = ih->daddr;
3460 ret = 0;
3461
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003462 if (proto)
3463 *proto = ih->protocol;
3464
Linus Torvalds1da177e2005-04-16 15:20:36 -07003465 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04003466 case IPPROTO_TCP: {
3467 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003468
Eric Paris828dfe12008-04-17 13:17:49 -04003469 if (ntohs(ih->frag_off) & IP_OFFSET)
3470 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003471
3472 offset += ihlen;
3473 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3474 if (th == NULL)
3475 break;
3476
3477 ad->u.net.sport = th->source;
3478 ad->u.net.dport = th->dest;
3479 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003480 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003481
Eric Paris828dfe12008-04-17 13:17:49 -04003482 case IPPROTO_UDP: {
3483 struct udphdr _udph, *uh;
3484
3485 if (ntohs(ih->frag_off) & IP_OFFSET)
3486 break;
3487
3488 offset += ihlen;
3489 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3490 if (uh == NULL)
3491 break;
3492
3493 ad->u.net.sport = uh->source;
3494 ad->u.net.dport = uh->dest;
3495 break;
3496 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003497
James Morris2ee92d42006-11-13 16:09:01 -08003498 case IPPROTO_DCCP: {
3499 struct dccp_hdr _dccph, *dh;
3500
3501 if (ntohs(ih->frag_off) & IP_OFFSET)
3502 break;
3503
3504 offset += ihlen;
3505 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3506 if (dh == NULL)
3507 break;
3508
3509 ad->u.net.sport = dh->dccph_sport;
3510 ad->u.net.dport = dh->dccph_dport;
3511 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003512 }
James Morris2ee92d42006-11-13 16:09:01 -08003513
Eric Paris828dfe12008-04-17 13:17:49 -04003514 default:
3515 break;
3516 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003517out:
3518 return ret;
3519}
3520
3521#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3522
3523/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003524static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003525 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003526{
3527 u8 nexthdr;
3528 int ret = -EINVAL, offset;
3529 struct ipv6hdr _ipv6h, *ip6;
3530
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003531 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003532 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3533 if (ip6 == NULL)
3534 goto out;
3535
3536 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3537 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3538 ret = 0;
3539
3540 nexthdr = ip6->nexthdr;
3541 offset += sizeof(_ipv6h);
Herbert Xu0d3d0772005-04-24 20:16:19 -07003542 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003543 if (offset < 0)
3544 goto out;
3545
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003546 if (proto)
3547 *proto = nexthdr;
3548
Linus Torvalds1da177e2005-04-16 15:20:36 -07003549 switch (nexthdr) {
3550 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04003551 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003552
3553 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3554 if (th == NULL)
3555 break;
3556
3557 ad->u.net.sport = th->source;
3558 ad->u.net.dport = th->dest;
3559 break;
3560 }
3561
3562 case IPPROTO_UDP: {
3563 struct udphdr _udph, *uh;
3564
3565 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3566 if (uh == NULL)
3567 break;
3568
3569 ad->u.net.sport = uh->source;
3570 ad->u.net.dport = uh->dest;
3571 break;
3572 }
3573
James Morris2ee92d42006-11-13 16:09:01 -08003574 case IPPROTO_DCCP: {
3575 struct dccp_hdr _dccph, *dh;
3576
3577 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3578 if (dh == NULL)
3579 break;
3580
3581 ad->u.net.sport = dh->dccph_sport;
3582 ad->u.net.dport = dh->dccph_dport;
3583 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003584 }
James Morris2ee92d42006-11-13 16:09:01 -08003585
Linus Torvalds1da177e2005-04-16 15:20:36 -07003586 /* includes fragments */
3587 default:
3588 break;
3589 }
3590out:
3591 return ret;
3592}
3593
3594#endif /* IPV6 */
3595
Thomas Liu2bf49692009-07-14 12:14:09 -04003596static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10003597 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003598{
David Howellscf9481e2008-07-27 21:31:07 +10003599 char *addrp;
3600 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003601
3602 switch (ad->u.net.family) {
3603 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003604 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003605 if (ret)
3606 goto parse_error;
3607 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3608 &ad->u.net.v4info.daddr);
3609 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003610
3611#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3612 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003613 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003614 if (ret)
3615 goto parse_error;
3616 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3617 &ad->u.net.v6info.daddr);
3618 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003619#endif /* IPV6 */
3620 default:
David Howellscf9481e2008-07-27 21:31:07 +10003621 addrp = NULL;
3622 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003623 }
3624
David Howellscf9481e2008-07-27 21:31:07 +10003625parse_error:
3626 printk(KERN_WARNING
3627 "SELinux: failure in selinux_parse_skb(),"
3628 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07003629 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10003630
3631okay:
3632 if (_addrp)
3633 *_addrp = addrp;
3634 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003635}
3636
Paul Moore4f6a9932007-03-01 14:35:22 -05003637/**
Paul Moore220deb92008-01-29 08:38:23 -05003638 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05003639 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05003640 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05003641 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05003642 *
3643 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05003644 * Check the various different forms of network peer labeling and determine
3645 * the peer label/SID for the packet; most of the magic actually occurs in
3646 * the security server function security_net_peersid_cmp(). The function
3647 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3648 * or -EACCES if @sid is invalid due to inconsistencies with the different
3649 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05003650 *
3651 */
Paul Moore220deb92008-01-29 08:38:23 -05003652static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05003653{
Paul Moore71f1cb02008-01-29 08:51:16 -05003654 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05003655 u32 xfrm_sid;
3656 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05003657 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05003658
3659 selinux_skb_xfrm_sid(skb, &xfrm_sid);
Paul Moore5dbe1eb2008-01-29 08:44:18 -05003660 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
Paul Moore220deb92008-01-29 08:38:23 -05003661
Paul Moore71f1cb02008-01-29 08:51:16 -05003662 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3663 if (unlikely(err)) {
3664 printk(KERN_WARNING
3665 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3666 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05003667 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05003668 }
Paul Moore220deb92008-01-29 08:38:23 -05003669
3670 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05003671}
3672
Linus Torvalds1da177e2005-04-16 15:20:36 -07003673/* socket security operations */
3674static int socket_has_perm(struct task_struct *task, struct socket *sock,
3675 u32 perms)
3676{
3677 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003678 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003679 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003680 int err = 0;
3681
Linus Torvalds1da177e2005-04-16 15:20:36 -07003682 isec = SOCK_INODE(sock)->i_security;
3683
3684 if (isec->sid == SECINITSID_KERNEL)
3685 goto out;
David Howells275bb412008-11-14 10:39:19 +11003686 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003687
Thomas Liu2bf49692009-07-14 12:14:09 -04003688 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003689 ad.u.net.sk = sock->sk;
David Howells275bb412008-11-14 10:39:19 +11003690 err = avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003691
3692out:
3693 return err;
3694}
3695
3696static int selinux_socket_create(int family, int type,
3697 int protocol, int kern)
3698{
David Howells275bb412008-11-14 10:39:19 +11003699 const struct cred *cred = current_cred();
3700 const struct task_security_struct *tsec = cred->security;
3701 u32 sid, newsid;
3702 u16 secclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003703 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003704
3705 if (kern)
3706 goto out;
3707
David Howells275bb412008-11-14 10:39:19 +11003708 sid = tsec->sid;
3709 newsid = tsec->sockcreate_sid ?: sid;
3710
3711 secclass = socket_type_to_security_class(family, type, protocol);
3712 err = avc_has_perm(sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003713
3714out:
3715 return err;
3716}
3717
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003718static int selinux_socket_post_create(struct socket *sock, int family,
3719 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003720{
David Howells275bb412008-11-14 10:39:19 +11003721 const struct cred *cred = current_cred();
3722 const struct task_security_struct *tsec = cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003723 struct inode_security_struct *isec;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003724 struct sk_security_struct *sksec;
David Howells275bb412008-11-14 10:39:19 +11003725 u32 sid, newsid;
3726 int err = 0;
3727
3728 sid = tsec->sid;
3729 newsid = tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003730
3731 isec = SOCK_INODE(sock)->i_security;
3732
David Howells275bb412008-11-14 10:39:19 +11003733 if (kern)
3734 isec->sid = SECINITSID_KERNEL;
3735 else if (newsid)
3736 isec->sid = newsid;
3737 else
3738 isec->sid = sid;
3739
Linus Torvalds1da177e2005-04-16 15:20:36 -07003740 isec->sclass = socket_type_to_security_class(family, type, protocol);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003741 isec->initialized = 1;
3742
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003743 if (sock->sk) {
3744 sksec = sock->sk->sk_security;
3745 sksec->sid = isec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05003746 sksec->sclass = isec->sclass;
Paul Moore389fb8002009-03-27 17:10:34 -04003747 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003748 }
3749
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003750 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003751}
3752
3753/* Range of port numbers used to automatically bind.
3754 Need to determine whether we should perform a name_bind
3755 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003756
3757static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3758{
3759 u16 family;
3760 int err;
3761
3762 err = socket_has_perm(current, sock, SOCKET__BIND);
3763 if (err)
3764 goto out;
3765
3766 /*
3767 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04003768 * Multiple address binding for SCTP is not supported yet: we just
3769 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003770 */
3771 family = sock->sk->sk_family;
3772 if (family == PF_INET || family == PF_INET6) {
3773 char *addrp;
3774 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003775 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003776 struct sockaddr_in *addr4 = NULL;
3777 struct sockaddr_in6 *addr6 = NULL;
3778 unsigned short snum;
3779 struct sock *sk = sock->sk;
James Morrise399f982008-06-12 01:39:58 +10003780 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003781
Linus Torvalds1da177e2005-04-16 15:20:36 -07003782 isec = SOCK_INODE(sock)->i_security;
3783
3784 if (family == PF_INET) {
3785 addr4 = (struct sockaddr_in *)address;
3786 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003787 addrp = (char *)&addr4->sin_addr.s_addr;
3788 } else {
3789 addr6 = (struct sockaddr_in6 *)address;
3790 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003791 addrp = (char *)&addr6->sin6_addr.s6_addr;
3792 }
3793
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003794 if (snum) {
3795 int low, high;
3796
3797 inet_get_local_port_range(&low, &high);
3798
3799 if (snum < max(PROT_SOCK, low) || snum > high) {
Paul Moore3e112172008-04-10 10:48:14 -04003800 err = sel_netport_sid(sk->sk_protocol,
3801 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003802 if (err)
3803 goto out;
Thomas Liu2bf49692009-07-14 12:14:09 -04003804 COMMON_AUDIT_DATA_INIT(&ad, NET);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003805 ad.u.net.sport = htons(snum);
3806 ad.u.net.family = family;
3807 err = avc_has_perm(isec->sid, sid,
3808 isec->sclass,
3809 SOCKET__NAME_BIND, &ad);
3810 if (err)
3811 goto out;
3812 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003813 }
Eric Paris828dfe12008-04-17 13:17:49 -04003814
3815 switch (isec->sclass) {
James Morris13402582005-09-30 14:24:34 -04003816 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003817 node_perm = TCP_SOCKET__NODE_BIND;
3818 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003819
James Morris13402582005-09-30 14:24:34 -04003820 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003821 node_perm = UDP_SOCKET__NODE_BIND;
3822 break;
James Morris2ee92d42006-11-13 16:09:01 -08003823
3824 case SECCLASS_DCCP_SOCKET:
3825 node_perm = DCCP_SOCKET__NODE_BIND;
3826 break;
3827
Linus Torvalds1da177e2005-04-16 15:20:36 -07003828 default:
3829 node_perm = RAWIP_SOCKET__NODE_BIND;
3830 break;
3831 }
Eric Paris828dfe12008-04-17 13:17:49 -04003832
Paul Moore224dfbd2008-01-29 08:38:13 -05003833 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003834 if (err)
3835 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04003836
Thomas Liu2bf49692009-07-14 12:14:09 -04003837 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003838 ad.u.net.sport = htons(snum);
3839 ad.u.net.family = family;
3840
3841 if (family == PF_INET)
3842 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3843 else
3844 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3845
3846 err = avc_has_perm(isec->sid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04003847 isec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003848 if (err)
3849 goto out;
3850 }
3851out:
3852 return err;
3853}
3854
3855static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3856{
Paul Moore014ab192008-10-10 10:16:33 -04003857 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003858 struct inode_security_struct *isec;
3859 int err;
3860
3861 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3862 if (err)
3863 return err;
3864
3865 /*
James Morris2ee92d42006-11-13 16:09:01 -08003866 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003867 */
3868 isec = SOCK_INODE(sock)->i_security;
James Morris2ee92d42006-11-13 16:09:01 -08003869 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3870 isec->sclass == SECCLASS_DCCP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04003871 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003872 struct sockaddr_in *addr4 = NULL;
3873 struct sockaddr_in6 *addr6 = NULL;
3874 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08003875 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003876
3877 if (sk->sk_family == PF_INET) {
3878 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003879 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003880 return -EINVAL;
3881 snum = ntohs(addr4->sin_port);
3882 } else {
3883 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003884 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003885 return -EINVAL;
3886 snum = ntohs(addr6->sin6_port);
3887 }
3888
Paul Moore3e112172008-04-10 10:48:14 -04003889 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003890 if (err)
3891 goto out;
3892
James Morris2ee92d42006-11-13 16:09:01 -08003893 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3894 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3895
Thomas Liu2bf49692009-07-14 12:14:09 -04003896 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003897 ad.u.net.dport = htons(snum);
3898 ad.u.net.family = sk->sk_family;
James Morris2ee92d42006-11-13 16:09:01 -08003899 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003900 if (err)
3901 goto out;
3902 }
3903
Paul Moore014ab192008-10-10 10:16:33 -04003904 err = selinux_netlbl_socket_connect(sk, address);
3905
Linus Torvalds1da177e2005-04-16 15:20:36 -07003906out:
3907 return err;
3908}
3909
3910static int selinux_socket_listen(struct socket *sock, int backlog)
3911{
3912 return socket_has_perm(current, sock, SOCKET__LISTEN);
3913}
3914
3915static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3916{
3917 int err;
3918 struct inode_security_struct *isec;
3919 struct inode_security_struct *newisec;
3920
3921 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3922 if (err)
3923 return err;
3924
3925 newisec = SOCK_INODE(newsock)->i_security;
3926
3927 isec = SOCK_INODE(sock)->i_security;
3928 newisec->sclass = isec->sclass;
3929 newisec->sid = isec->sid;
3930 newisec->initialized = 1;
3931
3932 return 0;
3933}
3934
3935static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04003936 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003937{
Paul Moore389fb8002009-03-27 17:10:34 -04003938 return socket_has_perm(current, sock, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003939}
3940
3941static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3942 int size, int flags)
3943{
3944 return socket_has_perm(current, sock, SOCKET__READ);
3945}
3946
3947static int selinux_socket_getsockname(struct socket *sock)
3948{
3949 return socket_has_perm(current, sock, SOCKET__GETATTR);
3950}
3951
3952static int selinux_socket_getpeername(struct socket *sock)
3953{
3954 return socket_has_perm(current, sock, SOCKET__GETATTR);
3955}
3956
Eric Paris828dfe12008-04-17 13:17:49 -04003957static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003958{
Paul Mooref8687af2006-10-30 15:22:15 -08003959 int err;
3960
3961 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3962 if (err)
3963 return err;
3964
3965 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003966}
3967
3968static int selinux_socket_getsockopt(struct socket *sock, int level,
3969 int optname)
3970{
3971 return socket_has_perm(current, sock, SOCKET__GETOPT);
3972}
3973
3974static int selinux_socket_shutdown(struct socket *sock, int how)
3975{
3976 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3977}
3978
3979static int selinux_socket_unix_stream_connect(struct socket *sock,
3980 struct socket *other,
3981 struct sock *newsk)
3982{
Eric Parisdd3e7832010-04-07 15:08:46 -04003983 struct sk_security_struct *sksec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003984 struct inode_security_struct *isec;
3985 struct inode_security_struct *other_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003986 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003987 int err;
3988
Linus Torvalds1da177e2005-04-16 15:20:36 -07003989 isec = SOCK_INODE(sock)->i_security;
3990 other_isec = SOCK_INODE(other)->i_security;
3991
Thomas Liu2bf49692009-07-14 12:14:09 -04003992 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003993 ad.u.net.sk = other->sk;
3994
3995 err = avc_has_perm(isec->sid, other_isec->sid,
3996 isec->sclass,
3997 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3998 if (err)
3999 return err;
4000
4001 /* connecting socket */
Eric Parisdd3e7832010-04-07 15:08:46 -04004002 sksec = sock->sk->sk_security;
4003 sksec->peer_sid = other_isec->sid;
Eric Paris828dfe12008-04-17 13:17:49 -04004004
Linus Torvalds1da177e2005-04-16 15:20:36 -07004005 /* server child socket */
Eric Parisdd3e7832010-04-07 15:08:46 -04004006 sksec = newsk->sk_security;
4007 sksec->peer_sid = isec->sid;
4008 err = security_sid_mls_copy(other_isec->sid, sksec->peer_sid, &sksec->sid);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004009
4010 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004011}
4012
4013static int selinux_socket_unix_may_send(struct socket *sock,
4014 struct socket *other)
4015{
4016 struct inode_security_struct *isec;
4017 struct inode_security_struct *other_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004018 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004019 int err;
4020
4021 isec = SOCK_INODE(sock)->i_security;
4022 other_isec = SOCK_INODE(other)->i_security;
4023
Thomas Liu2bf49692009-07-14 12:14:09 -04004024 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004025 ad.u.net.sk = other->sk;
4026
4027 err = avc_has_perm(isec->sid, other_isec->sid,
4028 isec->sclass, SOCKET__SENDTO, &ad);
4029 if (err)
4030 return err;
4031
4032 return 0;
4033}
4034
Paul Mooreeffad8d2008-01-29 08:49:27 -05004035static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4036 u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004037 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004038{
4039 int err;
4040 u32 if_sid;
4041 u32 node_sid;
4042
4043 err = sel_netif_sid(ifindex, &if_sid);
4044 if (err)
4045 return err;
4046 err = avc_has_perm(peer_sid, if_sid,
4047 SECCLASS_NETIF, NETIF__INGRESS, ad);
4048 if (err)
4049 return err;
4050
4051 err = sel_netnode_sid(addrp, family, &node_sid);
4052 if (err)
4053 return err;
4054 return avc_has_perm(peer_sid, node_sid,
4055 SECCLASS_NODE, NODE__RECVFROM, ad);
4056}
4057
Paul Moore220deb92008-01-29 08:38:23 -05004058static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004059 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004060{
Paul Moore277d3422008-12-31 12:54:11 -05004061 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004062 struct sk_security_struct *sksec = sk->sk_security;
4063 u32 peer_sid;
4064 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004065 struct common_audit_data ad;
Paul Moored8395c82008-10-10 10:16:30 -04004066 char *addrp;
4067
Thomas Liu2bf49692009-07-14 12:14:09 -04004068 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Dumazet8964be42009-11-20 15:35:04 -08004069 ad.u.net.netif = skb->skb_iif;
Paul Moored8395c82008-10-10 10:16:30 -04004070 ad.u.net.family = family;
4071 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4072 if (err)
4073 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004074
Paul Moore58bfbb52009-03-27 17:10:41 -04004075 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004076 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004077 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004078 if (err)
4079 return err;
4080 }
Paul Moore220deb92008-01-29 08:38:23 -05004081
4082 if (selinux_policycap_netpeer) {
4083 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004084 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004085 return err;
4086 err = avc_has_perm(sk_sid, peer_sid,
Paul Moored8395c82008-10-10 10:16:30 -04004087 SECCLASS_PEER, PEER__RECV, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004088 if (err)
4089 selinux_netlbl_err(skb, err, 0);
Paul Moore220deb92008-01-29 08:38:23 -05004090 } else {
Paul Moored8395c82008-10-10 10:16:30 -04004091 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
Paul Moore220deb92008-01-29 08:38:23 -05004092 if (err)
4093 return err;
Paul Moored8395c82008-10-10 10:16:30 -04004094 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004095 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004096
James Morris4e5ab4c2006-06-09 00:33:33 -07004097 return err;
4098}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004099
James Morris4e5ab4c2006-06-09 00:33:33 -07004100static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4101{
Paul Moore220deb92008-01-29 08:38:23 -05004102 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004103 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004104 u16 family = sk->sk_family;
4105 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004106 struct common_audit_data ad;
Paul Moore220deb92008-01-29 08:38:23 -05004107 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004108 u8 secmark_active;
4109 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004110
James Morris4e5ab4c2006-06-09 00:33:33 -07004111 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004112 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004113
4114 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004115 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004116 family = PF_INET;
4117
Paul Moored8395c82008-10-10 10:16:30 -04004118 /* If any sort of compatibility mode is enabled then handoff processing
4119 * to the selinux_sock_rcv_skb_compat() function to deal with the
4120 * special handling. We do this in an attempt to keep this function
4121 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004122 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004123 return selinux_sock_rcv_skb_compat(sk, skb, family);
4124
4125 secmark_active = selinux_secmark_enabled();
4126 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4127 if (!secmark_active && !peerlbl_active)
4128 return 0;
4129
Thomas Liu2bf49692009-07-14 12:14:09 -04004130 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Dumazet8964be42009-11-20 15:35:04 -08004131 ad.u.net.netif = skb->skb_iif;
James Morris4e5ab4c2006-06-09 00:33:33 -07004132 ad.u.net.family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004133 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004134 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004135 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004136
Paul Moored8395c82008-10-10 10:16:30 -04004137 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004138 u32 peer_sid;
4139
4140 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4141 if (err)
4142 return err;
Eric Dumazet8964be42009-11-20 15:35:04 -08004143 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004144 peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004145 if (err) {
4146 selinux_netlbl_err(skb, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004147 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004148 }
Paul Moored621d352008-01-29 08:43:36 -05004149 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4150 PEER__RECV, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004151 if (err)
4152 selinux_netlbl_err(skb, err, 0);
Paul Moored621d352008-01-29 08:43:36 -05004153 }
4154
Paul Moored8395c82008-10-10 10:16:30 -04004155 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004156 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4157 PACKET__RECV, &ad);
4158 if (err)
4159 return err;
4160 }
4161
Paul Moored621d352008-01-29 08:43:36 -05004162 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004163}
4164
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004165static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4166 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004167{
4168 int err = 0;
4169 char *scontext;
4170 u32 scontext_len;
Eric Parisdd3e7832010-04-07 15:08:46 -04004171 struct sk_security_struct *sksec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004172 struct inode_security_struct *isec;
Paul Moore3de4bab2006-11-17 17:38:54 -05004173 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004174
4175 isec = SOCK_INODE(sock)->i_security;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004176
Paul Moore3de4bab2006-11-17 17:38:54 -05004177 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4178 isec->sclass == SECCLASS_TCP_SOCKET) {
Eric Parisdd3e7832010-04-07 15:08:46 -04004179 sksec = sock->sk->sk_security;
4180 peer_sid = sksec->peer_sid;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004181 }
Paul Moore3de4bab2006-11-17 17:38:54 -05004182 if (peer_sid == SECSID_NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004183 err = -ENOPROTOOPT;
4184 goto out;
4185 }
4186
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004187 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4188
Linus Torvalds1da177e2005-04-16 15:20:36 -07004189 if (err)
4190 goto out;
4191
4192 if (scontext_len > len) {
4193 err = -ERANGE;
4194 goto out_len;
4195 }
4196
4197 if (copy_to_user(optval, scontext, scontext_len))
4198 err = -EFAULT;
4199
4200out_len:
4201 if (put_user(scontext_len, optlen))
4202 err = -EFAULT;
4203
4204 kfree(scontext);
Eric Paris828dfe12008-04-17 13:17:49 -04004205out:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004206 return err;
4207}
4208
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004209static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004210{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004211 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004212 u16 family;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004213
Paul Mooreaa862902008-10-10 10:16:29 -04004214 if (skb && skb->protocol == htons(ETH_P_IP))
4215 family = PF_INET;
4216 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4217 family = PF_INET6;
4218 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004219 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004220 else
4221 goto out;
4222
4223 if (sock && family == PF_UNIX)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02004224 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
Paul Moore3de4bab2006-11-17 17:38:54 -05004225 else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004226 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004227
Paul Moore75e22912008-01-29 08:38:04 -05004228out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004229 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004230 if (peer_secid == SECSID_NULL)
4231 return -EINVAL;
4232 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004233}
4234
Al Viro7d877f32005-10-21 03:20:43 -04004235static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004236{
4237 return sk_alloc_security(sk, family, priority);
4238}
4239
4240static void selinux_sk_free_security(struct sock *sk)
4241{
4242 sk_free_security(sk);
4243}
4244
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004245static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4246{
Eric Parisdd3e7832010-04-07 15:08:46 -04004247 struct sk_security_struct *sksec = sk->sk_security;
4248 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004249
Eric Parisdd3e7832010-04-07 15:08:46 -04004250 newsksec->sid = sksec->sid;
4251 newsksec->peer_sid = sksec->peer_sid;
4252 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004253
Eric Parisdd3e7832010-04-07 15:08:46 -04004254 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004255}
4256
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004257static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004258{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004259 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004260 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004261 else {
4262 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004263
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004264 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004265 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004266}
4267
Eric Paris828dfe12008-04-17 13:17:49 -04004268static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004269{
4270 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4271 struct sk_security_struct *sksec = sk->sk_security;
4272
David Woodhouse2148ccc2006-09-29 15:50:25 -07004273 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4274 sk->sk_family == PF_UNIX)
4275 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004276 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004277}
4278
Adrian Bunk9a673e52006-08-15 00:03:53 -07004279static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4280 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004281{
4282 struct sk_security_struct *sksec = sk->sk_security;
4283 int err;
Paul Mooreaa862902008-10-10 10:16:29 -04004284 u16 family = sk->sk_family;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004285 u32 newsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004286 u32 peersid;
4287
Paul Mooreaa862902008-10-10 10:16:29 -04004288 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4289 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4290 family = PF_INET;
4291
4292 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004293 if (err)
4294 return err;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004295 if (peersid == SECSID_NULL) {
4296 req->secid = sksec->sid;
Paul Moore3de4bab2006-11-17 17:38:54 -05004297 req->peer_secid = SECSID_NULL;
Paul Moore389fb8002009-03-27 17:10:34 -04004298 } else {
4299 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4300 if (err)
4301 return err;
4302 req->secid = newsid;
4303 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004304 }
4305
Paul Moore389fb8002009-03-27 17:10:34 -04004306 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004307}
4308
Adrian Bunk9a673e52006-08-15 00:03:53 -07004309static void selinux_inet_csk_clone(struct sock *newsk,
4310 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004311{
4312 struct sk_security_struct *newsksec = newsk->sk_security;
4313
4314 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004315 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004316 /* NOTE: Ideally, we should also get the isec->sid for the
4317 new socket in sync, but we don't have the isec available yet.
4318 So we will wait until sock_graft to do it, by which
4319 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004320
Paul Moore9f2ad662006-11-17 17:38:53 -05004321 /* We don't need to take any sort of lock here as we are the only
4322 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04004323 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004324}
4325
Paul Moore014ab192008-10-10 10:16:33 -04004326static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004327{
Paul Mooreaa862902008-10-10 10:16:29 -04004328 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004329 struct sk_security_struct *sksec = sk->sk_security;
4330
Paul Mooreaa862902008-10-10 10:16:29 -04004331 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4332 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4333 family = PF_INET;
4334
4335 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004336}
4337
Adrian Bunk9a673e52006-08-15 00:03:53 -07004338static void selinux_req_classify_flow(const struct request_sock *req,
4339 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004340{
4341 fl->secid = req->secid;
4342}
4343
Paul Mooreed6d76e2009-08-28 18:12:49 -04004344static int selinux_tun_dev_create(void)
4345{
4346 u32 sid = current_sid();
4347
4348 /* we aren't taking into account the "sockcreate" SID since the socket
4349 * that is being created here is not a socket in the traditional sense,
4350 * instead it is a private sock, accessible only to the kernel, and
4351 * representing a wide range of network traffic spanning multiple
4352 * connections unlike traditional sockets - check the TUN driver to
4353 * get a better understanding of why this socket is special */
4354
4355 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4356 NULL);
4357}
4358
4359static void selinux_tun_dev_post_create(struct sock *sk)
4360{
4361 struct sk_security_struct *sksec = sk->sk_security;
4362
4363 /* we don't currently perform any NetLabel based labeling here and it
4364 * isn't clear that we would want to do so anyway; while we could apply
4365 * labeling without the support of the TUN user the resulting labeled
4366 * traffic from the other end of the connection would almost certainly
4367 * cause confusion to the TUN user that had no idea network labeling
4368 * protocols were being used */
4369
4370 /* see the comments in selinux_tun_dev_create() about why we don't use
4371 * the sockcreate SID here */
4372
4373 sksec->sid = current_sid();
4374 sksec->sclass = SECCLASS_TUN_SOCKET;
4375}
4376
4377static int selinux_tun_dev_attach(struct sock *sk)
4378{
4379 struct sk_security_struct *sksec = sk->sk_security;
4380 u32 sid = current_sid();
4381 int err;
4382
4383 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4384 TUN_SOCKET__RELABELFROM, NULL);
4385 if (err)
4386 return err;
4387 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4388 TUN_SOCKET__RELABELTO, NULL);
4389 if (err)
4390 return err;
4391
4392 sksec->sid = sid;
4393
4394 return 0;
4395}
4396
Linus Torvalds1da177e2005-04-16 15:20:36 -07004397static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4398{
4399 int err = 0;
4400 u32 perm;
4401 struct nlmsghdr *nlh;
4402 struct socket *sock = sk->sk_socket;
4403 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
Eric Paris828dfe12008-04-17 13:17:49 -04004404
Linus Torvalds1da177e2005-04-16 15:20:36 -07004405 if (skb->len < NLMSG_SPACE(0)) {
4406 err = -EINVAL;
4407 goto out;
4408 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07004409 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04004410
Linus Torvalds1da177e2005-04-16 15:20:36 -07004411 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4412 if (err) {
4413 if (err == -EINVAL) {
David Woodhouse9ad9ad32005-06-22 15:04:33 +01004414 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004415 "SELinux: unrecognized netlink message"
4416 " type=%hu for sclass=%hu\n",
4417 nlh->nlmsg_type, isec->sclass);
Eric Paris39c9aed2008-11-05 09:34:42 -05004418 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07004419 err = 0;
4420 }
4421
4422 /* Ignore */
4423 if (err == -ENOENT)
4424 err = 0;
4425 goto out;
4426 }
4427
4428 err = socket_has_perm(current, sock, perm);
4429out:
4430 return err;
4431}
4432
4433#ifdef CONFIG_NETFILTER
4434
Paul Mooreeffad8d2008-01-29 08:49:27 -05004435static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4436 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004437{
Paul Mooredfaebe92008-10-10 10:16:31 -04004438 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004439 char *addrp;
4440 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004441 struct common_audit_data ad;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004442 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04004443 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004444 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004445
Paul Mooreeffad8d2008-01-29 08:49:27 -05004446 if (!selinux_policycap_netpeer)
4447 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004448
Paul Mooreeffad8d2008-01-29 08:49:27 -05004449 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04004450 netlbl_active = netlbl_enabled();
4451 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05004452 if (!secmark_active && !peerlbl_active)
4453 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004454
Paul Moored8395c82008-10-10 10:16:30 -04004455 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4456 return NF_DROP;
4457
Thomas Liu2bf49692009-07-14 12:14:09 -04004458 COMMON_AUDIT_DATA_INIT(&ad, NET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004459 ad.u.net.netif = ifindex;
4460 ad.u.net.family = family;
4461 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4462 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004463
Paul Mooredfaebe92008-10-10 10:16:31 -04004464 if (peerlbl_active) {
4465 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4466 peer_sid, &ad);
4467 if (err) {
4468 selinux_netlbl_err(skb, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004469 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04004470 }
4471 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05004472
4473 if (secmark_active)
4474 if (avc_has_perm(peer_sid, skb->secmark,
4475 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4476 return NF_DROP;
4477
Paul Moore948bf852008-10-10 10:16:32 -04004478 if (netlbl_active)
4479 /* we do this in the FORWARD path and not the POST_ROUTING
4480 * path because we want to make sure we apply the necessary
4481 * labeling before IPsec is applied so we can leverage AH
4482 * protection */
4483 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4484 return NF_DROP;
4485
Paul Mooreeffad8d2008-01-29 08:49:27 -05004486 return NF_ACCEPT;
4487}
4488
4489static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4490 struct sk_buff *skb,
4491 const struct net_device *in,
4492 const struct net_device *out,
4493 int (*okfn)(struct sk_buff *))
4494{
4495 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4496}
4497
4498#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4499static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4500 struct sk_buff *skb,
4501 const struct net_device *in,
4502 const struct net_device *out,
4503 int (*okfn)(struct sk_buff *))
4504{
4505 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4506}
4507#endif /* IPV6 */
4508
Paul Moore948bf852008-10-10 10:16:32 -04004509static unsigned int selinux_ip_output(struct sk_buff *skb,
4510 u16 family)
4511{
4512 u32 sid;
4513
4514 if (!netlbl_enabled())
4515 return NF_ACCEPT;
4516
4517 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4518 * because we want to make sure we apply the necessary labeling
4519 * before IPsec is applied so we can leverage AH protection */
4520 if (skb->sk) {
4521 struct sk_security_struct *sksec = skb->sk->sk_security;
4522 sid = sksec->sid;
4523 } else
4524 sid = SECINITSID_KERNEL;
4525 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4526 return NF_DROP;
4527
4528 return NF_ACCEPT;
4529}
4530
4531static unsigned int selinux_ipv4_output(unsigned int hooknum,
4532 struct sk_buff *skb,
4533 const struct net_device *in,
4534 const struct net_device *out,
4535 int (*okfn)(struct sk_buff *))
4536{
4537 return selinux_ip_output(skb, PF_INET);
4538}
4539
Paul Mooreeffad8d2008-01-29 08:49:27 -05004540static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4541 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04004542 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07004543{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004544 struct sock *sk = skb->sk;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004545 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004546 struct common_audit_data ad;
Paul Moored8395c82008-10-10 10:16:30 -04004547 char *addrp;
4548 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07004549
Paul Mooreeffad8d2008-01-29 08:49:27 -05004550 if (sk == NULL)
4551 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004552 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07004553
Thomas Liu2bf49692009-07-14 12:14:09 -04004554 COMMON_AUDIT_DATA_INIT(&ad, NET);
Paul Moored8395c82008-10-10 10:16:30 -04004555 ad.u.net.netif = ifindex;
4556 ad.u.net.family = family;
4557 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4558 return NF_DROP;
4559
Paul Moore58bfbb52009-03-27 17:10:41 -04004560 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05004561 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04004562 SECCLASS_PACKET, PACKET__SEND, &ad))
Paul Mooreeffad8d2008-01-29 08:49:27 -05004563 return NF_DROP;
James Morris4e5ab4c2006-06-09 00:33:33 -07004564
Paul Mooreeffad8d2008-01-29 08:49:27 -05004565 if (selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004566 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
Paul Mooreeffad8d2008-01-29 08:49:27 -05004567 return NF_DROP;
James Morris4e5ab4c2006-06-09 00:33:33 -07004568
Paul Mooreeffad8d2008-01-29 08:49:27 -05004569 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004570}
4571
Paul Mooreeffad8d2008-01-29 08:49:27 -05004572static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4573 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004574{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004575 u32 secmark_perm;
4576 u32 peer_sid;
4577 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04004578 struct common_audit_data ad;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004579 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004580 u8 secmark_active;
4581 u8 peerlbl_active;
4582
Paul Mooreeffad8d2008-01-29 08:49:27 -05004583 /* If any sort of compatibility mode is enabled then handoff processing
4584 * to the selinux_ip_postroute_compat() function to deal with the
4585 * special handling. We do this in an attempt to keep this function
4586 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004587 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004588 return selinux_ip_postroute_compat(skb, ifindex, family);
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004589#ifdef CONFIG_XFRM
Paul Mooreeffad8d2008-01-29 08:49:27 -05004590 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4591 * packet transformation so allow the packet to pass without any checks
4592 * since we'll have another chance to perform access control checks
4593 * when the packet is on it's final way out.
4594 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4595 * is NULL, in this case go ahead and apply access control. */
Eric Dumazetadf30902009-06-02 05:19:30 +00004596 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004597 return NF_ACCEPT;
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004598#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05004599 secmark_active = selinux_secmark_enabled();
4600 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4601 if (!secmark_active && !peerlbl_active)
4602 return NF_ACCEPT;
4603
Paul Moored8395c82008-10-10 10:16:30 -04004604 /* if the packet is being forwarded then get the peer label from the
4605 * packet itself; otherwise check to see if it is from a local
4606 * application or the kernel, if from an application get the peer label
4607 * from the sending socket, otherwise use the kernel's sid */
Paul Mooreeffad8d2008-01-29 08:49:27 -05004608 sk = skb->sk;
Paul Moored8395c82008-10-10 10:16:30 -04004609 if (sk == NULL) {
4610 switch (family) {
4611 case PF_INET:
4612 if (IPCB(skb)->flags & IPSKB_FORWARDED)
4613 secmark_perm = PACKET__FORWARD_OUT;
4614 else
4615 secmark_perm = PACKET__SEND;
4616 break;
4617 case PF_INET6:
4618 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4619 secmark_perm = PACKET__FORWARD_OUT;
4620 else
4621 secmark_perm = PACKET__SEND;
4622 break;
4623 default:
4624 return NF_DROP;
4625 }
4626 if (secmark_perm == PACKET__FORWARD_OUT) {
4627 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4628 return NF_DROP;
4629 } else
4630 peer_sid = SECINITSID_KERNEL;
4631 } else {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004632 struct sk_security_struct *sksec = sk->sk_security;
4633 peer_sid = sksec->sid;
4634 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004635 }
4636
Thomas Liu2bf49692009-07-14 12:14:09 -04004637 COMMON_AUDIT_DATA_INIT(&ad, NET);
Paul Moored8395c82008-10-10 10:16:30 -04004638 ad.u.net.netif = ifindex;
4639 ad.u.net.family = family;
4640 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4641 return NF_DROP;
4642
Paul Mooreeffad8d2008-01-29 08:49:27 -05004643 if (secmark_active)
4644 if (avc_has_perm(peer_sid, skb->secmark,
4645 SECCLASS_PACKET, secmark_perm, &ad))
4646 return NF_DROP;
4647
4648 if (peerlbl_active) {
4649 u32 if_sid;
4650 u32 node_sid;
4651
4652 if (sel_netif_sid(ifindex, &if_sid))
4653 return NF_DROP;
4654 if (avc_has_perm(peer_sid, if_sid,
4655 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4656 return NF_DROP;
4657
4658 if (sel_netnode_sid(addrp, family, &node_sid))
4659 return NF_DROP;
4660 if (avc_has_perm(peer_sid, node_sid,
4661 SECCLASS_NODE, NODE__SENDTO, &ad))
4662 return NF_DROP;
4663 }
4664
4665 return NF_ACCEPT;
4666}
4667
4668static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4669 struct sk_buff *skb,
4670 const struct net_device *in,
4671 const struct net_device *out,
4672 int (*okfn)(struct sk_buff *))
4673{
4674 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004675}
4676
4677#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004678static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4679 struct sk_buff *skb,
4680 const struct net_device *in,
4681 const struct net_device *out,
4682 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004683{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004684 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004685}
Linus Torvalds1da177e2005-04-16 15:20:36 -07004686#endif /* IPV6 */
4687
4688#endif /* CONFIG_NETFILTER */
4689
Linus Torvalds1da177e2005-04-16 15:20:36 -07004690static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4691{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004692 int err;
4693
Eric Paris200ac532009-02-12 15:01:04 -05004694 err = cap_netlink_send(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004695 if (err)
4696 return err;
4697
Stephen Smalley941fc5b2009-10-01 14:48:23 -04004698 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004699}
4700
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004701static int selinux_netlink_recv(struct sk_buff *skb, int capability)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004702{
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004703 int err;
Thomas Liu2bf49692009-07-14 12:14:09 -04004704 struct common_audit_data ad;
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004705
Eric Paris200ac532009-02-12 15:01:04 -05004706 err = cap_netlink_recv(skb, capability);
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004707 if (err)
4708 return err;
4709
Thomas Liu2bf49692009-07-14 12:14:09 -04004710 COMMON_AUDIT_DATA_INIT(&ad, CAP);
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004711 ad.u.cap = capability;
4712
4713 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
Eric Paris828dfe12008-04-17 13:17:49 -04004714 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004715}
4716
4717static int ipc_alloc_security(struct task_struct *task,
4718 struct kern_ipc_perm *perm,
4719 u16 sclass)
4720{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004721 struct ipc_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11004722 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004723
James Morris89d155e2005-10-30 14:59:21 -08004724 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004725 if (!isec)
4726 return -ENOMEM;
4727
David Howells275bb412008-11-14 10:39:19 +11004728 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004729 isec->sclass = sclass;
David Howells275bb412008-11-14 10:39:19 +11004730 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004731 perm->security = isec;
4732
4733 return 0;
4734}
4735
4736static void ipc_free_security(struct kern_ipc_perm *perm)
4737{
4738 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004739 perm->security = NULL;
4740 kfree(isec);
4741}
4742
4743static int msg_msg_alloc_security(struct msg_msg *msg)
4744{
4745 struct msg_security_struct *msec;
4746
James Morris89d155e2005-10-30 14:59:21 -08004747 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004748 if (!msec)
4749 return -ENOMEM;
4750
Linus Torvalds1da177e2005-04-16 15:20:36 -07004751 msec->sid = SECINITSID_UNLABELED;
4752 msg->security = msec;
4753
4754 return 0;
4755}
4756
4757static void msg_msg_free_security(struct msg_msg *msg)
4758{
4759 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004760
4761 msg->security = NULL;
4762 kfree(msec);
4763}
4764
4765static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07004766 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004767{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004768 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004769 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004770 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004771
Linus Torvalds1da177e2005-04-16 15:20:36 -07004772 isec = ipc_perms->security;
4773
Thomas Liu2bf49692009-07-14 12:14:09 -04004774 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004775 ad.u.ipc_id = ipc_perms->key;
4776
David Howells275bb412008-11-14 10:39:19 +11004777 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004778}
4779
4780static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4781{
4782 return msg_msg_alloc_security(msg);
4783}
4784
4785static void selinux_msg_msg_free_security(struct msg_msg *msg)
4786{
4787 msg_msg_free_security(msg);
4788}
4789
4790/* message queue security operations */
4791static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4792{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004793 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004794 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004795 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004796 int rc;
4797
4798 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4799 if (rc)
4800 return rc;
4801
Linus Torvalds1da177e2005-04-16 15:20:36 -07004802 isec = msq->q_perm.security;
4803
Thomas Liu2bf49692009-07-14 12:14:09 -04004804 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04004805 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004806
David Howells275bb412008-11-14 10:39:19 +11004807 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004808 MSGQ__CREATE, &ad);
4809 if (rc) {
4810 ipc_free_security(&msq->q_perm);
4811 return rc;
4812 }
4813 return 0;
4814}
4815
4816static void selinux_msg_queue_free_security(struct msg_queue *msq)
4817{
4818 ipc_free_security(&msq->q_perm);
4819}
4820
4821static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4822{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004823 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004824 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004825 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004826
Linus Torvalds1da177e2005-04-16 15:20:36 -07004827 isec = msq->q_perm.security;
4828
Thomas Liu2bf49692009-07-14 12:14:09 -04004829 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004830 ad.u.ipc_id = msq->q_perm.key;
4831
David Howells275bb412008-11-14 10:39:19 +11004832 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004833 MSGQ__ASSOCIATE, &ad);
4834}
4835
4836static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4837{
4838 int err;
4839 int perms;
4840
Eric Paris828dfe12008-04-17 13:17:49 -04004841 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004842 case IPC_INFO:
4843 case MSG_INFO:
4844 /* No specific object, just general system-wide information. */
4845 return task_has_system(current, SYSTEM__IPC_INFO);
4846 case IPC_STAT:
4847 case MSG_STAT:
4848 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4849 break;
4850 case IPC_SET:
4851 perms = MSGQ__SETATTR;
4852 break;
4853 case IPC_RMID:
4854 perms = MSGQ__DESTROY;
4855 break;
4856 default:
4857 return 0;
4858 }
4859
Stephen Smalley6af963f2005-05-01 08:58:39 -07004860 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004861 return err;
4862}
4863
4864static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4865{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004866 struct ipc_security_struct *isec;
4867 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004868 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004869 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004870 int rc;
4871
Linus Torvalds1da177e2005-04-16 15:20:36 -07004872 isec = msq->q_perm.security;
4873 msec = msg->security;
4874
4875 /*
4876 * First time through, need to assign label to the message
4877 */
4878 if (msec->sid == SECINITSID_UNLABELED) {
4879 /*
4880 * Compute new sid based on current process and
4881 * message queue this message will be stored in
4882 */
David Howells275bb412008-11-14 10:39:19 +11004883 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004884 &msec->sid);
4885 if (rc)
4886 return rc;
4887 }
4888
Thomas Liu2bf49692009-07-14 12:14:09 -04004889 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004890 ad.u.ipc_id = msq->q_perm.key;
4891
4892 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11004893 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004894 MSGQ__WRITE, &ad);
4895 if (!rc)
4896 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11004897 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4898 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004899 if (!rc)
4900 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11004901 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4902 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004903
4904 return rc;
4905}
4906
4907static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4908 struct task_struct *target,
4909 long type, int mode)
4910{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004911 struct ipc_security_struct *isec;
4912 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004913 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004914 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004915 int rc;
4916
Linus Torvalds1da177e2005-04-16 15:20:36 -07004917 isec = msq->q_perm.security;
4918 msec = msg->security;
4919
Thomas Liu2bf49692009-07-14 12:14:09 -04004920 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04004921 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004922
David Howells275bb412008-11-14 10:39:19 +11004923 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004924 SECCLASS_MSGQ, MSGQ__READ, &ad);
4925 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11004926 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004927 SECCLASS_MSG, MSG__RECEIVE, &ad);
4928 return rc;
4929}
4930
4931/* Shared Memory security operations */
4932static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4933{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004934 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004935 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004936 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004937 int rc;
4938
4939 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4940 if (rc)
4941 return rc;
4942
Linus Torvalds1da177e2005-04-16 15:20:36 -07004943 isec = shp->shm_perm.security;
4944
Thomas Liu2bf49692009-07-14 12:14:09 -04004945 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04004946 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004947
David Howells275bb412008-11-14 10:39:19 +11004948 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004949 SHM__CREATE, &ad);
4950 if (rc) {
4951 ipc_free_security(&shp->shm_perm);
4952 return rc;
4953 }
4954 return 0;
4955}
4956
4957static void selinux_shm_free_security(struct shmid_kernel *shp)
4958{
4959 ipc_free_security(&shp->shm_perm);
4960}
4961
4962static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4963{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004964 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004965 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004966 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004967
Linus Torvalds1da177e2005-04-16 15:20:36 -07004968 isec = shp->shm_perm.security;
4969
Thomas Liu2bf49692009-07-14 12:14:09 -04004970 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004971 ad.u.ipc_id = shp->shm_perm.key;
4972
David Howells275bb412008-11-14 10:39:19 +11004973 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004974 SHM__ASSOCIATE, &ad);
4975}
4976
4977/* Note, at this point, shp is locked down */
4978static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4979{
4980 int perms;
4981 int err;
4982
Eric Paris828dfe12008-04-17 13:17:49 -04004983 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004984 case IPC_INFO:
4985 case SHM_INFO:
4986 /* No specific object, just general system-wide information. */
4987 return task_has_system(current, SYSTEM__IPC_INFO);
4988 case IPC_STAT:
4989 case SHM_STAT:
4990 perms = SHM__GETATTR | SHM__ASSOCIATE;
4991 break;
4992 case IPC_SET:
4993 perms = SHM__SETATTR;
4994 break;
4995 case SHM_LOCK:
4996 case SHM_UNLOCK:
4997 perms = SHM__LOCK;
4998 break;
4999 case IPC_RMID:
5000 perms = SHM__DESTROY;
5001 break;
5002 default:
5003 return 0;
5004 }
5005
Stephen Smalley6af963f2005-05-01 08:58:39 -07005006 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005007 return err;
5008}
5009
5010static int selinux_shm_shmat(struct shmid_kernel *shp,
5011 char __user *shmaddr, int shmflg)
5012{
5013 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005014
5015 if (shmflg & SHM_RDONLY)
5016 perms = SHM__READ;
5017 else
5018 perms = SHM__READ | SHM__WRITE;
5019
Stephen Smalley6af963f2005-05-01 08:58:39 -07005020 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005021}
5022
5023/* Semaphore security operations */
5024static int selinux_sem_alloc_security(struct sem_array *sma)
5025{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005026 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005027 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005028 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005029 int rc;
5030
5031 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5032 if (rc)
5033 return rc;
5034
Linus Torvalds1da177e2005-04-16 15:20:36 -07005035 isec = sma->sem_perm.security;
5036
Thomas Liu2bf49692009-07-14 12:14:09 -04005037 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04005038 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005039
David Howells275bb412008-11-14 10:39:19 +11005040 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005041 SEM__CREATE, &ad);
5042 if (rc) {
5043 ipc_free_security(&sma->sem_perm);
5044 return rc;
5045 }
5046 return 0;
5047}
5048
5049static void selinux_sem_free_security(struct sem_array *sma)
5050{
5051 ipc_free_security(&sma->sem_perm);
5052}
5053
5054static int selinux_sem_associate(struct sem_array *sma, int semflg)
5055{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005056 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005057 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005058 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005059
Linus Torvalds1da177e2005-04-16 15:20:36 -07005060 isec = sma->sem_perm.security;
5061
Thomas Liu2bf49692009-07-14 12:14:09 -04005062 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005063 ad.u.ipc_id = sma->sem_perm.key;
5064
David Howells275bb412008-11-14 10:39:19 +11005065 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005066 SEM__ASSOCIATE, &ad);
5067}
5068
5069/* Note, at this point, sma is locked down */
5070static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5071{
5072 int err;
5073 u32 perms;
5074
Eric Paris828dfe12008-04-17 13:17:49 -04005075 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005076 case IPC_INFO:
5077 case SEM_INFO:
5078 /* No specific object, just general system-wide information. */
5079 return task_has_system(current, SYSTEM__IPC_INFO);
5080 case GETPID:
5081 case GETNCNT:
5082 case GETZCNT:
5083 perms = SEM__GETATTR;
5084 break;
5085 case GETVAL:
5086 case GETALL:
5087 perms = SEM__READ;
5088 break;
5089 case SETVAL:
5090 case SETALL:
5091 perms = SEM__WRITE;
5092 break;
5093 case IPC_RMID:
5094 perms = SEM__DESTROY;
5095 break;
5096 case IPC_SET:
5097 perms = SEM__SETATTR;
5098 break;
5099 case IPC_STAT:
5100 case SEM_STAT:
5101 perms = SEM__GETATTR | SEM__ASSOCIATE;
5102 break;
5103 default:
5104 return 0;
5105 }
5106
Stephen Smalley6af963f2005-05-01 08:58:39 -07005107 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005108 return err;
5109}
5110
5111static int selinux_sem_semop(struct sem_array *sma,
5112 struct sembuf *sops, unsigned nsops, int alter)
5113{
5114 u32 perms;
5115
5116 if (alter)
5117 perms = SEM__READ | SEM__WRITE;
5118 else
5119 perms = SEM__READ;
5120
Stephen Smalley6af963f2005-05-01 08:58:39 -07005121 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005122}
5123
5124static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5125{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005126 u32 av = 0;
5127
Linus Torvalds1da177e2005-04-16 15:20:36 -07005128 av = 0;
5129 if (flag & S_IRUGO)
5130 av |= IPC__UNIX_READ;
5131 if (flag & S_IWUGO)
5132 av |= IPC__UNIX_WRITE;
5133
5134 if (av == 0)
5135 return 0;
5136
Stephen Smalley6af963f2005-05-01 08:58:39 -07005137 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005138}
5139
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02005140static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5141{
5142 struct ipc_security_struct *isec = ipcp->security;
5143 *secid = isec->sid;
5144}
5145
Eric Paris828dfe12008-04-17 13:17:49 -04005146static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005147{
5148 if (inode)
5149 inode_doinit_with_dentry(inode, dentry);
5150}
5151
5152static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005153 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005154{
David Howells275bb412008-11-14 10:39:19 +11005155 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005156 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005157 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005158 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005159
5160 if (current != p) {
David Howells3b11a1d2008-11-14 10:39:26 +11005161 error = current_has_perm(p, PROCESS__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005162 if (error)
5163 return error;
5164 }
5165
David Howells275bb412008-11-14 10:39:19 +11005166 rcu_read_lock();
5167 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005168
5169 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005170 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005171 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005172 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005173 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005174 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005175 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005176 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005177 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005178 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005179 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005180 sid = __tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005181 else
David Howells275bb412008-11-14 10:39:19 +11005182 goto invalid;
5183 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005184
5185 if (!sid)
5186 return 0;
5187
Al Viro04ff9702007-03-12 16:17:58 +00005188 error = security_sid_to_context(sid, value, &len);
5189 if (error)
5190 return error;
5191 return len;
David Howells275bb412008-11-14 10:39:19 +11005192
5193invalid:
5194 rcu_read_unlock();
5195 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005196}
5197
5198static int selinux_setprocattr(struct task_struct *p,
5199 char *name, void *value, size_t size)
5200{
5201 struct task_security_struct *tsec;
Roland McGrath03563572008-03-26 15:46:39 -07005202 struct task_struct *tracer;
David Howellsd84f4f92008-11-14 10:39:23 +11005203 struct cred *new;
5204 u32 sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005205 int error;
5206 char *str = value;
5207
5208 if (current != p) {
5209 /* SELinux only allows a process to change its own
5210 security attributes. */
5211 return -EACCES;
5212 }
5213
5214 /*
5215 * Basic control over ability to set these attributes at all.
5216 * current == p, but we'll pass them separately in case the
5217 * above restriction is ever removed.
5218 */
5219 if (!strcmp(name, "exec"))
David Howells3b11a1d2008-11-14 10:39:26 +11005220 error = current_has_perm(p, PROCESS__SETEXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005221 else if (!strcmp(name, "fscreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005222 error = current_has_perm(p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005223 else if (!strcmp(name, "keycreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005224 error = current_has_perm(p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07005225 else if (!strcmp(name, "sockcreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005226 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005227 else if (!strcmp(name, "current"))
David Howells3b11a1d2008-11-14 10:39:26 +11005228 error = current_has_perm(p, PROCESS__SETCURRENT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005229 else
5230 error = -EINVAL;
5231 if (error)
5232 return error;
5233
5234 /* Obtain a SID for the context, if one was specified. */
5235 if (size && str[1] && str[1] != '\n') {
5236 if (str[size-1] == '\n') {
5237 str[size-1] = 0;
5238 size--;
5239 }
5240 error = security_context_to_sid(value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005241 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5242 if (!capable(CAP_MAC_ADMIN))
5243 return error;
5244 error = security_context_to_sid_force(value, size,
5245 &sid);
5246 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005247 if (error)
5248 return error;
5249 }
5250
David Howellsd84f4f92008-11-14 10:39:23 +11005251 new = prepare_creds();
5252 if (!new)
5253 return -ENOMEM;
5254
Linus Torvalds1da177e2005-04-16 15:20:36 -07005255 /* Permission checking based on the specified context is
5256 performed during the actual operation (execve,
5257 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11005258 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07005259 checks and may_create for the file creation checks. The
5260 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11005261 tsec = new->security;
5262 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005263 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005264 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005265 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005266 } else if (!strcmp(name, "keycreate")) {
Michael LeMay4eb582c2006-06-26 00:24:57 -07005267 error = may_create_key(sid, p);
5268 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005269 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005270 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005271 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07005272 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005273 } else if (!strcmp(name, "current")) {
5274 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005275 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11005276 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09005277
David Howellsd84f4f92008-11-14 10:39:23 +11005278 /* Only allow single threaded processes to change context */
5279 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02005280 if (!current_is_single_threaded()) {
David Howellsd84f4f92008-11-14 10:39:23 +11005281 error = security_bounded_transition(tsec->sid, sid);
5282 if (error)
5283 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04005284 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005285
5286 /* Check permissions for the transition. */
5287 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04005288 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005289 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005290 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005291
5292 /* Check for ptracing, and update the task SID if ok.
5293 Otherwise, leave SID unchanged and fail. */
David Howellsd84f4f92008-11-14 10:39:23 +11005294 ptsid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005295 task_lock(p);
Roland McGrath0d094ef2008-07-25 19:45:49 -07005296 tracer = tracehook_tracer_task(p);
David Howellsd84f4f92008-11-14 10:39:23 +11005297 if (tracer)
5298 ptsid = task_sid(tracer);
5299 task_unlock(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005300
David Howellsd84f4f92008-11-14 10:39:23 +11005301 if (tracer) {
5302 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5303 PROCESS__PTRACE, NULL);
5304 if (error)
5305 goto abort_change;
5306 }
5307
5308 tsec->sid = sid;
5309 } else {
5310 error = -EINVAL;
5311 goto abort_change;
5312 }
5313
5314 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005315 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11005316
5317abort_change:
5318 abort_creds(new);
5319 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005320}
5321
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005322static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5323{
5324 return security_sid_to_context(secid, secdata, seclen);
5325}
5326
David Howells7bf570d2008-04-29 20:52:51 +01005327static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00005328{
5329 return security_context_to_sid(secdata, seclen, secid);
5330}
5331
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005332static void selinux_release_secctx(char *secdata, u32 seclen)
5333{
Paul Moore088999e2007-08-01 11:12:58 -04005334 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005335}
5336
David P. Quigley1ee65e32009-09-03 14:25:57 -04005337/*
5338 * called with inode->i_mutex locked
5339 */
5340static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5341{
5342 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5343}
5344
5345/*
5346 * called with inode->i_mutex locked
5347 */
5348static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5349{
5350 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5351}
5352
5353static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5354{
5355 int len = 0;
5356 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5357 ctx, true);
5358 if (len < 0)
5359 return len;
5360 *ctxlen = len;
5361 return 0;
5362}
Michael LeMayd7200242006-06-22 14:47:17 -07005363#ifdef CONFIG_KEYS
5364
David Howellsd84f4f92008-11-14 10:39:23 +11005365static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07005366 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07005367{
David Howellsd84f4f92008-11-14 10:39:23 +11005368 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07005369 struct key_security_struct *ksec;
5370
5371 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5372 if (!ksec)
5373 return -ENOMEM;
5374
David Howellsd84f4f92008-11-14 10:39:23 +11005375 tsec = cred->security;
5376 if (tsec->keycreate_sid)
5377 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005378 else
David Howellsd84f4f92008-11-14 10:39:23 +11005379 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005380
David Howells275bb412008-11-14 10:39:19 +11005381 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07005382 return 0;
5383}
5384
5385static void selinux_key_free(struct key *k)
5386{
5387 struct key_security_struct *ksec = k->security;
5388
5389 k->security = NULL;
5390 kfree(ksec);
5391}
5392
5393static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11005394 const struct cred *cred,
5395 key_perm_t perm)
Michael LeMayd7200242006-06-22 14:47:17 -07005396{
5397 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07005398 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11005399 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005400
5401 /* if no specific permissions are requested, we skip the
5402 permission check. No serious, additional covert channels
5403 appear to be created. */
5404 if (perm == 0)
5405 return 0;
5406
David Howellsd84f4f92008-11-14 10:39:23 +11005407 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11005408
5409 key = key_ref_to_ptr(key_ref);
5410 ksec = key->security;
5411
5412 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07005413}
5414
David Howells70a5bb72008-04-29 01:01:26 -07005415static int selinux_key_getsecurity(struct key *key, char **_buffer)
5416{
5417 struct key_security_struct *ksec = key->security;
5418 char *context = NULL;
5419 unsigned len;
5420 int rc;
5421
5422 rc = security_sid_to_context(ksec->sid, &context, &len);
5423 if (!rc)
5424 rc = len;
5425 *_buffer = context;
5426 return rc;
5427}
5428
Michael LeMayd7200242006-06-22 14:47:17 -07005429#endif
5430
Linus Torvalds1da177e2005-04-16 15:20:36 -07005431static struct security_operations selinux_ops = {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005432 .name = "selinux",
5433
Ingo Molnar9e488582009-05-07 19:26:19 +10005434 .ptrace_access_check = selinux_ptrace_access_check,
David Howells5cd9c582008-08-14 11:37:28 +01005435 .ptrace_traceme = selinux_ptrace_traceme,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005436 .capget = selinux_capget,
David Howellsd84f4f92008-11-14 10:39:23 +11005437 .capset = selinux_capset,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005438 .sysctl = selinux_sysctl,
5439 .capable = selinux_capable,
5440 .quotactl = selinux_quotactl,
5441 .quota_on = selinux_quota_on,
5442 .syslog = selinux_syslog,
5443 .vm_enough_memory = selinux_vm_enough_memory,
5444
5445 .netlink_send = selinux_netlink_send,
Eric Paris828dfe12008-04-17 13:17:49 -04005446 .netlink_recv = selinux_netlink_recv,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005447
David Howellsa6f76f22008-11-14 10:39:24 +11005448 .bprm_set_creds = selinux_bprm_set_creds,
David Howellsa6f76f22008-11-14 10:39:24 +11005449 .bprm_committing_creds = selinux_bprm_committing_creds,
5450 .bprm_committed_creds = selinux_bprm_committed_creds,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005451 .bprm_secureexec = selinux_bprm_secureexec,
5452
5453 .sb_alloc_security = selinux_sb_alloc_security,
5454 .sb_free_security = selinux_sb_free_security,
5455 .sb_copy_data = selinux_sb_copy_data,
Eric Paris828dfe12008-04-17 13:17:49 -04005456 .sb_kern_mount = selinux_sb_kern_mount,
Eric Paris2069f452008-07-04 09:47:13 +10005457 .sb_show_options = selinux_sb_show_options,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005458 .sb_statfs = selinux_sb_statfs,
5459 .sb_mount = selinux_mount,
5460 .sb_umount = selinux_umount,
Eric Parisc9180a52007-11-30 13:00:35 -05005461 .sb_set_mnt_opts = selinux_set_mnt_opts,
Eric Paris828dfe12008-04-17 13:17:49 -04005462 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
Eric Parise0007522008-03-05 10:31:54 -05005463 .sb_parse_opts_str = selinux_parse_opts_str,
5464
Linus Torvalds1da177e2005-04-16 15:20:36 -07005465
5466 .inode_alloc_security = selinux_inode_alloc_security,
5467 .inode_free_security = selinux_inode_free_security,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07005468 .inode_init_security = selinux_inode_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005469 .inode_create = selinux_inode_create,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005470 .inode_link = selinux_inode_link,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005471 .inode_unlink = selinux_inode_unlink,
5472 .inode_symlink = selinux_inode_symlink,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005473 .inode_mkdir = selinux_inode_mkdir,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005474 .inode_rmdir = selinux_inode_rmdir,
5475 .inode_mknod = selinux_inode_mknod,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005476 .inode_rename = selinux_inode_rename,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005477 .inode_readlink = selinux_inode_readlink,
5478 .inode_follow_link = selinux_inode_follow_link,
5479 .inode_permission = selinux_inode_permission,
5480 .inode_setattr = selinux_inode_setattr,
5481 .inode_getattr = selinux_inode_getattr,
5482 .inode_setxattr = selinux_inode_setxattr,
5483 .inode_post_setxattr = selinux_inode_post_setxattr,
5484 .inode_getxattr = selinux_inode_getxattr,
5485 .inode_listxattr = selinux_inode_listxattr,
5486 .inode_removexattr = selinux_inode_removexattr,
Eric Paris828dfe12008-04-17 13:17:49 -04005487 .inode_getsecurity = selinux_inode_getsecurity,
5488 .inode_setsecurity = selinux_inode_setsecurity,
5489 .inode_listsecurity = selinux_inode_listsecurity,
Eric Parisf5269712008-05-14 11:27:45 -04005490 .inode_getsecid = selinux_inode_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005491
5492 .file_permission = selinux_file_permission,
5493 .file_alloc_security = selinux_file_alloc_security,
5494 .file_free_security = selinux_file_free_security,
5495 .file_ioctl = selinux_file_ioctl,
5496 .file_mmap = selinux_file_mmap,
5497 .file_mprotect = selinux_file_mprotect,
5498 .file_lock = selinux_file_lock,
5499 .file_fcntl = selinux_file_fcntl,
5500 .file_set_fowner = selinux_file_set_fowner,
5501 .file_send_sigiotask = selinux_file_send_sigiotask,
5502 .file_receive = selinux_file_receive,
5503
Eric Paris828dfe12008-04-17 13:17:49 -04005504 .dentry_open = selinux_dentry_open,
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09005505
Linus Torvalds1da177e2005-04-16 15:20:36 -07005506 .task_create = selinux_task_create,
David Howellsee18d642009-09-02 09:14:21 +01005507 .cred_alloc_blank = selinux_cred_alloc_blank,
David Howellsf1752ee2008-11-14 10:39:17 +11005508 .cred_free = selinux_cred_free,
David Howellsd84f4f92008-11-14 10:39:23 +11005509 .cred_prepare = selinux_cred_prepare,
David Howellsee18d642009-09-02 09:14:21 +01005510 .cred_transfer = selinux_cred_transfer,
David Howells3a3b7ce2008-11-14 10:39:28 +11005511 .kernel_act_as = selinux_kernel_act_as,
5512 .kernel_create_files_as = selinux_kernel_create_files_as,
Eric Paris25354c42009-08-13 09:45:03 -04005513 .kernel_module_request = selinux_kernel_module_request,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005514 .task_setpgid = selinux_task_setpgid,
5515 .task_getpgid = selinux_task_getpgid,
Eric Paris828dfe12008-04-17 13:17:49 -04005516 .task_getsid = selinux_task_getsid,
David Quigleyf9008e42006-06-30 01:55:46 -07005517 .task_getsecid = selinux_task_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005518 .task_setnice = selinux_task_setnice,
James Morris03e68062006-06-23 02:03:58 -07005519 .task_setioprio = selinux_task_setioprio,
David Quigleya1836a42006-06-30 01:55:49 -07005520 .task_getioprio = selinux_task_getioprio,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005521 .task_setrlimit = selinux_task_setrlimit,
5522 .task_setscheduler = selinux_task_setscheduler,
5523 .task_getscheduler = selinux_task_getscheduler,
David Quigley35601542006-06-23 02:04:01 -07005524 .task_movememory = selinux_task_movememory,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005525 .task_kill = selinux_task_kill,
5526 .task_wait = selinux_task_wait,
Eric Paris828dfe12008-04-17 13:17:49 -04005527 .task_to_inode = selinux_task_to_inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005528
5529 .ipc_permission = selinux_ipc_permission,
Eric Parisf5269712008-05-14 11:27:45 -04005530 .ipc_getsecid = selinux_ipc_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005531
5532 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5533 .msg_msg_free_security = selinux_msg_msg_free_security,
5534
5535 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5536 .msg_queue_free_security = selinux_msg_queue_free_security,
5537 .msg_queue_associate = selinux_msg_queue_associate,
5538 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5539 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5540 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5541
5542 .shm_alloc_security = selinux_shm_alloc_security,
5543 .shm_free_security = selinux_shm_free_security,
5544 .shm_associate = selinux_shm_associate,
5545 .shm_shmctl = selinux_shm_shmctl,
5546 .shm_shmat = selinux_shm_shmat,
5547
Eric Paris828dfe12008-04-17 13:17:49 -04005548 .sem_alloc_security = selinux_sem_alloc_security,
5549 .sem_free_security = selinux_sem_free_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005550 .sem_associate = selinux_sem_associate,
5551 .sem_semctl = selinux_sem_semctl,
5552 .sem_semop = selinux_sem_semop,
5553
Eric Paris828dfe12008-04-17 13:17:49 -04005554 .d_instantiate = selinux_d_instantiate,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005555
Eric Paris828dfe12008-04-17 13:17:49 -04005556 .getprocattr = selinux_getprocattr,
5557 .setprocattr = selinux_setprocattr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005558
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005559 .secid_to_secctx = selinux_secid_to_secctx,
David Howells63cb3442008-01-15 23:47:35 +00005560 .secctx_to_secid = selinux_secctx_to_secid,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005561 .release_secctx = selinux_release_secctx,
David P. Quigley1ee65e32009-09-03 14:25:57 -04005562 .inode_notifysecctx = selinux_inode_notifysecctx,
5563 .inode_setsecctx = selinux_inode_setsecctx,
5564 .inode_getsecctx = selinux_inode_getsecctx,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005565
Eric Paris828dfe12008-04-17 13:17:49 -04005566 .unix_stream_connect = selinux_socket_unix_stream_connect,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005567 .unix_may_send = selinux_socket_unix_may_send,
5568
5569 .socket_create = selinux_socket_create,
5570 .socket_post_create = selinux_socket_post_create,
5571 .socket_bind = selinux_socket_bind,
5572 .socket_connect = selinux_socket_connect,
5573 .socket_listen = selinux_socket_listen,
5574 .socket_accept = selinux_socket_accept,
5575 .socket_sendmsg = selinux_socket_sendmsg,
5576 .socket_recvmsg = selinux_socket_recvmsg,
5577 .socket_getsockname = selinux_socket_getsockname,
5578 .socket_getpeername = selinux_socket_getpeername,
5579 .socket_getsockopt = selinux_socket_getsockopt,
5580 .socket_setsockopt = selinux_socket_setsockopt,
5581 .socket_shutdown = selinux_socket_shutdown,
5582 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005583 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5584 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005585 .sk_alloc_security = selinux_sk_alloc_security,
5586 .sk_free_security = selinux_sk_free_security,
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005587 .sk_clone_security = selinux_sk_clone_security,
Eric Paris828dfe12008-04-17 13:17:49 -04005588 .sk_getsecid = selinux_sk_getsecid,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005589 .sock_graft = selinux_sock_graft,
5590 .inet_conn_request = selinux_inet_conn_request,
5591 .inet_csk_clone = selinux_inet_csk_clone,
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005592 .inet_conn_established = selinux_inet_conn_established,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005593 .req_classify_flow = selinux_req_classify_flow,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005594 .tun_dev_create = selinux_tun_dev_create,
5595 .tun_dev_post_create = selinux_tun_dev_post_create,
5596 .tun_dev_attach = selinux_tun_dev_attach,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005597
5598#ifdef CONFIG_SECURITY_NETWORK_XFRM
5599 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5600 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5601 .xfrm_policy_free_security = selinux_xfrm_policy_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005602 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005603 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5604 .xfrm_state_free_security = selinux_xfrm_state_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005605 .xfrm_state_delete_security = selinux_xfrm_state_delete,
Eric Paris828dfe12008-04-17 13:17:49 -04005606 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005607 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005608 .xfrm_decode_session = selinux_xfrm_decode_session,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005609#endif
Michael LeMayd7200242006-06-22 14:47:17 -07005610
5611#ifdef CONFIG_KEYS
Eric Paris828dfe12008-04-17 13:17:49 -04005612 .key_alloc = selinux_key_alloc,
5613 .key_free = selinux_key_free,
5614 .key_permission = selinux_key_permission,
David Howells70a5bb72008-04-29 01:01:26 -07005615 .key_getsecurity = selinux_key_getsecurity,
Michael LeMayd7200242006-06-22 14:47:17 -07005616#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02005617
5618#ifdef CONFIG_AUDIT
5619 .audit_rule_init = selinux_audit_rule_init,
5620 .audit_rule_known = selinux_audit_rule_known,
5621 .audit_rule_match = selinux_audit_rule_match,
5622 .audit_rule_free = selinux_audit_rule_free,
5623#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07005624};
5625
5626static __init int selinux_init(void)
5627{
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005628 if (!security_module_enable(&selinux_ops)) {
5629 selinux_enabled = 0;
5630 return 0;
5631 }
5632
Linus Torvalds1da177e2005-04-16 15:20:36 -07005633 if (!selinux_enabled) {
5634 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5635 return 0;
5636 }
5637
5638 printk(KERN_INFO "SELinux: Initializing.\n");
5639
5640 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11005641 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005642
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04005643 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5644
James Morris7cae7e22006-03-22 00:09:22 -08005645 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5646 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09005647 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005648 avc_init();
5649
Eric Paris828dfe12008-04-17 13:17:49 -04005650 if (register_security(&selinux_ops))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005651 panic("SELinux: Unable to register with kernel.\n");
5652
Eric Paris828dfe12008-04-17 13:17:49 -04005653 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05005654 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04005655 else
Eric Parisfadcdb42007-02-22 18:11:31 -05005656 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07005657
Linus Torvalds1da177e2005-04-16 15:20:36 -07005658 return 0;
5659}
5660
Al Viroe8c26252010-03-23 06:36:54 -04005661static void delayed_superblock_init(struct super_block *sb, void *unused)
5662{
5663 superblock_doinit(sb, NULL);
5664}
5665
Linus Torvalds1da177e2005-04-16 15:20:36 -07005666void selinux_complete_init(void)
5667{
Eric Parisfadcdb42007-02-22 18:11:31 -05005668 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005669
5670 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05005671 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04005672 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005673}
5674
5675/* SELinux requires early initialization in order to label
5676 all processes and objects when they are created. */
5677security_initcall(selinux_init);
5678
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005679#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005680
Paul Mooreeffad8d2008-01-29 08:49:27 -05005681static struct nf_hook_ops selinux_ipv4_ops[] = {
5682 {
5683 .hook = selinux_ipv4_postroute,
5684 .owner = THIS_MODULE,
5685 .pf = PF_INET,
5686 .hooknum = NF_INET_POST_ROUTING,
5687 .priority = NF_IP_PRI_SELINUX_LAST,
5688 },
5689 {
5690 .hook = selinux_ipv4_forward,
5691 .owner = THIS_MODULE,
5692 .pf = PF_INET,
5693 .hooknum = NF_INET_FORWARD,
5694 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04005695 },
5696 {
5697 .hook = selinux_ipv4_output,
5698 .owner = THIS_MODULE,
5699 .pf = PF_INET,
5700 .hooknum = NF_INET_LOCAL_OUT,
5701 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005702 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005703};
5704
5705#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5706
Paul Mooreeffad8d2008-01-29 08:49:27 -05005707static struct nf_hook_ops selinux_ipv6_ops[] = {
5708 {
5709 .hook = selinux_ipv6_postroute,
5710 .owner = THIS_MODULE,
5711 .pf = PF_INET6,
5712 .hooknum = NF_INET_POST_ROUTING,
5713 .priority = NF_IP6_PRI_SELINUX_LAST,
5714 },
5715 {
5716 .hook = selinux_ipv6_forward,
5717 .owner = THIS_MODULE,
5718 .pf = PF_INET6,
5719 .hooknum = NF_INET_FORWARD,
5720 .priority = NF_IP6_PRI_SELINUX_FIRST,
5721 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005722};
5723
5724#endif /* IPV6 */
5725
5726static int __init selinux_nf_ip_init(void)
5727{
5728 int err = 0;
5729
5730 if (!selinux_enabled)
5731 goto out;
Eric Parisfadcdb42007-02-22 18:11:31 -05005732
5733 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5734
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005735 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5736 if (err)
5737 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005738
5739#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005740 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5741 if (err)
5742 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005743#endif /* IPV6 */
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005744
Linus Torvalds1da177e2005-04-16 15:20:36 -07005745out:
5746 return err;
5747}
5748
5749__initcall(selinux_nf_ip_init);
5750
5751#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5752static void selinux_nf_ip_exit(void)
5753{
Eric Parisfadcdb42007-02-22 18:11:31 -05005754 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005755
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005756 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005757#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005758 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005759#endif /* IPV6 */
5760}
5761#endif
5762
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005763#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005764
5765#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5766#define selinux_nf_ip_exit()
5767#endif
5768
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005769#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005770
5771#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04005772static int selinux_disabled;
5773
Linus Torvalds1da177e2005-04-16 15:20:36 -07005774int selinux_disable(void)
5775{
5776 extern void exit_sel_fs(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005777
5778 if (ss_initialized) {
5779 /* Not permitted after initial policy load. */
5780 return -EINVAL;
5781 }
5782
5783 if (selinux_disabled) {
5784 /* Only do this once. */
5785 return -EINVAL;
5786 }
5787
5788 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5789
5790 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04005791 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005792
wzt.wzt@gmail.com189b3b12010-02-23 23:15:28 +08005793 reset_security_ops();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005794
Eric Parisaf8ff042009-09-20 21:23:01 -04005795 /* Try to destroy the avc node cache */
5796 avc_disable();
5797
Linus Torvalds1da177e2005-04-16 15:20:36 -07005798 /* Unregister netfilter hooks. */
5799 selinux_nf_ip_exit();
5800
5801 /* Unregister selinuxfs. */
5802 exit_sel_fs();
5803
5804 return 0;
5805}
5806#endif