blob: 337fb325e5ccafa3403502839521944463bb17a4 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070082#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070083#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070084#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080085#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070086#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040087#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000088#include <linux/msg.h>
89#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070090#include <linux/bpf.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070091
92#include "avc.h"
93#include "objsec.h"
94#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050095#include "netnode.h"
Paul Moore3e112172008-04-10 10:48:14 -040096#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030097#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080098#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050099#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200100#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000101#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500103struct selinux_state selinux_state;
104
Paul Moored621d352008-01-29 08:43:36 -0500105/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000106static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500107
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500109static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110
111static int __init enforcing_setup(char *str)
112{
Eric Parisf5269712008-05-14 11:27:45 -0400113 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900114 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500115 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 return 1;
117}
118__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500119#else
120#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121#endif
122
123#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
124int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
125
126static int __init selinux_enabled_setup(char *str)
127{
Eric Parisf5269712008-05-14 11:27:45 -0400128 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900129 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400130 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700131 return 1;
132}
133__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400134#else
135int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136#endif
137
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500138static unsigned int selinux_checkreqprot_boot =
139 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140
141static int __init checkreqprot_setup(char *str)
142{
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(str, 0, &checkreqprot))
146 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
147 return 1;
148}
149__setup("checkreqprot=", checkreqprot_setup);
150
Christoph Lametere18b8902006-12-06 20:33:20 -0800151static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400152static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800153
Paul Moored621d352008-01-29 08:43:36 -0500154/**
155 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
156 *
157 * Description:
158 * This function checks the SECMARK reference counter to see if any SECMARK
159 * targets are currently configured, if the reference counter is greater than
160 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400161 * enabled, false (0) if SECMARK is disabled. If the always_check_network
162 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500163 *
164 */
165static int selinux_secmark_enabled(void)
166{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500167 return (selinux_policycap_alwaysnetwork() ||
168 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400169}
170
171/**
172 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
173 *
174 * Description:
175 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
176 * (1) if any are enabled or false (0) if neither are enabled. If the
177 * always_check_network policy capability is enabled, peer labeling
178 * is always considered enabled.
179 *
180 */
181static int selinux_peerlbl_enabled(void)
182{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500183 return (selinux_policycap_alwaysnetwork() ||
184 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500185}
186
Paul Moore615e51f2014-06-26 14:33:56 -0400187static int selinux_netcache_avc_callback(u32 event)
188{
189 if (event == AVC_CALLBACK_RESET) {
190 sel_netif_flush();
191 sel_netnode_flush();
192 sel_netport_flush();
193 synchronize_net();
194 }
195 return 0;
196}
197
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300198static int selinux_lsm_notifier_avc_callback(u32 event)
199{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300200 if (event == AVC_CALLBACK_RESET) {
201 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300202 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300203 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300204
205 return 0;
206}
207
David Howellsd84f4f92008-11-14 10:39:23 +1100208/*
209 * initialise the security for the init task
210 */
211static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212{
David Howells3b11a1d2008-11-14 10:39:26 +1100213 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700214 struct task_security_struct *tsec;
215
James Morris89d155e2005-10-30 14:59:21 -0800216 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100218 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700219
David Howellsd84f4f92008-11-14 10:39:23 +1100220 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100221 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222}
223
David Howells275bb412008-11-14 10:39:19 +1100224/*
David Howells88e67f32008-11-14 10:39:21 +1100225 * get the security ID of a set of credentials
226 */
227static inline u32 cred_sid(const struct cred *cred)
228{
229 const struct task_security_struct *tsec;
230
231 tsec = cred->security;
232 return tsec->sid;
233}
234
235/*
David Howells3b11a1d2008-11-14 10:39:26 +1100236 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100237 */
238static inline u32 task_sid(const struct task_struct *task)
239{
David Howells275bb412008-11-14 10:39:19 +1100240 u32 sid;
241
242 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100243 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100244 rcu_read_unlock();
245 return sid;
246}
247
David Howells88e67f32008-11-14 10:39:21 +1100248/* Allocate and free functions for each kind of security blob. */
249
Linus Torvalds1da177e2005-04-16 15:20:36 -0700250static int inode_alloc_security(struct inode *inode)
251{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100253 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700254
Josef Bacika02fe132008-04-04 09:35:05 +1100255 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 if (!isec)
257 return -ENOMEM;
258
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100259 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 isec->inode = inode;
262 isec->sid = SECINITSID_UNLABELED;
263 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100264 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100265 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266 inode->i_security = isec;
267
268 return 0;
269}
270
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500271static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
272
273/*
274 * Try reloading inode security labels that have been marked as invalid. The
275 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100276 * allowed; when set to false, returns -ECHILD when the label is
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500277 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
278 * when no dentry is available, set it to NULL instead.
279 */
280static int __inode_security_revalidate(struct inode *inode,
281 struct dentry *opt_dentry,
282 bool may_sleep)
283{
284 struct inode_security_struct *isec = inode->i_security;
285
286 might_sleep_if(may_sleep);
287
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500288 if (selinux_state.initialized &&
289 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500290 if (!may_sleep)
291 return -ECHILD;
292
293 /*
294 * Try reloading the inode security label. This will fail if
295 * @opt_dentry is NULL and no dentry for this inode can be
296 * found; in that case, continue using the old label.
297 */
298 inode_doinit_with_dentry(inode, opt_dentry);
299 }
300 return 0;
301}
302
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500303static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
304{
305 return inode->i_security;
306}
307
308static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309{
310 int error;
311
312 error = __inode_security_revalidate(inode, NULL, !rcu);
313 if (error)
314 return ERR_PTR(error);
315 return inode->i_security;
316}
317
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500318/*
319 * Get the security label of an inode.
320 */
321static struct inode_security_struct *inode_security(struct inode *inode)
322{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500323 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500324 return inode->i_security;
325}
326
Paul Moore2c971652016-04-19 16:36:28 -0400327static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
328{
329 struct inode *inode = d_backing_inode(dentry);
330
331 return inode->i_security;
332}
333
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500334/*
335 * Get the security label of a dentry's backing inode.
336 */
337static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
338{
339 struct inode *inode = d_backing_inode(dentry);
340
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500341 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500342 return inode->i_security;
343}
344
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500345static void inode_free_rcu(struct rcu_head *head)
346{
347 struct inode_security_struct *isec;
348
349 isec = container_of(head, struct inode_security_struct, rcu);
350 kmem_cache_free(sel_inode_cache, isec);
351}
352
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353static void inode_free_security(struct inode *inode)
354{
355 struct inode_security_struct *isec = inode->i_security;
356 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
357
Waiman Long9629d042015-07-10 17:19:56 -0400358 /*
359 * As not all inode security structures are in a list, we check for
360 * empty list outside of the lock to make sure that we won't waste
361 * time taking a lock doing nothing.
362 *
363 * The list_del_init() function can be safely called more than once.
364 * It should not be possible for this function to be called with
365 * concurrent list_add(), but for better safety against future changes
366 * in the code, we use list_empty_careful() here.
367 */
368 if (!list_empty_careful(&isec->list)) {
369 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400371 spin_unlock(&sbsec->isec_lock);
372 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500374 /*
375 * The inode may still be referenced in a path walk and
376 * a call to selinux_inode_permission() can be made
377 * after inode_free_security() is called. Ideally, the VFS
378 * wouldn't do this, but fixing that is a much harder
379 * job. For now, simply free the i_security via RCU, and
380 * leave the current inode->i_security pointer intact.
381 * The inode will be freed after the RCU grace period too.
382 */
383 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384}
385
386static int file_alloc_security(struct file *file)
387{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100389 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390
Sangwoo63205652015-10-21 17:44:30 -0400391 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 if (!fsec)
393 return -ENOMEM;
394
David Howells275bb412008-11-14 10:39:19 +1100395 fsec->sid = sid;
396 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 file->f_security = fsec;
398
399 return 0;
400}
401
402static void file_free_security(struct file *file)
403{
404 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700405 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400406 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407}
408
409static int superblock_alloc_security(struct super_block *sb)
410{
411 struct superblock_security_struct *sbsec;
412
James Morris89d155e2005-10-30 14:59:21 -0800413 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 if (!sbsec)
415 return -ENOMEM;
416
Eric Parisbc7e9822006-09-25 23:32:02 -0700417 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 INIT_LIST_HEAD(&sbsec->isec_head);
419 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 sbsec->sb = sb;
421 sbsec->sid = SECINITSID_UNLABELED;
422 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700423 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 sb->s_security = sbsec;
425
426 return 0;
427}
428
429static void superblock_free_security(struct super_block *sb)
430{
431 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700432 sb->s_security = NULL;
433 kfree(sbsec);
434}
435
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436static inline int inode_doinit(struct inode *inode)
437{
438 return inode_doinit_with_dentry(inode, NULL);
439}
440
441enum {
Eric Paris31e87932007-09-19 17:19:12 -0400442 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443 Opt_context = 1,
444 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500445 Opt_defcontext = 3,
446 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500447 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400448 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449};
450
Eric Parisd355987f2012-08-24 15:58:53 -0400451#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
452
Steven Whitehousea447c092008-10-13 10:46:57 +0100453static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400454 {Opt_context, CONTEXT_STR "%s"},
455 {Opt_fscontext, FSCONTEXT_STR "%s"},
456 {Opt_defcontext, DEFCONTEXT_STR "%s"},
457 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500458 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400459 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460};
461
462#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
463
Eric Parisc312feb2006-07-10 04:43:53 -0700464static int may_context_mount_sb_relabel(u32 sid,
465 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100466 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700467{
David Howells275bb412008-11-14 10:39:19 +1100468 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700469 int rc;
470
471 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
472 FILESYSTEM__RELABELFROM, NULL);
473 if (rc)
474 return rc;
475
476 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
477 FILESYSTEM__RELABELTO, NULL);
478 return rc;
479}
480
Eric Paris08089252006-07-10 04:43:55 -0700481static int may_context_mount_inode_relabel(u32 sid,
482 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100483 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700484{
David Howells275bb412008-11-14 10:39:19 +1100485 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700486 int rc;
487 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
488 FILESYSTEM__RELABELFROM, NULL);
489 if (rc)
490 return rc;
491
492 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
493 FILESYSTEM__ASSOCIATE, NULL);
494 return rc;
495}
496
Eric Parisb43e7252012-10-10 14:27:35 -0400497static int selinux_is_sblabel_mnt(struct super_block *sb)
498{
499 struct superblock_security_struct *sbsec = sb->s_security;
500
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500501 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
502 sbsec->behavior == SECURITY_FS_USE_TRANS ||
503 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400504 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500505 /* Special handling. Genfs but also in-core setxattr handler */
506 !strcmp(sb->s_type->name, "sysfs") ||
507 !strcmp(sb->s_type->name, "pstore") ||
508 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500509 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500510 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500511 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500512 (!strcmp(sb->s_type->name, "cgroup") ||
513 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400514}
515
Eric Parisc9180a52007-11-30 13:00:35 -0500516static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700517{
518 struct superblock_security_struct *sbsec = sb->s_security;
519 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000520 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521 int rc = 0;
522
Linus Torvalds1da177e2005-04-16 15:20:36 -0700523 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
524 /* Make sure that the xattr handler exists and that no
525 error other than -ENODATA is returned by getxattr on
526 the root directory. -ENODATA is ok, as this may be
527 the first boot of the SELinux kernel before we have
528 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200529 if (!(root_inode->i_opflags & IOP_XATTR)) {
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800530 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
531 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700532 rc = -EOPNOTSUPP;
533 goto out;
534 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200535
536 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700537 if (rc < 0 && rc != -ENODATA) {
538 if (rc == -EOPNOTSUPP)
539 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800540 "%s) has no security xattr handler\n",
541 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700542 else
543 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800544 "%s) getxattr errno %d\n", sb->s_id,
545 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 goto out;
547 }
548 }
549
Eric Pariseadcabc2012-08-24 15:59:14 -0400550 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400551
552 /*
553 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
554 * leave the flag untouched because sb_clone_mnt_opts might be handing
555 * us a superblock that needs the flag to be cleared.
556 */
Eric Parisb43e7252012-10-10 14:27:35 -0400557 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400558 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400559 else
560 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400561
Linus Torvalds1da177e2005-04-16 15:20:36 -0700562 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500563 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700564
565 /* Initialize any other inodes associated with the superblock, e.g.
566 inodes created prior to initial policy load or inodes created
567 during get_sb by a pseudo filesystem that directly
568 populates itself. */
569 spin_lock(&sbsec->isec_lock);
570next_inode:
571 if (!list_empty(&sbsec->isec_head)) {
572 struct inode_security_struct *isec =
573 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500574 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700575 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400576 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700577 spin_unlock(&sbsec->isec_lock);
578 inode = igrab(inode);
579 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500580 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700581 inode_doinit(inode);
582 iput(inode);
583 }
584 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585 goto next_inode;
586 }
587 spin_unlock(&sbsec->isec_lock);
588out:
Eric Parisc9180a52007-11-30 13:00:35 -0500589 return rc;
590}
591
592/*
593 * This function should allow an FS to ask what it's mount security
594 * options were so it can use those later for submounts, displaying
595 * mount options, or whatever.
596 */
597static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500598 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500599{
600 int rc = 0, i;
601 struct superblock_security_struct *sbsec = sb->s_security;
602 char *context = NULL;
603 u32 len;
604 char tmp;
605
Eric Parise0007522008-03-05 10:31:54 -0500606 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500607
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500608 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500609 return -EINVAL;
610
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500611 if (!selinux_state.initialized)
Eric Parisc9180a52007-11-30 13:00:35 -0500612 return -EINVAL;
613
Eric Parisaf8e50c2012-08-24 15:59:00 -0400614 /* make sure we always check enough bits to cover the mask */
615 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
616
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500617 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500618 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400619 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500620 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500621 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500622 tmp >>= 1;
623 }
David P. Quigley11689d42009-01-16 09:22:03 -0500624 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400625 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500626 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500627
Eric Parise0007522008-03-05 10:31:54 -0500628 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
629 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500630 rc = -ENOMEM;
631 goto out_free;
632 }
633
Eric Parise0007522008-03-05 10:31:54 -0500634 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
635 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500636 rc = -ENOMEM;
637 goto out_free;
638 }
639
640 i = 0;
641 if (sbsec->flags & FSCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500642 rc = security_sid_to_context(&selinux_state, sbsec->sid,
643 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500644 if (rc)
645 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500646 opts->mnt_opts[i] = context;
647 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500648 }
649 if (sbsec->flags & CONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500650 rc = security_sid_to_context(&selinux_state,
651 sbsec->mntpoint_sid,
652 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500653 if (rc)
654 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500655 opts->mnt_opts[i] = context;
656 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500657 }
658 if (sbsec->flags & DEFCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500659 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
660 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500661 if (rc)
662 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500663 opts->mnt_opts[i] = context;
664 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500665 }
666 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500667 struct dentry *root = sbsec->sb->s_root;
668 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500669
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500670 rc = security_sid_to_context(&selinux_state, isec->sid,
671 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500672 if (rc)
673 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500674 opts->mnt_opts[i] = context;
675 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500676 }
Eric Paris12f348b2012-10-09 10:56:25 -0400677 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500678 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400679 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500680 }
Eric Parisc9180a52007-11-30 13:00:35 -0500681
Eric Parise0007522008-03-05 10:31:54 -0500682 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500683
684 return 0;
685
686out_free:
Eric Parise0007522008-03-05 10:31:54 -0500687 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500688 return rc;
689}
690
691static int bad_option(struct superblock_security_struct *sbsec, char flag,
692 u32 old_sid, u32 new_sid)
693{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500694 char mnt_flags = sbsec->flags & SE_MNTMASK;
695
Eric Parisc9180a52007-11-30 13:00:35 -0500696 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500697 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500698 if (!(sbsec->flags & flag) ||
699 (old_sid != new_sid))
700 return 1;
701
702 /* check if we were passed the same options twice,
703 * aka someone passed context=a,context=b
704 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500705 if (!(sbsec->flags & SE_SBINITIALIZED))
706 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500707 return 1;
708 return 0;
709}
Eric Parise0007522008-03-05 10:31:54 -0500710
Eric Parisc9180a52007-11-30 13:00:35 -0500711/*
712 * Allow filesystems with binary mount data to explicitly set mount point
713 * labeling information.
714 */
Eric Parise0007522008-03-05 10:31:54 -0500715static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400716 struct security_mnt_opts *opts,
717 unsigned long kern_flags,
718 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500719{
David Howells275bb412008-11-14 10:39:19 +1100720 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500721 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500722 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800723 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500724 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400725 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500726 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
727 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500728 char **mount_options = opts->mnt_opts;
729 int *flags = opts->mnt_opts_flags;
730 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500731
732 mutex_lock(&sbsec->lock);
733
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500734 if (!selinux_state.initialized) {
Eric Parisc9180a52007-11-30 13:00:35 -0500735 if (!num_opts) {
736 /* Defer initialization until selinux_complete_init,
737 after the initial policy is loaded and the security
738 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500739 goto out;
740 }
741 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400742 printk(KERN_WARNING "SELinux: Unable to set superblock options "
743 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500744 goto out;
745 }
David Quigley649f6e72013-05-22 12:50:36 -0400746 if (kern_flags && !set_kern_flags) {
747 /* Specifying internal flags without providing a place to
748 * place the results is not allowed */
749 rc = -EINVAL;
750 goto out;
751 }
Eric Parisc9180a52007-11-30 13:00:35 -0500752
753 /*
Eric Parise0007522008-03-05 10:31:54 -0500754 * Binary mount data FS will come through this function twice. Once
755 * from an explicit call and once from the generic calls from the vfs.
756 * Since the generic VFS calls will not contain any security mount data
757 * we need to skip the double mount verification.
758 *
759 * This does open a hole in which we will not notice if the first
760 * mount using this sb set explict options and a second mount using
761 * this sb does not set any security options. (The first options
762 * will be used for both mounts)
763 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500764 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500765 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400766 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500767
Paul Moore2c971652016-04-19 16:36:28 -0400768 root_isec = backing_inode_security_novalidate(root);
769
Eric Parise0007522008-03-05 10:31:54 -0500770 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500771 * parse the mount options, check if they are valid sids.
772 * also check if someone is trying to mount the same sb more
773 * than once with different security options.
774 */
775 for (i = 0; i < num_opts; i++) {
776 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500777
Eric Paris12f348b2012-10-09 10:56:25 -0400778 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500779 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500780 rc = security_context_str_to_sid(&selinux_state,
781 mount_options[i], &sid,
782 GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500783 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400784 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800785 "(%s) failed for (dev %s, type %s) errno=%d\n",
786 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500787 goto out;
788 }
789 switch (flags[i]) {
790 case FSCONTEXT_MNT:
791 fscontext_sid = sid;
792
793 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
794 fscontext_sid))
795 goto out_double_mount;
796
797 sbsec->flags |= FSCONTEXT_MNT;
798 break;
799 case CONTEXT_MNT:
800 context_sid = sid;
801
802 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
803 context_sid))
804 goto out_double_mount;
805
806 sbsec->flags |= CONTEXT_MNT;
807 break;
808 case ROOTCONTEXT_MNT:
809 rootcontext_sid = sid;
810
811 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
812 rootcontext_sid))
813 goto out_double_mount;
814
815 sbsec->flags |= ROOTCONTEXT_MNT;
816
817 break;
818 case DEFCONTEXT_MNT:
819 defcontext_sid = sid;
820
821 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
822 defcontext_sid))
823 goto out_double_mount;
824
825 sbsec->flags |= DEFCONTEXT_MNT;
826
827 break;
828 default:
829 rc = -EINVAL;
830 goto out;
831 }
832 }
833
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500834 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500835 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500836 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500837 goto out_double_mount;
838 rc = 0;
839 goto out;
840 }
841
James Morris089be432008-07-15 18:32:49 +1000842 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400843 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
844
Stephen Smalley8e014722015-06-04 16:22:17 -0400845 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700846 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400847 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100848 !strcmp(sb->s_type->name, "pstore") ||
849 !strcmp(sb->s_type->name, "cgroup") ||
850 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400851 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500852
David Quigleyeb9ae682013-05-22 12:50:37 -0400853 if (!sbsec->behavior) {
854 /*
855 * Determine the labeling behavior to use for this
856 * filesystem type.
857 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500858 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400859 if (rc) {
860 printk(KERN_WARNING
861 "%s: security_fs_use(%s) returned %d\n",
862 __func__, sb->s_type->name, rc);
863 goto out;
864 }
Eric Parisc9180a52007-11-30 13:00:35 -0500865 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500866
867 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500868 * If this is a user namespace mount and the filesystem type is not
869 * explicitly whitelisted, then no contexts are allowed on the command
870 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500871 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500872 if (sb->s_user_ns != &init_user_ns &&
873 strcmp(sb->s_type->name, "tmpfs") &&
874 strcmp(sb->s_type->name, "ramfs") &&
875 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500876 if (context_sid || fscontext_sid || rootcontext_sid ||
877 defcontext_sid) {
878 rc = -EACCES;
879 goto out;
880 }
881 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
882 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500883 rc = security_transition_sid(&selinux_state,
884 current_sid(),
885 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500886 SECCLASS_FILE, NULL,
887 &sbsec->mntpoint_sid);
888 if (rc)
889 goto out;
890 }
891 goto out_set_opts;
892 }
893
Eric Parisc9180a52007-11-30 13:00:35 -0500894 /* sets the context of the superblock for the fs being mounted. */
895 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100896 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500897 if (rc)
898 goto out;
899
900 sbsec->sid = fscontext_sid;
901 }
902
903 /*
904 * Switch to using mount point labeling behavior.
905 * sets the label used on all file below the mountpoint, and will set
906 * the superblock context if not already set.
907 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400908 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
909 sbsec->behavior = SECURITY_FS_USE_NATIVE;
910 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
911 }
912
Eric Parisc9180a52007-11-30 13:00:35 -0500913 if (context_sid) {
914 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100915 rc = may_context_mount_sb_relabel(context_sid, sbsec,
916 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500917 if (rc)
918 goto out;
919 sbsec->sid = context_sid;
920 } else {
David Howells275bb412008-11-14 10:39:19 +1100921 rc = may_context_mount_inode_relabel(context_sid, sbsec,
922 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500923 if (rc)
924 goto out;
925 }
926 if (!rootcontext_sid)
927 rootcontext_sid = context_sid;
928
929 sbsec->mntpoint_sid = context_sid;
930 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
931 }
932
933 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100934 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
935 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500936 if (rc)
937 goto out;
938
939 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500940 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500941 }
942
943 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400944 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
945 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500946 rc = -EINVAL;
947 printk(KERN_WARNING "SELinux: defcontext option is "
948 "invalid for this filesystem type\n");
949 goto out;
950 }
951
952 if (defcontext_sid != sbsec->def_sid) {
953 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100954 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500955 if (rc)
956 goto out;
957 }
958
959 sbsec->def_sid = defcontext_sid;
960 }
961
Seth Forsheeaad82892016-04-26 14:36:20 -0500962out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500963 rc = sb_finish_set_opts(sb);
964out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700965 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700966 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500967out_double_mount:
968 rc = -EINVAL;
969 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800970 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500971 goto out;
972}
973
Jeff Layton094f7b62013-04-01 08:14:24 -0400974static int selinux_cmp_sb_context(const struct super_block *oldsb,
975 const struct super_block *newsb)
976{
977 struct superblock_security_struct *old = oldsb->s_security;
978 struct superblock_security_struct *new = newsb->s_security;
979 char oldflags = old->flags & SE_MNTMASK;
980 char newflags = new->flags & SE_MNTMASK;
981
982 if (oldflags != newflags)
983 goto mismatch;
984 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
985 goto mismatch;
986 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
987 goto mismatch;
988 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
989 goto mismatch;
990 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500991 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
992 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400993 if (oldroot->sid != newroot->sid)
994 goto mismatch;
995 }
996 return 0;
997mismatch:
998 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
999 "different security settings for (dev %s, "
1000 "type %s)\n", newsb->s_id, newsb->s_type->name);
1001 return -EBUSY;
1002}
1003
1004static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001005 struct super_block *newsb,
1006 unsigned long kern_flags,
1007 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -05001008{
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001009 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001010 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1011 struct superblock_security_struct *newsbsec = newsb->s_security;
1012
1013 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
1014 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1015 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1016
Eric Paris0f5e6422008-04-21 16:24:11 -04001017 /*
1018 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -04001019 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -04001020 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001021 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -04001022 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001023
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001024 /*
1025 * Specifying internal flags without providing a place to
1026 * place the results is not allowed.
1027 */
1028 if (kern_flags && !set_kern_flags)
1029 return -EINVAL;
1030
Eric Parisc9180a52007-11-30 13:00:35 -05001031 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001032 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -05001033
Jeff Layton094f7b62013-04-01 08:14:24 -04001034 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001035 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -04001036 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -04001037
Eric Parisc9180a52007-11-30 13:00:35 -05001038 mutex_lock(&newsbsec->lock);
1039
1040 newsbsec->flags = oldsbsec->flags;
1041
1042 newsbsec->sid = oldsbsec->sid;
1043 newsbsec->def_sid = oldsbsec->def_sid;
1044 newsbsec->behavior = oldsbsec->behavior;
1045
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001046 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1047 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001048 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001049 if (rc)
1050 goto out;
1051 }
1052
1053 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1054 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1055 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1056 }
1057
Eric Parisc9180a52007-11-30 13:00:35 -05001058 if (set_context) {
1059 u32 sid = oldsbsec->mntpoint_sid;
1060
1061 if (!set_fscontext)
1062 newsbsec->sid = sid;
1063 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001064 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001065 newisec->sid = sid;
1066 }
1067 newsbsec->mntpoint_sid = sid;
1068 }
1069 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001070 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1071 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001072
1073 newisec->sid = oldisec->sid;
1074 }
1075
1076 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001077out:
Eric Parisc9180a52007-11-30 13:00:35 -05001078 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001079 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -05001080}
1081
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001082static int selinux_parse_opts_str(char *options,
1083 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001084{
Eric Parise0007522008-03-05 10:31:54 -05001085 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001086 char *context = NULL, *defcontext = NULL;
1087 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001088 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001089
Eric Parise0007522008-03-05 10:31:54 -05001090 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001091
1092 /* Standard string-based options. */
1093 while ((p = strsep(&options, "|")) != NULL) {
1094 int token;
1095 substring_t args[MAX_OPT_ARGS];
1096
1097 if (!*p)
1098 continue;
1099
1100 token = match_token(p, tokens, args);
1101
1102 switch (token) {
1103 case Opt_context:
1104 if (context || defcontext) {
1105 rc = -EINVAL;
1106 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1107 goto out_err;
1108 }
1109 context = match_strdup(&args[0]);
1110 if (!context) {
1111 rc = -ENOMEM;
1112 goto out_err;
1113 }
1114 break;
1115
1116 case Opt_fscontext:
1117 if (fscontext) {
1118 rc = -EINVAL;
1119 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1120 goto out_err;
1121 }
1122 fscontext = match_strdup(&args[0]);
1123 if (!fscontext) {
1124 rc = -ENOMEM;
1125 goto out_err;
1126 }
1127 break;
1128
1129 case Opt_rootcontext:
1130 if (rootcontext) {
1131 rc = -EINVAL;
1132 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1133 goto out_err;
1134 }
1135 rootcontext = match_strdup(&args[0]);
1136 if (!rootcontext) {
1137 rc = -ENOMEM;
1138 goto out_err;
1139 }
1140 break;
1141
1142 case Opt_defcontext:
1143 if (context || defcontext) {
1144 rc = -EINVAL;
1145 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1146 goto out_err;
1147 }
1148 defcontext = match_strdup(&args[0]);
1149 if (!defcontext) {
1150 rc = -ENOMEM;
1151 goto out_err;
1152 }
1153 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001154 case Opt_labelsupport:
1155 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001156 default:
1157 rc = -EINVAL;
1158 printk(KERN_WARNING "SELinux: unknown mount option\n");
1159 goto out_err;
1160
1161 }
1162 }
1163
Eric Parise0007522008-03-05 10:31:54 -05001164 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001165 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001166 if (!opts->mnt_opts)
1167 goto out_err;
1168
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001169 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1170 GFP_KERNEL);
Paul Moore023f1082017-06-07 16:48:19 -04001171 if (!opts->mnt_opts_flags)
Eric Parise0007522008-03-05 10:31:54 -05001172 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001173
Eric Parise0007522008-03-05 10:31:54 -05001174 if (fscontext) {
1175 opts->mnt_opts[num_mnt_opts] = fscontext;
1176 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1177 }
1178 if (context) {
1179 opts->mnt_opts[num_mnt_opts] = context;
1180 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1181 }
1182 if (rootcontext) {
1183 opts->mnt_opts[num_mnt_opts] = rootcontext;
1184 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1185 }
1186 if (defcontext) {
1187 opts->mnt_opts[num_mnt_opts] = defcontext;
1188 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1189 }
1190
1191 opts->num_mnt_opts = num_mnt_opts;
1192 return 0;
1193
Eric Parisc9180a52007-11-30 13:00:35 -05001194out_err:
Paul Moore023f1082017-06-07 16:48:19 -04001195 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -05001196 kfree(context);
1197 kfree(defcontext);
1198 kfree(fscontext);
1199 kfree(rootcontext);
1200 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001201}
Eric Parise0007522008-03-05 10:31:54 -05001202/*
1203 * string mount options parsing and call set the sbsec
1204 */
1205static int superblock_doinit(struct super_block *sb, void *data)
1206{
1207 int rc = 0;
1208 char *options = data;
1209 struct security_mnt_opts opts;
1210
1211 security_init_mnt_opts(&opts);
1212
1213 if (!data)
1214 goto out;
1215
1216 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1217
1218 rc = selinux_parse_opts_str(options, &opts);
1219 if (rc)
1220 goto out_err;
1221
1222out:
David Quigley649f6e72013-05-22 12:50:36 -04001223 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001224
1225out_err:
1226 security_free_mnt_opts(&opts);
1227 return rc;
1228}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001229
Adrian Bunk3583a712008-07-22 20:21:23 +03001230static void selinux_write_opts(struct seq_file *m,
1231 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001232{
1233 int i;
1234 char *prefix;
1235
1236 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001237 char *has_comma;
1238
1239 if (opts->mnt_opts[i])
1240 has_comma = strchr(opts->mnt_opts[i], ',');
1241 else
1242 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001243
1244 switch (opts->mnt_opts_flags[i]) {
1245 case CONTEXT_MNT:
1246 prefix = CONTEXT_STR;
1247 break;
1248 case FSCONTEXT_MNT:
1249 prefix = FSCONTEXT_STR;
1250 break;
1251 case ROOTCONTEXT_MNT:
1252 prefix = ROOTCONTEXT_STR;
1253 break;
1254 case DEFCONTEXT_MNT:
1255 prefix = DEFCONTEXT_STR;
1256 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001257 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001258 seq_putc(m, ',');
1259 seq_puts(m, LABELSUPP_STR);
1260 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001261 default:
1262 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001263 return;
Eric Paris2069f452008-07-04 09:47:13 +10001264 };
1265 /* we need a comma before each option */
1266 seq_putc(m, ',');
1267 seq_puts(m, prefix);
1268 if (has_comma)
1269 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001270 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001271 if (has_comma)
1272 seq_putc(m, '\"');
1273 }
1274}
1275
1276static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1277{
1278 struct security_mnt_opts opts;
1279 int rc;
1280
1281 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001282 if (rc) {
1283 /* before policy load we may get EINVAL, don't show anything */
1284 if (rc == -EINVAL)
1285 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001286 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001287 }
Eric Paris2069f452008-07-04 09:47:13 +10001288
1289 selinux_write_opts(m, &opts);
1290
1291 security_free_mnt_opts(&opts);
1292
1293 return rc;
1294}
1295
Linus Torvalds1da177e2005-04-16 15:20:36 -07001296static inline u16 inode_mode_to_security_class(umode_t mode)
1297{
1298 switch (mode & S_IFMT) {
1299 case S_IFSOCK:
1300 return SECCLASS_SOCK_FILE;
1301 case S_IFLNK:
1302 return SECCLASS_LNK_FILE;
1303 case S_IFREG:
1304 return SECCLASS_FILE;
1305 case S_IFBLK:
1306 return SECCLASS_BLK_FILE;
1307 case S_IFDIR:
1308 return SECCLASS_DIR;
1309 case S_IFCHR:
1310 return SECCLASS_CHR_FILE;
1311 case S_IFIFO:
1312 return SECCLASS_FIFO_FILE;
1313
1314 }
1315
1316 return SECCLASS_FILE;
1317}
1318
James Morris13402582005-09-30 14:24:34 -04001319static inline int default_protocol_stream(int protocol)
1320{
1321 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1322}
1323
1324static inline int default_protocol_dgram(int protocol)
1325{
1326 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1327}
1328
Linus Torvalds1da177e2005-04-16 15:20:36 -07001329static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1330{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001331 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001332
Linus Torvalds1da177e2005-04-16 15:20:36 -07001333 switch (family) {
1334 case PF_UNIX:
1335 switch (type) {
1336 case SOCK_STREAM:
1337 case SOCK_SEQPACKET:
1338 return SECCLASS_UNIX_STREAM_SOCKET;
1339 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001340 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001341 return SECCLASS_UNIX_DGRAM_SOCKET;
1342 }
1343 break;
1344 case PF_INET:
1345 case PF_INET6:
1346 switch (type) {
1347 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001348 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001349 if (default_protocol_stream(protocol))
1350 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001351 else if (extsockclass && protocol == IPPROTO_SCTP)
1352 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001353 else
1354 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001355 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001356 if (default_protocol_dgram(protocol))
1357 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001358 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1359 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001360 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001361 else
1362 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001363 case SOCK_DCCP:
1364 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001365 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001366 return SECCLASS_RAWIP_SOCKET;
1367 }
1368 break;
1369 case PF_NETLINK:
1370 switch (protocol) {
1371 case NETLINK_ROUTE:
1372 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001373 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001374 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1375 case NETLINK_NFLOG:
1376 return SECCLASS_NETLINK_NFLOG_SOCKET;
1377 case NETLINK_XFRM:
1378 return SECCLASS_NETLINK_XFRM_SOCKET;
1379 case NETLINK_SELINUX:
1380 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001381 case NETLINK_ISCSI:
1382 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001383 case NETLINK_AUDIT:
1384 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001385 case NETLINK_FIB_LOOKUP:
1386 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1387 case NETLINK_CONNECTOR:
1388 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1389 case NETLINK_NETFILTER:
1390 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001391 case NETLINK_DNRTMSG:
1392 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001393 case NETLINK_KOBJECT_UEVENT:
1394 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001395 case NETLINK_GENERIC:
1396 return SECCLASS_NETLINK_GENERIC_SOCKET;
1397 case NETLINK_SCSITRANSPORT:
1398 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1399 case NETLINK_RDMA:
1400 return SECCLASS_NETLINK_RDMA_SOCKET;
1401 case NETLINK_CRYPTO:
1402 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001403 default:
1404 return SECCLASS_NETLINK_SOCKET;
1405 }
1406 case PF_PACKET:
1407 return SECCLASS_PACKET_SOCKET;
1408 case PF_KEY:
1409 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001410 case PF_APPLETALK:
1411 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001412 }
1413
Stephen Smalleyda69a532017-01-09 10:07:30 -05001414 if (extsockclass) {
1415 switch (family) {
1416 case PF_AX25:
1417 return SECCLASS_AX25_SOCKET;
1418 case PF_IPX:
1419 return SECCLASS_IPX_SOCKET;
1420 case PF_NETROM:
1421 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001422 case PF_ATMPVC:
1423 return SECCLASS_ATMPVC_SOCKET;
1424 case PF_X25:
1425 return SECCLASS_X25_SOCKET;
1426 case PF_ROSE:
1427 return SECCLASS_ROSE_SOCKET;
1428 case PF_DECnet:
1429 return SECCLASS_DECNET_SOCKET;
1430 case PF_ATMSVC:
1431 return SECCLASS_ATMSVC_SOCKET;
1432 case PF_RDS:
1433 return SECCLASS_RDS_SOCKET;
1434 case PF_IRDA:
1435 return SECCLASS_IRDA_SOCKET;
1436 case PF_PPPOX:
1437 return SECCLASS_PPPOX_SOCKET;
1438 case PF_LLC:
1439 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001440 case PF_CAN:
1441 return SECCLASS_CAN_SOCKET;
1442 case PF_TIPC:
1443 return SECCLASS_TIPC_SOCKET;
1444 case PF_BLUETOOTH:
1445 return SECCLASS_BLUETOOTH_SOCKET;
1446 case PF_IUCV:
1447 return SECCLASS_IUCV_SOCKET;
1448 case PF_RXRPC:
1449 return SECCLASS_RXRPC_SOCKET;
1450 case PF_ISDN:
1451 return SECCLASS_ISDN_SOCKET;
1452 case PF_PHONET:
1453 return SECCLASS_PHONET_SOCKET;
1454 case PF_IEEE802154:
1455 return SECCLASS_IEEE802154_SOCKET;
1456 case PF_CAIF:
1457 return SECCLASS_CAIF_SOCKET;
1458 case PF_ALG:
1459 return SECCLASS_ALG_SOCKET;
1460 case PF_NFC:
1461 return SECCLASS_NFC_SOCKET;
1462 case PF_VSOCK:
1463 return SECCLASS_VSOCK_SOCKET;
1464 case PF_KCM:
1465 return SECCLASS_KCM_SOCKET;
1466 case PF_QIPCRTR:
1467 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001468 case PF_SMC:
1469 return SECCLASS_SMC_SOCKET;
1470#if PF_MAX > 44
Stephen Smalleyda69a532017-01-09 10:07:30 -05001471#error New address family defined, please update this function.
1472#endif
1473 }
1474 }
1475
Linus Torvalds1da177e2005-04-16 15:20:36 -07001476 return SECCLASS_SOCKET;
1477}
1478
Stephen Smalley134509d2015-06-04 16:22:17 -04001479static int selinux_genfs_get_sid(struct dentry *dentry,
1480 u16 tclass,
1481 u16 flags,
1482 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001483{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001484 int rc;
Al Virofc640052016-04-10 01:33:30 -04001485 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001486 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001487
Eric Paris828dfe12008-04-17 13:17:49 -04001488 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001489 if (!buffer)
1490 return -ENOMEM;
1491
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001492 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1493 if (IS_ERR(path))
1494 rc = PTR_ERR(path);
1495 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001496 if (flags & SE_SBPROC) {
1497 /* each process gets a /proc/PID/ entry. Strip off the
1498 * PID part to get a valid selinux labeling.
1499 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1500 while (path[1] >= '0' && path[1] <= '9') {
1501 path[1] = '/';
1502 path++;
1503 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001504 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001505 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1506 path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001507 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001508 free_page((unsigned long)buffer);
1509 return rc;
1510}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001511
1512/* The inode's security attributes must be initialized before first use. */
1513static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1514{
1515 struct superblock_security_struct *sbsec = NULL;
1516 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001517 u32 task_sid, sid = 0;
1518 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001519 struct dentry *dentry;
1520#define INITCONTEXTLEN 255
1521 char *context = NULL;
1522 unsigned len = 0;
1523 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001524
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001525 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001526 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001527
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001528 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001529 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001530 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001531
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001532 if (isec->sclass == SECCLASS_FILE)
1533 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1534
Linus Torvalds1da177e2005-04-16 15:20:36 -07001535 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001536 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001537 /* Defer initialization until selinux_complete_init,
1538 after the initial policy is loaded and the security
1539 server is ready to handle calls. */
1540 spin_lock(&sbsec->isec_lock);
1541 if (list_empty(&isec->list))
1542 list_add(&isec->list, &sbsec->isec_head);
1543 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001544 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001545 }
1546
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001547 sclass = isec->sclass;
1548 task_sid = isec->task_sid;
1549 sid = isec->sid;
1550 isec->initialized = LABEL_PENDING;
1551 spin_unlock(&isec->lock);
1552
Linus Torvalds1da177e2005-04-16 15:20:36 -07001553 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001554 case SECURITY_FS_USE_NATIVE:
1555 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001557 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001558 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001559 break;
1560 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001561 /* Need a dentry, since the xattr API requires one.
1562 Life would be simpler if we could just pass the inode. */
1563 if (opt_dentry) {
1564 /* Called from d_instantiate or d_splice_alias. */
1565 dentry = dget(opt_dentry);
1566 } else {
1567 /* Called from selinux_complete_init, try to find a dentry. */
1568 dentry = d_find_alias(inode);
1569 }
1570 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001571 /*
1572 * this is can be hit on boot when a file is accessed
1573 * before the policy is loaded. When we load policy we
1574 * may find inodes that have no dentry on the
1575 * sbsec->isec_head list. No reason to complain as these
1576 * will get fixed up the next time we go through
1577 * inode_doinit with a dentry, before these inodes could
1578 * be used again by userspace.
1579 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001580 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001581 }
1582
1583 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001584 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 if (!context) {
1586 rc = -ENOMEM;
1587 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001588 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001589 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001590 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001591 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001592 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001593 kfree(context);
1594
Linus Torvalds1da177e2005-04-16 15:20:36 -07001595 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001596 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001597 if (rc < 0) {
1598 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001599 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001600 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001601 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001602 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001603 if (!context) {
1604 rc = -ENOMEM;
1605 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001606 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001607 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001608 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001609 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001610 }
1611 dput(dentry);
1612 if (rc < 0) {
1613 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001614 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001615 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001616 -rc, inode->i_sb->s_id, inode->i_ino);
1617 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001618 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001619 }
1620 /* Map ENODATA to the default file SID */
1621 sid = sbsec->def_sid;
1622 rc = 0;
1623 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001624 rc = security_context_to_sid_default(&selinux_state,
1625 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001626 sbsec->def_sid,
1627 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001628 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001629 char *dev = inode->i_sb->s_id;
1630 unsigned long ino = inode->i_ino;
1631
1632 if (rc == -EINVAL) {
1633 if (printk_ratelimit())
1634 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1635 "context=%s. This indicates you may need to relabel the inode or the "
1636 "filesystem in question.\n", ino, dev, context);
1637 } else {
1638 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1639 "returned %d for dev=%s ino=%ld\n",
1640 __func__, context, -rc, dev, ino);
1641 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001642 kfree(context);
1643 /* Leave with the unlabeled SID */
1644 rc = 0;
1645 break;
1646 }
1647 }
1648 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001649 break;
1650 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001651 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001652 break;
1653 case SECURITY_FS_USE_TRANS:
1654 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001655 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001656
1657 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001658 rc = security_transition_sid(&selinux_state, task_sid, sid,
1659 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001660 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001661 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001662 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001663 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001664 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001665 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001666 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001667 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001668 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001669
Stephen Smalley134509d2015-06-04 16:22:17 -04001670 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001671 /* We must have a dentry to determine the label on
1672 * procfs inodes */
1673 if (opt_dentry)
1674 /* Called from d_instantiate or
1675 * d_splice_alias. */
1676 dentry = dget(opt_dentry);
1677 else
1678 /* Called from selinux_complete_init, try to
1679 * find a dentry. */
1680 dentry = d_find_alias(inode);
1681 /*
1682 * This can be hit on boot when a file is accessed
1683 * before the policy is loaded. When we load policy we
1684 * may find inodes that have no dentry on the
1685 * sbsec->isec_head list. No reason to complain as
1686 * these will get fixed up the next time we go through
1687 * inode_doinit() with a dentry, before these inodes
1688 * could be used again by userspace.
1689 */
1690 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001691 goto out;
1692 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001693 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001694 dput(dentry);
1695 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001696 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001697 }
1698 break;
1699 }
1700
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001701out:
1702 spin_lock(&isec->lock);
1703 if (isec->initialized == LABEL_PENDING) {
1704 if (!sid || rc) {
1705 isec->initialized = LABEL_INVALID;
1706 goto out_unlock;
1707 }
1708
1709 isec->initialized = LABEL_INITIALIZED;
1710 isec->sid = sid;
1711 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001712
Eric Paris23970742006-09-25 23:32:01 -07001713out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001714 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001715 return rc;
1716}
1717
1718/* Convert a Linux signal to an access vector. */
1719static inline u32 signal_to_av(int sig)
1720{
1721 u32 perm = 0;
1722
1723 switch (sig) {
1724 case SIGCHLD:
1725 /* Commonly granted from child to parent. */
1726 perm = PROCESS__SIGCHLD;
1727 break;
1728 case SIGKILL:
1729 /* Cannot be caught or ignored */
1730 perm = PROCESS__SIGKILL;
1731 break;
1732 case SIGSTOP:
1733 /* Cannot be caught or ignored */
1734 perm = PROCESS__SIGSTOP;
1735 break;
1736 default:
1737 /* All other signals. */
1738 perm = PROCESS__SIGNAL;
1739 break;
1740 }
1741
1742 return perm;
1743}
1744
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001745#if CAP_LAST_CAP > 63
1746#error Fix SELinux to handle capabilities > 63.
1747#endif
1748
Linus Torvalds1da177e2005-04-16 15:20:36 -07001749/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001750static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001751 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001752{
Thomas Liu2bf49692009-07-14 12:14:09 -04001753 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001754 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001755 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001756 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001757 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001758 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001759
Eric Paris50c205f2012-04-04 15:01:43 -04001760 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001761 ad.u.cap = cap;
1762
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001763 switch (CAP_TO_INDEX(cap)) {
1764 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001765 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001766 break;
1767 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001768 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001769 break;
1770 default:
1771 printk(KERN_ERR
1772 "SELinux: out of range capability %d\n", cap);
1773 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001774 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001775 }
Eric Paris06112162008-11-11 22:02:50 +11001776
David Howells275bb412008-11-14 10:39:19 +11001777 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001778 if (audit == SECURITY_CAP_AUDIT) {
NeilBrown7b20ea22015-03-23 13:37:39 +11001779 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001780 if (rc2)
1781 return rc2;
1782 }
Eric Paris06112162008-11-11 22:02:50 +11001783 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001784}
1785
Linus Torvalds1da177e2005-04-16 15:20:36 -07001786/* Check whether a task has a particular permission to an inode.
1787 The 'adp' parameter is optional and allows other audit
1788 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001789static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001790 struct inode *inode,
1791 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001792 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001793{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001794 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001795 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001796
David Howellse0e81732009-09-02 09:13:40 +01001797 validate_creds(cred);
1798
Eric Paris828dfe12008-04-17 13:17:49 -04001799 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001800 return 0;
1801
David Howells88e67f32008-11-14 10:39:21 +11001802 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803 isec = inode->i_security;
1804
Linus Torvalds19e49832013-10-04 12:54:11 -07001805 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001806}
1807
1808/* Same as inode_has_perm, but pass explicit audit data containing
1809 the dentry to help the auditing code to more easily generate the
1810 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001811static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001812 struct dentry *dentry,
1813 u32 av)
1814{
David Howellsc6f493d2015-03-17 22:26:22 +00001815 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001816 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001817
Eric Paris50c205f2012-04-04 15:01:43 -04001818 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001819 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001820 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001821 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001822}
1823
1824/* Same as inode_has_perm, but pass explicit audit data containing
1825 the path to help the auditing code to more easily generate the
1826 pathname if needed. */
1827static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001828 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001829 u32 av)
1830{
David Howellsc6f493d2015-03-17 22:26:22 +00001831 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001832 struct common_audit_data ad;
1833
Eric Paris50c205f2012-04-04 15:01:43 -04001834 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001835 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001836 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001837 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001838}
1839
David Howells13f8e982013-06-13 23:37:55 +01001840/* Same as path_has_perm, but uses the inode from the file struct. */
1841static inline int file_path_has_perm(const struct cred *cred,
1842 struct file *file,
1843 u32 av)
1844{
1845 struct common_audit_data ad;
1846
Vivek Goyal43af5de2016-09-09 11:37:49 -04001847 ad.type = LSM_AUDIT_DATA_FILE;
1848 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001849 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001850}
1851
Chenbo Fengf66e4482017-10-18 13:00:26 -07001852#ifdef CONFIG_BPF_SYSCALL
1853static int bpf_fd_pass(struct file *file, u32 sid);
1854#endif
1855
Linus Torvalds1da177e2005-04-16 15:20:36 -07001856/* Check whether a task can use an open file descriptor to
1857 access an inode in a given way. Check access to the
1858 descriptor itself, and then use dentry_has_perm to
1859 check a particular permission to the file.
1860 Access to the descriptor is implicitly granted if it
1861 has the same SID as the process. If av is zero, then
1862 access to the file is not checked, e.g. for cases
1863 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001864static int file_has_perm(const struct cred *cred,
1865 struct file *file,
1866 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001867{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001868 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001869 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001870 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001871 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001872 int rc;
1873
Vivek Goyal43af5de2016-09-09 11:37:49 -04001874 ad.type = LSM_AUDIT_DATA_FILE;
1875 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001876
David Howells275bb412008-11-14 10:39:19 +11001877 if (sid != fsec->sid) {
1878 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001879 SECCLASS_FD,
1880 FD__USE,
1881 &ad);
1882 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001883 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001884 }
1885
Chenbo Fengf66e4482017-10-18 13:00:26 -07001886#ifdef CONFIG_BPF_SYSCALL
1887 rc = bpf_fd_pass(file, cred_sid(cred));
1888 if (rc)
1889 return rc;
1890#endif
1891
Linus Torvalds1da177e2005-04-16 15:20:36 -07001892 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001893 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001894 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001895 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001896
David Howells88e67f32008-11-14 10:39:21 +11001897out:
1898 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001899}
1900
David Howellsc3c188b2015-07-10 17:19:58 -04001901/*
1902 * Determine the label for an inode that might be unioned.
1903 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001904static int
1905selinux_determine_inode_label(const struct task_security_struct *tsec,
1906 struct inode *dir,
1907 const struct qstr *name, u16 tclass,
1908 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001909{
1910 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001911
1912 if ((sbsec->flags & SE_SBINITIALIZED) &&
1913 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1914 *_new_isid = sbsec->mntpoint_sid;
1915 } else if ((sbsec->flags & SBLABEL_MNT) &&
1916 tsec->create_sid) {
1917 *_new_isid = tsec->create_sid;
1918 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001919 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001920 return security_transition_sid(&selinux_state, tsec->sid,
1921 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001922 name, _new_isid);
1923 }
1924
1925 return 0;
1926}
1927
Linus Torvalds1da177e2005-04-16 15:20:36 -07001928/* Check whether a task can create a file. */
1929static int may_create(struct inode *dir,
1930 struct dentry *dentry,
1931 u16 tclass)
1932{
Paul Moore5fb49872010-04-22 14:46:19 -04001933 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001934 struct inode_security_struct *dsec;
1935 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001936 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001937 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001938 int rc;
1939
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001940 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001941 sbsec = dir->i_sb->s_security;
1942
David Howells275bb412008-11-14 10:39:19 +11001943 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001944
Eric Paris50c205f2012-04-04 15:01:43 -04001945 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001946 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001947
David Howells275bb412008-11-14 10:39:19 +11001948 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001949 DIR__ADD_NAME | DIR__SEARCH,
1950 &ad);
1951 if (rc)
1952 return rc;
1953
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001954 rc = selinux_determine_inode_label(current_security(), dir,
1955 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001956 if (rc)
1957 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001958
David Howells275bb412008-11-14 10:39:19 +11001959 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001960 if (rc)
1961 return rc;
1962
1963 return avc_has_perm(newsid, sbsec->sid,
1964 SECCLASS_FILESYSTEM,
1965 FILESYSTEM__ASSOCIATE, &ad);
1966}
1967
Eric Paris828dfe12008-04-17 13:17:49 -04001968#define MAY_LINK 0
1969#define MAY_UNLINK 1
1970#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001971
1972/* Check whether a task can link, unlink, or rmdir a file/directory. */
1973static int may_link(struct inode *dir,
1974 struct dentry *dentry,
1975 int kind)
1976
1977{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001978 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001979 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001980 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001981 u32 av;
1982 int rc;
1983
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001984 dsec = inode_security(dir);
1985 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001986
Eric Paris50c205f2012-04-04 15:01:43 -04001987 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001988 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001989
1990 av = DIR__SEARCH;
1991 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001992 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001993 if (rc)
1994 return rc;
1995
1996 switch (kind) {
1997 case MAY_LINK:
1998 av = FILE__LINK;
1999 break;
2000 case MAY_UNLINK:
2001 av = FILE__UNLINK;
2002 break;
2003 case MAY_RMDIR:
2004 av = DIR__RMDIR;
2005 break;
2006 default:
Eric Paris744ba352008-04-17 11:52:44 -04002007 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
2008 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002009 return 0;
2010 }
2011
David Howells275bb412008-11-14 10:39:19 +11002012 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002013 return rc;
2014}
2015
2016static inline int may_rename(struct inode *old_dir,
2017 struct dentry *old_dentry,
2018 struct inode *new_dir,
2019 struct dentry *new_dentry)
2020{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002021 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002022 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002023 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002024 u32 av;
2025 int old_is_dir, new_is_dir;
2026 int rc;
2027
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002028 old_dsec = inode_security(old_dir);
2029 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002030 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002031 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002032
Eric Paris50c205f2012-04-04 15:01:43 -04002033 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002034
Eric Parisa2694342011-04-25 13:10:27 -04002035 ad.u.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11002036 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002037 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2038 if (rc)
2039 return rc;
David Howells275bb412008-11-14 10:39:19 +11002040 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002041 old_isec->sclass, FILE__RENAME, &ad);
2042 if (rc)
2043 return rc;
2044 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11002045 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046 old_isec->sclass, DIR__REPARENT, &ad);
2047 if (rc)
2048 return rc;
2049 }
2050
Eric Parisa2694342011-04-25 13:10:27 -04002051 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002052 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002053 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002054 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11002055 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002056 if (rc)
2057 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002058 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002059 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002060 new_is_dir = d_is_dir(new_dentry);
David Howells275bb412008-11-14 10:39:19 +11002061 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002062 new_isec->sclass,
2063 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2064 if (rc)
2065 return rc;
2066 }
2067
2068 return 0;
2069}
2070
2071/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002072static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002073 struct super_block *sb,
2074 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002075 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002076{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002077 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002078 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002079
Linus Torvalds1da177e2005-04-16 15:20:36 -07002080 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11002081 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002082}
2083
2084/* Convert a Linux mode and permission mask to an access vector. */
2085static inline u32 file_mask_to_av(int mode, int mask)
2086{
2087 u32 av = 0;
2088
Al Virodba19c62011-07-25 20:49:29 -04002089 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002090 if (mask & MAY_EXEC)
2091 av |= FILE__EXECUTE;
2092 if (mask & MAY_READ)
2093 av |= FILE__READ;
2094
2095 if (mask & MAY_APPEND)
2096 av |= FILE__APPEND;
2097 else if (mask & MAY_WRITE)
2098 av |= FILE__WRITE;
2099
2100 } else {
2101 if (mask & MAY_EXEC)
2102 av |= DIR__SEARCH;
2103 if (mask & MAY_WRITE)
2104 av |= DIR__WRITE;
2105 if (mask & MAY_READ)
2106 av |= DIR__READ;
2107 }
2108
2109 return av;
2110}
2111
2112/* Convert a Linux file to an access vector. */
2113static inline u32 file_to_av(struct file *file)
2114{
2115 u32 av = 0;
2116
2117 if (file->f_mode & FMODE_READ)
2118 av |= FILE__READ;
2119 if (file->f_mode & FMODE_WRITE) {
2120 if (file->f_flags & O_APPEND)
2121 av |= FILE__APPEND;
2122 else
2123 av |= FILE__WRITE;
2124 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002125 if (!av) {
2126 /*
2127 * Special file opened with flags 3 for ioctl-only use.
2128 */
2129 av = FILE__IOCTL;
2130 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002131
2132 return av;
2133}
2134
Eric Paris8b6a5a32008-10-29 17:06:46 -04002135/*
2136 * Convert a file to an access vector and include the correct open
2137 * open permission.
2138 */
2139static inline u32 open_file_to_av(struct file *file)
2140{
2141 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002142 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002143
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002144 if (selinux_policycap_openperm() &&
2145 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002146 av |= FILE__OPEN;
2147
Eric Paris8b6a5a32008-10-29 17:06:46 -04002148 return av;
2149}
2150
Linus Torvalds1da177e2005-04-16 15:20:36 -07002151/* Hook functions begin here. */
2152
Stephen Smalley79af7302015-01-21 10:54:10 -05002153static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2154{
2155 u32 mysid = current_sid();
2156 u32 mgrsid = task_sid(mgr);
2157
2158 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2159 BINDER__SET_CONTEXT_MGR, NULL);
2160}
2161
2162static int selinux_binder_transaction(struct task_struct *from,
2163 struct task_struct *to)
2164{
2165 u32 mysid = current_sid();
2166 u32 fromsid = task_sid(from);
2167 u32 tosid = task_sid(to);
2168 int rc;
2169
2170 if (mysid != fromsid) {
2171 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2172 BINDER__IMPERSONATE, NULL);
2173 if (rc)
2174 return rc;
2175 }
2176
2177 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2178 NULL);
2179}
2180
2181static int selinux_binder_transfer_binder(struct task_struct *from,
2182 struct task_struct *to)
2183{
2184 u32 fromsid = task_sid(from);
2185 u32 tosid = task_sid(to);
2186
2187 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2188 NULL);
2189}
2190
2191static int selinux_binder_transfer_file(struct task_struct *from,
2192 struct task_struct *to,
2193 struct file *file)
2194{
2195 u32 sid = task_sid(to);
2196 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002197 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002198 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002199 struct common_audit_data ad;
2200 int rc;
2201
2202 ad.type = LSM_AUDIT_DATA_PATH;
2203 ad.u.path = file->f_path;
2204
2205 if (sid != fsec->sid) {
2206 rc = avc_has_perm(sid, fsec->sid,
2207 SECCLASS_FD,
2208 FD__USE,
2209 &ad);
2210 if (rc)
2211 return rc;
2212 }
2213
Chenbo Fengf66e4482017-10-18 13:00:26 -07002214#ifdef CONFIG_BPF_SYSCALL
2215 rc = bpf_fd_pass(file, sid);
2216 if (rc)
2217 return rc;
2218#endif
2219
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002220 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002221 return 0;
2222
Paul Moore20cdef82016-04-04 14:14:42 -04002223 isec = backing_inode_security(dentry);
Stephen Smalley79af7302015-01-21 10:54:10 -05002224 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2225 &ad);
2226}
2227
Ingo Molnar9e488582009-05-07 19:26:19 +10002228static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002229 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002230{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002231 u32 sid = current_sid();
2232 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002233
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002234 if (mode & PTRACE_MODE_READ)
2235 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2236
2237 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002238}
2239
2240static int selinux_ptrace_traceme(struct task_struct *parent)
2241{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002242 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2243 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002244}
2245
2246static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002247 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002248{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002249 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2250 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002251}
2252
David Howellsd84f4f92008-11-14 10:39:23 +11002253static int selinux_capset(struct cred *new, const struct cred *old,
2254 const kernel_cap_t *effective,
2255 const kernel_cap_t *inheritable,
2256 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002257{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002258 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2259 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002260}
2261
James Morris5626d3e2009-01-30 10:05:06 +11002262/*
2263 * (This comment used to live with the selinux_task_setuid hook,
2264 * which was removed).
2265 *
2266 * Since setuid only affects the current process, and since the SELinux
2267 * controls are not based on the Linux identity attributes, SELinux does not
2268 * need to control this operation. However, SELinux does control the use of
2269 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2270 */
2271
Eric Paris6a9de492012-01-03 12:25:14 -05002272static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2273 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002274{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002275 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002276}
2277
Linus Torvalds1da177e2005-04-16 15:20:36 -07002278static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2279{
David Howells88e67f32008-11-14 10:39:21 +11002280 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002281 int rc = 0;
2282
2283 if (!sb)
2284 return 0;
2285
2286 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002287 case Q_SYNC:
2288 case Q_QUOTAON:
2289 case Q_QUOTAOFF:
2290 case Q_SETINFO:
2291 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002292 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002293 break;
2294 case Q_GETFMT:
2295 case Q_GETINFO:
2296 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002297 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002298 break;
2299 default:
2300 rc = 0; /* let the kernel handle invalid cmds */
2301 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002302 }
2303 return rc;
2304}
2305
2306static int selinux_quota_on(struct dentry *dentry)
2307{
David Howells88e67f32008-11-14 10:39:21 +11002308 const struct cred *cred = current_cred();
2309
Eric Paris2875fa02011-04-28 16:04:24 -04002310 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002311}
2312
Eric Paris12b30522010-11-15 18:36:29 -05002313static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002314{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002315 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002316 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2317 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002318 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2319 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002320 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2321 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2322 /* Set level of messages printed to console */
2323 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002324 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2325 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2326 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002327 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002328 /* All other syslog types */
2329 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2330 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002331}
2332
2333/*
2334 * Check that a process has enough memory to allocate a new virtual
2335 * mapping. 0 means there is enough memory for the allocation to
2336 * succeed and -ENOMEM implies there is not.
2337 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002338 * Do not audit the selinux permission check, as this is applied to all
2339 * processes that allocate mappings.
2340 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002341static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002342{
2343 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002344
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002345 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002346 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002347 if (rc == 0)
2348 cap_sys_admin = 1;
2349
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002350 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002351}
2352
2353/* binprm security operations */
2354
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002355static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002356{
2357 u32 sid = 0;
2358 struct task_struct *tracer;
2359
2360 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002361 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002362 if (tracer)
2363 sid = task_sid(tracer);
2364 rcu_read_unlock();
2365
2366 return sid;
2367}
2368
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002369static int check_nnp_nosuid(const struct linux_binprm *bprm,
2370 const struct task_security_struct *old_tsec,
2371 const struct task_security_struct *new_tsec)
2372{
2373 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002374 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002375 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002376 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002377
2378 if (!nnp && !nosuid)
2379 return 0; /* neither NNP nor nosuid */
2380
2381 if (new_tsec->sid == old_tsec->sid)
2382 return 0; /* No change in credentials */
2383
2384 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002385 * If the policy enables the nnp_nosuid_transition policy capability,
2386 * then we permit transitions under NNP or nosuid if the
2387 * policy allows the corresponding permission between
2388 * the old and new contexts.
2389 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002390 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002391 av = 0;
2392 if (nnp)
2393 av |= PROCESS2__NNP_TRANSITION;
2394 if (nosuid)
2395 av |= PROCESS2__NOSUID_TRANSITION;
2396 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2397 SECCLASS_PROCESS2, av, NULL);
2398 if (!rc)
2399 return 0;
2400 }
2401
2402 /*
2403 * We also permit NNP or nosuid transitions to bounded SIDs,
2404 * i.e. SIDs that are guaranteed to only be allowed a subset
2405 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002406 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002407 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2408 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002409 if (!rc)
2410 return 0;
2411
2412 /*
2413 * On failure, preserve the errno values for NNP vs nosuid.
2414 * NNP: Operation not permitted for caller.
2415 * nosuid: Permission denied to file.
2416 */
2417 if (nnp)
2418 return -EPERM;
2419 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002420}
2421
David Howellsa6f76f22008-11-14 10:39:24 +11002422static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002423{
David Howellsa6f76f22008-11-14 10:39:24 +11002424 const struct task_security_struct *old_tsec;
2425 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002426 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002427 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002428 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002429 int rc;
2430
David Howellsa6f76f22008-11-14 10:39:24 +11002431 /* SELinux context only depends on initial program or script and not
2432 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002433 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002434 return 0;
2435
David Howellsa6f76f22008-11-14 10:39:24 +11002436 old_tsec = current_security();
2437 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002438 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002439
2440 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002441 new_tsec->sid = old_tsec->sid;
2442 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002443
Michael LeMay28eba5b2006-06-27 02:53:42 -07002444 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002445 new_tsec->create_sid = 0;
2446 new_tsec->keycreate_sid = 0;
2447 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002448
David Howellsa6f76f22008-11-14 10:39:24 +11002449 if (old_tsec->exec_sid) {
2450 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002451 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002452 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002453
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002454 /* Fail on NNP or nosuid if not an allowed transition. */
2455 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2456 if (rc)
2457 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002458 } else {
2459 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002460 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2461 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002462 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002463 if (rc)
2464 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002465
2466 /*
2467 * Fallback to old SID on NNP or nosuid if not an allowed
2468 * transition.
2469 */
2470 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2471 if (rc)
2472 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002473 }
2474
Vivek Goyal43af5de2016-09-09 11:37:49 -04002475 ad.type = LSM_AUDIT_DATA_FILE;
2476 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002477
David Howellsa6f76f22008-11-14 10:39:24 +11002478 if (new_tsec->sid == old_tsec->sid) {
2479 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002480 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2481 if (rc)
2482 return rc;
2483 } else {
2484 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002485 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002486 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2487 if (rc)
2488 return rc;
2489
David Howellsa6f76f22008-11-14 10:39:24 +11002490 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002491 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2492 if (rc)
2493 return rc;
2494
David Howellsa6f76f22008-11-14 10:39:24 +11002495 /* Check for shared state */
2496 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2497 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2498 SECCLASS_PROCESS, PROCESS__SHARE,
2499 NULL);
2500 if (rc)
2501 return -EPERM;
2502 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002503
David Howellsa6f76f22008-11-14 10:39:24 +11002504 /* Make sure that anyone attempting to ptrace over a task that
2505 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002506 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002507 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002508 if (ptsid != 0) {
2509 rc = avc_has_perm(ptsid, new_tsec->sid,
2510 SECCLASS_PROCESS,
2511 PROCESS__PTRACE, NULL);
2512 if (rc)
2513 return -EPERM;
2514 }
2515 }
2516
2517 /* Clear any possibly unsafe personality bits on exec: */
2518 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002519
Linus Torvalds1da177e2005-04-16 15:20:36 -07002520 /* Enable secure mode for SIDs transitions unless
2521 the noatsecure permission is granted between
2522 the two SIDs, i.e. ahp returns 0. */
Kees Cook62874c32017-07-18 15:25:25 -07002523 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2524 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2525 NULL);
2526 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002527 }
2528
Kees Cook62874c32017-07-18 15:25:25 -07002529 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002530}
2531
Al Viroc3c073f2012-08-21 22:32:06 -04002532static int match_file(const void *p, struct file *file, unsigned fd)
2533{
2534 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2535}
2536
Linus Torvalds1da177e2005-04-16 15:20:36 -07002537/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002538static inline void flush_unauthorized_files(const struct cred *cred,
2539 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002540{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002541 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002542 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002543 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002544 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002545
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002546 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002547 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002548 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002549 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002550 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002551
Linus Torvalds1da177e2005-04-16 15:20:36 -07002552 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002553 Use file_path_has_perm on the tty path directly
2554 rather than using file_has_perm, as this particular
2555 open file may belong to another process and we are
2556 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002557 file_priv = list_first_entry(&tty->tty_files,
2558 struct tty_file_private, list);
2559 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002560 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002561 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002562 }
Peter Hurley4a510962016-01-09 21:35:23 -08002563 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002564 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002565 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002566 /* Reset controlling tty. */
2567 if (drop_tty)
2568 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002569
2570 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002571 n = iterate_fd(files, 0, match_file, cred);
2572 if (!n) /* none found? */
2573 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002574
Al Viroc3c073f2012-08-21 22:32:06 -04002575 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002576 if (IS_ERR(devnull))
2577 devnull = NULL;
2578 /* replace all the matching ones with this */
2579 do {
2580 replace_fd(n - 1, devnull, 0);
2581 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2582 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002583 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002584}
2585
Linus Torvalds1da177e2005-04-16 15:20:36 -07002586/*
David Howellsa6f76f22008-11-14 10:39:24 +11002587 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002588 */
David Howellsa6f76f22008-11-14 10:39:24 +11002589static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002590{
David Howellsa6f76f22008-11-14 10:39:24 +11002591 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002592 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002593 int rc, i;
2594
David Howellsa6f76f22008-11-14 10:39:24 +11002595 new_tsec = bprm->cred->security;
2596 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002597 return;
2598
2599 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002600 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002601
David Howellsa6f76f22008-11-14 10:39:24 +11002602 /* Always clear parent death signal on SID transitions. */
2603 current->pdeath_signal = 0;
2604
2605 /* Check whether the new SID can inherit resource limits from the old
2606 * SID. If not, reset all soft limits to the lower of the current
2607 * task's hard limit and the init task's soft limit.
2608 *
2609 * Note that the setting of hard limits (even to lower them) can be
2610 * controlled by the setrlimit check. The inclusion of the init task's
2611 * soft limit into the computation is to avoid resetting soft limits
2612 * higher than the default soft limit for cases where the default is
2613 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2614 */
2615 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2616 PROCESS__RLIMITINH, NULL);
2617 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002618 /* protect against do_prlimit() */
2619 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002620 for (i = 0; i < RLIM_NLIMITS; i++) {
2621 rlim = current->signal->rlim + i;
2622 initrlim = init_task.signal->rlim + i;
2623 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2624 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002625 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002626 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2627 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002628 }
2629}
2630
2631/*
2632 * Clean up the process immediately after the installation of new credentials
2633 * due to exec
2634 */
2635static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2636{
2637 const struct task_security_struct *tsec = current_security();
2638 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002639 u32 osid, sid;
2640 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002641
David Howellsa6f76f22008-11-14 10:39:24 +11002642 osid = tsec->osid;
2643 sid = tsec->sid;
2644
2645 if (sid == osid)
2646 return;
2647
2648 /* Check whether the new SID can inherit signal state from the old SID.
2649 * If not, clear itimers to avoid subsequent signal generation and
2650 * flush and unblock signals.
2651 *
2652 * This must occur _after_ the task SID has been updated so that any
2653 * kill done after the flush will be checked against the new SID.
2654 */
2655 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002656 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002657 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2658 memset(&itimer, 0, sizeof itimer);
2659 for (i = 0; i < 3; i++)
2660 do_setitimer(i, &itimer, NULL);
2661 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002662 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002663 if (!fatal_signal_pending(current)) {
2664 flush_sigqueue(&current->pending);
2665 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002666 flush_signal_handlers(current, 1);
2667 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002668 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002669 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002670 spin_unlock_irq(&current->sighand->siglock);
2671 }
2672
David Howellsa6f76f22008-11-14 10:39:24 +11002673 /* Wake up the parent if it is waiting so that it can recheck
2674 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002675 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002676 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002677 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002678}
2679
2680/* superblock security operations */
2681
2682static int selinux_sb_alloc_security(struct super_block *sb)
2683{
2684 return superblock_alloc_security(sb);
2685}
2686
2687static void selinux_sb_free_security(struct super_block *sb)
2688{
2689 superblock_free_security(sb);
2690}
2691
2692static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2693{
2694 if (plen > olen)
2695 return 0;
2696
2697 return !memcmp(prefix, option, plen);
2698}
2699
2700static inline int selinux_option(char *option, int len)
2701{
Eric Paris832cbd92008-04-01 13:24:09 -04002702 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2703 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2704 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002705 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2706 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002707}
2708
2709static inline void take_option(char **to, char *from, int *first, int len)
2710{
2711 if (!*first) {
2712 **to = ',';
2713 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002714 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002715 *first = 0;
2716 memcpy(*to, from, len);
2717 *to += len;
2718}
2719
Eric Paris828dfe12008-04-17 13:17:49 -04002720static inline void take_selinux_option(char **to, char *from, int *first,
2721 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002722{
2723 int current_size = 0;
2724
2725 if (!*first) {
2726 **to = '|';
2727 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002728 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002729 *first = 0;
2730
2731 while (current_size < len) {
2732 if (*from != '"') {
2733 **to = *from;
2734 *to += 1;
2735 }
2736 from += 1;
2737 current_size += 1;
2738 }
2739}
2740
Eric Parise0007522008-03-05 10:31:54 -05002741static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002742{
2743 int fnosec, fsec, rc = 0;
2744 char *in_save, *in_curr, *in_end;
2745 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002746 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002747
2748 in_curr = orig;
2749 sec_curr = copy;
2750
Linus Torvalds1da177e2005-04-16 15:20:36 -07002751 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2752 if (!nosec) {
2753 rc = -ENOMEM;
2754 goto out;
2755 }
2756
2757 nosec_save = nosec;
2758 fnosec = fsec = 1;
2759 in_save = in_end = orig;
2760
2761 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002762 if (*in_end == '"')
2763 open_quote = !open_quote;
2764 if ((*in_end == ',' && open_quote == 0) ||
2765 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002766 int len = in_end - in_curr;
2767
2768 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002769 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002770 else
2771 take_option(&nosec, in_curr, &fnosec, len);
2772
2773 in_curr = in_end + 1;
2774 }
2775 } while (*in_end++);
2776
Eric Paris6931dfc2005-06-30 02:58:51 -07002777 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002778 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002779out:
2780 return rc;
2781}
2782
Eric Paris026eb162011-03-03 16:09:14 -05002783static int selinux_sb_remount(struct super_block *sb, void *data)
2784{
2785 int rc, i, *flags;
2786 struct security_mnt_opts opts;
2787 char *secdata, **mount_options;
2788 struct superblock_security_struct *sbsec = sb->s_security;
2789
2790 if (!(sbsec->flags & SE_SBINITIALIZED))
2791 return 0;
2792
2793 if (!data)
2794 return 0;
2795
2796 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2797 return 0;
2798
2799 security_init_mnt_opts(&opts);
2800 secdata = alloc_secdata();
2801 if (!secdata)
2802 return -ENOMEM;
2803 rc = selinux_sb_copy_data(data, secdata);
2804 if (rc)
2805 goto out_free_secdata;
2806
2807 rc = selinux_parse_opts_str(secdata, &opts);
2808 if (rc)
2809 goto out_free_secdata;
2810
2811 mount_options = opts.mnt_opts;
2812 flags = opts.mnt_opts_flags;
2813
2814 for (i = 0; i < opts.num_mnt_opts; i++) {
2815 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002816
Eric Paris12f348b2012-10-09 10:56:25 -04002817 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002818 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002819 rc = security_context_str_to_sid(&selinux_state,
2820 mount_options[i], &sid,
2821 GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002822 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002823 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002824 "(%s) failed for (dev %s, type %s) errno=%d\n",
2825 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002826 goto out_free_opts;
2827 }
2828 rc = -EINVAL;
2829 switch (flags[i]) {
2830 case FSCONTEXT_MNT:
2831 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2832 goto out_bad_option;
2833 break;
2834 case CONTEXT_MNT:
2835 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2836 goto out_bad_option;
2837 break;
2838 case ROOTCONTEXT_MNT: {
2839 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002840 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002841
2842 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2843 goto out_bad_option;
2844 break;
2845 }
2846 case DEFCONTEXT_MNT:
2847 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2848 goto out_bad_option;
2849 break;
2850 default:
2851 goto out_free_opts;
2852 }
2853 }
2854
2855 rc = 0;
2856out_free_opts:
2857 security_free_mnt_opts(&opts);
2858out_free_secdata:
2859 free_secdata(secdata);
2860 return rc;
2861out_bad_option:
2862 printk(KERN_WARNING "SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002863 "during remount (dev %s, type=%s)\n", sb->s_id,
2864 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002865 goto out_free_opts;
2866}
2867
James Morris12204e22008-12-19 10:44:42 +11002868static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002869{
David Howells88e67f32008-11-14 10:39:21 +11002870 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002871 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002872 int rc;
2873
2874 rc = superblock_doinit(sb, data);
2875 if (rc)
2876 return rc;
2877
James Morris74192242008-12-19 11:41:10 +11002878 /* Allow all mounts performed by the kernel */
2879 if (flags & MS_KERNMOUNT)
2880 return 0;
2881
Eric Paris50c205f2012-04-04 15:01:43 -04002882 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002883 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002884 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002885}
2886
David Howells726c3342006-06-23 02:02:58 -07002887static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002888{
David Howells88e67f32008-11-14 10:39:21 +11002889 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002890 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002891
Eric Paris50c205f2012-04-04 15:01:43 -04002892 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002893 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002894 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002895}
2896
Al Viro808d4e32012-10-11 11:42:01 -04002897static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002898 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002899 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002900 unsigned long flags,
2901 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002902{
David Howells88e67f32008-11-14 10:39:21 +11002903 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002904
2905 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002906 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002907 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002908 else
Eric Paris2875fa02011-04-28 16:04:24 -04002909 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002910}
2911
2912static int selinux_umount(struct vfsmount *mnt, int flags)
2913{
David Howells88e67f32008-11-14 10:39:21 +11002914 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002915
David Howells88e67f32008-11-14 10:39:21 +11002916 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002917 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002918}
2919
2920/* inode security operations */
2921
2922static int selinux_inode_alloc_security(struct inode *inode)
2923{
2924 return inode_alloc_security(inode);
2925}
2926
2927static void selinux_inode_free_security(struct inode *inode)
2928{
2929 inode_free_security(inode);
2930}
2931
David Quigleyd47be3d2013-05-22 12:50:34 -04002932static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002933 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002934 u32 *ctxlen)
2935{
David Quigleyd47be3d2013-05-22 12:50:34 -04002936 u32 newsid;
2937 int rc;
2938
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002939 rc = selinux_determine_inode_label(current_security(),
2940 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002941 inode_mode_to_security_class(mode),
2942 &newsid);
2943 if (rc)
2944 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002945
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002946 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2947 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002948}
2949
Vivek Goyala518b0a2016-07-13 10:44:53 -04002950static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2951 struct qstr *name,
2952 const struct cred *old,
2953 struct cred *new)
2954{
2955 u32 newsid;
2956 int rc;
2957 struct task_security_struct *tsec;
2958
2959 rc = selinux_determine_inode_label(old->security,
2960 d_inode(dentry->d_parent), name,
2961 inode_mode_to_security_class(mode),
2962 &newsid);
2963 if (rc)
2964 return rc;
2965
2966 tsec = new->security;
2967 tsec->create_sid = newsid;
2968 return 0;
2969}
2970
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002971static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002972 const struct qstr *qstr,
2973 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002974 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002975{
Paul Moore5fb49872010-04-22 14:46:19 -04002976 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002977 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02002978 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002979 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002980 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002981
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002982 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002983
David Howells275bb412008-11-14 10:39:19 +11002984 newsid = tsec->create_sid;
2985
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002986 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04002987 dir, qstr,
2988 inode_mode_to_security_class(inode->i_mode),
2989 &newsid);
2990 if (rc)
2991 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002992
Eric Paris296fddf2006-09-25 23:32:00 -07002993 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002994 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002995 struct inode_security_struct *isec = inode->i_security;
2996 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2997 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002998 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002999 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003000
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003001 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08003002 return -EOPNOTSUPP;
3003
Tetsuo Handa95489062013-07-25 05:44:02 +09003004 if (name)
3005 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003006
3007 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003008 rc = security_sid_to_context_force(&selinux_state, newsid,
3009 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003010 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003011 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003012 *value = context;
3013 *len = clen;
3014 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003015
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003016 return 0;
3017}
3018
Al Viro4acdaf22011-07-26 01:42:34 -04003019static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003020{
3021 return may_create(dir, dentry, SECCLASS_FILE);
3022}
3023
Linus Torvalds1da177e2005-04-16 15:20:36 -07003024static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3025{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003026 return may_link(dir, old_dentry, MAY_LINK);
3027}
3028
Linus Torvalds1da177e2005-04-16 15:20:36 -07003029static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3030{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003031 return may_link(dir, dentry, MAY_UNLINK);
3032}
3033
3034static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3035{
3036 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3037}
3038
Al Viro18bb1db2011-07-26 01:41:39 -04003039static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003040{
3041 return may_create(dir, dentry, SECCLASS_DIR);
3042}
3043
Linus Torvalds1da177e2005-04-16 15:20:36 -07003044static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3045{
3046 return may_link(dir, dentry, MAY_RMDIR);
3047}
3048
Al Viro1a67aaf2011-07-26 01:52:52 -04003049static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003050{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003051 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3052}
3053
Linus Torvalds1da177e2005-04-16 15:20:36 -07003054static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003055 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003056{
3057 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3058}
3059
Linus Torvalds1da177e2005-04-16 15:20:36 -07003060static int selinux_inode_readlink(struct dentry *dentry)
3061{
David Howells88e67f32008-11-14 10:39:21 +11003062 const struct cred *cred = current_cred();
3063
Eric Paris2875fa02011-04-28 16:04:24 -04003064 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003065}
3066
NeilBrownbda0be72015-03-23 13:37:39 +11003067static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3068 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003069{
David Howells88e67f32008-11-14 10:39:21 +11003070 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003071 struct common_audit_data ad;
3072 struct inode_security_struct *isec;
3073 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003074
NeilBrownbda0be72015-03-23 13:37:39 +11003075 validate_creds(cred);
3076
3077 ad.type = LSM_AUDIT_DATA_DENTRY;
3078 ad.u.dentry = dentry;
3079 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003080 isec = inode_security_rcu(inode, rcu);
3081 if (IS_ERR(isec))
3082 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003083
3084 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
3085 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003086}
3087
Eric Parisd4cf970d2012-04-04 15:01:42 -04003088static noinline int audit_inode_permission(struct inode *inode,
3089 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003090 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003091 unsigned flags)
3092{
3093 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003094 struct inode_security_struct *isec = inode->i_security;
3095 int rc;
3096
Eric Paris50c205f2012-04-04 15:01:43 -04003097 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003098 ad.u.inode = inode;
3099
3100 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003101 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003102 if (rc)
3103 return rc;
3104 return 0;
3105}
3106
Al Viroe74f71e2011-06-20 19:38:15 -04003107static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003108{
David Howells88e67f32008-11-14 10:39:21 +11003109 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003110 u32 perms;
3111 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003112 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003113 struct inode_security_struct *isec;
3114 u32 sid;
3115 struct av_decision avd;
3116 int rc, rc2;
3117 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003118
Eric Parisb782e0a2010-07-23 11:44:03 -04003119 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003120 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3121
Eric Parisb782e0a2010-07-23 11:44:03 -04003122 /* No permission to check. Existence test. */
3123 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003124 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003125
Eric Paris2e334052012-04-04 15:01:42 -04003126 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003127
Eric Paris2e334052012-04-04 15:01:42 -04003128 if (unlikely(IS_PRIVATE(inode)))
3129 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003130
3131 perms = file_mask_to_av(inode->i_mode, mask);
3132
Eric Paris2e334052012-04-04 15:01:42 -04003133 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003134 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3135 if (IS_ERR(isec))
3136 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003137
3138 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3139 audited = avc_audit_required(perms, &avd, rc,
3140 from_access ? FILE__AUDIT_ACCESS : 0,
3141 &denied);
3142 if (likely(!audited))
3143 return rc;
3144
Stephen Smalley626b9742014-04-29 11:29:04 -07003145 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003146 if (rc2)
3147 return rc2;
3148 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003149}
3150
3151static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3152{
David Howells88e67f32008-11-14 10:39:21 +11003153 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003154 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003155 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003156 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003157
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003158 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3159 if (ia_valid & ATTR_FORCE) {
3160 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3161 ATTR_FORCE);
3162 if (!ia_valid)
3163 return 0;
3164 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003165
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003166 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3167 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003168 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003169
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003170 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003171 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3172 (ia_valid & ATTR_SIZE) &&
3173 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003174 av |= FILE__OPEN;
3175
3176 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003177}
3178
Al Viro3f7036a2015-03-08 19:28:30 -04003179static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003180{
Al Viro3f7036a2015-03-08 19:28:30 -04003181 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003182}
3183
Stephen Smalleydb590002017-04-20 11:31:30 -04003184static bool has_cap_mac_admin(bool audit)
3185{
3186 const struct cred *cred = current_cred();
3187 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3188
3189 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3190 return false;
3191 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3192 return false;
3193 return true;
3194}
3195
David Howells8f0cfa52008-04-29 00:59:41 -07003196static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3197 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003198{
David Howellsc6f493d2015-03-17 22:26:22 +00003199 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003200 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003201 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003202 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003203 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003204 int rc = 0;
3205
Eric W. Biederman6b240302017-10-02 09:38:20 -05003206 if (strcmp(name, XATTR_NAME_SELINUX)) {
3207 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3208 if (rc)
3209 return rc;
3210
3211 /* Not an attribute we recognize, so just check the
3212 ordinary setattr permission. */
3213 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3214 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003215
3216 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003217 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003218 return -EOPNOTSUPP;
3219
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003220 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003221 return -EPERM;
3222
Eric Paris50c205f2012-04-04 15:01:43 -04003223 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003224 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003225
Paul Moore20cdef82016-04-04 14:14:42 -04003226 isec = backing_inode_security(dentry);
David Howells275bb412008-11-14 10:39:19 +11003227 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003228 FILE__RELABELFROM, &ad);
3229 if (rc)
3230 return rc;
3231
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003232 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3233 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003234 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003235 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003236 struct audit_buffer *ab;
3237 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003238
3239 /* We strip a nul only if it is at the end, otherwise the
3240 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003241 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003242 const char *str = value;
3243
Al Viroe3fea3f2012-06-09 08:15:16 +01003244 if (str[size - 1] == '\0')
3245 audit_size = size - 1;
3246 else
3247 audit_size = size;
3248 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003249 audit_size = 0;
3250 }
Eric Parisd6ea83e2012-04-04 13:45:49 -04003251 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3252 audit_log_format(ab, "op=setxattr invalid_context=");
3253 audit_log_n_untrustedstring(ab, value, audit_size);
3254 audit_log_end(ab);
3255
Stephen Smalley12b29f32008-05-07 13:03:20 -04003256 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003257 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003258 rc = security_context_to_sid_force(&selinux_state, value,
3259 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003260 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003261 if (rc)
3262 return rc;
3263
David Howells275bb412008-11-14 10:39:19 +11003264 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003265 FILE__RELABELTO, &ad);
3266 if (rc)
3267 return rc;
3268
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003269 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3270 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003271 if (rc)
3272 return rc;
3273
3274 return avc_has_perm(newsid,
3275 sbsec->sid,
3276 SECCLASS_FILESYSTEM,
3277 FILESYSTEM__ASSOCIATE,
3278 &ad);
3279}
3280
David Howells8f0cfa52008-04-29 00:59:41 -07003281static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003282 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003283 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003284{
David Howellsc6f493d2015-03-17 22:26:22 +00003285 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003286 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003287 u32 newsid;
3288 int rc;
3289
3290 if (strcmp(name, XATTR_NAME_SELINUX)) {
3291 /* Not an attribute we recognize, so nothing to do. */
3292 return;
3293 }
3294
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003295 rc = security_context_to_sid_force(&selinux_state, value, size,
3296 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003297 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003298 printk(KERN_ERR "SELinux: unable to map context to SID"
3299 "for (%s, %lu), rc=%d\n",
3300 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003301 return;
3302 }
3303
Paul Moore20cdef82016-04-04 14:14:42 -04003304 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003305 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003306 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003307 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003308 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003309 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003310
Linus Torvalds1da177e2005-04-16 15:20:36 -07003311 return;
3312}
3313
David Howells8f0cfa52008-04-29 00:59:41 -07003314static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003315{
David Howells88e67f32008-11-14 10:39:21 +11003316 const struct cred *cred = current_cred();
3317
Eric Paris2875fa02011-04-28 16:04:24 -04003318 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003319}
3320
Eric Paris828dfe12008-04-17 13:17:49 -04003321static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003322{
David Howells88e67f32008-11-14 10:39:21 +11003323 const struct cred *cred = current_cred();
3324
Eric Paris2875fa02011-04-28 16:04:24 -04003325 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003326}
3327
David Howells8f0cfa52008-04-29 00:59:41 -07003328static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003329{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003330 if (strcmp(name, XATTR_NAME_SELINUX)) {
3331 int rc = cap_inode_removexattr(dentry, name);
3332 if (rc)
3333 return rc;
3334
3335 /* Not an attribute we recognize, so just check the
3336 ordinary setattr permission. */
3337 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3338 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003339
3340 /* No one is allowed to remove a SELinux security label.
3341 You can change the label, but all data must be labeled. */
3342 return -EACCES;
3343}
3344
James Morrisd381d8a2005-10-30 14:59:22 -08003345/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003346 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003347 *
3348 * Permission check is handled by selinux_inode_getxattr hook.
3349 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003350static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003351{
David P. Quigley42492592008-02-04 22:29:39 -08003352 u32 size;
3353 int error;
3354 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003355 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003356
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003357 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3358 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003359
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003360 /*
3361 * If the caller has CAP_MAC_ADMIN, then get the raw context
3362 * value even if it is not defined by current policy; otherwise,
3363 * use the in-core value under current policy.
3364 * Use the non-auditing forms of the permission checks since
3365 * getxattr may be called by unprivileged processes commonly
3366 * and lack of permission just means that we fall back to the
3367 * in-core context value, not a denial.
3368 */
Paul Moore20cdef82016-04-04 14:14:42 -04003369 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003370 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003371 error = security_sid_to_context_force(&selinux_state,
3372 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003373 &size);
3374 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003375 error = security_sid_to_context(&selinux_state, isec->sid,
3376 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003377 if (error)
3378 return error;
3379 error = size;
3380 if (alloc) {
3381 *buffer = context;
3382 goto out_nofree;
3383 }
3384 kfree(context);
3385out_nofree:
3386 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003387}
3388
3389static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003390 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003391{
Paul Moore2c971652016-04-19 16:36:28 -04003392 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003393 u32 newsid;
3394 int rc;
3395
3396 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3397 return -EOPNOTSUPP;
3398
3399 if (!value || !size)
3400 return -EACCES;
3401
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003402 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3403 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003404 if (rc)
3405 return rc;
3406
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003407 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003408 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003409 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003410 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003411 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003412 return 0;
3413}
3414
3415static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3416{
3417 const int len = sizeof(XATTR_NAME_SELINUX);
3418 if (buffer && len <= buffer_size)
3419 memcpy(buffer, XATTR_NAME_SELINUX, len);
3420 return len;
3421}
3422
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003423static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003424{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003425 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003426 *secid = isec->sid;
3427}
3428
Vivek Goyal56909eb2016-07-13 10:44:48 -04003429static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3430{
3431 u32 sid;
3432 struct task_security_struct *tsec;
3433 struct cred *new_creds = *new;
3434
3435 if (new_creds == NULL) {
3436 new_creds = prepare_creds();
3437 if (!new_creds)
3438 return -ENOMEM;
3439 }
3440
3441 tsec = new_creds->security;
3442 /* Get label from overlay inode and set it in create_sid */
3443 selinux_inode_getsecid(d_inode(src), &sid);
3444 tsec->create_sid = sid;
3445 *new = new_creds;
3446 return 0;
3447}
3448
Vivek Goyal19472b62016-07-13 10:44:50 -04003449static int selinux_inode_copy_up_xattr(const char *name)
3450{
3451 /* The copy_up hook above sets the initial context on an inode, but we
3452 * don't then want to overwrite it by blindly copying all the lower
3453 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3454 */
3455 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3456 return 1; /* Discard */
3457 /*
3458 * Any other attribute apart from SELINUX is not claimed, supported
3459 * by selinux.
3460 */
3461 return -EOPNOTSUPP;
3462}
3463
Linus Torvalds1da177e2005-04-16 15:20:36 -07003464/* file security operations */
3465
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003466static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003467{
David Howells88e67f32008-11-14 10:39:21 +11003468 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003469 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003470
Linus Torvalds1da177e2005-04-16 15:20:36 -07003471 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3472 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3473 mask |= MAY_APPEND;
3474
Paul Moore389fb8002009-03-27 17:10:34 -04003475 return file_has_perm(cred, file,
3476 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003477}
3478
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003479static int selinux_file_permission(struct file *file, int mask)
3480{
Al Viro496ad9a2013-01-23 17:07:38 -05003481 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003482 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003483 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003484 u32 sid = current_sid();
3485
Paul Moore389fb8002009-03-27 17:10:34 -04003486 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003487 /* No permission to check. Existence test. */
3488 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003489
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003490 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003491 if (sid == fsec->sid && fsec->isid == isec->sid &&
3492 fsec->pseqno == avc_policy_seqno())
Eric Paris83d49852012-04-04 13:45:40 -04003493 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003494 return 0;
3495
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003496 return selinux_revalidate_file_permission(file, mask);
3497}
3498
Linus Torvalds1da177e2005-04-16 15:20:36 -07003499static int selinux_file_alloc_security(struct file *file)
3500{
3501 return file_alloc_security(file);
3502}
3503
3504static void selinux_file_free_security(struct file *file)
3505{
3506 file_free_security(file);
3507}
3508
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003509/*
3510 * Check whether a task has the ioctl permission and cmd
3511 * operation to an inode.
3512 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003513static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003514 u32 requested, u16 cmd)
3515{
3516 struct common_audit_data ad;
3517 struct file_security_struct *fsec = file->f_security;
3518 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003519 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003520 struct lsm_ioctlop_audit ioctl;
3521 u32 ssid = cred_sid(cred);
3522 int rc;
3523 u8 driver = cmd >> 8;
3524 u8 xperm = cmd & 0xff;
3525
3526 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3527 ad.u.op = &ioctl;
3528 ad.u.op->cmd = cmd;
3529 ad.u.op->path = file->f_path;
3530
3531 if (ssid != fsec->sid) {
3532 rc = avc_has_perm(ssid, fsec->sid,
3533 SECCLASS_FD,
3534 FD__USE,
3535 &ad);
3536 if (rc)
3537 goto out;
3538 }
3539
3540 if (unlikely(IS_PRIVATE(inode)))
3541 return 0;
3542
Paul Moore20cdef82016-04-04 14:14:42 -04003543 isec = inode_security(inode);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003544 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3545 requested, driver, xperm, &ad);
3546out:
3547 return rc;
3548}
3549
Linus Torvalds1da177e2005-04-16 15:20:36 -07003550static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3551 unsigned long arg)
3552{
David Howells88e67f32008-11-14 10:39:21 +11003553 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003554 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003555
Eric Paris0b24dcb2011-02-25 15:39:20 -05003556 switch (cmd) {
3557 case FIONREAD:
3558 /* fall through */
3559 case FIBMAP:
3560 /* fall through */
3561 case FIGETBSZ:
3562 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003563 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003564 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003565 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003566 error = file_has_perm(cred, file, FILE__GETATTR);
3567 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003568
Al Viro2f99c362012-03-23 16:04:05 -04003569 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003570 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003571 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003572 error = file_has_perm(cred, file, FILE__SETATTR);
3573 break;
3574
3575 /* sys_ioctl() checks */
3576 case FIONBIO:
3577 /* fall through */
3578 case FIOASYNC:
3579 error = file_has_perm(cred, file, 0);
3580 break;
3581
3582 case KDSKBENT:
3583 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003584 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003585 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003586 break;
3587
3588 /* default case assumes that the command will go
3589 * to the file's ioctl() function.
3590 */
3591 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003592 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003593 }
3594 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003595}
3596
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003597static int default_noexec;
3598
Linus Torvalds1da177e2005-04-16 15:20:36 -07003599static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3600{
David Howells88e67f32008-11-14 10:39:21 +11003601 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003602 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003603 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003604
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003605 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003606 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3607 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003608 /*
3609 * We are making executable an anonymous mapping or a
3610 * private file mapping that will also be writable.
3611 * This has an additional check.
3612 */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003613 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3614 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003615 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003616 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003617 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003618
3619 if (file) {
3620 /* read access is always possible with a mapping */
3621 u32 av = FILE__READ;
3622
3623 /* write access only matters if the mapping is shared */
3624 if (shared && (prot & PROT_WRITE))
3625 av |= FILE__WRITE;
3626
3627 if (prot & PROT_EXEC)
3628 av |= FILE__EXECUTE;
3629
David Howells88e67f32008-11-14 10:39:21 +11003630 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003631 }
David Howellsd84f4f92008-11-14 10:39:23 +11003632
3633error:
3634 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003635}
3636
Al Viroe5467852012-05-30 13:30:51 -04003637static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003638{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003639 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003640
3641 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3642 u32 sid = current_sid();
3643 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3644 MEMPROTECT__MMAP_ZERO, NULL);
3645 }
3646
3647 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003648}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003649
Al Viroe5467852012-05-30 13:30:51 -04003650static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3651 unsigned long prot, unsigned long flags)
3652{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003653 struct common_audit_data ad;
3654 int rc;
3655
3656 if (file) {
3657 ad.type = LSM_AUDIT_DATA_FILE;
3658 ad.u.file = file;
3659 rc = inode_has_perm(current_cred(), file_inode(file),
3660 FILE__MAP, &ad);
3661 if (rc)
3662 return rc;
3663 }
3664
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003665 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003666 prot = reqprot;
3667
3668 return file_map_prot_check(file, prot,
3669 (flags & MAP_TYPE) == MAP_SHARED);
3670}
3671
3672static int selinux_file_mprotect(struct vm_area_struct *vma,
3673 unsigned long reqprot,
3674 unsigned long prot)
3675{
David Howells88e67f32008-11-14 10:39:21 +11003676 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003677 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003678
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003679 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003680 prot = reqprot;
3681
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003682 if (default_noexec &&
3683 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003684 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003685 if (vma->vm_start >= vma->vm_mm->start_brk &&
3686 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003687 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3688 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003689 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003690 ((vma->vm_start <= vma->vm_mm->start_stack &&
3691 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003692 vma_is_stack_for_current(vma))) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003693 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3694 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003695 } else if (vma->vm_file && vma->anon_vma) {
3696 /*
3697 * We are making executable a file mapping that has
3698 * had some COW done. Since pages might have been
3699 * written, check ability to execute the possibly
3700 * modified content. This typically should only
3701 * occur for text relocations.
3702 */
David Howellsd84f4f92008-11-14 10:39:23 +11003703 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003704 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003705 if (rc)
3706 return rc;
3707 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003708
3709 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3710}
3711
3712static int selinux_file_lock(struct file *file, unsigned int cmd)
3713{
David Howells88e67f32008-11-14 10:39:21 +11003714 const struct cred *cred = current_cred();
3715
3716 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003717}
3718
3719static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3720 unsigned long arg)
3721{
David Howells88e67f32008-11-14 10:39:21 +11003722 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003723 int err = 0;
3724
3725 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003726 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003727 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003728 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003729 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003730 }
3731 /* fall through */
3732 case F_SETOWN:
3733 case F_SETSIG:
3734 case F_GETFL:
3735 case F_GETOWN:
3736 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003737 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003738 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003739 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003740 break;
3741 case F_GETLK:
3742 case F_SETLK:
3743 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003744 case F_OFD_GETLK:
3745 case F_OFD_SETLK:
3746 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003747#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003748 case F_GETLK64:
3749 case F_SETLK64:
3750 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003751#endif
David Howells88e67f32008-11-14 10:39:21 +11003752 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003753 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003754 }
3755
3756 return err;
3757}
3758
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003759static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003760{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003761 struct file_security_struct *fsec;
3762
Linus Torvalds1da177e2005-04-16 15:20:36 -07003763 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003764 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003765}
3766
3767static int selinux_file_send_sigiotask(struct task_struct *tsk,
3768 struct fown_struct *fown, int signum)
3769{
Eric Paris828dfe12008-04-17 13:17:49 -04003770 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003771 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003772 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003773 struct file_security_struct *fsec;
3774
3775 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003776 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003777
Linus Torvalds1da177e2005-04-16 15:20:36 -07003778 fsec = file->f_security;
3779
3780 if (!signum)
3781 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3782 else
3783 perm = signal_to_av(signum);
3784
David Howells275bb412008-11-14 10:39:19 +11003785 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003786 SECCLASS_PROCESS, perm, NULL);
3787}
3788
3789static int selinux_file_receive(struct file *file)
3790{
David Howells88e67f32008-11-14 10:39:21 +11003791 const struct cred *cred = current_cred();
3792
3793 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003794}
3795
Eric Paris83d49852012-04-04 13:45:40 -04003796static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003797{
3798 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003799 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003800
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003801 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003802 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003803 /*
3804 * Save inode label and policy sequence number
3805 * at open-time so that selinux_file_permission
3806 * can determine whether revalidation is necessary.
3807 * Task label is already saved in the file security
3808 * struct as its SID.
3809 */
3810 fsec->isid = isec->sid;
3811 fsec->pseqno = avc_policy_seqno();
3812 /*
3813 * Since the inode label or policy seqno may have changed
3814 * between the selinux_inode_permission check and the saving
3815 * of state above, recheck that access is still permitted.
3816 * Otherwise, access might never be revalidated against the
3817 * new inode label or new policy.
3818 * This check is not redundant - do not remove.
3819 */
David Howells13f8e982013-06-13 23:37:55 +01003820 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003821}
3822
Linus Torvalds1da177e2005-04-16 15:20:36 -07003823/* task security operations */
3824
Tetsuo Handaa79be232017-03-28 23:08:45 +09003825static int selinux_task_alloc(struct task_struct *task,
3826 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003827{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003828 u32 sid = current_sid();
3829
3830 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003831}
3832
David Howellsf1752ee2008-11-14 10:39:17 +11003833/*
David Howellsee18d642009-09-02 09:14:21 +01003834 * allocate the SELinux part of blank credentials
3835 */
3836static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3837{
3838 struct task_security_struct *tsec;
3839
3840 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3841 if (!tsec)
3842 return -ENOMEM;
3843
3844 cred->security = tsec;
3845 return 0;
3846}
3847
3848/*
David Howellsf1752ee2008-11-14 10:39:17 +11003849 * detach and free the LSM part of a set of credentials
3850 */
3851static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003852{
David Howellsf1752ee2008-11-14 10:39:17 +11003853 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003854
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003855 /*
3856 * cred->security == NULL if security_cred_alloc_blank() or
3857 * security_prepare_creds() returned an error.
3858 */
3859 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003860 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003861 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003862}
3863
David Howellsd84f4f92008-11-14 10:39:23 +11003864/*
3865 * prepare a new set of credentials for modification
3866 */
3867static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3868 gfp_t gfp)
3869{
3870 const struct task_security_struct *old_tsec;
3871 struct task_security_struct *tsec;
3872
3873 old_tsec = old->security;
3874
3875 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3876 if (!tsec)
3877 return -ENOMEM;
3878
3879 new->security = tsec;
3880 return 0;
3881}
3882
3883/*
David Howellsee18d642009-09-02 09:14:21 +01003884 * transfer the SELinux data to a blank set of creds
3885 */
3886static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3887{
3888 const struct task_security_struct *old_tsec = old->security;
3889 struct task_security_struct *tsec = new->security;
3890
3891 *tsec = *old_tsec;
3892}
3893
3894/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003895 * set the security data for a kernel service
3896 * - all the creation contexts are set to unlabelled
3897 */
3898static int selinux_kernel_act_as(struct cred *new, u32 secid)
3899{
3900 struct task_security_struct *tsec = new->security;
3901 u32 sid = current_sid();
3902 int ret;
3903
3904 ret = avc_has_perm(sid, secid,
3905 SECCLASS_KERNEL_SERVICE,
3906 KERNEL_SERVICE__USE_AS_OVERRIDE,
3907 NULL);
3908 if (ret == 0) {
3909 tsec->sid = secid;
3910 tsec->create_sid = 0;
3911 tsec->keycreate_sid = 0;
3912 tsec->sockcreate_sid = 0;
3913 }
3914 return ret;
3915}
3916
3917/*
3918 * set the file creation context in a security record to the same as the
3919 * objective context of the specified inode
3920 */
3921static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3922{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003923 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003924 struct task_security_struct *tsec = new->security;
3925 u32 sid = current_sid();
3926 int ret;
3927
3928 ret = avc_has_perm(sid, isec->sid,
3929 SECCLASS_KERNEL_SERVICE,
3930 KERNEL_SERVICE__CREATE_FILES_AS,
3931 NULL);
3932
3933 if (ret == 0)
3934 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003935 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003936}
3937
Eric Parisdd8dbf22009-11-03 16:35:32 +11003938static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003939{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003940 struct common_audit_data ad;
3941
Eric Paris50c205f2012-04-04 15:01:43 -04003942 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003943 ad.u.kmod_name = kmod_name;
3944
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003945 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11003946 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003947}
3948
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07003949static int selinux_kernel_module_from_file(struct file *file)
3950{
3951 struct common_audit_data ad;
3952 struct inode_security_struct *isec;
3953 struct file_security_struct *fsec;
3954 u32 sid = current_sid();
3955 int rc;
3956
3957 /* init_module */
3958 if (file == NULL)
3959 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3960 SYSTEM__MODULE_LOAD, NULL);
3961
3962 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003963
Vivek Goyal43af5de2016-09-09 11:37:49 -04003964 ad.type = LSM_AUDIT_DATA_FILE;
3965 ad.u.file = file;
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07003966
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07003967 fsec = file->f_security;
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07003968 if (sid != fsec->sid) {
3969 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3970 if (rc)
3971 return rc;
3972 }
3973
Paul Moore20cdef82016-04-04 14:14:42 -04003974 isec = inode_security(file_inode(file));
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07003975 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3976 SYSTEM__MODULE_LOAD, &ad);
3977}
3978
3979static int selinux_kernel_read_file(struct file *file,
3980 enum kernel_read_file_id id)
3981{
3982 int rc = 0;
3983
3984 switch (id) {
3985 case READING_MODULE:
3986 rc = selinux_kernel_module_from_file(file);
3987 break;
3988 default:
3989 break;
3990 }
3991
3992 return rc;
3993}
3994
Linus Torvalds1da177e2005-04-16 15:20:36 -07003995static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3996{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003997 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3998 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003999}
4000
4001static int selinux_task_getpgid(struct task_struct *p)
4002{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004003 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4004 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004005}
4006
4007static int selinux_task_getsid(struct task_struct *p)
4008{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004009 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4010 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004011}
4012
David Quigleyf9008e42006-06-30 01:55:46 -07004013static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4014{
David Howells275bb412008-11-14 10:39:19 +11004015 *secid = task_sid(p);
David Quigleyf9008e42006-06-30 01:55:46 -07004016}
4017
Linus Torvalds1da177e2005-04-16 15:20:36 -07004018static int selinux_task_setnice(struct task_struct *p, int nice)
4019{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004020 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4021 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004022}
4023
James Morris03e68062006-06-23 02:03:58 -07004024static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4025{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004026 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4027 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004028}
4029
David Quigleya1836a42006-06-30 01:55:49 -07004030static int selinux_task_getioprio(struct task_struct *p)
4031{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004032 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4033 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004034}
4035
Corentin LABBE42985552017-10-04 20:32:18 +02004036static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4037 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004038{
4039 u32 av = 0;
4040
Stephen Smalley84e68852017-02-28 09:35:08 -05004041 if (!flags)
4042 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004043 if (flags & LSM_PRLIMIT_WRITE)
4044 av |= PROCESS__SETRLIMIT;
4045 if (flags & LSM_PRLIMIT_READ)
4046 av |= PROCESS__GETRLIMIT;
4047 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
4048 SECCLASS_PROCESS, av, NULL);
4049}
4050
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004051static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4052 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004053{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004054 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004055
4056 /* Control the ability to change the hard limit (whether
4057 lowering or raising it), so that the hard limit can
4058 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004059 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004060 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004061 return avc_has_perm(current_sid(), task_sid(p),
4062 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004063
4064 return 0;
4065}
4066
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004067static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004068{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004069 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4070 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004071}
4072
4073static int selinux_task_getscheduler(struct task_struct *p)
4074{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004075 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4076 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004077}
4078
David Quigley35601542006-06-23 02:04:01 -07004079static int selinux_task_movememory(struct task_struct *p)
4080{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004081 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4082 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004083}
4084
David Quigleyf9008e42006-06-30 01:55:46 -07004085static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
4086 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004087{
4088 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004089
Linus Torvalds1da177e2005-04-16 15:20:36 -07004090 if (!sig)
4091 perm = PROCESS__SIGNULL; /* null signal; existence test */
4092 else
4093 perm = signal_to_av(sig);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004094 if (!secid)
4095 secid = current_sid();
4096 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004097}
4098
Linus Torvalds1da177e2005-04-16 15:20:36 -07004099static void selinux_task_to_inode(struct task_struct *p,
4100 struct inode *inode)
4101{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004102 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004103 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004104
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004105 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004106 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004107 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004108 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004109 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004110}
4111
Linus Torvalds1da177e2005-04-16 15:20:36 -07004112/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004113static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004114 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004115{
4116 int offset, ihlen, ret = -EINVAL;
4117 struct iphdr _iph, *ih;
4118
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004119 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004120 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4121 if (ih == NULL)
4122 goto out;
4123
4124 ihlen = ih->ihl * 4;
4125 if (ihlen < sizeof(_iph))
4126 goto out;
4127
Eric Paris48c62af2012-04-02 13:15:44 -04004128 ad->u.net->v4info.saddr = ih->saddr;
4129 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004130 ret = 0;
4131
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004132 if (proto)
4133 *proto = ih->protocol;
4134
Linus Torvalds1da177e2005-04-16 15:20:36 -07004135 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004136 case IPPROTO_TCP: {
4137 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004138
Eric Paris828dfe12008-04-17 13:17:49 -04004139 if (ntohs(ih->frag_off) & IP_OFFSET)
4140 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004141
4142 offset += ihlen;
4143 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4144 if (th == NULL)
4145 break;
4146
Eric Paris48c62af2012-04-02 13:15:44 -04004147 ad->u.net->sport = th->source;
4148 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004149 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004150 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004151
Eric Paris828dfe12008-04-17 13:17:49 -04004152 case IPPROTO_UDP: {
4153 struct udphdr _udph, *uh;
4154
4155 if (ntohs(ih->frag_off) & IP_OFFSET)
4156 break;
4157
4158 offset += ihlen;
4159 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4160 if (uh == NULL)
4161 break;
4162
Eric Paris48c62af2012-04-02 13:15:44 -04004163 ad->u.net->sport = uh->source;
4164 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004165 break;
4166 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004167
James Morris2ee92d42006-11-13 16:09:01 -08004168 case IPPROTO_DCCP: {
4169 struct dccp_hdr _dccph, *dh;
4170
4171 if (ntohs(ih->frag_off) & IP_OFFSET)
4172 break;
4173
4174 offset += ihlen;
4175 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4176 if (dh == NULL)
4177 break;
4178
Eric Paris48c62af2012-04-02 13:15:44 -04004179 ad->u.net->sport = dh->dccph_sport;
4180 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004181 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004182 }
James Morris2ee92d42006-11-13 16:09:01 -08004183
Richard Hainesd4529302018-02-13 20:57:18 +00004184#if IS_ENABLED(CONFIG_IP_SCTP)
4185 case IPPROTO_SCTP: {
4186 struct sctphdr _sctph, *sh;
4187
4188 if (ntohs(ih->frag_off) & IP_OFFSET)
4189 break;
4190
4191 offset += ihlen;
4192 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4193 if (sh == NULL)
4194 break;
4195
4196 ad->u.net->sport = sh->source;
4197 ad->u.net->dport = sh->dest;
4198 break;
4199 }
4200#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004201 default:
4202 break;
4203 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004204out:
4205 return ret;
4206}
4207
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004208#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004209
4210/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004211static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004212 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004213{
4214 u8 nexthdr;
4215 int ret = -EINVAL, offset;
4216 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004217 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004218
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004219 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004220 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4221 if (ip6 == NULL)
4222 goto out;
4223
Eric Paris48c62af2012-04-02 13:15:44 -04004224 ad->u.net->v6info.saddr = ip6->saddr;
4225 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004226 ret = 0;
4227
4228 nexthdr = ip6->nexthdr;
4229 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004230 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004231 if (offset < 0)
4232 goto out;
4233
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004234 if (proto)
4235 *proto = nexthdr;
4236
Linus Torvalds1da177e2005-04-16 15:20:36 -07004237 switch (nexthdr) {
4238 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004239 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004240
4241 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4242 if (th == NULL)
4243 break;
4244
Eric Paris48c62af2012-04-02 13:15:44 -04004245 ad->u.net->sport = th->source;
4246 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004247 break;
4248 }
4249
4250 case IPPROTO_UDP: {
4251 struct udphdr _udph, *uh;
4252
4253 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4254 if (uh == NULL)
4255 break;
4256
Eric Paris48c62af2012-04-02 13:15:44 -04004257 ad->u.net->sport = uh->source;
4258 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004259 break;
4260 }
4261
James Morris2ee92d42006-11-13 16:09:01 -08004262 case IPPROTO_DCCP: {
4263 struct dccp_hdr _dccph, *dh;
4264
4265 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4266 if (dh == NULL)
4267 break;
4268
Eric Paris48c62af2012-04-02 13:15:44 -04004269 ad->u.net->sport = dh->dccph_sport;
4270 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004271 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004272 }
James Morris2ee92d42006-11-13 16:09:01 -08004273
Richard Hainesd4529302018-02-13 20:57:18 +00004274#if IS_ENABLED(CONFIG_IP_SCTP)
4275 case IPPROTO_SCTP: {
4276 struct sctphdr _sctph, *sh;
4277
4278 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4279 if (sh == NULL)
4280 break;
4281
4282 ad->u.net->sport = sh->source;
4283 ad->u.net->dport = sh->dest;
4284 break;
4285 }
4286#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004287 /* includes fragments */
4288 default:
4289 break;
4290 }
4291out:
4292 return ret;
4293}
4294
4295#endif /* IPV6 */
4296
Thomas Liu2bf49692009-07-14 12:14:09 -04004297static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004298 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004299{
David Howellscf9481e2008-07-27 21:31:07 +10004300 char *addrp;
4301 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004302
Eric Paris48c62af2012-04-02 13:15:44 -04004303 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004304 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004305 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004306 if (ret)
4307 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004308 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4309 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004310 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004311
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004312#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004313 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004314 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004315 if (ret)
4316 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004317 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4318 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004319 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004320#endif /* IPV6 */
4321 default:
David Howellscf9481e2008-07-27 21:31:07 +10004322 addrp = NULL;
4323 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004324 }
4325
David Howellscf9481e2008-07-27 21:31:07 +10004326parse_error:
4327 printk(KERN_WARNING
4328 "SELinux: failure in selinux_parse_skb(),"
4329 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004330 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004331
4332okay:
4333 if (_addrp)
4334 *_addrp = addrp;
4335 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004336}
4337
Paul Moore4f6a9932007-03-01 14:35:22 -05004338/**
Paul Moore220deb92008-01-29 08:38:23 -05004339 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004340 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004341 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004342 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004343 *
4344 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004345 * Check the various different forms of network peer labeling and determine
4346 * the peer label/SID for the packet; most of the magic actually occurs in
4347 * the security server function security_net_peersid_cmp(). The function
4348 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4349 * or -EACCES if @sid is invalid due to inconsistencies with the different
4350 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004351 *
4352 */
Paul Moore220deb92008-01-29 08:38:23 -05004353static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004354{
Paul Moore71f1cb02008-01-29 08:51:16 -05004355 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004356 u32 xfrm_sid;
4357 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004358 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004359
Paul Moore817eff72013-12-10 14:57:54 -05004360 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004361 if (unlikely(err))
4362 return -EACCES;
4363 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4364 if (unlikely(err))
4365 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004366
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004367 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4368 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004369 if (unlikely(err)) {
4370 printk(KERN_WARNING
4371 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4372 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004373 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004374 }
Paul Moore220deb92008-01-29 08:38:23 -05004375
4376 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004377}
4378
Paul Moore446b8022013-12-04 16:10:51 -05004379/**
4380 * selinux_conn_sid - Determine the child socket label for a connection
4381 * @sk_sid: the parent socket's SID
4382 * @skb_sid: the packet's SID
4383 * @conn_sid: the resulting connection SID
4384 *
4385 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4386 * combined with the MLS information from @skb_sid in order to create
4387 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4388 * of @sk_sid. Returns zero on success, negative values on failure.
4389 *
4390 */
4391static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4392{
4393 int err = 0;
4394
4395 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004396 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4397 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004398 else
4399 *conn_sid = sk_sid;
4400
4401 return err;
4402}
4403
Linus Torvalds1da177e2005-04-16 15:20:36 -07004404/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004405
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004406static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4407 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004408{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004409 if (tsec->sockcreate_sid > SECSID_NULL) {
4410 *socksid = tsec->sockcreate_sid;
4411 return 0;
4412 }
4413
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004414 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4415 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004416}
4417
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004418static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004419{
Paul Moore253bfae2010-04-22 14:46:19 -04004420 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004421 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004422 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004423
Paul Moore253bfae2010-04-22 14:46:19 -04004424 if (sksec->sid == SECINITSID_KERNEL)
4425 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004426
Eric Paris50c205f2012-04-04 15:01:43 -04004427 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004428 ad.u.net = &net;
4429 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004430
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004431 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4432 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004433}
4434
4435static int selinux_socket_create(int family, int type,
4436 int protocol, int kern)
4437{
Paul Moore5fb49872010-04-22 14:46:19 -04004438 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004439 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004440 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004441 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004442
4443 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004444 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004445
David Howells275bb412008-11-14 10:39:19 +11004446 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004447 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4448 if (rc)
4449 return rc;
4450
Paul Moored4f2d972010-04-22 14:46:18 -04004451 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004452}
4453
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004454static int selinux_socket_post_create(struct socket *sock, int family,
4455 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004456{
Paul Moore5fb49872010-04-22 14:46:19 -04004457 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004458 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004459 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004460 u16 sclass = socket_type_to_security_class(family, type, protocol);
4461 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004462 int err = 0;
4463
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004464 if (!kern) {
4465 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004466 if (err)
4467 return err;
4468 }
David Howells275bb412008-11-14 10:39:19 +11004469
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004470 isec->sclass = sclass;
4471 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004472 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004473
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004474 if (sock->sk) {
4475 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004476 sksec->sclass = sclass;
4477 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004478 /* Allows detection of the first association on this socket */
4479 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4480 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4481
Paul Moore389fb8002009-03-27 17:10:34 -04004482 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004483 }
4484
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004485 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004486}
4487
4488/* Range of port numbers used to automatically bind.
4489 Need to determine whether we should perform a name_bind
4490 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004491
4492static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4493{
Paul Moore253bfae2010-04-22 14:46:19 -04004494 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004495 u16 family;
4496 int err;
4497
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004498 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004499 if (err)
4500 goto out;
4501
Richard Hainesd4529302018-02-13 20:57:18 +00004502 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004503 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004504 if (family == PF_INET || family == PF_INET6) {
4505 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04004506 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004507 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004508 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004509 struct sockaddr_in *addr4 = NULL;
4510 struct sockaddr_in6 *addr6 = NULL;
4511 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004512 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004513
Richard Hainesd4529302018-02-13 20:57:18 +00004514 /*
4515 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4516 * that validates multiple binding addresses. Because of this
4517 * need to check address->sa_family as it is possible to have
4518 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4519 */
4520 if (address->sa_family == AF_INET) {
Alexander Potapenkoe2f586b2017-03-06 19:46:14 +01004521 if (addrlen < sizeof(struct sockaddr_in)) {
4522 err = -EINVAL;
4523 goto out;
4524 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004525 addr4 = (struct sockaddr_in *)address;
4526 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004527 addrp = (char *)&addr4->sin_addr.s_addr;
4528 } else {
Alexander Potapenkoe2f586b2017-03-06 19:46:14 +01004529 if (addrlen < SIN6_LEN_RFC2133) {
4530 err = -EINVAL;
4531 goto out;
4532 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004533 addr6 = (struct sockaddr_in6 *)address;
4534 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004535 addrp = (char *)&addr6->sin6_addr.s6_addr;
4536 }
4537
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004538 if (snum) {
4539 int low, high;
4540
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004541 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004542
Krister Johansen4548b682017-01-20 17:49:11 -08004543 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4544 snum > high) {
Paul Moore3e112172008-04-10 10:48:14 -04004545 err = sel_netport_sid(sk->sk_protocol,
4546 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004547 if (err)
4548 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04004549 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004550 ad.u.net = &net;
4551 ad.u.net->sport = htons(snum);
4552 ad.u.net->family = family;
Paul Moore253bfae2010-04-22 14:46:19 -04004553 err = avc_has_perm(sksec->sid, sid,
4554 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004555 SOCKET__NAME_BIND, &ad);
4556 if (err)
4557 goto out;
4558 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004559 }
Eric Paris828dfe12008-04-17 13:17:49 -04004560
Paul Moore253bfae2010-04-22 14:46:19 -04004561 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004562 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004563 node_perm = TCP_SOCKET__NODE_BIND;
4564 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004565
James Morris13402582005-09-30 14:24:34 -04004566 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004567 node_perm = UDP_SOCKET__NODE_BIND;
4568 break;
James Morris2ee92d42006-11-13 16:09:01 -08004569
4570 case SECCLASS_DCCP_SOCKET:
4571 node_perm = DCCP_SOCKET__NODE_BIND;
4572 break;
4573
Richard Hainesd4529302018-02-13 20:57:18 +00004574 case SECCLASS_SCTP_SOCKET:
4575 node_perm = SCTP_SOCKET__NODE_BIND;
4576 break;
4577
Linus Torvalds1da177e2005-04-16 15:20:36 -07004578 default:
4579 node_perm = RAWIP_SOCKET__NODE_BIND;
4580 break;
4581 }
Eric Paris828dfe12008-04-17 13:17:49 -04004582
Paul Moore224dfbd2008-01-29 08:38:13 -05004583 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004584 if (err)
4585 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004586
Eric Paris50c205f2012-04-04 15:01:43 -04004587 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004588 ad.u.net = &net;
4589 ad.u.net->sport = htons(snum);
4590 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004591
Richard Hainesd4529302018-02-13 20:57:18 +00004592 if (address->sa_family == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004593 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004594 else
Eric Paris48c62af2012-04-02 13:15:44 -04004595 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004596
Paul Moore253bfae2010-04-22 14:46:19 -04004597 err = avc_has_perm(sksec->sid, sid,
4598 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004599 if (err)
4600 goto out;
4601 }
4602out:
4603 return err;
4604}
4605
Richard Hainesd4529302018-02-13 20:57:18 +00004606/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4607 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.txt
4608 */
4609static int selinux_socket_connect_helper(struct socket *sock,
4610 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004611{
Paul Moore014ab192008-10-10 10:16:33 -04004612 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004613 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004614 int err;
4615
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004616 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004617 if (err)
4618 return err;
4619
4620 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004621 * If a TCP, DCCP or SCTP socket, check name_connect permission
4622 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004623 */
Paul Moore253bfae2010-04-22 14:46:19 -04004624 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004625 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4626 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004627 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004628 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004629 struct sockaddr_in *addr4 = NULL;
4630 struct sockaddr_in6 *addr6 = NULL;
4631 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004632 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004633
Richard Hainesd4529302018-02-13 20:57:18 +00004634 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4635 * that validates multiple connect addresses. Because of this
4636 * need to check address->sa_family as it is possible to have
4637 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4638 */
4639 if (address->sa_family == AF_INET) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004640 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004641 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004642 return -EINVAL;
4643 snum = ntohs(addr4->sin_port);
4644 } else {
4645 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004646 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004647 return -EINVAL;
4648 snum = ntohs(addr6->sin6_port);
4649 }
4650
Paul Moore3e112172008-04-10 10:48:14 -04004651 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004652 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004653 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004654
Richard Hainesd4529302018-02-13 20:57:18 +00004655 switch (sksec->sclass) {
4656 case SECCLASS_TCP_SOCKET:
4657 perm = TCP_SOCKET__NAME_CONNECT;
4658 break;
4659 case SECCLASS_DCCP_SOCKET:
4660 perm = DCCP_SOCKET__NAME_CONNECT;
4661 break;
4662 case SECCLASS_SCTP_SOCKET:
4663 perm = SCTP_SOCKET__NAME_CONNECT;
4664 break;
4665 }
James Morris2ee92d42006-11-13 16:09:01 -08004666
Eric Paris50c205f2012-04-04 15:01:43 -04004667 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004668 ad.u.net = &net;
4669 ad.u.net->dport = htons(snum);
4670 ad.u.net->family = sk->sk_family;
Paul Moore253bfae2010-04-22 14:46:19 -04004671 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004672 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004673 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004674 }
4675
Richard Hainesd4529302018-02-13 20:57:18 +00004676 return 0;
4677}
Paul Moore014ab192008-10-10 10:16:33 -04004678
Richard Hainesd4529302018-02-13 20:57:18 +00004679/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4680static int selinux_socket_connect(struct socket *sock,
4681 struct sockaddr *address, int addrlen)
4682{
4683 int err;
4684 struct sock *sk = sock->sk;
4685
4686 err = selinux_socket_connect_helper(sock, address, addrlen);
4687 if (err)
4688 return err;
4689
4690 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004691}
4692
4693static int selinux_socket_listen(struct socket *sock, int backlog)
4694{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004695 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004696}
4697
4698static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4699{
4700 int err;
4701 struct inode_security_struct *isec;
4702 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004703 u16 sclass;
4704 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004705
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004706 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004707 if (err)
4708 return err;
4709
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004710 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004711 spin_lock(&isec->lock);
4712 sclass = isec->sclass;
4713 sid = isec->sid;
4714 spin_unlock(&isec->lock);
4715
4716 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4717 newisec->sclass = sclass;
4718 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004719 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004720
4721 return 0;
4722}
4723
4724static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004725 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004726{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004727 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004728}
4729
4730static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4731 int size, int flags)
4732{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004733 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004734}
4735
4736static int selinux_socket_getsockname(struct socket *sock)
4737{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004738 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004739}
4740
4741static int selinux_socket_getpeername(struct socket *sock)
4742{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004743 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004744}
4745
Eric Paris828dfe12008-04-17 13:17:49 -04004746static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004747{
Paul Mooref8687af2006-10-30 15:22:15 -08004748 int err;
4749
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004750 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004751 if (err)
4752 return err;
4753
4754 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004755}
4756
4757static int selinux_socket_getsockopt(struct socket *sock, int level,
4758 int optname)
4759{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004760 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004761}
4762
4763static int selinux_socket_shutdown(struct socket *sock, int how)
4764{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004765 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004766}
4767
David S. Miller3610cda2011-01-05 15:38:53 -08004768static int selinux_socket_unix_stream_connect(struct sock *sock,
4769 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004770 struct sock *newsk)
4771{
David S. Miller3610cda2011-01-05 15:38:53 -08004772 struct sk_security_struct *sksec_sock = sock->sk_security;
4773 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004774 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004775 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004776 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004777 int err;
4778
Eric Paris50c205f2012-04-04 15:01:43 -04004779 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004780 ad.u.net = &net;
4781 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004782
Paul Moore4d1e2452010-04-22 14:46:18 -04004783 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4784 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004785 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4786 if (err)
4787 return err;
4788
Linus Torvalds1da177e2005-04-16 15:20:36 -07004789 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004790 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004791 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4792 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004793 if (err)
4794 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004795
Paul Moore4d1e2452010-04-22 14:46:18 -04004796 /* connecting socket */
4797 sksec_sock->peer_sid = sksec_new->sid;
4798
4799 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004800}
4801
4802static int selinux_socket_unix_may_send(struct socket *sock,
4803 struct socket *other)
4804{
Paul Moore253bfae2010-04-22 14:46:19 -04004805 struct sk_security_struct *ssec = sock->sk->sk_security;
4806 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004807 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004808 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004809
Eric Paris50c205f2012-04-04 15:01:43 -04004810 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004811 ad.u.net = &net;
4812 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004813
Paul Moore253bfae2010-04-22 14:46:19 -04004814 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4815 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004816}
4817
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004818static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4819 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004820 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004821{
4822 int err;
4823 u32 if_sid;
4824 u32 node_sid;
4825
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004826 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004827 if (err)
4828 return err;
4829 err = avc_has_perm(peer_sid, if_sid,
4830 SECCLASS_NETIF, NETIF__INGRESS, ad);
4831 if (err)
4832 return err;
4833
4834 err = sel_netnode_sid(addrp, family, &node_sid);
4835 if (err)
4836 return err;
4837 return avc_has_perm(peer_sid, node_sid,
4838 SECCLASS_NODE, NODE__RECVFROM, ad);
4839}
4840
Paul Moore220deb92008-01-29 08:38:23 -05004841static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004842 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004843{
Paul Moore277d3422008-12-31 12:54:11 -05004844 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004845 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004846 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004847 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004848 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004849 char *addrp;
4850
Eric Paris50c205f2012-04-04 15:01:43 -04004851 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004852 ad.u.net = &net;
4853 ad.u.net->netif = skb->skb_iif;
4854 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004855 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4856 if (err)
4857 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004858
Paul Moore58bfbb52009-03-27 17:10:41 -04004859 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004860 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004861 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004862 if (err)
4863 return err;
4864 }
Paul Moore220deb92008-01-29 08:38:23 -05004865
Steffen Klassertb9679a72011-02-23 12:55:21 +01004866 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4867 if (err)
4868 return err;
4869 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004870
James Morris4e5ab4c2006-06-09 00:33:33 -07004871 return err;
4872}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004873
James Morris4e5ab4c2006-06-09 00:33:33 -07004874static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4875{
Paul Moore220deb92008-01-29 08:38:23 -05004876 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004877 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004878 u16 family = sk->sk_family;
4879 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004880 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004881 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004882 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004883 u8 secmark_active;
4884 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004885
James Morris4e5ab4c2006-06-09 00:33:33 -07004886 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004887 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004888
4889 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004890 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004891 family = PF_INET;
4892
Paul Moored8395c82008-10-10 10:16:30 -04004893 /* If any sort of compatibility mode is enabled then handoff processing
4894 * to the selinux_sock_rcv_skb_compat() function to deal with the
4895 * special handling. We do this in an attempt to keep this function
4896 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004897 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04004898 return selinux_sock_rcv_skb_compat(sk, skb, family);
4899
4900 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004901 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04004902 if (!secmark_active && !peerlbl_active)
4903 return 0;
4904
Eric Paris50c205f2012-04-04 15:01:43 -04004905 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004906 ad.u.net = &net;
4907 ad.u.net->netif = skb->skb_iif;
4908 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004909 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004910 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004911 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004912
Paul Moored8395c82008-10-10 10:16:30 -04004913 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004914 u32 peer_sid;
4915
4916 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4917 if (err)
4918 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004919 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4920 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004921 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004922 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004923 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004924 }
Paul Moored621d352008-01-29 08:43:36 -05004925 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4926 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05004927 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004928 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05004929 return err;
4930 }
Paul Moored621d352008-01-29 08:43:36 -05004931 }
4932
Paul Moored8395c82008-10-10 10:16:30 -04004933 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004934 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4935 PACKET__RECV, &ad);
4936 if (err)
4937 return err;
4938 }
4939
Paul Moored621d352008-01-29 08:43:36 -05004940 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004941}
4942
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004943static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4944 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004945{
4946 int err = 0;
4947 char *scontext;
4948 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004949 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004950 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004951
Paul Moore253bfae2010-04-22 14:46:19 -04004952 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004953 sksec->sclass == SECCLASS_TCP_SOCKET ||
4954 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004955 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004956 if (peer_sid == SECSID_NULL)
4957 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004958
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004959 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
4960 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004961 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004962 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004963
4964 if (scontext_len > len) {
4965 err = -ERANGE;
4966 goto out_len;
4967 }
4968
4969 if (copy_to_user(optval, scontext, scontext_len))
4970 err = -EFAULT;
4971
4972out_len:
4973 if (put_user(scontext_len, optlen))
4974 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004975 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004976 return err;
4977}
4978
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004979static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004980{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004981 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004982 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04004983 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004984
Paul Mooreaa862902008-10-10 10:16:29 -04004985 if (skb && skb->protocol == htons(ETH_P_IP))
4986 family = PF_INET;
4987 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4988 family = PF_INET6;
4989 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004990 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004991 else
4992 goto out;
4993
Paul Moore899134f2016-03-28 15:19:10 -04004994 if (sock && family == PF_UNIX) {
4995 isec = inode_security_novalidate(SOCK_INODE(sock));
4996 peer_secid = isec->sid;
4997 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004998 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004999
Paul Moore75e22912008-01-29 08:38:04 -05005000out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005001 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005002 if (peer_secid == SECSID_NULL)
5003 return -EINVAL;
5004 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005005}
5006
Al Viro7d877f32005-10-21 03:20:43 -04005007static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005008{
Paul Moore84914b72010-04-22 14:46:18 -04005009 struct sk_security_struct *sksec;
5010
5011 sksec = kzalloc(sizeof(*sksec), priority);
5012 if (!sksec)
5013 return -ENOMEM;
5014
5015 sksec->peer_sid = SECINITSID_UNLABELED;
5016 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005017 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005018 selinux_netlbl_sk_security_reset(sksec);
5019 sk->sk_security = sksec;
5020
5021 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005022}
5023
5024static void selinux_sk_free_security(struct sock *sk)
5025{
Paul Moore84914b72010-04-22 14:46:18 -04005026 struct sk_security_struct *sksec = sk->sk_security;
5027
5028 sk->sk_security = NULL;
5029 selinux_netlbl_sk_security_free(sksec);
5030 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005031}
5032
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005033static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5034{
Eric Parisdd3e7832010-04-07 15:08:46 -04005035 struct sk_security_struct *sksec = sk->sk_security;
5036 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005037
Eric Parisdd3e7832010-04-07 15:08:46 -04005038 newsksec->sid = sksec->sid;
5039 newsksec->peer_sid = sksec->peer_sid;
5040 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005041
Eric Parisdd3e7832010-04-07 15:08:46 -04005042 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005043}
5044
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005045static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005046{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005047 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005048 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005049 else {
5050 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005051
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005052 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005053 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005054}
5055
Eric Paris828dfe12008-04-17 13:17:49 -04005056static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005057{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005058 struct inode_security_struct *isec =
5059 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005060 struct sk_security_struct *sksec = sk->sk_security;
5061
Paul Moore2873ead2014-07-28 10:42:48 -04005062 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5063 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005064 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005065 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005066}
5067
Richard Hainesd4529302018-02-13 20:57:18 +00005068/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5069 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5070 * already present).
5071 */
5072static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5073 struct sk_buff *skb)
5074{
5075 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5076 struct common_audit_data ad;
5077 struct lsm_network_audit net = {0,};
5078 u8 peerlbl_active;
5079 u32 peer_sid = SECINITSID_UNLABELED;
5080 u32 conn_sid;
5081 int err = 0;
5082
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005083 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005084 return 0;
5085
5086 peerlbl_active = selinux_peerlbl_enabled();
5087
5088 if (peerlbl_active) {
5089 /* This will return peer_sid = SECSID_NULL if there are
5090 * no peer labels, see security_net_peersid_resolve().
5091 */
5092 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5093 &peer_sid);
5094 if (err)
5095 return err;
5096
5097 if (peer_sid == SECSID_NULL)
5098 peer_sid = SECINITSID_UNLABELED;
5099 }
5100
5101 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5102 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5103
5104 /* Here as first association on socket. As the peer SID
5105 * was allowed by peer recv (and the netif/node checks),
5106 * then it is approved by policy and used as the primary
5107 * peer SID for getpeercon(3).
5108 */
5109 sksec->peer_sid = peer_sid;
5110 } else if (sksec->peer_sid != peer_sid) {
5111 /* Other association peer SIDs are checked to enforce
5112 * consistency among the peer SIDs.
5113 */
5114 ad.type = LSM_AUDIT_DATA_NET;
5115 ad.u.net = &net;
5116 ad.u.net->sk = ep->base.sk;
5117 err = avc_has_perm(sksec->peer_sid, peer_sid, sksec->sclass,
5118 SCTP_SOCKET__ASSOCIATION, &ad);
5119 if (err)
5120 return err;
5121 }
5122
5123 /* Compute the MLS component for the connection and store
5124 * the information in ep. This will be used by SCTP TCP type
5125 * sockets and peeled off connections as they cause a new
5126 * socket to be generated. selinux_sctp_sk_clone() will then
5127 * plug this into the new socket.
5128 */
5129 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5130 if (err)
5131 return err;
5132
5133 ep->secid = conn_sid;
5134 ep->peer_secid = peer_sid;
5135
5136 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5137 return selinux_netlbl_sctp_assoc_request(ep, skb);
5138}
5139
5140/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5141 * based on their @optname.
5142 */
5143static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5144 struct sockaddr *address,
5145 int addrlen)
5146{
5147 int len, err = 0, walk_size = 0;
5148 void *addr_buf;
5149 struct sockaddr *addr;
5150 struct socket *sock;
5151
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005152 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005153 return 0;
5154
5155 /* Process one or more addresses that may be IPv4 or IPv6 */
5156 sock = sk->sk_socket;
5157 addr_buf = address;
5158
5159 while (walk_size < addrlen) {
5160 addr = addr_buf;
5161 switch (addr->sa_family) {
5162 case AF_INET:
5163 len = sizeof(struct sockaddr_in);
5164 break;
5165 case AF_INET6:
5166 len = sizeof(struct sockaddr_in6);
5167 break;
5168 default:
5169 return -EAFNOSUPPORT;
5170 }
5171
5172 err = -EINVAL;
5173 switch (optname) {
5174 /* Bind checks */
5175 case SCTP_PRIMARY_ADDR:
5176 case SCTP_SET_PEER_PRIMARY_ADDR:
5177 case SCTP_SOCKOPT_BINDX_ADD:
5178 err = selinux_socket_bind(sock, addr, len);
5179 break;
5180 /* Connect checks */
5181 case SCTP_SOCKOPT_CONNECTX:
5182 case SCTP_PARAM_SET_PRIMARY:
5183 case SCTP_PARAM_ADD_IP:
5184 case SCTP_SENDMSG_CONNECT:
5185 err = selinux_socket_connect_helper(sock, addr, len);
5186 if (err)
5187 return err;
5188
5189 /* As selinux_sctp_bind_connect() is called by the
5190 * SCTP protocol layer, the socket is already locked,
5191 * therefore selinux_netlbl_socket_connect_locked() is
5192 * is called here. The situations handled are:
5193 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5194 * whenever a new IP address is added or when a new
5195 * primary address is selected.
5196 * Note that an SCTP connect(2) call happens before
5197 * the SCTP protocol layer and is handled via
5198 * selinux_socket_connect().
5199 */
5200 err = selinux_netlbl_socket_connect_locked(sk, addr);
5201 break;
5202 }
5203
5204 if (err)
5205 return err;
5206
5207 addr_buf += len;
5208 walk_size += len;
5209 }
5210
5211 return 0;
5212}
5213
5214/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5215static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5216 struct sock *newsk)
5217{
5218 struct sk_security_struct *sksec = sk->sk_security;
5219 struct sk_security_struct *newsksec = newsk->sk_security;
5220
5221 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5222 * the non-sctp clone version.
5223 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005224 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005225 return selinux_sk_clone_security(sk, newsk);
5226
5227 newsksec->sid = ep->secid;
5228 newsksec->peer_sid = ep->peer_secid;
5229 newsksec->sclass = sksec->sclass;
5230 selinux_netlbl_sctp_sk_clone(sk, newsk);
5231}
5232
Adrian Bunk9a673e52006-08-15 00:03:53 -07005233static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5234 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005235{
5236 struct sk_security_struct *sksec = sk->sk_security;
5237 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005238 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005239 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005240 u32 peersid;
5241
Paul Mooreaa862902008-10-10 10:16:29 -04005242 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005243 if (err)
5244 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005245 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5246 if (err)
5247 return err;
5248 req->secid = connsid;
5249 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005250
Paul Moore389fb8002009-03-27 17:10:34 -04005251 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005252}
5253
Adrian Bunk9a673e52006-08-15 00:03:53 -07005254static void selinux_inet_csk_clone(struct sock *newsk,
5255 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005256{
5257 struct sk_security_struct *newsksec = newsk->sk_security;
5258
5259 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005260 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005261 /* NOTE: Ideally, we should also get the isec->sid for the
5262 new socket in sync, but we don't have the isec available yet.
5263 So we will wait until sock_graft to do it, by which
5264 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005265
Paul Moore9f2ad662006-11-17 17:38:53 -05005266 /* We don't need to take any sort of lock here as we are the only
5267 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005268 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005269}
5270
Paul Moore014ab192008-10-10 10:16:33 -04005271static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005272{
Paul Mooreaa862902008-10-10 10:16:29 -04005273 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005274 struct sk_security_struct *sksec = sk->sk_security;
5275
Paul Mooreaa862902008-10-10 10:16:29 -04005276 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5277 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5278 family = PF_INET;
5279
5280 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005281}
5282
Eric Paris2606fd12010-10-13 16:24:41 -04005283static int selinux_secmark_relabel_packet(u32 sid)
5284{
5285 const struct task_security_struct *__tsec;
5286 u32 tsid;
5287
5288 __tsec = current_security();
5289 tsid = __tsec->sid;
5290
5291 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
5292}
5293
5294static void selinux_secmark_refcount_inc(void)
5295{
5296 atomic_inc(&selinux_secmark_refcount);
5297}
5298
5299static void selinux_secmark_refcount_dec(void)
5300{
5301 atomic_dec(&selinux_secmark_refcount);
5302}
5303
Adrian Bunk9a673e52006-08-15 00:03:53 -07005304static void selinux_req_classify_flow(const struct request_sock *req,
5305 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005306{
David S. Miller1d28f422011-03-12 00:29:39 -05005307 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005308}
5309
Paul Moore5dbbaf22013-01-14 07:12:19 +00005310static int selinux_tun_dev_alloc_security(void **security)
5311{
5312 struct tun_security_struct *tunsec;
5313
5314 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5315 if (!tunsec)
5316 return -ENOMEM;
5317 tunsec->sid = current_sid();
5318
5319 *security = tunsec;
5320 return 0;
5321}
5322
5323static void selinux_tun_dev_free_security(void *security)
5324{
5325 kfree(security);
5326}
5327
Paul Mooreed6d76e2009-08-28 18:12:49 -04005328static int selinux_tun_dev_create(void)
5329{
5330 u32 sid = current_sid();
5331
5332 /* we aren't taking into account the "sockcreate" SID since the socket
5333 * that is being created here is not a socket in the traditional sense,
5334 * instead it is a private sock, accessible only to the kernel, and
5335 * representing a wide range of network traffic spanning multiple
5336 * connections unlike traditional sockets - check the TUN driver to
5337 * get a better understanding of why this socket is special */
5338
5339 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5340 NULL);
5341}
5342
Paul Moore5dbbaf22013-01-14 07:12:19 +00005343static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005344{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005345 struct tun_security_struct *tunsec = security;
5346
5347 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5348 TUN_SOCKET__ATTACH_QUEUE, NULL);
5349}
5350
5351static int selinux_tun_dev_attach(struct sock *sk, void *security)
5352{
5353 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005354 struct sk_security_struct *sksec = sk->sk_security;
5355
5356 /* we don't currently perform any NetLabel based labeling here and it
5357 * isn't clear that we would want to do so anyway; while we could apply
5358 * labeling without the support of the TUN user the resulting labeled
5359 * traffic from the other end of the connection would almost certainly
5360 * cause confusion to the TUN user that had no idea network labeling
5361 * protocols were being used */
5362
Paul Moore5dbbaf22013-01-14 07:12:19 +00005363 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005364 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005365
5366 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005367}
5368
Paul Moore5dbbaf22013-01-14 07:12:19 +00005369static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005370{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005371 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005372 u32 sid = current_sid();
5373 int err;
5374
Paul Moore5dbbaf22013-01-14 07:12:19 +00005375 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005376 TUN_SOCKET__RELABELFROM, NULL);
5377 if (err)
5378 return err;
5379 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5380 TUN_SOCKET__RELABELTO, NULL);
5381 if (err)
5382 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005383 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005384
5385 return 0;
5386}
5387
Linus Torvalds1da177e2005-04-16 15:20:36 -07005388static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5389{
5390 int err = 0;
5391 u32 perm;
5392 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005393 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005394
Hong zhi guo77954982013-03-27 06:49:35 +00005395 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005396 err = -EINVAL;
5397 goto out;
5398 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005399 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005400
Paul Moore253bfae2010-04-22 14:46:19 -04005401 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005402 if (err) {
5403 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005404 pr_warn_ratelimited("SELinux: unrecognized netlink"
5405 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5406 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005407 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005408 secclass_map[sksec->sclass - 1].name,
5409 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005410 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005411 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005412 err = 0;
5413 }
5414
5415 /* Ignore */
5416 if (err == -ENOENT)
5417 err = 0;
5418 goto out;
5419 }
5420
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005421 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005422out:
5423 return err;
5424}
5425
5426#ifdef CONFIG_NETFILTER
5427
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005428static unsigned int selinux_ip_forward(struct sk_buff *skb,
5429 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005430 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005431{
Paul Mooredfaebe92008-10-10 10:16:31 -04005432 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005433 char *addrp;
5434 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005435 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005436 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005437 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005438 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005439 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005440
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005441 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005442 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005443
Paul Mooreeffad8d2008-01-29 08:49:27 -05005444 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005445 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005446 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005447 if (!secmark_active && !peerlbl_active)
5448 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005449
Paul Moored8395c82008-10-10 10:16:30 -04005450 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5451 return NF_DROP;
5452
Eric Paris50c205f2012-04-04 15:01:43 -04005453 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005454 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005455 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005456 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005457 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5458 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005459
Paul Mooredfaebe92008-10-10 10:16:31 -04005460 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005461 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5462 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005463 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005464 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005465 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005466 }
5467 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005468
5469 if (secmark_active)
5470 if (avc_has_perm(peer_sid, skb->secmark,
5471 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5472 return NF_DROP;
5473
Paul Moore948bf852008-10-10 10:16:32 -04005474 if (netlbl_active)
5475 /* we do this in the FORWARD path and not the POST_ROUTING
5476 * path because we want to make sure we apply the necessary
5477 * labeling before IPsec is applied so we can leverage AH
5478 * protection */
5479 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5480 return NF_DROP;
5481
Paul Mooreeffad8d2008-01-29 08:49:27 -05005482 return NF_ACCEPT;
5483}
5484
Eric W. Biederman06198b32015-09-18 14:33:06 -05005485static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005486 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005487 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005488{
David S. Miller238e54c2015-04-03 20:32:56 -04005489 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005490}
5491
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005492#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005493static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005494 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005495 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005496{
David S. Miller238e54c2015-04-03 20:32:56 -04005497 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005498}
5499#endif /* IPV6 */
5500
Paul Moore948bf852008-10-10 10:16:32 -04005501static unsigned int selinux_ip_output(struct sk_buff *skb,
5502 u16 family)
5503{
Paul Moore47180062013-12-04 16:10:45 -05005504 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005505 u32 sid;
5506
5507 if (!netlbl_enabled())
5508 return NF_ACCEPT;
5509
5510 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5511 * because we want to make sure we apply the necessary labeling
5512 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005513 sk = skb->sk;
5514 if (sk) {
5515 struct sk_security_struct *sksec;
5516
Eric Dumazete446f9d2015-10-08 05:01:55 -07005517 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005518 /* if the socket is the listening state then this
5519 * packet is a SYN-ACK packet which means it needs to
5520 * be labeled based on the connection/request_sock and
5521 * not the parent socket. unfortunately, we can't
5522 * lookup the request_sock yet as it isn't queued on
5523 * the parent socket until after the SYN-ACK is sent.
5524 * the "solution" is to simply pass the packet as-is
5525 * as any IP option based labeling should be copied
5526 * from the initial connection request (in the IP
5527 * layer). it is far from ideal, but until we get a
5528 * security label in the packet itself this is the
5529 * best we can do. */
5530 return NF_ACCEPT;
5531
5532 /* standard practice, label using the parent socket */
5533 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005534 sid = sksec->sid;
5535 } else
5536 sid = SECINITSID_KERNEL;
5537 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5538 return NF_DROP;
5539
5540 return NF_ACCEPT;
5541}
5542
Eric W. Biederman06198b32015-09-18 14:33:06 -05005543static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005544 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005545 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005546{
5547 return selinux_ip_output(skb, PF_INET);
5548}
5549
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005550#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005551static unsigned int selinux_ipv6_output(void *priv,
5552 struct sk_buff *skb,
5553 const struct nf_hook_state *state)
5554{
5555 return selinux_ip_output(skb, PF_INET6);
5556}
5557#endif /* IPV6 */
5558
Paul Mooreeffad8d2008-01-29 08:49:27 -05005559static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5560 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005561 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005562{
Eric Dumazet54abc682015-11-08 10:54:07 -08005563 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005564 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005565 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005566 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005567 char *addrp;
5568 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005569
Paul Mooreeffad8d2008-01-29 08:49:27 -05005570 if (sk == NULL)
5571 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005572 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005573
Eric Paris50c205f2012-04-04 15:01:43 -04005574 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005575 ad.u.net = &net;
5576 ad.u.net->netif = ifindex;
5577 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005578 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5579 return NF_DROP;
5580
Paul Moore58bfbb52009-03-27 17:10:41 -04005581 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005582 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005583 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005584 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005585
Steffen Klassertb9679a72011-02-23 12:55:21 +01005586 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5587 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005588
Paul Mooreeffad8d2008-01-29 08:49:27 -05005589 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005590}
5591
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005592static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5593 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005594 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005595{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005596 u32 secmark_perm;
5597 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005598 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005599 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005600 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005601 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005602 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005603 u8 secmark_active;
5604 u8 peerlbl_active;
5605
Paul Mooreeffad8d2008-01-29 08:49:27 -05005606 /* If any sort of compatibility mode is enabled then handoff processing
5607 * to the selinux_ip_postroute_compat() function to deal with the
5608 * special handling. We do this in an attempt to keep this function
5609 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005610 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005611 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005612
Paul Mooreeffad8d2008-01-29 08:49:27 -05005613 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005614 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005615 if (!secmark_active && !peerlbl_active)
5616 return NF_ACCEPT;
5617
Eric Dumazet54abc682015-11-08 10:54:07 -08005618 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005619
Paul Mooreeffad8d2008-01-29 08:49:27 -05005620#ifdef CONFIG_XFRM
5621 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5622 * packet transformation so allow the packet to pass without any checks
5623 * since we'll have another chance to perform access control checks
5624 * when the packet is on it's final way out.
5625 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005626 * is NULL, in this case go ahead and apply access control.
5627 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5628 * TCP listening state we cannot wait until the XFRM processing
5629 * is done as we will miss out on the SA label if we do;
5630 * unfortunately, this means more work, but it is only once per
5631 * connection. */
5632 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005633 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005634 return NF_ACCEPT;
5635#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005636
Paul Moored8395c82008-10-10 10:16:30 -04005637 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005638 /* Without an associated socket the packet is either coming
5639 * from the kernel or it is being forwarded; check the packet
5640 * to determine which and if the packet is being forwarded
5641 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005642 if (skb->skb_iif) {
5643 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005644 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005645 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005646 } else {
5647 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005648 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005649 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005650 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005651 /* Locally generated packet but the associated socket is in the
5652 * listening state which means this is a SYN-ACK packet. In
5653 * this particular case the correct security label is assigned
5654 * to the connection/request_sock but unfortunately we can't
5655 * query the request_sock as it isn't queued on the parent
5656 * socket until after the SYN-ACK packet is sent; the only
5657 * viable choice is to regenerate the label like we do in
5658 * selinux_inet_conn_request(). See also selinux_ip_output()
5659 * for similar problems. */
5660 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005661 struct sk_security_struct *sksec;
5662
Eric Dumazete446f9d2015-10-08 05:01:55 -07005663 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005664 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5665 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005666 /* At this point, if the returned skb peerlbl is SECSID_NULL
5667 * and the packet has been through at least one XFRM
5668 * transformation then we must be dealing with the "final"
5669 * form of labeled IPsec packet; since we've already applied
5670 * all of our access controls on this packet we can safely
5671 * pass the packet. */
5672 if (skb_sid == SECSID_NULL) {
5673 switch (family) {
5674 case PF_INET:
5675 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5676 return NF_ACCEPT;
5677 break;
5678 case PF_INET6:
5679 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5680 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005681 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005682 default:
5683 return NF_DROP_ERR(-ECONNREFUSED);
5684 }
5685 }
Paul Moore446b8022013-12-04 16:10:51 -05005686 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5687 return NF_DROP;
5688 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005689 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005690 /* Locally generated packet, fetch the security label from the
5691 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005692 struct sk_security_struct *sksec = sk->sk_security;
5693 peer_sid = sksec->sid;
5694 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005695 }
5696
Eric Paris50c205f2012-04-04 15:01:43 -04005697 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005698 ad.u.net = &net;
5699 ad.u.net->netif = ifindex;
5700 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005701 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005702 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005703
Paul Mooreeffad8d2008-01-29 08:49:27 -05005704 if (secmark_active)
5705 if (avc_has_perm(peer_sid, skb->secmark,
5706 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005707 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005708
5709 if (peerlbl_active) {
5710 u32 if_sid;
5711 u32 node_sid;
5712
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005713 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005714 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005715 if (avc_has_perm(peer_sid, if_sid,
5716 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005717 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005718
5719 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005720 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005721 if (avc_has_perm(peer_sid, node_sid,
5722 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005723 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005724 }
5725
5726 return NF_ACCEPT;
5727}
5728
Eric W. Biederman06198b32015-09-18 14:33:06 -05005729static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005730 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005731 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005732{
David S. Miller238e54c2015-04-03 20:32:56 -04005733 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005734}
5735
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005736#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005737static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005738 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005739 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005740{
David S. Miller238e54c2015-04-03 20:32:56 -04005741 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005742}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005743#endif /* IPV6 */
5744
5745#endif /* CONFIG_NETFILTER */
5746
Linus Torvalds1da177e2005-04-16 15:20:36 -07005747static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5748{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005749 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005750}
5751
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005752static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005753 u16 sclass)
5754{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005755 struct ipc_security_struct *isec;
5756
James Morris89d155e2005-10-30 14:59:21 -08005757 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005758 if (!isec)
5759 return -ENOMEM;
5760
Linus Torvalds1da177e2005-04-16 15:20:36 -07005761 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005762 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005763 perm->security = isec;
5764
5765 return 0;
5766}
5767
5768static void ipc_free_security(struct kern_ipc_perm *perm)
5769{
5770 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005771 perm->security = NULL;
5772 kfree(isec);
5773}
5774
5775static int msg_msg_alloc_security(struct msg_msg *msg)
5776{
5777 struct msg_security_struct *msec;
5778
James Morris89d155e2005-10-30 14:59:21 -08005779 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005780 if (!msec)
5781 return -ENOMEM;
5782
Linus Torvalds1da177e2005-04-16 15:20:36 -07005783 msec->sid = SECINITSID_UNLABELED;
5784 msg->security = msec;
5785
5786 return 0;
5787}
5788
5789static void msg_msg_free_security(struct msg_msg *msg)
5790{
5791 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005792
5793 msg->security = NULL;
5794 kfree(msec);
5795}
5796
5797static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005798 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005799{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005800 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005801 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005802 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005803
Linus Torvalds1da177e2005-04-16 15:20:36 -07005804 isec = ipc_perms->security;
5805
Eric Paris50c205f2012-04-04 15:01:43 -04005806 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005807 ad.u.ipc_id = ipc_perms->key;
5808
David Howells275bb412008-11-14 10:39:19 +11005809 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005810}
5811
5812static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5813{
5814 return msg_msg_alloc_security(msg);
5815}
5816
5817static void selinux_msg_msg_free_security(struct msg_msg *msg)
5818{
5819 msg_msg_free_security(msg);
5820}
5821
5822/* message queue security operations */
5823static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5824{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005825 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005826 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005827 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005828 int rc;
5829
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005830 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005831 if (rc)
5832 return rc;
5833
Linus Torvalds1da177e2005-04-16 15:20:36 -07005834 isec = msq->q_perm.security;
5835
Eric Paris50c205f2012-04-04 15:01:43 -04005836 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005837 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005838
David Howells275bb412008-11-14 10:39:19 +11005839 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005840 MSGQ__CREATE, &ad);
5841 if (rc) {
5842 ipc_free_security(&msq->q_perm);
5843 return rc;
5844 }
5845 return 0;
5846}
5847
5848static void selinux_msg_queue_free_security(struct msg_queue *msq)
5849{
5850 ipc_free_security(&msq->q_perm);
5851}
5852
5853static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5854{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005855 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005856 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005857 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005858
Linus Torvalds1da177e2005-04-16 15:20:36 -07005859 isec = msq->q_perm.security;
5860
Eric Paris50c205f2012-04-04 15:01:43 -04005861 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005862 ad.u.ipc_id = msq->q_perm.key;
5863
David Howells275bb412008-11-14 10:39:19 +11005864 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005865 MSGQ__ASSOCIATE, &ad);
5866}
5867
5868static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5869{
5870 int err;
5871 int perms;
5872
Eric Paris828dfe12008-04-17 13:17:49 -04005873 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005874 case IPC_INFO:
5875 case MSG_INFO:
5876 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005877 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5878 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005879 case IPC_STAT:
5880 case MSG_STAT:
5881 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5882 break;
5883 case IPC_SET:
5884 perms = MSGQ__SETATTR;
5885 break;
5886 case IPC_RMID:
5887 perms = MSGQ__DESTROY;
5888 break;
5889 default:
5890 return 0;
5891 }
5892
Stephen Smalley6af963f2005-05-01 08:58:39 -07005893 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005894 return err;
5895}
5896
5897static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5898{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005899 struct ipc_security_struct *isec;
5900 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005901 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005902 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005903 int rc;
5904
Linus Torvalds1da177e2005-04-16 15:20:36 -07005905 isec = msq->q_perm.security;
5906 msec = msg->security;
5907
5908 /*
5909 * First time through, need to assign label to the message
5910 */
5911 if (msec->sid == SECINITSID_UNLABELED) {
5912 /*
5913 * Compute new sid based on current process and
5914 * message queue this message will be stored in
5915 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005916 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5917 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005918 if (rc)
5919 return rc;
5920 }
5921
Eric Paris50c205f2012-04-04 15:01:43 -04005922 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005923 ad.u.ipc_id = msq->q_perm.key;
5924
5925 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11005926 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005927 MSGQ__WRITE, &ad);
5928 if (!rc)
5929 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11005930 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5931 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005932 if (!rc)
5933 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11005934 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5935 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005936
5937 return rc;
5938}
5939
5940static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5941 struct task_struct *target,
5942 long type, int mode)
5943{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005944 struct ipc_security_struct *isec;
5945 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005946 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005947 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005948 int rc;
5949
Linus Torvalds1da177e2005-04-16 15:20:36 -07005950 isec = msq->q_perm.security;
5951 msec = msg->security;
5952
Eric Paris50c205f2012-04-04 15:01:43 -04005953 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005954 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005955
David Howells275bb412008-11-14 10:39:19 +11005956 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005957 SECCLASS_MSGQ, MSGQ__READ, &ad);
5958 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11005959 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005960 SECCLASS_MSG, MSG__RECEIVE, &ad);
5961 return rc;
5962}
5963
5964/* Shared Memory security operations */
5965static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5966{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005967 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005968 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005969 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005970 int rc;
5971
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005972 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005973 if (rc)
5974 return rc;
5975
Linus Torvalds1da177e2005-04-16 15:20:36 -07005976 isec = shp->shm_perm.security;
5977
Eric Paris50c205f2012-04-04 15:01:43 -04005978 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005979 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005980
David Howells275bb412008-11-14 10:39:19 +11005981 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005982 SHM__CREATE, &ad);
5983 if (rc) {
5984 ipc_free_security(&shp->shm_perm);
5985 return rc;
5986 }
5987 return 0;
5988}
5989
5990static void selinux_shm_free_security(struct shmid_kernel *shp)
5991{
5992 ipc_free_security(&shp->shm_perm);
5993}
5994
5995static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5996{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005997 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005998 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005999 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006000
Linus Torvalds1da177e2005-04-16 15:20:36 -07006001 isec = shp->shm_perm.security;
6002
Eric Paris50c205f2012-04-04 15:01:43 -04006003 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006004 ad.u.ipc_id = shp->shm_perm.key;
6005
David Howells275bb412008-11-14 10:39:19 +11006006 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006007 SHM__ASSOCIATE, &ad);
6008}
6009
6010/* Note, at this point, shp is locked down */
6011static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
6012{
6013 int perms;
6014 int err;
6015
Eric Paris828dfe12008-04-17 13:17:49 -04006016 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006017 case IPC_INFO:
6018 case SHM_INFO:
6019 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006020 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6021 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006022 case IPC_STAT:
6023 case SHM_STAT:
6024 perms = SHM__GETATTR | SHM__ASSOCIATE;
6025 break;
6026 case IPC_SET:
6027 perms = SHM__SETATTR;
6028 break;
6029 case SHM_LOCK:
6030 case SHM_UNLOCK:
6031 perms = SHM__LOCK;
6032 break;
6033 case IPC_RMID:
6034 perms = SHM__DESTROY;
6035 break;
6036 default:
6037 return 0;
6038 }
6039
Stephen Smalley6af963f2005-05-01 08:58:39 -07006040 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006041 return err;
6042}
6043
6044static int selinux_shm_shmat(struct shmid_kernel *shp,
6045 char __user *shmaddr, int shmflg)
6046{
6047 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006048
6049 if (shmflg & SHM_RDONLY)
6050 perms = SHM__READ;
6051 else
6052 perms = SHM__READ | SHM__WRITE;
6053
Stephen Smalley6af963f2005-05-01 08:58:39 -07006054 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006055}
6056
6057/* Semaphore security operations */
6058static int selinux_sem_alloc_security(struct sem_array *sma)
6059{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006060 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006061 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006062 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006063 int rc;
6064
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006065 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006066 if (rc)
6067 return rc;
6068
Linus Torvalds1da177e2005-04-16 15:20:36 -07006069 isec = sma->sem_perm.security;
6070
Eric Paris50c205f2012-04-04 15:01:43 -04006071 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04006072 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006073
David Howells275bb412008-11-14 10:39:19 +11006074 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006075 SEM__CREATE, &ad);
6076 if (rc) {
6077 ipc_free_security(&sma->sem_perm);
6078 return rc;
6079 }
6080 return 0;
6081}
6082
6083static void selinux_sem_free_security(struct sem_array *sma)
6084{
6085 ipc_free_security(&sma->sem_perm);
6086}
6087
6088static int selinux_sem_associate(struct sem_array *sma, int semflg)
6089{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006090 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006091 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006092 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006093
Linus Torvalds1da177e2005-04-16 15:20:36 -07006094 isec = sma->sem_perm.security;
6095
Eric Paris50c205f2012-04-04 15:01:43 -04006096 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006097 ad.u.ipc_id = sma->sem_perm.key;
6098
David Howells275bb412008-11-14 10:39:19 +11006099 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006100 SEM__ASSOCIATE, &ad);
6101}
6102
6103/* Note, at this point, sma is locked down */
6104static int selinux_sem_semctl(struct sem_array *sma, int cmd)
6105{
6106 int err;
6107 u32 perms;
6108
Eric Paris828dfe12008-04-17 13:17:49 -04006109 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006110 case IPC_INFO:
6111 case SEM_INFO:
6112 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006113 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6114 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006115 case GETPID:
6116 case GETNCNT:
6117 case GETZCNT:
6118 perms = SEM__GETATTR;
6119 break;
6120 case GETVAL:
6121 case GETALL:
6122 perms = SEM__READ;
6123 break;
6124 case SETVAL:
6125 case SETALL:
6126 perms = SEM__WRITE;
6127 break;
6128 case IPC_RMID:
6129 perms = SEM__DESTROY;
6130 break;
6131 case IPC_SET:
6132 perms = SEM__SETATTR;
6133 break;
6134 case IPC_STAT:
6135 case SEM_STAT:
6136 perms = SEM__GETATTR | SEM__ASSOCIATE;
6137 break;
6138 default:
6139 return 0;
6140 }
6141
Stephen Smalley6af963f2005-05-01 08:58:39 -07006142 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006143 return err;
6144}
6145
6146static int selinux_sem_semop(struct sem_array *sma,
6147 struct sembuf *sops, unsigned nsops, int alter)
6148{
6149 u32 perms;
6150
6151 if (alter)
6152 perms = SEM__READ | SEM__WRITE;
6153 else
6154 perms = SEM__READ;
6155
Stephen Smalley6af963f2005-05-01 08:58:39 -07006156 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006157}
6158
6159static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6160{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006161 u32 av = 0;
6162
Linus Torvalds1da177e2005-04-16 15:20:36 -07006163 av = 0;
6164 if (flag & S_IRUGO)
6165 av |= IPC__UNIX_READ;
6166 if (flag & S_IWUGO)
6167 av |= IPC__UNIX_WRITE;
6168
6169 if (av == 0)
6170 return 0;
6171
Stephen Smalley6af963f2005-05-01 08:58:39 -07006172 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006173}
6174
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006175static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6176{
6177 struct ipc_security_struct *isec = ipcp->security;
6178 *secid = isec->sid;
6179}
6180
Eric Paris828dfe12008-04-17 13:17:49 -04006181static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006182{
6183 if (inode)
6184 inode_doinit_with_dentry(inode, dentry);
6185}
6186
6187static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006188 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006189{
David Howells275bb412008-11-14 10:39:19 +11006190 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006191 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006192 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006193 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006194
David Howells275bb412008-11-14 10:39:19 +11006195 rcu_read_lock();
6196 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006197
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006198 if (current != p) {
6199 error = avc_has_perm(current_sid(), __tsec->sid,
6200 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6201 if (error)
6202 goto bad;
6203 }
6204
Linus Torvalds1da177e2005-04-16 15:20:36 -07006205 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006206 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006207 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006208 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006209 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006210 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006211 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006212 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006213 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006214 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006215 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006216 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006217 else {
6218 error = -EINVAL;
6219 goto bad;
6220 }
David Howells275bb412008-11-14 10:39:19 +11006221 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006222
6223 if (!sid)
6224 return 0;
6225
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006226 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006227 if (error)
6228 return error;
6229 return len;
David Howells275bb412008-11-14 10:39:19 +11006230
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006231bad:
David Howells275bb412008-11-14 10:39:19 +11006232 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006233 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006234}
6235
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006236static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006237{
6238 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006239 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006240 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006241 int error;
6242 char *str = value;
6243
Linus Torvalds1da177e2005-04-16 15:20:36 -07006244 /*
6245 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006246 */
6247 if (!strcmp(name, "exec"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006248 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6249 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006250 else if (!strcmp(name, "fscreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006251 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6252 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006253 else if (!strcmp(name, "keycreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006254 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6255 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006256 else if (!strcmp(name, "sockcreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006257 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6258 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006259 else if (!strcmp(name, "current"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006260 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6261 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006262 else
6263 error = -EINVAL;
6264 if (error)
6265 return error;
6266
6267 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006268 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006269 if (str[size-1] == '\n') {
6270 str[size-1] = 0;
6271 size--;
6272 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006273 error = security_context_to_sid(&selinux_state, value, size,
6274 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006275 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006276 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006277 struct audit_buffer *ab;
6278 size_t audit_size;
6279
6280 /* We strip a nul only if it is at the end, otherwise the
6281 * context contains a nul and we should audit that */
6282 if (str[size - 1] == '\0')
6283 audit_size = size - 1;
6284 else
6285 audit_size = size;
6286 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
6287 audit_log_format(ab, "op=fscreate invalid_context=");
6288 audit_log_n_untrustedstring(ab, value, audit_size);
6289 audit_log_end(ab);
6290
Stephen Smalley12b29f32008-05-07 13:03:20 -04006291 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006292 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006293 error = security_context_to_sid_force(
6294 &selinux_state,
6295 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006296 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006297 if (error)
6298 return error;
6299 }
6300
David Howellsd84f4f92008-11-14 10:39:23 +11006301 new = prepare_creds();
6302 if (!new)
6303 return -ENOMEM;
6304
Linus Torvalds1da177e2005-04-16 15:20:36 -07006305 /* Permission checking based on the specified context is
6306 performed during the actual operation (execve,
6307 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006308 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006309 checks and may_create for the file creation checks. The
6310 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006311 tsec = new->security;
6312 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006313 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006314 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006315 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006316 } else if (!strcmp(name, "keycreate")) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006317 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
6318 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006319 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006320 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006321 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006322 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006323 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006324 } else if (!strcmp(name, "current")) {
6325 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006326 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006327 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006328
David Howellsd84f4f92008-11-14 10:39:23 +11006329 /* Only allow single threaded processes to change context */
6330 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006331 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006332 error = security_bounded_transition(&selinux_state,
6333 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006334 if (error)
6335 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006336 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006337
6338 /* Check permissions for the transition. */
6339 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006340 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006341 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006342 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006343
6344 /* Check for ptracing, and update the task SID if ok.
6345 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006346 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006347 if (ptsid != 0) {
David Howellsd84f4f92008-11-14 10:39:23 +11006348 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6349 PROCESS__PTRACE, NULL);
6350 if (error)
6351 goto abort_change;
6352 }
6353
6354 tsec->sid = sid;
6355 } else {
6356 error = -EINVAL;
6357 goto abort_change;
6358 }
6359
6360 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006361 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006362
6363abort_change:
6364 abort_creds(new);
6365 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006366}
6367
David Quigley746df9b2013-05-22 12:50:35 -04006368static int selinux_ismaclabel(const char *name)
6369{
6370 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6371}
6372
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006373static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6374{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006375 return security_sid_to_context(&selinux_state, secid,
6376 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006377}
6378
David Howells7bf570d2008-04-29 20:52:51 +01006379static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006380{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006381 return security_context_to_sid(&selinux_state, secdata, seclen,
6382 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006383}
6384
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006385static void selinux_release_secctx(char *secdata, u32 seclen)
6386{
Paul Moore088999e2007-08-01 11:12:58 -04006387 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006388}
6389
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006390static void selinux_inode_invalidate_secctx(struct inode *inode)
6391{
6392 struct inode_security_struct *isec = inode->i_security;
6393
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006394 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006395 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006396 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006397}
6398
David P. Quigley1ee65e32009-09-03 14:25:57 -04006399/*
6400 * called with inode->i_mutex locked
6401 */
6402static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6403{
6404 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6405}
6406
6407/*
6408 * called with inode->i_mutex locked
6409 */
6410static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6411{
6412 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6413}
6414
6415static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6416{
6417 int len = 0;
6418 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6419 ctx, true);
6420 if (len < 0)
6421 return len;
6422 *ctxlen = len;
6423 return 0;
6424}
Michael LeMayd7200242006-06-22 14:47:17 -07006425#ifdef CONFIG_KEYS
6426
David Howellsd84f4f92008-11-14 10:39:23 +11006427static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006428 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006429{
David Howellsd84f4f92008-11-14 10:39:23 +11006430 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006431 struct key_security_struct *ksec;
6432
6433 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6434 if (!ksec)
6435 return -ENOMEM;
6436
David Howellsd84f4f92008-11-14 10:39:23 +11006437 tsec = cred->security;
6438 if (tsec->keycreate_sid)
6439 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006440 else
David Howellsd84f4f92008-11-14 10:39:23 +11006441 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006442
David Howells275bb412008-11-14 10:39:19 +11006443 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006444 return 0;
6445}
6446
6447static void selinux_key_free(struct key *k)
6448{
6449 struct key_security_struct *ksec = k->security;
6450
6451 k->security = NULL;
6452 kfree(ksec);
6453}
6454
6455static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006456 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006457 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006458{
6459 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006460 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006461 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006462
6463 /* if no specific permissions are requested, we skip the
6464 permission check. No serious, additional covert channels
6465 appear to be created. */
6466 if (perm == 0)
6467 return 0;
6468
David Howellsd84f4f92008-11-14 10:39:23 +11006469 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006470
6471 key = key_ref_to_ptr(key_ref);
6472 ksec = key->security;
6473
6474 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006475}
6476
David Howells70a5bb72008-04-29 01:01:26 -07006477static int selinux_key_getsecurity(struct key *key, char **_buffer)
6478{
6479 struct key_security_struct *ksec = key->security;
6480 char *context = NULL;
6481 unsigned len;
6482 int rc;
6483
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006484 rc = security_sid_to_context(&selinux_state, ksec->sid,
6485 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006486 if (!rc)
6487 rc = len;
6488 *_buffer = context;
6489 return rc;
6490}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006491#endif
David Howells70a5bb72008-04-29 01:01:26 -07006492
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006493#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006494static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6495{
6496 struct common_audit_data ad;
6497 int err;
6498 u32 sid = 0;
6499 struct ib_security_struct *sec = ib_sec;
6500 struct lsm_ibpkey_audit ibpkey;
6501
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006502 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006503 if (err)
6504 return err;
6505
6506 ad.type = LSM_AUDIT_DATA_IBPKEY;
6507 ibpkey.subnet_prefix = subnet_prefix;
6508 ibpkey.pkey = pkey_val;
6509 ad.u.ibpkey = &ibpkey;
6510 return avc_has_perm(sec->sid, sid,
6511 SECCLASS_INFINIBAND_PKEY,
6512 INFINIBAND_PKEY__ACCESS, &ad);
6513}
6514
Daniel Jurgensab861df2017-05-19 15:48:58 +03006515static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6516 u8 port_num)
6517{
6518 struct common_audit_data ad;
6519 int err;
6520 u32 sid = 0;
6521 struct ib_security_struct *sec = ib_sec;
6522 struct lsm_ibendport_audit ibendport;
6523
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006524 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6525 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006526
6527 if (err)
6528 return err;
6529
6530 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6531 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6532 ibendport.port = port_num;
6533 ad.u.ibendport = &ibendport;
6534 return avc_has_perm(sec->sid, sid,
6535 SECCLASS_INFINIBAND_ENDPORT,
6536 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6537}
6538
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006539static int selinux_ib_alloc_security(void **ib_sec)
6540{
6541 struct ib_security_struct *sec;
6542
6543 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6544 if (!sec)
6545 return -ENOMEM;
6546 sec->sid = current_sid();
6547
6548 *ib_sec = sec;
6549 return 0;
6550}
6551
6552static void selinux_ib_free_security(void *ib_sec)
6553{
6554 kfree(ib_sec);
6555}
Michael LeMayd7200242006-06-22 14:47:17 -07006556#endif
6557
Chenbo Fengec27c352017-10-18 13:00:25 -07006558#ifdef CONFIG_BPF_SYSCALL
6559static int selinux_bpf(int cmd, union bpf_attr *attr,
6560 unsigned int size)
6561{
6562 u32 sid = current_sid();
6563 int ret;
6564
6565 switch (cmd) {
6566 case BPF_MAP_CREATE:
6567 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6568 NULL);
6569 break;
6570 case BPF_PROG_LOAD:
6571 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6572 NULL);
6573 break;
6574 default:
6575 ret = 0;
6576 break;
6577 }
6578
6579 return ret;
6580}
6581
6582static u32 bpf_map_fmode_to_av(fmode_t fmode)
6583{
6584 u32 av = 0;
6585
6586 if (fmode & FMODE_READ)
6587 av |= BPF__MAP_READ;
6588 if (fmode & FMODE_WRITE)
6589 av |= BPF__MAP_WRITE;
6590 return av;
6591}
6592
Chenbo Fengf66e4482017-10-18 13:00:26 -07006593/* This function will check the file pass through unix socket or binder to see
6594 * if it is a bpf related object. And apply correspinding checks on the bpf
6595 * object based on the type. The bpf maps and programs, not like other files and
6596 * socket, are using a shared anonymous inode inside the kernel as their inode.
6597 * So checking that inode cannot identify if the process have privilege to
6598 * access the bpf object and that's why we have to add this additional check in
6599 * selinux_file_receive and selinux_binder_transfer_files.
6600 */
6601static int bpf_fd_pass(struct file *file, u32 sid)
6602{
6603 struct bpf_security_struct *bpfsec;
6604 struct bpf_prog *prog;
6605 struct bpf_map *map;
6606 int ret;
6607
6608 if (file->f_op == &bpf_map_fops) {
6609 map = file->private_data;
6610 bpfsec = map->security;
6611 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6612 bpf_map_fmode_to_av(file->f_mode), NULL);
6613 if (ret)
6614 return ret;
6615 } else if (file->f_op == &bpf_prog_fops) {
6616 prog = file->private_data;
6617 bpfsec = prog->aux->security;
6618 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6619 BPF__PROG_RUN, NULL);
6620 if (ret)
6621 return ret;
6622 }
6623 return 0;
6624}
6625
Chenbo Fengec27c352017-10-18 13:00:25 -07006626static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6627{
6628 u32 sid = current_sid();
6629 struct bpf_security_struct *bpfsec;
6630
6631 bpfsec = map->security;
6632 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6633 bpf_map_fmode_to_av(fmode), NULL);
6634}
6635
6636static int selinux_bpf_prog(struct bpf_prog *prog)
6637{
6638 u32 sid = current_sid();
6639 struct bpf_security_struct *bpfsec;
6640
6641 bpfsec = prog->aux->security;
6642 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6643 BPF__PROG_RUN, NULL);
6644}
6645
6646static int selinux_bpf_map_alloc(struct bpf_map *map)
6647{
6648 struct bpf_security_struct *bpfsec;
6649
6650 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6651 if (!bpfsec)
6652 return -ENOMEM;
6653
6654 bpfsec->sid = current_sid();
6655 map->security = bpfsec;
6656
6657 return 0;
6658}
6659
6660static void selinux_bpf_map_free(struct bpf_map *map)
6661{
6662 struct bpf_security_struct *bpfsec = map->security;
6663
6664 map->security = NULL;
6665 kfree(bpfsec);
6666}
6667
6668static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6669{
6670 struct bpf_security_struct *bpfsec;
6671
6672 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6673 if (!bpfsec)
6674 return -ENOMEM;
6675
6676 bpfsec->sid = current_sid();
6677 aux->security = bpfsec;
6678
6679 return 0;
6680}
6681
6682static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6683{
6684 struct bpf_security_struct *bpfsec = aux->security;
6685
6686 aux->security = NULL;
6687 kfree(bpfsec);
6688}
6689#endif
6690
James Morrisca97d932017-02-15 00:18:51 +11006691static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006692 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6693 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6694 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6695 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006696
Casey Schauflere20b0432015-05-02 15:11:36 -07006697 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6698 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6699 LSM_HOOK_INIT(capget, selinux_capget),
6700 LSM_HOOK_INIT(capset, selinux_capset),
6701 LSM_HOOK_INIT(capable, selinux_capable),
6702 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6703 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6704 LSM_HOOK_INIT(syslog, selinux_syslog),
6705 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006706
Casey Schauflere20b0432015-05-02 15:11:36 -07006707 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006708
Casey Schauflere20b0432015-05-02 15:11:36 -07006709 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6710 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6711 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006712
Casey Schauflere20b0432015-05-02 15:11:36 -07006713 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6714 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6715 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6716 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6717 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6718 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6719 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6720 LSM_HOOK_INIT(sb_mount, selinux_mount),
6721 LSM_HOOK_INIT(sb_umount, selinux_umount),
6722 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6723 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6724 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006725
Casey Schauflere20b0432015-05-02 15:11:36 -07006726 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006727 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006728
Casey Schauflere20b0432015-05-02 15:11:36 -07006729 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6730 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6731 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6732 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6733 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6734 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6735 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6736 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6737 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6738 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6739 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6740 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6741 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6742 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6743 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6744 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6745 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6746 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6747 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6748 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6749 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6750 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6751 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6752 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6753 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006754 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006755 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006756
Casey Schauflere20b0432015-05-02 15:11:36 -07006757 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6758 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6759 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6760 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6761 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6762 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6763 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6764 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6765 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6766 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6767 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6768 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006769
Casey Schauflere20b0432015-05-02 15:11:36 -07006770 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006771
Tetsuo Handaa79be232017-03-28 23:08:45 +09006772 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006773 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6774 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6775 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6776 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6777 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6778 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6779 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07006780 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006781 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6782 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6783 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6784 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6785 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6786 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6787 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006788 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006789 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6790 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6791 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6792 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6793 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006794 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006795
Casey Schauflere20b0432015-05-02 15:11:36 -07006796 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6797 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006798
Casey Schauflere20b0432015-05-02 15:11:36 -07006799 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6800 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006801
Casey Schauflere20b0432015-05-02 15:11:36 -07006802 LSM_HOOK_INIT(msg_queue_alloc_security,
6803 selinux_msg_queue_alloc_security),
6804 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6805 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6806 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6807 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6808 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006809
Casey Schauflere20b0432015-05-02 15:11:36 -07006810 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6811 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6812 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6813 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6814 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006815
Casey Schauflere20b0432015-05-02 15:11:36 -07006816 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6817 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6818 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6819 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6820 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006821
Casey Schauflere20b0432015-05-02 15:11:36 -07006822 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006823
Casey Schauflere20b0432015-05-02 15:11:36 -07006824 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6825 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006826
Casey Schauflere20b0432015-05-02 15:11:36 -07006827 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6828 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6829 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6830 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006831 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006832 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6833 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6834 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006835
Casey Schauflere20b0432015-05-02 15:11:36 -07006836 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6837 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006838
Casey Schauflere20b0432015-05-02 15:11:36 -07006839 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6840 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6841 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6842 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6843 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6844 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6845 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6846 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6847 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6848 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6849 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6850 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6851 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6852 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6853 LSM_HOOK_INIT(socket_getpeersec_stream,
6854 selinux_socket_getpeersec_stream),
6855 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6856 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6857 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6858 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6859 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6860 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00006861 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6862 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6863 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07006864 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6865 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6866 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6867 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6868 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6869 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6870 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6871 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6872 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6873 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6874 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6875 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6876 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006877#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006878 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03006879 LSM_HOOK_INIT(ib_endport_manage_subnet,
6880 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006881 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6882 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6883#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08006884#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07006885 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6886 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6887 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6888 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6889 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6890 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6891 selinux_xfrm_state_alloc_acquire),
6892 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6893 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6894 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6895 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6896 selinux_xfrm_state_pol_flow_match),
6897 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006898#endif
Michael LeMayd7200242006-06-22 14:47:17 -07006899
6900#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07006901 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6902 LSM_HOOK_INIT(key_free, selinux_key_free),
6903 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6904 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07006905#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006906
6907#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07006908 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6909 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6910 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6911 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006912#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07006913
6914#ifdef CONFIG_BPF_SYSCALL
6915 LSM_HOOK_INIT(bpf, selinux_bpf),
6916 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6917 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6918 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6919 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6920 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6921 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6922#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07006923};
6924
6925static __init int selinux_init(void)
6926{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006927 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006928 selinux_enabled = 0;
6929 return 0;
6930 }
6931
Linus Torvalds1da177e2005-04-16 15:20:36 -07006932 if (!selinux_enabled) {
6933 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6934 return 0;
6935 }
6936
6937 printk(KERN_INFO "SELinux: Initializing.\n");
6938
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006939 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05006940 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006941 selinux_state.checkreqprot = selinux_checkreqprot_boot;
6942 selinux_ss_init(&selinux_state.ss);
6943
Linus Torvalds1da177e2005-04-16 15:20:36 -07006944 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11006945 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006946
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04006947 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6948
James Morris7cae7e22006-03-22 00:09:22 -08006949 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6950 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09006951 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04006952 file_security_cache = kmem_cache_create("selinux_file_security",
6953 sizeof(struct file_security_struct),
6954 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006955 avc_init();
6956
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006957 avtab_cache_init();
6958
6959 ebitmap_cache_init();
6960
6961 hashtab_cache_init();
6962
Casey Schauflerd69dece2017-01-18 17:09:05 -08006963 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006964
Paul Moore615e51f2014-06-26 14:33:56 -04006965 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6966 panic("SELinux: Unable to register AVC netcache callback\n");
6967
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03006968 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6969 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6970
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006971 if (selinux_enforcing_boot)
Eric Parisfadcdb42007-02-22 18:11:31 -05006972 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04006973 else
Eric Parisfadcdb42007-02-22 18:11:31 -05006974 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07006975
Linus Torvalds1da177e2005-04-16 15:20:36 -07006976 return 0;
6977}
6978
Al Viroe8c26252010-03-23 06:36:54 -04006979static void delayed_superblock_init(struct super_block *sb, void *unused)
6980{
6981 superblock_doinit(sb, NULL);
6982}
6983
Linus Torvalds1da177e2005-04-16 15:20:36 -07006984void selinux_complete_init(void)
6985{
Eric Parisfadcdb42007-02-22 18:11:31 -05006986 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006987
6988 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05006989 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04006990 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006991}
6992
6993/* SELinux requires early initialization in order to label
6994 all processes and objects when they are created. */
6995security_initcall(selinux_init);
6996
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006997#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006998
Florian Westphal591bb272017-07-26 11:40:52 +02006999static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007000 {
7001 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007002 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007003 .hooknum = NF_INET_POST_ROUTING,
7004 .priority = NF_IP_PRI_SELINUX_LAST,
7005 },
7006 {
7007 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007008 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007009 .hooknum = NF_INET_FORWARD,
7010 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007011 },
7012 {
7013 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007014 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007015 .hooknum = NF_INET_LOCAL_OUT,
7016 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007017 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007018#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007019 {
7020 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007021 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007022 .hooknum = NF_INET_POST_ROUTING,
7023 .priority = NF_IP6_PRI_SELINUX_LAST,
7024 },
7025 {
7026 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007027 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007028 .hooknum = NF_INET_FORWARD,
7029 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007030 },
Huw Davies2917f572016-06-27 15:06:15 -04007031 {
7032 .hook = selinux_ipv6_output,
7033 .pf = NFPROTO_IPV6,
7034 .hooknum = NF_INET_LOCAL_OUT,
7035 .priority = NF_IP6_PRI_SELINUX_FIRST,
7036 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007037#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007038};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007039
Florian Westphal8e71bf72017-04-21 11:49:09 +02007040static int __net_init selinux_nf_register(struct net *net)
7041{
7042 return nf_register_net_hooks(net, selinux_nf_ops,
7043 ARRAY_SIZE(selinux_nf_ops));
7044}
7045
7046static void __net_exit selinux_nf_unregister(struct net *net)
7047{
7048 nf_unregister_net_hooks(net, selinux_nf_ops,
7049 ARRAY_SIZE(selinux_nf_ops));
7050}
7051
7052static struct pernet_operations selinux_net_ops = {
7053 .init = selinux_nf_register,
7054 .exit = selinux_nf_unregister,
7055};
7056
Linus Torvalds1da177e2005-04-16 15:20:36 -07007057static int __init selinux_nf_ip_init(void)
7058{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007059 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007060
7061 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007062 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007063
7064 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
7065
Florian Westphal8e71bf72017-04-21 11:49:09 +02007066 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007067 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007068 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007069
Jiri Pirko25db6be2014-09-03 17:42:13 +02007070 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007071}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007072__initcall(selinux_nf_ip_init);
7073
7074#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7075static void selinux_nf_ip_exit(void)
7076{
Eric Parisfadcdb42007-02-22 18:11:31 -05007077 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007078
Florian Westphal8e71bf72017-04-21 11:49:09 +02007079 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007080}
7081#endif
7082
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007083#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007084
7085#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7086#define selinux_nf_ip_exit()
7087#endif
7088
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007089#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007090
7091#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007092int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007093{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007094 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007095 /* Not permitted after initial policy load. */
7096 return -EINVAL;
7097 }
7098
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007099 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007100 /* Only do this once. */
7101 return -EINVAL;
7102 }
7103
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007104 state->disabled = 1;
7105
Linus Torvalds1da177e2005-04-16 15:20:36 -07007106 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
7107
Stephen Smalley30d55282006-05-03 10:52:36 -04007108 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007109
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007110 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007111
Eric Parisaf8ff042009-09-20 21:23:01 -04007112 /* Try to destroy the avc node cache */
7113 avc_disable();
7114
Linus Torvalds1da177e2005-04-16 15:20:36 -07007115 /* Unregister netfilter hooks. */
7116 selinux_nf_ip_exit();
7117
7118 /* Unregister selinuxfs. */
7119 exit_sel_fs();
7120
7121 return 0;
7122}
7123#endif