blob: b02315183b2f5063eac075b4c00645f407dc2a2d [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070082#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070083#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070084#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080085#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070086#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040087#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000088#include <linux/msg.h>
89#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070090#include <linux/bpf.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070091
92#include "avc.h"
93#include "objsec.h"
94#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050095#include "netnode.h"
Paul Moore3e112172008-04-10 10:48:14 -040096#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030097#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080098#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050099#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200100#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000101#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500103struct selinux_state selinux_state;
104
Paul Moored621d352008-01-29 08:43:36 -0500105/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000106static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500107
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500109static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110
111static int __init enforcing_setup(char *str)
112{
Eric Parisf5269712008-05-14 11:27:45 -0400113 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900114 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500115 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 return 1;
117}
118__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500119#else
120#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121#endif
122
123#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
124int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
125
126static int __init selinux_enabled_setup(char *str)
127{
Eric Parisf5269712008-05-14 11:27:45 -0400128 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900129 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400130 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700131 return 1;
132}
133__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400134#else
135int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136#endif
137
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500138static unsigned int selinux_checkreqprot_boot =
139 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140
141static int __init checkreqprot_setup(char *str)
142{
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(str, 0, &checkreqprot))
146 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
147 return 1;
148}
149__setup("checkreqprot=", checkreqprot_setup);
150
Christoph Lametere18b8902006-12-06 20:33:20 -0800151static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400152static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800153
Paul Moored621d352008-01-29 08:43:36 -0500154/**
155 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
156 *
157 * Description:
158 * This function checks the SECMARK reference counter to see if any SECMARK
159 * targets are currently configured, if the reference counter is greater than
160 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400161 * enabled, false (0) if SECMARK is disabled. If the always_check_network
162 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500163 *
164 */
165static int selinux_secmark_enabled(void)
166{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500167 return (selinux_policycap_alwaysnetwork() ||
168 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400169}
170
171/**
172 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
173 *
174 * Description:
175 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
176 * (1) if any are enabled or false (0) if neither are enabled. If the
177 * always_check_network policy capability is enabled, peer labeling
178 * is always considered enabled.
179 *
180 */
181static int selinux_peerlbl_enabled(void)
182{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500183 return (selinux_policycap_alwaysnetwork() ||
184 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500185}
186
Paul Moore615e51f2014-06-26 14:33:56 -0400187static int selinux_netcache_avc_callback(u32 event)
188{
189 if (event == AVC_CALLBACK_RESET) {
190 sel_netif_flush();
191 sel_netnode_flush();
192 sel_netport_flush();
193 synchronize_net();
194 }
195 return 0;
196}
197
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300198static int selinux_lsm_notifier_avc_callback(u32 event)
199{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300200 if (event == AVC_CALLBACK_RESET) {
201 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300202 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300203 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300204
205 return 0;
206}
207
David Howellsd84f4f92008-11-14 10:39:23 +1100208/*
209 * initialise the security for the init task
210 */
211static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212{
David Howells3b11a1d2008-11-14 10:39:26 +1100213 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700214 struct task_security_struct *tsec;
215
James Morris89d155e2005-10-30 14:59:21 -0800216 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100218 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700219
David Howellsd84f4f92008-11-14 10:39:23 +1100220 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100221 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222}
223
David Howells275bb412008-11-14 10:39:19 +1100224/*
David Howells88e67f32008-11-14 10:39:21 +1100225 * get the security ID of a set of credentials
226 */
227static inline u32 cred_sid(const struct cred *cred)
228{
229 const struct task_security_struct *tsec;
230
231 tsec = cred->security;
232 return tsec->sid;
233}
234
235/*
David Howells3b11a1d2008-11-14 10:39:26 +1100236 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100237 */
238static inline u32 task_sid(const struct task_struct *task)
239{
David Howells275bb412008-11-14 10:39:19 +1100240 u32 sid;
241
242 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100243 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100244 rcu_read_unlock();
245 return sid;
246}
247
David Howells88e67f32008-11-14 10:39:21 +1100248/* Allocate and free functions for each kind of security blob. */
249
Linus Torvalds1da177e2005-04-16 15:20:36 -0700250static int inode_alloc_security(struct inode *inode)
251{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100253 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700254
Josef Bacika02fe132008-04-04 09:35:05 +1100255 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 if (!isec)
257 return -ENOMEM;
258
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100259 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 isec->inode = inode;
262 isec->sid = SECINITSID_UNLABELED;
263 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100264 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100265 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266 inode->i_security = isec;
267
268 return 0;
269}
270
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500271static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
272
273/*
274 * Try reloading inode security labels that have been marked as invalid. The
275 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100276 * allowed; when set to false, returns -ECHILD when the label is
Al Viroe9193282018-04-24 21:31:02 -0400277 * invalid. The @dentry parameter should be set to a dentry of the inode.
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500278 */
279static int __inode_security_revalidate(struct inode *inode,
Al Viroe9193282018-04-24 21:31:02 -0400280 struct dentry *dentry,
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500281 bool may_sleep)
282{
283 struct inode_security_struct *isec = inode->i_security;
284
285 might_sleep_if(may_sleep);
286
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500287 if (selinux_state.initialized &&
288 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500289 if (!may_sleep)
290 return -ECHILD;
291
292 /*
293 * Try reloading the inode security label. This will fail if
294 * @opt_dentry is NULL and no dentry for this inode can be
295 * found; in that case, continue using the old label.
296 */
Al Viroe9193282018-04-24 21:31:02 -0400297 inode_doinit_with_dentry(inode, dentry);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500298 }
299 return 0;
300}
301
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500302static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
303{
304 return inode->i_security;
305}
306
307static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
308{
309 int error;
310
311 error = __inode_security_revalidate(inode, NULL, !rcu);
312 if (error)
313 return ERR_PTR(error);
314 return inode->i_security;
315}
316
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500317/*
318 * Get the security label of an inode.
319 */
320static struct inode_security_struct *inode_security(struct inode *inode)
321{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500322 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500323 return inode->i_security;
324}
325
Paul Moore2c971652016-04-19 16:36:28 -0400326static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
327{
328 struct inode *inode = d_backing_inode(dentry);
329
330 return inode->i_security;
331}
332
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500333/*
334 * Get the security label of a dentry's backing inode.
335 */
336static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
337{
338 struct inode *inode = d_backing_inode(dentry);
339
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500340 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500341 return inode->i_security;
342}
343
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500344static void inode_free_rcu(struct rcu_head *head)
345{
346 struct inode_security_struct *isec;
347
348 isec = container_of(head, struct inode_security_struct, rcu);
349 kmem_cache_free(sel_inode_cache, isec);
350}
351
Linus Torvalds1da177e2005-04-16 15:20:36 -0700352static void inode_free_security(struct inode *inode)
353{
354 struct inode_security_struct *isec = inode->i_security;
355 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
356
Waiman Long9629d042015-07-10 17:19:56 -0400357 /*
358 * As not all inode security structures are in a list, we check for
359 * empty list outside of the lock to make sure that we won't waste
360 * time taking a lock doing nothing.
361 *
362 * The list_del_init() function can be safely called more than once.
363 * It should not be possible for this function to be called with
364 * concurrent list_add(), but for better safety against future changes
365 * in the code, we use list_empty_careful() here.
366 */
367 if (!list_empty_careful(&isec->list)) {
368 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400370 spin_unlock(&sbsec->isec_lock);
371 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700372
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500373 /*
374 * The inode may still be referenced in a path walk and
375 * a call to selinux_inode_permission() can be made
376 * after inode_free_security() is called. Ideally, the VFS
377 * wouldn't do this, but fixing that is a much harder
378 * job. For now, simply free the i_security via RCU, and
379 * leave the current inode->i_security pointer intact.
380 * The inode will be freed after the RCU grace period too.
381 */
382 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700383}
384
385static int file_alloc_security(struct file *file)
386{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700387 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100388 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700389
Sangwoo63205652015-10-21 17:44:30 -0400390 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700391 if (!fsec)
392 return -ENOMEM;
393
David Howells275bb412008-11-14 10:39:19 +1100394 fsec->sid = sid;
395 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700396 file->f_security = fsec;
397
398 return 0;
399}
400
401static void file_free_security(struct file *file)
402{
403 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700404 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400405 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700406}
407
408static int superblock_alloc_security(struct super_block *sb)
409{
410 struct superblock_security_struct *sbsec;
411
James Morris89d155e2005-10-30 14:59:21 -0800412 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700413 if (!sbsec)
414 return -ENOMEM;
415
Eric Parisbc7e9822006-09-25 23:32:02 -0700416 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700417 INIT_LIST_HEAD(&sbsec->isec_head);
418 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700419 sbsec->sb = sb;
420 sbsec->sid = SECINITSID_UNLABELED;
421 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700422 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700423 sb->s_security = sbsec;
424
425 return 0;
426}
427
428static void superblock_free_security(struct super_block *sb)
429{
430 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700431 sb->s_security = NULL;
432 kfree(sbsec);
433}
434
Linus Torvalds1da177e2005-04-16 15:20:36 -0700435static inline int inode_doinit(struct inode *inode)
436{
437 return inode_doinit_with_dentry(inode, NULL);
438}
439
440enum {
Eric Paris31e87932007-09-19 17:19:12 -0400441 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700442 Opt_context = 1,
443 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500444 Opt_defcontext = 3,
445 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500446 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400447 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700448};
449
Eric Parisd355987f2012-08-24 15:58:53 -0400450#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
451
Steven Whitehousea447c092008-10-13 10:46:57 +0100452static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400453 {Opt_context, CONTEXT_STR "%s"},
454 {Opt_fscontext, FSCONTEXT_STR "%s"},
455 {Opt_defcontext, DEFCONTEXT_STR "%s"},
456 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500457 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400458 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700459};
460
461#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
462
Eric Parisc312feb2006-07-10 04:43:53 -0700463static int may_context_mount_sb_relabel(u32 sid,
464 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100465 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700466{
David Howells275bb412008-11-14 10:39:19 +1100467 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700468 int rc;
469
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500470 rc = avc_has_perm(&selinux_state,
471 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700472 FILESYSTEM__RELABELFROM, NULL);
473 if (rc)
474 return rc;
475
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500476 rc = avc_has_perm(&selinux_state,
477 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700478 FILESYSTEM__RELABELTO, NULL);
479 return rc;
480}
481
Eric Paris08089252006-07-10 04:43:55 -0700482static int may_context_mount_inode_relabel(u32 sid,
483 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100484 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700485{
David Howells275bb412008-11-14 10:39:19 +1100486 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700487 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500488 rc = avc_has_perm(&selinux_state,
489 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700490 FILESYSTEM__RELABELFROM, NULL);
491 if (rc)
492 return rc;
493
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500494 rc = avc_has_perm(&selinux_state,
495 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700496 FILESYSTEM__ASSOCIATE, NULL);
497 return rc;
498}
499
Eric Parisb43e7252012-10-10 14:27:35 -0400500static int selinux_is_sblabel_mnt(struct super_block *sb)
501{
502 struct superblock_security_struct *sbsec = sb->s_security;
503
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500504 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
505 sbsec->behavior == SECURITY_FS_USE_TRANS ||
506 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400507 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500508 /* Special handling. Genfs but also in-core setxattr handler */
509 !strcmp(sb->s_type->name, "sysfs") ||
510 !strcmp(sb->s_type->name, "pstore") ||
511 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500512 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500513 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500514 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500515 (!strcmp(sb->s_type->name, "cgroup") ||
516 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400517}
518
Eric Parisc9180a52007-11-30 13:00:35 -0500519static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700520{
521 struct superblock_security_struct *sbsec = sb->s_security;
522 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000523 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700524 int rc = 0;
525
Linus Torvalds1da177e2005-04-16 15:20:36 -0700526 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
527 /* Make sure that the xattr handler exists and that no
528 error other than -ENODATA is returned by getxattr on
529 the root directory. -ENODATA is ok, as this may be
530 the first boot of the SELinux kernel before we have
531 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200532 if (!(root_inode->i_opflags & IOP_XATTR)) {
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800533 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
534 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700535 rc = -EOPNOTSUPP;
536 goto out;
537 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200538
539 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700540 if (rc < 0 && rc != -ENODATA) {
541 if (rc == -EOPNOTSUPP)
542 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800543 "%s) has no security xattr handler\n",
544 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700545 else
546 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800547 "%s) getxattr errno %d\n", sb->s_id,
548 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700549 goto out;
550 }
551 }
552
Eric Pariseadcabc2012-08-24 15:59:14 -0400553 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400554
555 /*
556 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
557 * leave the flag untouched because sb_clone_mnt_opts might be handing
558 * us a superblock that needs the flag to be cleared.
559 */
Eric Parisb43e7252012-10-10 14:27:35 -0400560 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400561 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400562 else
563 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400564
Linus Torvalds1da177e2005-04-16 15:20:36 -0700565 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500566 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700567
568 /* Initialize any other inodes associated with the superblock, e.g.
569 inodes created prior to initial policy load or inodes created
570 during get_sb by a pseudo filesystem that directly
571 populates itself. */
572 spin_lock(&sbsec->isec_lock);
573next_inode:
574 if (!list_empty(&sbsec->isec_head)) {
575 struct inode_security_struct *isec =
576 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500577 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700578 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400579 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700580 spin_unlock(&sbsec->isec_lock);
581 inode = igrab(inode);
582 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500583 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700584 inode_doinit(inode);
585 iput(inode);
586 }
587 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 goto next_inode;
589 }
590 spin_unlock(&sbsec->isec_lock);
591out:
Eric Parisc9180a52007-11-30 13:00:35 -0500592 return rc;
593}
594
595/*
596 * This function should allow an FS to ask what it's mount security
597 * options were so it can use those later for submounts, displaying
598 * mount options, or whatever.
599 */
600static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500601 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500602{
603 int rc = 0, i;
604 struct superblock_security_struct *sbsec = sb->s_security;
605 char *context = NULL;
606 u32 len;
607 char tmp;
608
Eric Parise0007522008-03-05 10:31:54 -0500609 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500610
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500611 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500612 return -EINVAL;
613
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500614 if (!selinux_state.initialized)
Eric Parisc9180a52007-11-30 13:00:35 -0500615 return -EINVAL;
616
Eric Parisaf8e50c2012-08-24 15:59:00 -0400617 /* make sure we always check enough bits to cover the mask */
618 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
619
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500620 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500621 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400622 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500623 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500624 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500625 tmp >>= 1;
626 }
David P. Quigley11689d42009-01-16 09:22:03 -0500627 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400628 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500629 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500630
Eric Parise0007522008-03-05 10:31:54 -0500631 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
632 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500633 rc = -ENOMEM;
634 goto out_free;
635 }
636
Eric Parise0007522008-03-05 10:31:54 -0500637 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
638 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500639 rc = -ENOMEM;
640 goto out_free;
641 }
642
643 i = 0;
644 if (sbsec->flags & FSCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500645 rc = security_sid_to_context(&selinux_state, sbsec->sid,
646 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500647 if (rc)
648 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500649 opts->mnt_opts[i] = context;
650 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500651 }
652 if (sbsec->flags & CONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500653 rc = security_sid_to_context(&selinux_state,
654 sbsec->mntpoint_sid,
655 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500656 if (rc)
657 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500658 opts->mnt_opts[i] = context;
659 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500660 }
661 if (sbsec->flags & DEFCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500662 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
663 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500664 if (rc)
665 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500666 opts->mnt_opts[i] = context;
667 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500668 }
669 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500670 struct dentry *root = sbsec->sb->s_root;
671 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500672
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500673 rc = security_sid_to_context(&selinux_state, isec->sid,
674 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500675 if (rc)
676 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500677 opts->mnt_opts[i] = context;
678 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500679 }
Eric Paris12f348b2012-10-09 10:56:25 -0400680 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500681 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400682 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500683 }
Eric Parisc9180a52007-11-30 13:00:35 -0500684
Eric Parise0007522008-03-05 10:31:54 -0500685 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500686
687 return 0;
688
689out_free:
Eric Parise0007522008-03-05 10:31:54 -0500690 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500691 return rc;
692}
693
694static int bad_option(struct superblock_security_struct *sbsec, char flag,
695 u32 old_sid, u32 new_sid)
696{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500697 char mnt_flags = sbsec->flags & SE_MNTMASK;
698
Eric Parisc9180a52007-11-30 13:00:35 -0500699 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500700 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500701 if (!(sbsec->flags & flag) ||
702 (old_sid != new_sid))
703 return 1;
704
705 /* check if we were passed the same options twice,
706 * aka someone passed context=a,context=b
707 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500708 if (!(sbsec->flags & SE_SBINITIALIZED))
709 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500710 return 1;
711 return 0;
712}
Eric Parise0007522008-03-05 10:31:54 -0500713
Eric Parisc9180a52007-11-30 13:00:35 -0500714/*
715 * Allow filesystems with binary mount data to explicitly set mount point
716 * labeling information.
717 */
Eric Parise0007522008-03-05 10:31:54 -0500718static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400719 struct security_mnt_opts *opts,
720 unsigned long kern_flags,
721 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500722{
David Howells275bb412008-11-14 10:39:19 +1100723 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500724 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500725 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800726 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500727 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400728 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500729 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
730 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500731 char **mount_options = opts->mnt_opts;
732 int *flags = opts->mnt_opts_flags;
733 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500734
735 mutex_lock(&sbsec->lock);
736
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500737 if (!selinux_state.initialized) {
Eric Parisc9180a52007-11-30 13:00:35 -0500738 if (!num_opts) {
739 /* Defer initialization until selinux_complete_init,
740 after the initial policy is loaded and the security
741 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500742 goto out;
743 }
744 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400745 printk(KERN_WARNING "SELinux: Unable to set superblock options "
746 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500747 goto out;
748 }
David Quigley649f6e72013-05-22 12:50:36 -0400749 if (kern_flags && !set_kern_flags) {
750 /* Specifying internal flags without providing a place to
751 * place the results is not allowed */
752 rc = -EINVAL;
753 goto out;
754 }
Eric Parisc9180a52007-11-30 13:00:35 -0500755
756 /*
Eric Parise0007522008-03-05 10:31:54 -0500757 * Binary mount data FS will come through this function twice. Once
758 * from an explicit call and once from the generic calls from the vfs.
759 * Since the generic VFS calls will not contain any security mount data
760 * we need to skip the double mount verification.
761 *
762 * This does open a hole in which we will not notice if the first
763 * mount using this sb set explict options and a second mount using
764 * this sb does not set any security options. (The first options
765 * will be used for both mounts)
766 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500767 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500768 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400769 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500770
Paul Moore2c971652016-04-19 16:36:28 -0400771 root_isec = backing_inode_security_novalidate(root);
772
Eric Parise0007522008-03-05 10:31:54 -0500773 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500774 * parse the mount options, check if they are valid sids.
775 * also check if someone is trying to mount the same sb more
776 * than once with different security options.
777 */
778 for (i = 0; i < num_opts; i++) {
779 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500780
Eric Paris12f348b2012-10-09 10:56:25 -0400781 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500782 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500783 rc = security_context_str_to_sid(&selinux_state,
784 mount_options[i], &sid,
785 GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500786 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400787 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800788 "(%s) failed for (dev %s, type %s) errno=%d\n",
789 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500790 goto out;
791 }
792 switch (flags[i]) {
793 case FSCONTEXT_MNT:
794 fscontext_sid = sid;
795
796 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
797 fscontext_sid))
798 goto out_double_mount;
799
800 sbsec->flags |= FSCONTEXT_MNT;
801 break;
802 case CONTEXT_MNT:
803 context_sid = sid;
804
805 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
806 context_sid))
807 goto out_double_mount;
808
809 sbsec->flags |= CONTEXT_MNT;
810 break;
811 case ROOTCONTEXT_MNT:
812 rootcontext_sid = sid;
813
814 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
815 rootcontext_sid))
816 goto out_double_mount;
817
818 sbsec->flags |= ROOTCONTEXT_MNT;
819
820 break;
821 case DEFCONTEXT_MNT:
822 defcontext_sid = sid;
823
824 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
825 defcontext_sid))
826 goto out_double_mount;
827
828 sbsec->flags |= DEFCONTEXT_MNT;
829
830 break;
831 default:
832 rc = -EINVAL;
833 goto out;
834 }
835 }
836
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500837 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500838 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500839 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500840 goto out_double_mount;
841 rc = 0;
842 goto out;
843 }
844
James Morris089be432008-07-15 18:32:49 +1000845 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400846 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
847
Stephen Smalley8e014722015-06-04 16:22:17 -0400848 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700849 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400850 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100851 !strcmp(sb->s_type->name, "pstore") ||
852 !strcmp(sb->s_type->name, "cgroup") ||
853 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400854 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500855
David Quigleyeb9ae682013-05-22 12:50:37 -0400856 if (!sbsec->behavior) {
857 /*
858 * Determine the labeling behavior to use for this
859 * filesystem type.
860 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500861 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400862 if (rc) {
863 printk(KERN_WARNING
864 "%s: security_fs_use(%s) returned %d\n",
865 __func__, sb->s_type->name, rc);
866 goto out;
867 }
Eric Parisc9180a52007-11-30 13:00:35 -0500868 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500869
870 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500871 * If this is a user namespace mount and the filesystem type is not
872 * explicitly whitelisted, then no contexts are allowed on the command
873 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500874 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500875 if (sb->s_user_ns != &init_user_ns &&
876 strcmp(sb->s_type->name, "tmpfs") &&
877 strcmp(sb->s_type->name, "ramfs") &&
878 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500879 if (context_sid || fscontext_sid || rootcontext_sid ||
880 defcontext_sid) {
881 rc = -EACCES;
882 goto out;
883 }
884 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
885 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500886 rc = security_transition_sid(&selinux_state,
887 current_sid(),
888 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500889 SECCLASS_FILE, NULL,
890 &sbsec->mntpoint_sid);
891 if (rc)
892 goto out;
893 }
894 goto out_set_opts;
895 }
896
Eric Parisc9180a52007-11-30 13:00:35 -0500897 /* sets the context of the superblock for the fs being mounted. */
898 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100899 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500900 if (rc)
901 goto out;
902
903 sbsec->sid = fscontext_sid;
904 }
905
906 /*
907 * Switch to using mount point labeling behavior.
908 * sets the label used on all file below the mountpoint, and will set
909 * the superblock context if not already set.
910 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400911 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
912 sbsec->behavior = SECURITY_FS_USE_NATIVE;
913 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
914 }
915
Eric Parisc9180a52007-11-30 13:00:35 -0500916 if (context_sid) {
917 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100918 rc = may_context_mount_sb_relabel(context_sid, sbsec,
919 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500920 if (rc)
921 goto out;
922 sbsec->sid = context_sid;
923 } else {
David Howells275bb412008-11-14 10:39:19 +1100924 rc = may_context_mount_inode_relabel(context_sid, sbsec,
925 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500926 if (rc)
927 goto out;
928 }
929 if (!rootcontext_sid)
930 rootcontext_sid = context_sid;
931
932 sbsec->mntpoint_sid = context_sid;
933 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
934 }
935
936 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100937 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
938 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500939 if (rc)
940 goto out;
941
942 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500943 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500944 }
945
946 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400947 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
948 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500949 rc = -EINVAL;
950 printk(KERN_WARNING "SELinux: defcontext option is "
951 "invalid for this filesystem type\n");
952 goto out;
953 }
954
955 if (defcontext_sid != sbsec->def_sid) {
956 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100957 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500958 if (rc)
959 goto out;
960 }
961
962 sbsec->def_sid = defcontext_sid;
963 }
964
Seth Forsheeaad82892016-04-26 14:36:20 -0500965out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500966 rc = sb_finish_set_opts(sb);
967out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700968 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700969 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500970out_double_mount:
971 rc = -EINVAL;
972 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800973 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500974 goto out;
975}
976
Jeff Layton094f7b62013-04-01 08:14:24 -0400977static int selinux_cmp_sb_context(const struct super_block *oldsb,
978 const struct super_block *newsb)
979{
980 struct superblock_security_struct *old = oldsb->s_security;
981 struct superblock_security_struct *new = newsb->s_security;
982 char oldflags = old->flags & SE_MNTMASK;
983 char newflags = new->flags & SE_MNTMASK;
984
985 if (oldflags != newflags)
986 goto mismatch;
987 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
988 goto mismatch;
989 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
990 goto mismatch;
991 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
992 goto mismatch;
993 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500994 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
995 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400996 if (oldroot->sid != newroot->sid)
997 goto mismatch;
998 }
999 return 0;
1000mismatch:
1001 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
1002 "different security settings for (dev %s, "
1003 "type %s)\n", newsb->s_id, newsb->s_type->name);
1004 return -EBUSY;
1005}
1006
1007static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001008 struct super_block *newsb,
1009 unsigned long kern_flags,
1010 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -05001011{
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001012 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001013 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1014 struct superblock_security_struct *newsbsec = newsb->s_security;
1015
1016 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
1017 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1018 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1019
Eric Paris0f5e6422008-04-21 16:24:11 -04001020 /*
1021 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -04001022 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -04001023 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001024 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -04001025 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001026
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001027 /*
1028 * Specifying internal flags without providing a place to
1029 * place the results is not allowed.
1030 */
1031 if (kern_flags && !set_kern_flags)
1032 return -EINVAL;
1033
Eric Parisc9180a52007-11-30 13:00:35 -05001034 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001035 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -05001036
Jeff Layton094f7b62013-04-01 08:14:24 -04001037 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001038 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -04001039 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -04001040
Eric Parisc9180a52007-11-30 13:00:35 -05001041 mutex_lock(&newsbsec->lock);
1042
1043 newsbsec->flags = oldsbsec->flags;
1044
1045 newsbsec->sid = oldsbsec->sid;
1046 newsbsec->def_sid = oldsbsec->def_sid;
1047 newsbsec->behavior = oldsbsec->behavior;
1048
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001049 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1050 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001051 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001052 if (rc)
1053 goto out;
1054 }
1055
1056 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1057 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1058 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1059 }
1060
Eric Parisc9180a52007-11-30 13:00:35 -05001061 if (set_context) {
1062 u32 sid = oldsbsec->mntpoint_sid;
1063
1064 if (!set_fscontext)
1065 newsbsec->sid = sid;
1066 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001067 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001068 newisec->sid = sid;
1069 }
1070 newsbsec->mntpoint_sid = sid;
1071 }
1072 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001073 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1074 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001075
1076 newisec->sid = oldisec->sid;
1077 }
1078
1079 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001080out:
Eric Parisc9180a52007-11-30 13:00:35 -05001081 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001082 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -05001083}
1084
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001085static int selinux_parse_opts_str(char *options,
1086 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001087{
Eric Parise0007522008-03-05 10:31:54 -05001088 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001089 char *context = NULL, *defcontext = NULL;
1090 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001091 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001092
Eric Parise0007522008-03-05 10:31:54 -05001093 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001094
1095 /* Standard string-based options. */
1096 while ((p = strsep(&options, "|")) != NULL) {
1097 int token;
1098 substring_t args[MAX_OPT_ARGS];
1099
1100 if (!*p)
1101 continue;
1102
1103 token = match_token(p, tokens, args);
1104
1105 switch (token) {
1106 case Opt_context:
1107 if (context || defcontext) {
1108 rc = -EINVAL;
1109 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1110 goto out_err;
1111 }
1112 context = match_strdup(&args[0]);
1113 if (!context) {
1114 rc = -ENOMEM;
1115 goto out_err;
1116 }
1117 break;
1118
1119 case Opt_fscontext:
1120 if (fscontext) {
1121 rc = -EINVAL;
1122 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1123 goto out_err;
1124 }
1125 fscontext = match_strdup(&args[0]);
1126 if (!fscontext) {
1127 rc = -ENOMEM;
1128 goto out_err;
1129 }
1130 break;
1131
1132 case Opt_rootcontext:
1133 if (rootcontext) {
1134 rc = -EINVAL;
1135 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1136 goto out_err;
1137 }
1138 rootcontext = match_strdup(&args[0]);
1139 if (!rootcontext) {
1140 rc = -ENOMEM;
1141 goto out_err;
1142 }
1143 break;
1144
1145 case Opt_defcontext:
1146 if (context || defcontext) {
1147 rc = -EINVAL;
1148 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1149 goto out_err;
1150 }
1151 defcontext = match_strdup(&args[0]);
1152 if (!defcontext) {
1153 rc = -ENOMEM;
1154 goto out_err;
1155 }
1156 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001157 case Opt_labelsupport:
1158 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001159 default:
1160 rc = -EINVAL;
1161 printk(KERN_WARNING "SELinux: unknown mount option\n");
1162 goto out_err;
1163
1164 }
1165 }
1166
Eric Parise0007522008-03-05 10:31:54 -05001167 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001168 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001169 if (!opts->mnt_opts)
1170 goto out_err;
1171
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001172 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1173 GFP_KERNEL);
Paul Moore023f1082017-06-07 16:48:19 -04001174 if (!opts->mnt_opts_flags)
Eric Parise0007522008-03-05 10:31:54 -05001175 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001176
Eric Parise0007522008-03-05 10:31:54 -05001177 if (fscontext) {
1178 opts->mnt_opts[num_mnt_opts] = fscontext;
1179 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1180 }
1181 if (context) {
1182 opts->mnt_opts[num_mnt_opts] = context;
1183 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1184 }
1185 if (rootcontext) {
1186 opts->mnt_opts[num_mnt_opts] = rootcontext;
1187 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1188 }
1189 if (defcontext) {
1190 opts->mnt_opts[num_mnt_opts] = defcontext;
1191 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1192 }
1193
1194 opts->num_mnt_opts = num_mnt_opts;
1195 return 0;
1196
Eric Parisc9180a52007-11-30 13:00:35 -05001197out_err:
Paul Moore023f1082017-06-07 16:48:19 -04001198 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -05001199 kfree(context);
1200 kfree(defcontext);
1201 kfree(fscontext);
1202 kfree(rootcontext);
1203 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001204}
Eric Parise0007522008-03-05 10:31:54 -05001205/*
1206 * string mount options parsing and call set the sbsec
1207 */
1208static int superblock_doinit(struct super_block *sb, void *data)
1209{
1210 int rc = 0;
1211 char *options = data;
1212 struct security_mnt_opts opts;
1213
1214 security_init_mnt_opts(&opts);
1215
1216 if (!data)
1217 goto out;
1218
1219 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1220
1221 rc = selinux_parse_opts_str(options, &opts);
1222 if (rc)
1223 goto out_err;
1224
1225out:
David Quigley649f6e72013-05-22 12:50:36 -04001226 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001227
1228out_err:
1229 security_free_mnt_opts(&opts);
1230 return rc;
1231}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001232
Adrian Bunk3583a712008-07-22 20:21:23 +03001233static void selinux_write_opts(struct seq_file *m,
1234 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001235{
1236 int i;
1237 char *prefix;
1238
1239 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001240 char *has_comma;
1241
1242 if (opts->mnt_opts[i])
1243 has_comma = strchr(opts->mnt_opts[i], ',');
1244 else
1245 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001246
1247 switch (opts->mnt_opts_flags[i]) {
1248 case CONTEXT_MNT:
1249 prefix = CONTEXT_STR;
1250 break;
1251 case FSCONTEXT_MNT:
1252 prefix = FSCONTEXT_STR;
1253 break;
1254 case ROOTCONTEXT_MNT:
1255 prefix = ROOTCONTEXT_STR;
1256 break;
1257 case DEFCONTEXT_MNT:
1258 prefix = DEFCONTEXT_STR;
1259 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001260 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001261 seq_putc(m, ',');
1262 seq_puts(m, LABELSUPP_STR);
1263 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001264 default:
1265 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001266 return;
Eric Paris2069f452008-07-04 09:47:13 +10001267 };
1268 /* we need a comma before each option */
1269 seq_putc(m, ',');
1270 seq_puts(m, prefix);
1271 if (has_comma)
1272 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001273 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001274 if (has_comma)
1275 seq_putc(m, '\"');
1276 }
1277}
1278
1279static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1280{
1281 struct security_mnt_opts opts;
1282 int rc;
1283
1284 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001285 if (rc) {
1286 /* before policy load we may get EINVAL, don't show anything */
1287 if (rc == -EINVAL)
1288 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001289 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001290 }
Eric Paris2069f452008-07-04 09:47:13 +10001291
1292 selinux_write_opts(m, &opts);
1293
1294 security_free_mnt_opts(&opts);
1295
1296 return rc;
1297}
1298
Linus Torvalds1da177e2005-04-16 15:20:36 -07001299static inline u16 inode_mode_to_security_class(umode_t mode)
1300{
1301 switch (mode & S_IFMT) {
1302 case S_IFSOCK:
1303 return SECCLASS_SOCK_FILE;
1304 case S_IFLNK:
1305 return SECCLASS_LNK_FILE;
1306 case S_IFREG:
1307 return SECCLASS_FILE;
1308 case S_IFBLK:
1309 return SECCLASS_BLK_FILE;
1310 case S_IFDIR:
1311 return SECCLASS_DIR;
1312 case S_IFCHR:
1313 return SECCLASS_CHR_FILE;
1314 case S_IFIFO:
1315 return SECCLASS_FIFO_FILE;
1316
1317 }
1318
1319 return SECCLASS_FILE;
1320}
1321
James Morris13402582005-09-30 14:24:34 -04001322static inline int default_protocol_stream(int protocol)
1323{
1324 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1325}
1326
1327static inline int default_protocol_dgram(int protocol)
1328{
1329 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1330}
1331
Linus Torvalds1da177e2005-04-16 15:20:36 -07001332static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1333{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001334 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001335
Linus Torvalds1da177e2005-04-16 15:20:36 -07001336 switch (family) {
1337 case PF_UNIX:
1338 switch (type) {
1339 case SOCK_STREAM:
1340 case SOCK_SEQPACKET:
1341 return SECCLASS_UNIX_STREAM_SOCKET;
1342 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001343 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001344 return SECCLASS_UNIX_DGRAM_SOCKET;
1345 }
1346 break;
1347 case PF_INET:
1348 case PF_INET6:
1349 switch (type) {
1350 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001351 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001352 if (default_protocol_stream(protocol))
1353 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001354 else if (extsockclass && protocol == IPPROTO_SCTP)
1355 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001356 else
1357 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001358 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001359 if (default_protocol_dgram(protocol))
1360 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001361 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1362 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001363 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001364 else
1365 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001366 case SOCK_DCCP:
1367 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001368 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001369 return SECCLASS_RAWIP_SOCKET;
1370 }
1371 break;
1372 case PF_NETLINK:
1373 switch (protocol) {
1374 case NETLINK_ROUTE:
1375 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001376 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001377 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1378 case NETLINK_NFLOG:
1379 return SECCLASS_NETLINK_NFLOG_SOCKET;
1380 case NETLINK_XFRM:
1381 return SECCLASS_NETLINK_XFRM_SOCKET;
1382 case NETLINK_SELINUX:
1383 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001384 case NETLINK_ISCSI:
1385 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001386 case NETLINK_AUDIT:
1387 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001388 case NETLINK_FIB_LOOKUP:
1389 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1390 case NETLINK_CONNECTOR:
1391 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1392 case NETLINK_NETFILTER:
1393 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001394 case NETLINK_DNRTMSG:
1395 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001396 case NETLINK_KOBJECT_UEVENT:
1397 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001398 case NETLINK_GENERIC:
1399 return SECCLASS_NETLINK_GENERIC_SOCKET;
1400 case NETLINK_SCSITRANSPORT:
1401 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1402 case NETLINK_RDMA:
1403 return SECCLASS_NETLINK_RDMA_SOCKET;
1404 case NETLINK_CRYPTO:
1405 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001406 default:
1407 return SECCLASS_NETLINK_SOCKET;
1408 }
1409 case PF_PACKET:
1410 return SECCLASS_PACKET_SOCKET;
1411 case PF_KEY:
1412 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001413 case PF_APPLETALK:
1414 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001415 }
1416
Stephen Smalleyda69a532017-01-09 10:07:30 -05001417 if (extsockclass) {
1418 switch (family) {
1419 case PF_AX25:
1420 return SECCLASS_AX25_SOCKET;
1421 case PF_IPX:
1422 return SECCLASS_IPX_SOCKET;
1423 case PF_NETROM:
1424 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001425 case PF_ATMPVC:
1426 return SECCLASS_ATMPVC_SOCKET;
1427 case PF_X25:
1428 return SECCLASS_X25_SOCKET;
1429 case PF_ROSE:
1430 return SECCLASS_ROSE_SOCKET;
1431 case PF_DECnet:
1432 return SECCLASS_DECNET_SOCKET;
1433 case PF_ATMSVC:
1434 return SECCLASS_ATMSVC_SOCKET;
1435 case PF_RDS:
1436 return SECCLASS_RDS_SOCKET;
1437 case PF_IRDA:
1438 return SECCLASS_IRDA_SOCKET;
1439 case PF_PPPOX:
1440 return SECCLASS_PPPOX_SOCKET;
1441 case PF_LLC:
1442 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001443 case PF_CAN:
1444 return SECCLASS_CAN_SOCKET;
1445 case PF_TIPC:
1446 return SECCLASS_TIPC_SOCKET;
1447 case PF_BLUETOOTH:
1448 return SECCLASS_BLUETOOTH_SOCKET;
1449 case PF_IUCV:
1450 return SECCLASS_IUCV_SOCKET;
1451 case PF_RXRPC:
1452 return SECCLASS_RXRPC_SOCKET;
1453 case PF_ISDN:
1454 return SECCLASS_ISDN_SOCKET;
1455 case PF_PHONET:
1456 return SECCLASS_PHONET_SOCKET;
1457 case PF_IEEE802154:
1458 return SECCLASS_IEEE802154_SOCKET;
1459 case PF_CAIF:
1460 return SECCLASS_CAIF_SOCKET;
1461 case PF_ALG:
1462 return SECCLASS_ALG_SOCKET;
1463 case PF_NFC:
1464 return SECCLASS_NFC_SOCKET;
1465 case PF_VSOCK:
1466 return SECCLASS_VSOCK_SOCKET;
1467 case PF_KCM:
1468 return SECCLASS_KCM_SOCKET;
1469 case PF_QIPCRTR:
1470 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001471 case PF_SMC:
1472 return SECCLASS_SMC_SOCKET;
1473#if PF_MAX > 44
Stephen Smalleyda69a532017-01-09 10:07:30 -05001474#error New address family defined, please update this function.
1475#endif
1476 }
1477 }
1478
Linus Torvalds1da177e2005-04-16 15:20:36 -07001479 return SECCLASS_SOCKET;
1480}
1481
Stephen Smalley134509d2015-06-04 16:22:17 -04001482static int selinux_genfs_get_sid(struct dentry *dentry,
1483 u16 tclass,
1484 u16 flags,
1485 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001486{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001487 int rc;
Al Virofc640052016-04-10 01:33:30 -04001488 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001489 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490
Eric Paris828dfe12008-04-17 13:17:49 -04001491 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001492 if (!buffer)
1493 return -ENOMEM;
1494
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001495 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1496 if (IS_ERR(path))
1497 rc = PTR_ERR(path);
1498 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001499 if (flags & SE_SBPROC) {
1500 /* each process gets a /proc/PID/ entry. Strip off the
1501 * PID part to get a valid selinux labeling.
1502 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1503 while (path[1] >= '0' && path[1] <= '9') {
1504 path[1] = '/';
1505 path++;
1506 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001507 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001508 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1509 path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001511 free_page((unsigned long)buffer);
1512 return rc;
1513}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001514
1515/* The inode's security attributes must be initialized before first use. */
1516static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1517{
1518 struct superblock_security_struct *sbsec = NULL;
1519 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001520 u32 task_sid, sid = 0;
1521 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001522 struct dentry *dentry;
1523#define INITCONTEXTLEN 255
1524 char *context = NULL;
1525 unsigned len = 0;
1526 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001527
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001528 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001529 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001530
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001531 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001532 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001533 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001534
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001535 if (isec->sclass == SECCLASS_FILE)
1536 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1537
Linus Torvalds1da177e2005-04-16 15:20:36 -07001538 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001539 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001540 /* Defer initialization until selinux_complete_init,
1541 after the initial policy is loaded and the security
1542 server is ready to handle calls. */
1543 spin_lock(&sbsec->isec_lock);
1544 if (list_empty(&isec->list))
1545 list_add(&isec->list, &sbsec->isec_head);
1546 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001547 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001548 }
1549
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001550 sclass = isec->sclass;
1551 task_sid = isec->task_sid;
1552 sid = isec->sid;
1553 isec->initialized = LABEL_PENDING;
1554 spin_unlock(&isec->lock);
1555
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001557 case SECURITY_FS_USE_NATIVE:
1558 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001559 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001560 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001561 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001562 break;
1563 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001564 /* Need a dentry, since the xattr API requires one.
1565 Life would be simpler if we could just pass the inode. */
1566 if (opt_dentry) {
1567 /* Called from d_instantiate or d_splice_alias. */
1568 dentry = dget(opt_dentry);
1569 } else {
1570 /* Called from selinux_complete_init, try to find a dentry. */
1571 dentry = d_find_alias(inode);
1572 }
1573 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001574 /*
1575 * this is can be hit on boot when a file is accessed
1576 * before the policy is loaded. When we load policy we
1577 * may find inodes that have no dentry on the
1578 * sbsec->isec_head list. No reason to complain as these
1579 * will get fixed up the next time we go through
1580 * inode_doinit with a dentry, before these inodes could
1581 * be used again by userspace.
1582 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001583 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001584 }
1585
1586 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001587 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001588 if (!context) {
1589 rc = -ENOMEM;
1590 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001591 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001592 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001593 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001594 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001595 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001596 kfree(context);
1597
Linus Torvalds1da177e2005-04-16 15:20:36 -07001598 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001599 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001600 if (rc < 0) {
1601 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001602 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001603 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001604 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001605 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001606 if (!context) {
1607 rc = -ENOMEM;
1608 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001609 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001610 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001611 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001612 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001613 }
1614 dput(dentry);
1615 if (rc < 0) {
1616 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001617 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001618 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001619 -rc, inode->i_sb->s_id, inode->i_ino);
1620 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001621 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001622 }
1623 /* Map ENODATA to the default file SID */
1624 sid = sbsec->def_sid;
1625 rc = 0;
1626 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001627 rc = security_context_to_sid_default(&selinux_state,
1628 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001629 sbsec->def_sid,
1630 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001631 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001632 char *dev = inode->i_sb->s_id;
1633 unsigned long ino = inode->i_ino;
1634
1635 if (rc == -EINVAL) {
1636 if (printk_ratelimit())
1637 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1638 "context=%s. This indicates you may need to relabel the inode or the "
1639 "filesystem in question.\n", ino, dev, context);
1640 } else {
1641 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1642 "returned %d for dev=%s ino=%ld\n",
1643 __func__, context, -rc, dev, ino);
1644 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001645 kfree(context);
1646 /* Leave with the unlabeled SID */
1647 rc = 0;
1648 break;
1649 }
1650 }
1651 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001652 break;
1653 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001654 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001655 break;
1656 case SECURITY_FS_USE_TRANS:
1657 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001658 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001659
1660 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001661 rc = security_transition_sid(&selinux_state, task_sid, sid,
1662 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001663 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001664 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001665 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001666 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001667 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001668 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001669 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001670 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001671 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001672
Stephen Smalley134509d2015-06-04 16:22:17 -04001673 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001674 /* We must have a dentry to determine the label on
1675 * procfs inodes */
1676 if (opt_dentry)
1677 /* Called from d_instantiate or
1678 * d_splice_alias. */
1679 dentry = dget(opt_dentry);
1680 else
1681 /* Called from selinux_complete_init, try to
1682 * find a dentry. */
1683 dentry = d_find_alias(inode);
1684 /*
1685 * This can be hit on boot when a file is accessed
1686 * before the policy is loaded. When we load policy we
1687 * may find inodes that have no dentry on the
1688 * sbsec->isec_head list. No reason to complain as
1689 * these will get fixed up the next time we go through
1690 * inode_doinit() with a dentry, before these inodes
1691 * could be used again by userspace.
1692 */
1693 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001694 goto out;
1695 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001696 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001697 dput(dentry);
1698 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001699 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001700 }
1701 break;
1702 }
1703
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001704out:
1705 spin_lock(&isec->lock);
1706 if (isec->initialized == LABEL_PENDING) {
1707 if (!sid || rc) {
1708 isec->initialized = LABEL_INVALID;
1709 goto out_unlock;
1710 }
1711
1712 isec->initialized = LABEL_INITIALIZED;
1713 isec->sid = sid;
1714 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001715
Eric Paris23970742006-09-25 23:32:01 -07001716out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001717 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001718 return rc;
1719}
1720
1721/* Convert a Linux signal to an access vector. */
1722static inline u32 signal_to_av(int sig)
1723{
1724 u32 perm = 0;
1725
1726 switch (sig) {
1727 case SIGCHLD:
1728 /* Commonly granted from child to parent. */
1729 perm = PROCESS__SIGCHLD;
1730 break;
1731 case SIGKILL:
1732 /* Cannot be caught or ignored */
1733 perm = PROCESS__SIGKILL;
1734 break;
1735 case SIGSTOP:
1736 /* Cannot be caught or ignored */
1737 perm = PROCESS__SIGSTOP;
1738 break;
1739 default:
1740 /* All other signals. */
1741 perm = PROCESS__SIGNAL;
1742 break;
1743 }
1744
1745 return perm;
1746}
1747
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001748#if CAP_LAST_CAP > 63
1749#error Fix SELinux to handle capabilities > 63.
1750#endif
1751
Linus Torvalds1da177e2005-04-16 15:20:36 -07001752/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001753static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001754 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001755{
Thomas Liu2bf49692009-07-14 12:14:09 -04001756 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001757 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001758 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001759 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001760 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001761 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001762
Eric Paris50c205f2012-04-04 15:01:43 -04001763 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001764 ad.u.cap = cap;
1765
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001766 switch (CAP_TO_INDEX(cap)) {
1767 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001768 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001769 break;
1770 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001771 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001772 break;
1773 default:
1774 printk(KERN_ERR
1775 "SELinux: out of range capability %d\n", cap);
1776 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001777 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001778 }
Eric Paris06112162008-11-11 22:02:50 +11001779
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001780 rc = avc_has_perm_noaudit(&selinux_state,
1781 sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001782 if (audit == SECURITY_CAP_AUDIT) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001783 int rc2 = avc_audit(&selinux_state,
1784 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001785 if (rc2)
1786 return rc2;
1787 }
Eric Paris06112162008-11-11 22:02:50 +11001788 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001789}
1790
Linus Torvalds1da177e2005-04-16 15:20:36 -07001791/* Check whether a task has a particular permission to an inode.
1792 The 'adp' parameter is optional and allows other audit
1793 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001794static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001795 struct inode *inode,
1796 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001797 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001798{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001799 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001800 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001801
David Howellse0e81732009-09-02 09:13:40 +01001802 validate_creds(cred);
1803
Eric Paris828dfe12008-04-17 13:17:49 -04001804 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001805 return 0;
1806
David Howells88e67f32008-11-14 10:39:21 +11001807 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001808 isec = inode->i_security;
1809
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001810 return avc_has_perm(&selinux_state,
1811 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001812}
1813
1814/* Same as inode_has_perm, but pass explicit audit data containing
1815 the dentry to help the auditing code to more easily generate the
1816 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001817static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001818 struct dentry *dentry,
1819 u32 av)
1820{
David Howellsc6f493d2015-03-17 22:26:22 +00001821 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001822 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001823
Eric Paris50c205f2012-04-04 15:01:43 -04001824 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001825 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001826 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001827 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001828}
1829
1830/* Same as inode_has_perm, but pass explicit audit data containing
1831 the path to help the auditing code to more easily generate the
1832 pathname if needed. */
1833static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001834 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001835 u32 av)
1836{
David Howellsc6f493d2015-03-17 22:26:22 +00001837 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001838 struct common_audit_data ad;
1839
Eric Paris50c205f2012-04-04 15:01:43 -04001840 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001841 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001842 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001843 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001844}
1845
David Howells13f8e982013-06-13 23:37:55 +01001846/* Same as path_has_perm, but uses the inode from the file struct. */
1847static inline int file_path_has_perm(const struct cred *cred,
1848 struct file *file,
1849 u32 av)
1850{
1851 struct common_audit_data ad;
1852
Vivek Goyal43af5de2016-09-09 11:37:49 -04001853 ad.type = LSM_AUDIT_DATA_FILE;
1854 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001855 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001856}
1857
Chenbo Fengf66e4482017-10-18 13:00:26 -07001858#ifdef CONFIG_BPF_SYSCALL
1859static int bpf_fd_pass(struct file *file, u32 sid);
1860#endif
1861
Linus Torvalds1da177e2005-04-16 15:20:36 -07001862/* Check whether a task can use an open file descriptor to
1863 access an inode in a given way. Check access to the
1864 descriptor itself, and then use dentry_has_perm to
1865 check a particular permission to the file.
1866 Access to the descriptor is implicitly granted if it
1867 has the same SID as the process. If av is zero, then
1868 access to the file is not checked, e.g. for cases
1869 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001870static int file_has_perm(const struct cred *cred,
1871 struct file *file,
1872 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001873{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001874 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001875 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001876 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001877 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001878 int rc;
1879
Vivek Goyal43af5de2016-09-09 11:37:49 -04001880 ad.type = LSM_AUDIT_DATA_FILE;
1881 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001882
David Howells275bb412008-11-14 10:39:19 +11001883 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001884 rc = avc_has_perm(&selinux_state,
1885 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001886 SECCLASS_FD,
1887 FD__USE,
1888 &ad);
1889 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001890 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001891 }
1892
Chenbo Fengf66e4482017-10-18 13:00:26 -07001893#ifdef CONFIG_BPF_SYSCALL
1894 rc = bpf_fd_pass(file, cred_sid(cred));
1895 if (rc)
1896 return rc;
1897#endif
1898
Linus Torvalds1da177e2005-04-16 15:20:36 -07001899 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001900 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001901 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001902 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001903
David Howells88e67f32008-11-14 10:39:21 +11001904out:
1905 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001906}
1907
David Howellsc3c188b2015-07-10 17:19:58 -04001908/*
1909 * Determine the label for an inode that might be unioned.
1910 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001911static int
1912selinux_determine_inode_label(const struct task_security_struct *tsec,
1913 struct inode *dir,
1914 const struct qstr *name, u16 tclass,
1915 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001916{
1917 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001918
1919 if ((sbsec->flags & SE_SBINITIALIZED) &&
1920 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1921 *_new_isid = sbsec->mntpoint_sid;
1922 } else if ((sbsec->flags & SBLABEL_MNT) &&
1923 tsec->create_sid) {
1924 *_new_isid = tsec->create_sid;
1925 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001926 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001927 return security_transition_sid(&selinux_state, tsec->sid,
1928 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001929 name, _new_isid);
1930 }
1931
1932 return 0;
1933}
1934
Linus Torvalds1da177e2005-04-16 15:20:36 -07001935/* Check whether a task can create a file. */
1936static int may_create(struct inode *dir,
1937 struct dentry *dentry,
1938 u16 tclass)
1939{
Paul Moore5fb49872010-04-22 14:46:19 -04001940 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001941 struct inode_security_struct *dsec;
1942 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001943 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001944 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001945 int rc;
1946
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001947 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001948 sbsec = dir->i_sb->s_security;
1949
David Howells275bb412008-11-14 10:39:19 +11001950 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001951
Eric Paris50c205f2012-04-04 15:01:43 -04001952 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001953 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001954
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001955 rc = avc_has_perm(&selinux_state,
1956 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001957 DIR__ADD_NAME | DIR__SEARCH,
1958 &ad);
1959 if (rc)
1960 return rc;
1961
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001962 rc = selinux_determine_inode_label(current_security(), dir,
1963 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001964 if (rc)
1965 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001966
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001967 rc = avc_has_perm(&selinux_state,
1968 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001969 if (rc)
1970 return rc;
1971
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001972 return avc_has_perm(&selinux_state,
1973 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001974 SECCLASS_FILESYSTEM,
1975 FILESYSTEM__ASSOCIATE, &ad);
1976}
1977
Eric Paris828dfe12008-04-17 13:17:49 -04001978#define MAY_LINK 0
1979#define MAY_UNLINK 1
1980#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001981
1982/* Check whether a task can link, unlink, or rmdir a file/directory. */
1983static int may_link(struct inode *dir,
1984 struct dentry *dentry,
1985 int kind)
1986
1987{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001988 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001989 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001990 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001991 u32 av;
1992 int rc;
1993
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001994 dsec = inode_security(dir);
1995 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001996
Eric Paris50c205f2012-04-04 15:01:43 -04001997 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001998 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001999
2000 av = DIR__SEARCH;
2001 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002002 rc = avc_has_perm(&selinux_state,
2003 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002004 if (rc)
2005 return rc;
2006
2007 switch (kind) {
2008 case MAY_LINK:
2009 av = FILE__LINK;
2010 break;
2011 case MAY_UNLINK:
2012 av = FILE__UNLINK;
2013 break;
2014 case MAY_RMDIR:
2015 av = DIR__RMDIR;
2016 break;
2017 default:
Eric Paris744ba352008-04-17 11:52:44 -04002018 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
2019 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002020 return 0;
2021 }
2022
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002023 rc = avc_has_perm(&selinux_state,
2024 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002025 return rc;
2026}
2027
2028static inline int may_rename(struct inode *old_dir,
2029 struct dentry *old_dentry,
2030 struct inode *new_dir,
2031 struct dentry *new_dentry)
2032{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002033 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002034 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002035 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002036 u32 av;
2037 int old_is_dir, new_is_dir;
2038 int rc;
2039
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002040 old_dsec = inode_security(old_dir);
2041 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002042 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002043 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002044
Eric Paris50c205f2012-04-04 15:01:43 -04002045 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046
Eric Parisa2694342011-04-25 13:10:27 -04002047 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002048 rc = avc_has_perm(&selinux_state,
2049 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002050 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2051 if (rc)
2052 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002053 rc = avc_has_perm(&selinux_state,
2054 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002055 old_isec->sclass, FILE__RENAME, &ad);
2056 if (rc)
2057 return rc;
2058 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002059 rc = avc_has_perm(&selinux_state,
2060 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002061 old_isec->sclass, DIR__REPARENT, &ad);
2062 if (rc)
2063 return rc;
2064 }
2065
Eric Parisa2694342011-04-25 13:10:27 -04002066 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002067 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002068 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002069 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002070 rc = avc_has_perm(&selinux_state,
2071 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002072 if (rc)
2073 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002074 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002075 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002076 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002077 rc = avc_has_perm(&selinux_state,
2078 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002079 new_isec->sclass,
2080 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2081 if (rc)
2082 return rc;
2083 }
2084
2085 return 0;
2086}
2087
2088/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002089static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002090 struct super_block *sb,
2091 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002092 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002093{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002094 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002095 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002096
Linus Torvalds1da177e2005-04-16 15:20:36 -07002097 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002098 return avc_has_perm(&selinux_state,
2099 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002100}
2101
2102/* Convert a Linux mode and permission mask to an access vector. */
2103static inline u32 file_mask_to_av(int mode, int mask)
2104{
2105 u32 av = 0;
2106
Al Virodba19c62011-07-25 20:49:29 -04002107 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002108 if (mask & MAY_EXEC)
2109 av |= FILE__EXECUTE;
2110 if (mask & MAY_READ)
2111 av |= FILE__READ;
2112
2113 if (mask & MAY_APPEND)
2114 av |= FILE__APPEND;
2115 else if (mask & MAY_WRITE)
2116 av |= FILE__WRITE;
2117
2118 } else {
2119 if (mask & MAY_EXEC)
2120 av |= DIR__SEARCH;
2121 if (mask & MAY_WRITE)
2122 av |= DIR__WRITE;
2123 if (mask & MAY_READ)
2124 av |= DIR__READ;
2125 }
2126
2127 return av;
2128}
2129
2130/* Convert a Linux file to an access vector. */
2131static inline u32 file_to_av(struct file *file)
2132{
2133 u32 av = 0;
2134
2135 if (file->f_mode & FMODE_READ)
2136 av |= FILE__READ;
2137 if (file->f_mode & FMODE_WRITE) {
2138 if (file->f_flags & O_APPEND)
2139 av |= FILE__APPEND;
2140 else
2141 av |= FILE__WRITE;
2142 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002143 if (!av) {
2144 /*
2145 * Special file opened with flags 3 for ioctl-only use.
2146 */
2147 av = FILE__IOCTL;
2148 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002149
2150 return av;
2151}
2152
Eric Paris8b6a5a32008-10-29 17:06:46 -04002153/*
2154 * Convert a file to an access vector and include the correct open
2155 * open permission.
2156 */
2157static inline u32 open_file_to_av(struct file *file)
2158{
2159 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002160 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002161
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002162 if (selinux_policycap_openperm() &&
2163 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002164 av |= FILE__OPEN;
2165
Eric Paris8b6a5a32008-10-29 17:06:46 -04002166 return av;
2167}
2168
Linus Torvalds1da177e2005-04-16 15:20:36 -07002169/* Hook functions begin here. */
2170
Stephen Smalley79af7302015-01-21 10:54:10 -05002171static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2172{
2173 u32 mysid = current_sid();
2174 u32 mgrsid = task_sid(mgr);
2175
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002176 return avc_has_perm(&selinux_state,
2177 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002178 BINDER__SET_CONTEXT_MGR, NULL);
2179}
2180
2181static int selinux_binder_transaction(struct task_struct *from,
2182 struct task_struct *to)
2183{
2184 u32 mysid = current_sid();
2185 u32 fromsid = task_sid(from);
2186 u32 tosid = task_sid(to);
2187 int rc;
2188
2189 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002190 rc = avc_has_perm(&selinux_state,
2191 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002192 BINDER__IMPERSONATE, NULL);
2193 if (rc)
2194 return rc;
2195 }
2196
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002197 return avc_has_perm(&selinux_state,
2198 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002199 NULL);
2200}
2201
2202static int selinux_binder_transfer_binder(struct task_struct *from,
2203 struct task_struct *to)
2204{
2205 u32 fromsid = task_sid(from);
2206 u32 tosid = task_sid(to);
2207
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002208 return avc_has_perm(&selinux_state,
2209 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002210 NULL);
2211}
2212
2213static int selinux_binder_transfer_file(struct task_struct *from,
2214 struct task_struct *to,
2215 struct file *file)
2216{
2217 u32 sid = task_sid(to);
2218 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002219 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002220 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002221 struct common_audit_data ad;
2222 int rc;
2223
2224 ad.type = LSM_AUDIT_DATA_PATH;
2225 ad.u.path = file->f_path;
2226
2227 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002228 rc = avc_has_perm(&selinux_state,
2229 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002230 SECCLASS_FD,
2231 FD__USE,
2232 &ad);
2233 if (rc)
2234 return rc;
2235 }
2236
Chenbo Fengf66e4482017-10-18 13:00:26 -07002237#ifdef CONFIG_BPF_SYSCALL
2238 rc = bpf_fd_pass(file, sid);
2239 if (rc)
2240 return rc;
2241#endif
2242
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002243 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002244 return 0;
2245
Paul Moore20cdef82016-04-04 14:14:42 -04002246 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002247 return avc_has_perm(&selinux_state,
2248 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002249 &ad);
2250}
2251
Ingo Molnar9e488582009-05-07 19:26:19 +10002252static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002253 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002254{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002255 u32 sid = current_sid();
2256 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002257
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002258 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002259 return avc_has_perm(&selinux_state,
2260 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002261
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002262 return avc_has_perm(&selinux_state,
2263 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002264}
2265
2266static int selinux_ptrace_traceme(struct task_struct *parent)
2267{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002268 return avc_has_perm(&selinux_state,
2269 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002270 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002271}
2272
2273static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002274 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002275{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002276 return avc_has_perm(&selinux_state,
2277 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002278 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002279}
2280
David Howellsd84f4f92008-11-14 10:39:23 +11002281static int selinux_capset(struct cred *new, const struct cred *old,
2282 const kernel_cap_t *effective,
2283 const kernel_cap_t *inheritable,
2284 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002285{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002286 return avc_has_perm(&selinux_state,
2287 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002288 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002289}
2290
James Morris5626d3e2009-01-30 10:05:06 +11002291/*
2292 * (This comment used to live with the selinux_task_setuid hook,
2293 * which was removed).
2294 *
2295 * Since setuid only affects the current process, and since the SELinux
2296 * controls are not based on the Linux identity attributes, SELinux does not
2297 * need to control this operation. However, SELinux does control the use of
2298 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2299 */
2300
Eric Paris6a9de492012-01-03 12:25:14 -05002301static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2302 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002303{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002304 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002305}
2306
Linus Torvalds1da177e2005-04-16 15:20:36 -07002307static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2308{
David Howells88e67f32008-11-14 10:39:21 +11002309 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002310 int rc = 0;
2311
2312 if (!sb)
2313 return 0;
2314
2315 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002316 case Q_SYNC:
2317 case Q_QUOTAON:
2318 case Q_QUOTAOFF:
2319 case Q_SETINFO:
2320 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002321 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002322 break;
2323 case Q_GETFMT:
2324 case Q_GETINFO:
2325 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002326 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002327 break;
2328 default:
2329 rc = 0; /* let the kernel handle invalid cmds */
2330 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002331 }
2332 return rc;
2333}
2334
2335static int selinux_quota_on(struct dentry *dentry)
2336{
David Howells88e67f32008-11-14 10:39:21 +11002337 const struct cred *cred = current_cred();
2338
Eric Paris2875fa02011-04-28 16:04:24 -04002339 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002340}
2341
Eric Paris12b30522010-11-15 18:36:29 -05002342static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002343{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002344 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002345 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2346 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002347 return avc_has_perm(&selinux_state,
2348 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002349 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002350 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2351 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2352 /* Set level of messages printed to console */
2353 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002354 return avc_has_perm(&selinux_state,
2355 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002356 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2357 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002358 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002359 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002360 return avc_has_perm(&selinux_state,
2361 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002362 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002363}
2364
2365/*
2366 * Check that a process has enough memory to allocate a new virtual
2367 * mapping. 0 means there is enough memory for the allocation to
2368 * succeed and -ENOMEM implies there is not.
2369 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002370 * Do not audit the selinux permission check, as this is applied to all
2371 * processes that allocate mappings.
2372 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002373static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002374{
2375 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002376
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002377 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002378 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002379 if (rc == 0)
2380 cap_sys_admin = 1;
2381
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002382 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002383}
2384
2385/* binprm security operations */
2386
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002387static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002388{
2389 u32 sid = 0;
2390 struct task_struct *tracer;
2391
2392 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002393 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002394 if (tracer)
2395 sid = task_sid(tracer);
2396 rcu_read_unlock();
2397
2398 return sid;
2399}
2400
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002401static int check_nnp_nosuid(const struct linux_binprm *bprm,
2402 const struct task_security_struct *old_tsec,
2403 const struct task_security_struct *new_tsec)
2404{
2405 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002406 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002407 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002408 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002409
2410 if (!nnp && !nosuid)
2411 return 0; /* neither NNP nor nosuid */
2412
2413 if (new_tsec->sid == old_tsec->sid)
2414 return 0; /* No change in credentials */
2415
2416 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002417 * If the policy enables the nnp_nosuid_transition policy capability,
2418 * then we permit transitions under NNP or nosuid if the
2419 * policy allows the corresponding permission between
2420 * the old and new contexts.
2421 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002422 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002423 av = 0;
2424 if (nnp)
2425 av |= PROCESS2__NNP_TRANSITION;
2426 if (nosuid)
2427 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002428 rc = avc_has_perm(&selinux_state,
2429 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002430 SECCLASS_PROCESS2, av, NULL);
2431 if (!rc)
2432 return 0;
2433 }
2434
2435 /*
2436 * We also permit NNP or nosuid transitions to bounded SIDs,
2437 * i.e. SIDs that are guaranteed to only be allowed a subset
2438 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002439 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002440 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2441 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002442 if (!rc)
2443 return 0;
2444
2445 /*
2446 * On failure, preserve the errno values for NNP vs nosuid.
2447 * NNP: Operation not permitted for caller.
2448 * nosuid: Permission denied to file.
2449 */
2450 if (nnp)
2451 return -EPERM;
2452 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002453}
2454
David Howellsa6f76f22008-11-14 10:39:24 +11002455static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002456{
David Howellsa6f76f22008-11-14 10:39:24 +11002457 const struct task_security_struct *old_tsec;
2458 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002459 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002460 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002461 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002462 int rc;
2463
David Howellsa6f76f22008-11-14 10:39:24 +11002464 /* SELinux context only depends on initial program or script and not
2465 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002466 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002467 return 0;
2468
David Howellsa6f76f22008-11-14 10:39:24 +11002469 old_tsec = current_security();
2470 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002471 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002472
2473 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002474 new_tsec->sid = old_tsec->sid;
2475 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002476
Michael LeMay28eba5b2006-06-27 02:53:42 -07002477 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002478 new_tsec->create_sid = 0;
2479 new_tsec->keycreate_sid = 0;
2480 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002481
David Howellsa6f76f22008-11-14 10:39:24 +11002482 if (old_tsec->exec_sid) {
2483 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002484 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002485 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002486
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002487 /* Fail on NNP or nosuid if not an allowed transition. */
2488 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2489 if (rc)
2490 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002491 } else {
2492 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002493 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2494 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002495 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002496 if (rc)
2497 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002498
2499 /*
2500 * Fallback to old SID on NNP or nosuid if not an allowed
2501 * transition.
2502 */
2503 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2504 if (rc)
2505 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002506 }
2507
Vivek Goyal43af5de2016-09-09 11:37:49 -04002508 ad.type = LSM_AUDIT_DATA_FILE;
2509 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002510
David Howellsa6f76f22008-11-14 10:39:24 +11002511 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002512 rc = avc_has_perm(&selinux_state,
2513 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002514 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2515 if (rc)
2516 return rc;
2517 } else {
2518 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002519 rc = avc_has_perm(&selinux_state,
2520 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002521 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2522 if (rc)
2523 return rc;
2524
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002525 rc = avc_has_perm(&selinux_state,
2526 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002527 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2528 if (rc)
2529 return rc;
2530
David Howellsa6f76f22008-11-14 10:39:24 +11002531 /* Check for shared state */
2532 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002533 rc = avc_has_perm(&selinux_state,
2534 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002535 SECCLASS_PROCESS, PROCESS__SHARE,
2536 NULL);
2537 if (rc)
2538 return -EPERM;
2539 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002540
David Howellsa6f76f22008-11-14 10:39:24 +11002541 /* Make sure that anyone attempting to ptrace over a task that
2542 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002543 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002544 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002545 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002546 rc = avc_has_perm(&selinux_state,
2547 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002548 SECCLASS_PROCESS,
2549 PROCESS__PTRACE, NULL);
2550 if (rc)
2551 return -EPERM;
2552 }
2553 }
2554
2555 /* Clear any possibly unsafe personality bits on exec: */
2556 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002557
Linus Torvalds1da177e2005-04-16 15:20:36 -07002558 /* Enable secure mode for SIDs transitions unless
2559 the noatsecure permission is granted between
2560 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002561 rc = avc_has_perm(&selinux_state,
2562 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002563 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2564 NULL);
2565 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002566 }
2567
Kees Cook62874c32017-07-18 15:25:25 -07002568 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002569}
2570
Al Viroc3c073f2012-08-21 22:32:06 -04002571static int match_file(const void *p, struct file *file, unsigned fd)
2572{
2573 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2574}
2575
Linus Torvalds1da177e2005-04-16 15:20:36 -07002576/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002577static inline void flush_unauthorized_files(const struct cred *cred,
2578 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002579{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002580 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002581 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002582 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002583 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002584
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002585 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002586 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002587 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002588 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002589 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002590
Linus Torvalds1da177e2005-04-16 15:20:36 -07002591 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002592 Use file_path_has_perm on the tty path directly
2593 rather than using file_has_perm, as this particular
2594 open file may belong to another process and we are
2595 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002596 file_priv = list_first_entry(&tty->tty_files,
2597 struct tty_file_private, list);
2598 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002599 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002600 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002601 }
Peter Hurley4a510962016-01-09 21:35:23 -08002602 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002603 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002604 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002605 /* Reset controlling tty. */
2606 if (drop_tty)
2607 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002608
2609 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002610 n = iterate_fd(files, 0, match_file, cred);
2611 if (!n) /* none found? */
2612 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002613
Al Viroc3c073f2012-08-21 22:32:06 -04002614 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002615 if (IS_ERR(devnull))
2616 devnull = NULL;
2617 /* replace all the matching ones with this */
2618 do {
2619 replace_fd(n - 1, devnull, 0);
2620 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2621 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002622 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002623}
2624
Linus Torvalds1da177e2005-04-16 15:20:36 -07002625/*
David Howellsa6f76f22008-11-14 10:39:24 +11002626 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002627 */
David Howellsa6f76f22008-11-14 10:39:24 +11002628static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002629{
David Howellsa6f76f22008-11-14 10:39:24 +11002630 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002631 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002632 int rc, i;
2633
David Howellsa6f76f22008-11-14 10:39:24 +11002634 new_tsec = bprm->cred->security;
2635 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002636 return;
2637
2638 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002639 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002640
David Howellsa6f76f22008-11-14 10:39:24 +11002641 /* Always clear parent death signal on SID transitions. */
2642 current->pdeath_signal = 0;
2643
2644 /* Check whether the new SID can inherit resource limits from the old
2645 * SID. If not, reset all soft limits to the lower of the current
2646 * task's hard limit and the init task's soft limit.
2647 *
2648 * Note that the setting of hard limits (even to lower them) can be
2649 * controlled by the setrlimit check. The inclusion of the init task's
2650 * soft limit into the computation is to avoid resetting soft limits
2651 * higher than the default soft limit for cases where the default is
2652 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2653 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002654 rc = avc_has_perm(&selinux_state,
2655 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002656 PROCESS__RLIMITINH, NULL);
2657 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002658 /* protect against do_prlimit() */
2659 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002660 for (i = 0; i < RLIM_NLIMITS; i++) {
2661 rlim = current->signal->rlim + i;
2662 initrlim = init_task.signal->rlim + i;
2663 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2664 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002665 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002666 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2667 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002668 }
2669}
2670
2671/*
2672 * Clean up the process immediately after the installation of new credentials
2673 * due to exec
2674 */
2675static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2676{
2677 const struct task_security_struct *tsec = current_security();
2678 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002679 u32 osid, sid;
2680 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002681
David Howellsa6f76f22008-11-14 10:39:24 +11002682 osid = tsec->osid;
2683 sid = tsec->sid;
2684
2685 if (sid == osid)
2686 return;
2687
2688 /* Check whether the new SID can inherit signal state from the old SID.
2689 * If not, clear itimers to avoid subsequent signal generation and
2690 * flush and unblock signals.
2691 *
2692 * This must occur _after_ the task SID has been updated so that any
2693 * kill done after the flush will be checked against the new SID.
2694 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002695 rc = avc_has_perm(&selinux_state,
2696 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002697 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002698 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2699 memset(&itimer, 0, sizeof itimer);
2700 for (i = 0; i < 3; i++)
2701 do_setitimer(i, &itimer, NULL);
2702 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002703 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002704 if (!fatal_signal_pending(current)) {
2705 flush_sigqueue(&current->pending);
2706 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002707 flush_signal_handlers(current, 1);
2708 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002709 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002710 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002711 spin_unlock_irq(&current->sighand->siglock);
2712 }
2713
David Howellsa6f76f22008-11-14 10:39:24 +11002714 /* Wake up the parent if it is waiting so that it can recheck
2715 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002716 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002717 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002718 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002719}
2720
2721/* superblock security operations */
2722
2723static int selinux_sb_alloc_security(struct super_block *sb)
2724{
2725 return superblock_alloc_security(sb);
2726}
2727
2728static void selinux_sb_free_security(struct super_block *sb)
2729{
2730 superblock_free_security(sb);
2731}
2732
2733static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2734{
2735 if (plen > olen)
2736 return 0;
2737
2738 return !memcmp(prefix, option, plen);
2739}
2740
2741static inline int selinux_option(char *option, int len)
2742{
Eric Paris832cbd92008-04-01 13:24:09 -04002743 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2744 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2745 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002746 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2747 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002748}
2749
2750static inline void take_option(char **to, char *from, int *first, int len)
2751{
2752 if (!*first) {
2753 **to = ',';
2754 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002755 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002756 *first = 0;
2757 memcpy(*to, from, len);
2758 *to += len;
2759}
2760
Eric Paris828dfe12008-04-17 13:17:49 -04002761static inline void take_selinux_option(char **to, char *from, int *first,
2762 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002763{
2764 int current_size = 0;
2765
2766 if (!*first) {
2767 **to = '|';
2768 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002769 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002770 *first = 0;
2771
2772 while (current_size < len) {
2773 if (*from != '"') {
2774 **to = *from;
2775 *to += 1;
2776 }
2777 from += 1;
2778 current_size += 1;
2779 }
2780}
2781
Eric Parise0007522008-03-05 10:31:54 -05002782static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002783{
2784 int fnosec, fsec, rc = 0;
2785 char *in_save, *in_curr, *in_end;
2786 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002787 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002788
2789 in_curr = orig;
2790 sec_curr = copy;
2791
Linus Torvalds1da177e2005-04-16 15:20:36 -07002792 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2793 if (!nosec) {
2794 rc = -ENOMEM;
2795 goto out;
2796 }
2797
2798 nosec_save = nosec;
2799 fnosec = fsec = 1;
2800 in_save = in_end = orig;
2801
2802 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002803 if (*in_end == '"')
2804 open_quote = !open_quote;
2805 if ((*in_end == ',' && open_quote == 0) ||
2806 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002807 int len = in_end - in_curr;
2808
2809 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002810 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002811 else
2812 take_option(&nosec, in_curr, &fnosec, len);
2813
2814 in_curr = in_end + 1;
2815 }
2816 } while (*in_end++);
2817
Eric Paris6931dfc2005-06-30 02:58:51 -07002818 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002819 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002820out:
2821 return rc;
2822}
2823
Eric Paris026eb162011-03-03 16:09:14 -05002824static int selinux_sb_remount(struct super_block *sb, void *data)
2825{
2826 int rc, i, *flags;
2827 struct security_mnt_opts opts;
2828 char *secdata, **mount_options;
2829 struct superblock_security_struct *sbsec = sb->s_security;
2830
2831 if (!(sbsec->flags & SE_SBINITIALIZED))
2832 return 0;
2833
2834 if (!data)
2835 return 0;
2836
2837 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2838 return 0;
2839
2840 security_init_mnt_opts(&opts);
2841 secdata = alloc_secdata();
2842 if (!secdata)
2843 return -ENOMEM;
2844 rc = selinux_sb_copy_data(data, secdata);
2845 if (rc)
2846 goto out_free_secdata;
2847
2848 rc = selinux_parse_opts_str(secdata, &opts);
2849 if (rc)
2850 goto out_free_secdata;
2851
2852 mount_options = opts.mnt_opts;
2853 flags = opts.mnt_opts_flags;
2854
2855 for (i = 0; i < opts.num_mnt_opts; i++) {
2856 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002857
Eric Paris12f348b2012-10-09 10:56:25 -04002858 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002859 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002860 rc = security_context_str_to_sid(&selinux_state,
2861 mount_options[i], &sid,
2862 GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002863 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002864 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002865 "(%s) failed for (dev %s, type %s) errno=%d\n",
2866 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002867 goto out_free_opts;
2868 }
2869 rc = -EINVAL;
2870 switch (flags[i]) {
2871 case FSCONTEXT_MNT:
2872 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2873 goto out_bad_option;
2874 break;
2875 case CONTEXT_MNT:
2876 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2877 goto out_bad_option;
2878 break;
2879 case ROOTCONTEXT_MNT: {
2880 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002881 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002882
2883 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2884 goto out_bad_option;
2885 break;
2886 }
2887 case DEFCONTEXT_MNT:
2888 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2889 goto out_bad_option;
2890 break;
2891 default:
2892 goto out_free_opts;
2893 }
2894 }
2895
2896 rc = 0;
2897out_free_opts:
2898 security_free_mnt_opts(&opts);
2899out_free_secdata:
2900 free_secdata(secdata);
2901 return rc;
2902out_bad_option:
2903 printk(KERN_WARNING "SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002904 "during remount (dev %s, type=%s)\n", sb->s_id,
2905 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002906 goto out_free_opts;
2907}
2908
James Morris12204e22008-12-19 10:44:42 +11002909static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002910{
David Howells88e67f32008-11-14 10:39:21 +11002911 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002912 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002913 int rc;
2914
2915 rc = superblock_doinit(sb, data);
2916 if (rc)
2917 return rc;
2918
James Morris74192242008-12-19 11:41:10 +11002919 /* Allow all mounts performed by the kernel */
2920 if (flags & MS_KERNMOUNT)
2921 return 0;
2922
Eric Paris50c205f2012-04-04 15:01:43 -04002923 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002924 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002925 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002926}
2927
David Howells726c3342006-06-23 02:02:58 -07002928static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002929{
David Howells88e67f32008-11-14 10:39:21 +11002930 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002931 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002932
Eric Paris50c205f2012-04-04 15:01:43 -04002933 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002934 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002935 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002936}
2937
Al Viro808d4e32012-10-11 11:42:01 -04002938static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002939 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002940 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002941 unsigned long flags,
2942 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002943{
David Howells88e67f32008-11-14 10:39:21 +11002944 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002945
2946 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002947 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002948 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002949 else
Eric Paris2875fa02011-04-28 16:04:24 -04002950 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002951}
2952
2953static int selinux_umount(struct vfsmount *mnt, int flags)
2954{
David Howells88e67f32008-11-14 10:39:21 +11002955 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002956
David Howells88e67f32008-11-14 10:39:21 +11002957 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002958 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002959}
2960
2961/* inode security operations */
2962
2963static int selinux_inode_alloc_security(struct inode *inode)
2964{
2965 return inode_alloc_security(inode);
2966}
2967
2968static void selinux_inode_free_security(struct inode *inode)
2969{
2970 inode_free_security(inode);
2971}
2972
David Quigleyd47be3d2013-05-22 12:50:34 -04002973static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002974 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002975 u32 *ctxlen)
2976{
David Quigleyd47be3d2013-05-22 12:50:34 -04002977 u32 newsid;
2978 int rc;
2979
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002980 rc = selinux_determine_inode_label(current_security(),
2981 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002982 inode_mode_to_security_class(mode),
2983 &newsid);
2984 if (rc)
2985 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002986
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002987 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2988 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002989}
2990
Vivek Goyala518b0a2016-07-13 10:44:53 -04002991static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2992 struct qstr *name,
2993 const struct cred *old,
2994 struct cred *new)
2995{
2996 u32 newsid;
2997 int rc;
2998 struct task_security_struct *tsec;
2999
3000 rc = selinux_determine_inode_label(old->security,
3001 d_inode(dentry->d_parent), name,
3002 inode_mode_to_security_class(mode),
3003 &newsid);
3004 if (rc)
3005 return rc;
3006
3007 tsec = new->security;
3008 tsec->create_sid = newsid;
3009 return 0;
3010}
3011
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003012static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09003013 const struct qstr *qstr,
3014 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05003015 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003016{
Paul Moore5fb49872010-04-22 14:46:19 -04003017 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003018 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02003019 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003020 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09003021 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003022
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003023 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003024
David Howells275bb412008-11-14 10:39:19 +11003025 newsid = tsec->create_sid;
3026
Vivek Goyalc957f6d2016-07-13 10:44:51 -04003027 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04003028 dir, qstr,
3029 inode_mode_to_security_class(inode->i_mode),
3030 &newsid);
3031 if (rc)
3032 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003033
Eric Paris296fddf2006-09-25 23:32:00 -07003034 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05003035 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07003036 struct inode_security_struct *isec = inode->i_security;
3037 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3038 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003039 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07003040 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003041
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003042 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08003043 return -EOPNOTSUPP;
3044
Tetsuo Handa95489062013-07-25 05:44:02 +09003045 if (name)
3046 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003047
3048 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003049 rc = security_sid_to_context_force(&selinux_state, newsid,
3050 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003051 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003052 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003053 *value = context;
3054 *len = clen;
3055 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003056
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003057 return 0;
3058}
3059
Al Viro4acdaf22011-07-26 01:42:34 -04003060static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003061{
3062 return may_create(dir, dentry, SECCLASS_FILE);
3063}
3064
Linus Torvalds1da177e2005-04-16 15:20:36 -07003065static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3066{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003067 return may_link(dir, old_dentry, MAY_LINK);
3068}
3069
Linus Torvalds1da177e2005-04-16 15:20:36 -07003070static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3071{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003072 return may_link(dir, dentry, MAY_UNLINK);
3073}
3074
3075static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3076{
3077 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3078}
3079
Al Viro18bb1db2011-07-26 01:41:39 -04003080static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003081{
3082 return may_create(dir, dentry, SECCLASS_DIR);
3083}
3084
Linus Torvalds1da177e2005-04-16 15:20:36 -07003085static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3086{
3087 return may_link(dir, dentry, MAY_RMDIR);
3088}
3089
Al Viro1a67aaf2011-07-26 01:52:52 -04003090static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003091{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003092 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3093}
3094
Linus Torvalds1da177e2005-04-16 15:20:36 -07003095static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003096 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003097{
3098 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3099}
3100
Linus Torvalds1da177e2005-04-16 15:20:36 -07003101static int selinux_inode_readlink(struct dentry *dentry)
3102{
David Howells88e67f32008-11-14 10:39:21 +11003103 const struct cred *cred = current_cred();
3104
Eric Paris2875fa02011-04-28 16:04:24 -04003105 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003106}
3107
NeilBrownbda0be72015-03-23 13:37:39 +11003108static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3109 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003110{
David Howells88e67f32008-11-14 10:39:21 +11003111 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003112 struct common_audit_data ad;
3113 struct inode_security_struct *isec;
3114 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003115
NeilBrownbda0be72015-03-23 13:37:39 +11003116 validate_creds(cred);
3117
3118 ad.type = LSM_AUDIT_DATA_DENTRY;
3119 ad.u.dentry = dentry;
3120 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003121 isec = inode_security_rcu(inode, rcu);
3122 if (IS_ERR(isec))
3123 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003124
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003125 return avc_has_perm_flags(&selinux_state,
3126 sid, isec->sid, isec->sclass, FILE__READ, &ad,
NeilBrownbda0be72015-03-23 13:37:39 +11003127 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003128}
3129
Eric Parisd4cf970d2012-04-04 15:01:42 -04003130static noinline int audit_inode_permission(struct inode *inode,
3131 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003132 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003133 unsigned flags)
3134{
3135 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003136 struct inode_security_struct *isec = inode->i_security;
3137 int rc;
3138
Eric Paris50c205f2012-04-04 15:01:43 -04003139 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003140 ad.u.inode = inode;
3141
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003142 rc = slow_avc_audit(&selinux_state,
3143 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003144 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003145 if (rc)
3146 return rc;
3147 return 0;
3148}
3149
Al Viroe74f71e2011-06-20 19:38:15 -04003150static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003151{
David Howells88e67f32008-11-14 10:39:21 +11003152 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003153 u32 perms;
3154 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003155 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003156 struct inode_security_struct *isec;
3157 u32 sid;
3158 struct av_decision avd;
3159 int rc, rc2;
3160 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003161
Eric Parisb782e0a2010-07-23 11:44:03 -04003162 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003163 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3164
Eric Parisb782e0a2010-07-23 11:44:03 -04003165 /* No permission to check. Existence test. */
3166 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003167 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003168
Eric Paris2e334052012-04-04 15:01:42 -04003169 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003170
Eric Paris2e334052012-04-04 15:01:42 -04003171 if (unlikely(IS_PRIVATE(inode)))
3172 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003173
3174 perms = file_mask_to_av(inode->i_mode, mask);
3175
Eric Paris2e334052012-04-04 15:01:42 -04003176 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003177 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3178 if (IS_ERR(isec))
3179 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003180
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003181 rc = avc_has_perm_noaudit(&selinux_state,
3182 sid, isec->sid, isec->sclass, perms, 0, &avd);
Eric Paris2e334052012-04-04 15:01:42 -04003183 audited = avc_audit_required(perms, &avd, rc,
3184 from_access ? FILE__AUDIT_ACCESS : 0,
3185 &denied);
3186 if (likely(!audited))
3187 return rc;
3188
Stephen Smalley626b9742014-04-29 11:29:04 -07003189 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003190 if (rc2)
3191 return rc2;
3192 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003193}
3194
3195static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3196{
David Howells88e67f32008-11-14 10:39:21 +11003197 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003198 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003199 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003200 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003201
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003202 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3203 if (ia_valid & ATTR_FORCE) {
3204 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3205 ATTR_FORCE);
3206 if (!ia_valid)
3207 return 0;
3208 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003209
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003210 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3211 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003212 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003213
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003214 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003215 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3216 (ia_valid & ATTR_SIZE) &&
3217 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003218 av |= FILE__OPEN;
3219
3220 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003221}
3222
Al Viro3f7036a2015-03-08 19:28:30 -04003223static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003224{
Al Viro3f7036a2015-03-08 19:28:30 -04003225 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003226}
3227
Stephen Smalleydb590002017-04-20 11:31:30 -04003228static bool has_cap_mac_admin(bool audit)
3229{
3230 const struct cred *cred = current_cred();
3231 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3232
3233 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3234 return false;
3235 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3236 return false;
3237 return true;
3238}
3239
David Howells8f0cfa52008-04-29 00:59:41 -07003240static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3241 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003242{
David Howellsc6f493d2015-03-17 22:26:22 +00003243 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003244 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003245 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003246 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003247 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003248 int rc = 0;
3249
Eric W. Biederman6b240302017-10-02 09:38:20 -05003250 if (strcmp(name, XATTR_NAME_SELINUX)) {
3251 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3252 if (rc)
3253 return rc;
3254
3255 /* Not an attribute we recognize, so just check the
3256 ordinary setattr permission. */
3257 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3258 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003259
3260 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003261 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003262 return -EOPNOTSUPP;
3263
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003264 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003265 return -EPERM;
3266
Eric Paris50c205f2012-04-04 15:01:43 -04003267 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003268 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003269
Paul Moore20cdef82016-04-04 14:14:42 -04003270 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003271 rc = avc_has_perm(&selinux_state,
3272 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003273 FILE__RELABELFROM, &ad);
3274 if (rc)
3275 return rc;
3276
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003277 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3278 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003279 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003280 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003281 struct audit_buffer *ab;
3282 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003283
3284 /* We strip a nul only if it is at the end, otherwise the
3285 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003286 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003287 const char *str = value;
3288
Al Viroe3fea3f2012-06-09 08:15:16 +01003289 if (str[size - 1] == '\0')
3290 audit_size = size - 1;
3291 else
3292 audit_size = size;
3293 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003294 audit_size = 0;
3295 }
Eric Parisd6ea83e2012-04-04 13:45:49 -04003296 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3297 audit_log_format(ab, "op=setxattr invalid_context=");
3298 audit_log_n_untrustedstring(ab, value, audit_size);
3299 audit_log_end(ab);
3300
Stephen Smalley12b29f32008-05-07 13:03:20 -04003301 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003302 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003303 rc = security_context_to_sid_force(&selinux_state, value,
3304 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003305 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003306 if (rc)
3307 return rc;
3308
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003309 rc = avc_has_perm(&selinux_state,
3310 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003311 FILE__RELABELTO, &ad);
3312 if (rc)
3313 return rc;
3314
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003315 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3316 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003317 if (rc)
3318 return rc;
3319
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003320 return avc_has_perm(&selinux_state,
3321 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003322 sbsec->sid,
3323 SECCLASS_FILESYSTEM,
3324 FILESYSTEM__ASSOCIATE,
3325 &ad);
3326}
3327
David Howells8f0cfa52008-04-29 00:59:41 -07003328static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003329 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003330 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003331{
David Howellsc6f493d2015-03-17 22:26:22 +00003332 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003333 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003334 u32 newsid;
3335 int rc;
3336
3337 if (strcmp(name, XATTR_NAME_SELINUX)) {
3338 /* Not an attribute we recognize, so nothing to do. */
3339 return;
3340 }
3341
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003342 rc = security_context_to_sid_force(&selinux_state, value, size,
3343 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003344 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003345 printk(KERN_ERR "SELinux: unable to map context to SID"
3346 "for (%s, %lu), rc=%d\n",
3347 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003348 return;
3349 }
3350
Paul Moore20cdef82016-04-04 14:14:42 -04003351 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003352 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003353 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003354 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003355 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003356 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003357
Linus Torvalds1da177e2005-04-16 15:20:36 -07003358 return;
3359}
3360
David Howells8f0cfa52008-04-29 00:59:41 -07003361static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003362{
David Howells88e67f32008-11-14 10:39:21 +11003363 const struct cred *cred = current_cred();
3364
Eric Paris2875fa02011-04-28 16:04:24 -04003365 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003366}
3367
Eric Paris828dfe12008-04-17 13:17:49 -04003368static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003369{
David Howells88e67f32008-11-14 10:39:21 +11003370 const struct cred *cred = current_cred();
3371
Eric Paris2875fa02011-04-28 16:04:24 -04003372 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003373}
3374
David Howells8f0cfa52008-04-29 00:59:41 -07003375static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003376{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003377 if (strcmp(name, XATTR_NAME_SELINUX)) {
3378 int rc = cap_inode_removexattr(dentry, name);
3379 if (rc)
3380 return rc;
3381
3382 /* Not an attribute we recognize, so just check the
3383 ordinary setattr permission. */
3384 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3385 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003386
3387 /* No one is allowed to remove a SELinux security label.
3388 You can change the label, but all data must be labeled. */
3389 return -EACCES;
3390}
3391
James Morrisd381d8a2005-10-30 14:59:22 -08003392/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003393 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003394 *
3395 * Permission check is handled by selinux_inode_getxattr hook.
3396 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003397static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003398{
David P. Quigley42492592008-02-04 22:29:39 -08003399 u32 size;
3400 int error;
3401 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003402 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003403
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003404 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3405 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003406
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003407 /*
3408 * If the caller has CAP_MAC_ADMIN, then get the raw context
3409 * value even if it is not defined by current policy; otherwise,
3410 * use the in-core value under current policy.
3411 * Use the non-auditing forms of the permission checks since
3412 * getxattr may be called by unprivileged processes commonly
3413 * and lack of permission just means that we fall back to the
3414 * in-core context value, not a denial.
3415 */
Paul Moore20cdef82016-04-04 14:14:42 -04003416 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003417 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003418 error = security_sid_to_context_force(&selinux_state,
3419 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003420 &size);
3421 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003422 error = security_sid_to_context(&selinux_state, isec->sid,
3423 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003424 if (error)
3425 return error;
3426 error = size;
3427 if (alloc) {
3428 *buffer = context;
3429 goto out_nofree;
3430 }
3431 kfree(context);
3432out_nofree:
3433 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003434}
3435
3436static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003437 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003438{
Paul Moore2c971652016-04-19 16:36:28 -04003439 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003440 u32 newsid;
3441 int rc;
3442
3443 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3444 return -EOPNOTSUPP;
3445
3446 if (!value || !size)
3447 return -EACCES;
3448
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003449 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3450 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003451 if (rc)
3452 return rc;
3453
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003454 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003455 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003456 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003457 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003458 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003459 return 0;
3460}
3461
3462static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3463{
3464 const int len = sizeof(XATTR_NAME_SELINUX);
3465 if (buffer && len <= buffer_size)
3466 memcpy(buffer, XATTR_NAME_SELINUX, len);
3467 return len;
3468}
3469
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003470static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003471{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003472 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003473 *secid = isec->sid;
3474}
3475
Vivek Goyal56909eb2016-07-13 10:44:48 -04003476static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3477{
3478 u32 sid;
3479 struct task_security_struct *tsec;
3480 struct cred *new_creds = *new;
3481
3482 if (new_creds == NULL) {
3483 new_creds = prepare_creds();
3484 if (!new_creds)
3485 return -ENOMEM;
3486 }
3487
3488 tsec = new_creds->security;
3489 /* Get label from overlay inode and set it in create_sid */
3490 selinux_inode_getsecid(d_inode(src), &sid);
3491 tsec->create_sid = sid;
3492 *new = new_creds;
3493 return 0;
3494}
3495
Vivek Goyal19472b62016-07-13 10:44:50 -04003496static int selinux_inode_copy_up_xattr(const char *name)
3497{
3498 /* The copy_up hook above sets the initial context on an inode, but we
3499 * don't then want to overwrite it by blindly copying all the lower
3500 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3501 */
3502 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3503 return 1; /* Discard */
3504 /*
3505 * Any other attribute apart from SELINUX is not claimed, supported
3506 * by selinux.
3507 */
3508 return -EOPNOTSUPP;
3509}
3510
Linus Torvalds1da177e2005-04-16 15:20:36 -07003511/* file security operations */
3512
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003513static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003514{
David Howells88e67f32008-11-14 10:39:21 +11003515 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003516 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003517
Linus Torvalds1da177e2005-04-16 15:20:36 -07003518 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3519 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3520 mask |= MAY_APPEND;
3521
Paul Moore389fb8002009-03-27 17:10:34 -04003522 return file_has_perm(cred, file,
3523 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003524}
3525
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003526static int selinux_file_permission(struct file *file, int mask)
3527{
Al Viro496ad9a2013-01-23 17:07:38 -05003528 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003529 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003530 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003531 u32 sid = current_sid();
3532
Paul Moore389fb8002009-03-27 17:10:34 -04003533 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003534 /* No permission to check. Existence test. */
3535 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003536
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003537 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003538 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003539 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003540 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003541 return 0;
3542
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003543 return selinux_revalidate_file_permission(file, mask);
3544}
3545
Linus Torvalds1da177e2005-04-16 15:20:36 -07003546static int selinux_file_alloc_security(struct file *file)
3547{
3548 return file_alloc_security(file);
3549}
3550
3551static void selinux_file_free_security(struct file *file)
3552{
3553 file_free_security(file);
3554}
3555
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003556/*
3557 * Check whether a task has the ioctl permission and cmd
3558 * operation to an inode.
3559 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003560static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003561 u32 requested, u16 cmd)
3562{
3563 struct common_audit_data ad;
3564 struct file_security_struct *fsec = file->f_security;
3565 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003566 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003567 struct lsm_ioctlop_audit ioctl;
3568 u32 ssid = cred_sid(cred);
3569 int rc;
3570 u8 driver = cmd >> 8;
3571 u8 xperm = cmd & 0xff;
3572
3573 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3574 ad.u.op = &ioctl;
3575 ad.u.op->cmd = cmd;
3576 ad.u.op->path = file->f_path;
3577
3578 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003579 rc = avc_has_perm(&selinux_state,
3580 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003581 SECCLASS_FD,
3582 FD__USE,
3583 &ad);
3584 if (rc)
3585 goto out;
3586 }
3587
3588 if (unlikely(IS_PRIVATE(inode)))
3589 return 0;
3590
Paul Moore20cdef82016-04-04 14:14:42 -04003591 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003592 rc = avc_has_extended_perms(&selinux_state,
3593 ssid, isec->sid, isec->sclass,
3594 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003595out:
3596 return rc;
3597}
3598
Linus Torvalds1da177e2005-04-16 15:20:36 -07003599static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3600 unsigned long arg)
3601{
David Howells88e67f32008-11-14 10:39:21 +11003602 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003603 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003604
Eric Paris0b24dcb2011-02-25 15:39:20 -05003605 switch (cmd) {
3606 case FIONREAD:
3607 /* fall through */
3608 case FIBMAP:
3609 /* fall through */
3610 case FIGETBSZ:
3611 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003612 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003613 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003614 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003615 error = file_has_perm(cred, file, FILE__GETATTR);
3616 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003617
Al Viro2f99c362012-03-23 16:04:05 -04003618 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003619 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003620 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003621 error = file_has_perm(cred, file, FILE__SETATTR);
3622 break;
3623
3624 /* sys_ioctl() checks */
3625 case FIONBIO:
3626 /* fall through */
3627 case FIOASYNC:
3628 error = file_has_perm(cred, file, 0);
3629 break;
3630
3631 case KDSKBENT:
3632 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003633 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003634 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003635 break;
3636
3637 /* default case assumes that the command will go
3638 * to the file's ioctl() function.
3639 */
3640 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003641 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003642 }
3643 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003644}
3645
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003646static int default_noexec;
3647
Linus Torvalds1da177e2005-04-16 15:20:36 -07003648static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3649{
David Howells88e67f32008-11-14 10:39:21 +11003650 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003651 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003652 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003653
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003654 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003655 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3656 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003657 /*
3658 * We are making executable an anonymous mapping or a
3659 * private file mapping that will also be writable.
3660 * This has an additional check.
3661 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003662 rc = avc_has_perm(&selinux_state,
3663 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003664 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003665 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003666 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003667 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003668
3669 if (file) {
3670 /* read access is always possible with a mapping */
3671 u32 av = FILE__READ;
3672
3673 /* write access only matters if the mapping is shared */
3674 if (shared && (prot & PROT_WRITE))
3675 av |= FILE__WRITE;
3676
3677 if (prot & PROT_EXEC)
3678 av |= FILE__EXECUTE;
3679
David Howells88e67f32008-11-14 10:39:21 +11003680 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003681 }
David Howellsd84f4f92008-11-14 10:39:23 +11003682
3683error:
3684 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003685}
3686
Al Viroe5467852012-05-30 13:30:51 -04003687static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003688{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003689 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003690
3691 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3692 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003693 rc = avc_has_perm(&selinux_state,
3694 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003695 MEMPROTECT__MMAP_ZERO, NULL);
3696 }
3697
3698 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003699}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003700
Al Viroe5467852012-05-30 13:30:51 -04003701static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3702 unsigned long prot, unsigned long flags)
3703{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003704 struct common_audit_data ad;
3705 int rc;
3706
3707 if (file) {
3708 ad.type = LSM_AUDIT_DATA_FILE;
3709 ad.u.file = file;
3710 rc = inode_has_perm(current_cred(), file_inode(file),
3711 FILE__MAP, &ad);
3712 if (rc)
3713 return rc;
3714 }
3715
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003716 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003717 prot = reqprot;
3718
3719 return file_map_prot_check(file, prot,
3720 (flags & MAP_TYPE) == MAP_SHARED);
3721}
3722
3723static int selinux_file_mprotect(struct vm_area_struct *vma,
3724 unsigned long reqprot,
3725 unsigned long prot)
3726{
David Howells88e67f32008-11-14 10:39:21 +11003727 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003728 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003729
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003730 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003731 prot = reqprot;
3732
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003733 if (default_noexec &&
3734 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003735 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003736 if (vma->vm_start >= vma->vm_mm->start_brk &&
3737 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003738 rc = avc_has_perm(&selinux_state,
3739 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003740 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003741 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003742 ((vma->vm_start <= vma->vm_mm->start_stack &&
3743 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003744 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003745 rc = avc_has_perm(&selinux_state,
3746 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003747 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003748 } else if (vma->vm_file && vma->anon_vma) {
3749 /*
3750 * We are making executable a file mapping that has
3751 * had some COW done. Since pages might have been
3752 * written, check ability to execute the possibly
3753 * modified content. This typically should only
3754 * occur for text relocations.
3755 */
David Howellsd84f4f92008-11-14 10:39:23 +11003756 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003757 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003758 if (rc)
3759 return rc;
3760 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003761
3762 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3763}
3764
3765static int selinux_file_lock(struct file *file, unsigned int cmd)
3766{
David Howells88e67f32008-11-14 10:39:21 +11003767 const struct cred *cred = current_cred();
3768
3769 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003770}
3771
3772static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3773 unsigned long arg)
3774{
David Howells88e67f32008-11-14 10:39:21 +11003775 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003776 int err = 0;
3777
3778 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003779 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003780 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003781 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003782 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003783 }
3784 /* fall through */
3785 case F_SETOWN:
3786 case F_SETSIG:
3787 case F_GETFL:
3788 case F_GETOWN:
3789 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003790 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003791 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003792 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003793 break;
3794 case F_GETLK:
3795 case F_SETLK:
3796 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003797 case F_OFD_GETLK:
3798 case F_OFD_SETLK:
3799 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003800#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003801 case F_GETLK64:
3802 case F_SETLK64:
3803 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003804#endif
David Howells88e67f32008-11-14 10:39:21 +11003805 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003806 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003807 }
3808
3809 return err;
3810}
3811
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003812static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003813{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003814 struct file_security_struct *fsec;
3815
Linus Torvalds1da177e2005-04-16 15:20:36 -07003816 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003817 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003818}
3819
3820static int selinux_file_send_sigiotask(struct task_struct *tsk,
3821 struct fown_struct *fown, int signum)
3822{
Eric Paris828dfe12008-04-17 13:17:49 -04003823 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003824 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003825 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003826 struct file_security_struct *fsec;
3827
3828 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003829 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003830
Linus Torvalds1da177e2005-04-16 15:20:36 -07003831 fsec = file->f_security;
3832
3833 if (!signum)
3834 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3835 else
3836 perm = signal_to_av(signum);
3837
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003838 return avc_has_perm(&selinux_state,
3839 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003840 SECCLASS_PROCESS, perm, NULL);
3841}
3842
3843static int selinux_file_receive(struct file *file)
3844{
David Howells88e67f32008-11-14 10:39:21 +11003845 const struct cred *cred = current_cred();
3846
3847 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003848}
3849
Eric Paris83d49852012-04-04 13:45:40 -04003850static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003851{
3852 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003853 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003854
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003855 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003856 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003857 /*
3858 * Save inode label and policy sequence number
3859 * at open-time so that selinux_file_permission
3860 * can determine whether revalidation is necessary.
3861 * Task label is already saved in the file security
3862 * struct as its SID.
3863 */
3864 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003865 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003866 /*
3867 * Since the inode label or policy seqno may have changed
3868 * between the selinux_inode_permission check and the saving
3869 * of state above, recheck that access is still permitted.
3870 * Otherwise, access might never be revalidated against the
3871 * new inode label or new policy.
3872 * This check is not redundant - do not remove.
3873 */
David Howells13f8e982013-06-13 23:37:55 +01003874 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003875}
3876
Linus Torvalds1da177e2005-04-16 15:20:36 -07003877/* task security operations */
3878
Tetsuo Handaa79be232017-03-28 23:08:45 +09003879static int selinux_task_alloc(struct task_struct *task,
3880 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003881{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003882 u32 sid = current_sid();
3883
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003884 return avc_has_perm(&selinux_state,
3885 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003886}
3887
David Howellsf1752ee2008-11-14 10:39:17 +11003888/*
David Howellsee18d642009-09-02 09:14:21 +01003889 * allocate the SELinux part of blank credentials
3890 */
3891static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3892{
3893 struct task_security_struct *tsec;
3894
3895 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3896 if (!tsec)
3897 return -ENOMEM;
3898
3899 cred->security = tsec;
3900 return 0;
3901}
3902
3903/*
David Howellsf1752ee2008-11-14 10:39:17 +11003904 * detach and free the LSM part of a set of credentials
3905 */
3906static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003907{
David Howellsf1752ee2008-11-14 10:39:17 +11003908 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003909
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003910 /*
3911 * cred->security == NULL if security_cred_alloc_blank() or
3912 * security_prepare_creds() returned an error.
3913 */
3914 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003915 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003916 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003917}
3918
David Howellsd84f4f92008-11-14 10:39:23 +11003919/*
3920 * prepare a new set of credentials for modification
3921 */
3922static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3923 gfp_t gfp)
3924{
3925 const struct task_security_struct *old_tsec;
3926 struct task_security_struct *tsec;
3927
3928 old_tsec = old->security;
3929
3930 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3931 if (!tsec)
3932 return -ENOMEM;
3933
3934 new->security = tsec;
3935 return 0;
3936}
3937
3938/*
David Howellsee18d642009-09-02 09:14:21 +01003939 * transfer the SELinux data to a blank set of creds
3940 */
3941static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3942{
3943 const struct task_security_struct *old_tsec = old->security;
3944 struct task_security_struct *tsec = new->security;
3945
3946 *tsec = *old_tsec;
3947}
3948
Matthew Garrett3ec30112018-01-08 13:36:19 -08003949static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3950{
3951 *secid = cred_sid(c);
3952}
3953
David Howellsee18d642009-09-02 09:14:21 +01003954/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003955 * set the security data for a kernel service
3956 * - all the creation contexts are set to unlabelled
3957 */
3958static int selinux_kernel_act_as(struct cred *new, u32 secid)
3959{
3960 struct task_security_struct *tsec = new->security;
3961 u32 sid = current_sid();
3962 int ret;
3963
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003964 ret = avc_has_perm(&selinux_state,
3965 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003966 SECCLASS_KERNEL_SERVICE,
3967 KERNEL_SERVICE__USE_AS_OVERRIDE,
3968 NULL);
3969 if (ret == 0) {
3970 tsec->sid = secid;
3971 tsec->create_sid = 0;
3972 tsec->keycreate_sid = 0;
3973 tsec->sockcreate_sid = 0;
3974 }
3975 return ret;
3976}
3977
3978/*
3979 * set the file creation context in a security record to the same as the
3980 * objective context of the specified inode
3981 */
3982static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3983{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003984 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003985 struct task_security_struct *tsec = new->security;
3986 u32 sid = current_sid();
3987 int ret;
3988
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003989 ret = avc_has_perm(&selinux_state,
3990 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003991 SECCLASS_KERNEL_SERVICE,
3992 KERNEL_SERVICE__CREATE_FILES_AS,
3993 NULL);
3994
3995 if (ret == 0)
3996 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003997 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003998}
3999
Eric Parisdd8dbf22009-11-03 16:35:32 +11004000static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04004001{
Eric Parisdd8dbf22009-11-03 16:35:32 +11004002 struct common_audit_data ad;
4003
Eric Paris50c205f2012-04-04 15:01:43 -04004004 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11004005 ad.u.kmod_name = kmod_name;
4006
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004007 return avc_has_perm(&selinux_state,
4008 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11004009 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04004010}
4011
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07004012static int selinux_kernel_module_from_file(struct file *file)
4013{
4014 struct common_audit_data ad;
4015 struct inode_security_struct *isec;
4016 struct file_security_struct *fsec;
4017 u32 sid = current_sid();
4018 int rc;
4019
4020 /* init_module */
4021 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004022 return avc_has_perm(&selinux_state,
4023 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07004024 SYSTEM__MODULE_LOAD, NULL);
4025
4026 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04004027
Vivek Goyal43af5de2016-09-09 11:37:49 -04004028 ad.type = LSM_AUDIT_DATA_FILE;
4029 ad.u.file = file;
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07004030
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07004031 fsec = file->f_security;
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07004032 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004033 rc = avc_has_perm(&selinux_state,
4034 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07004035 if (rc)
4036 return rc;
4037 }
4038
Paul Moore20cdef82016-04-04 14:14:42 -04004039 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004040 return avc_has_perm(&selinux_state,
4041 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07004042 SYSTEM__MODULE_LOAD, &ad);
4043}
4044
4045static int selinux_kernel_read_file(struct file *file,
4046 enum kernel_read_file_id id)
4047{
4048 int rc = 0;
4049
4050 switch (id) {
4051 case READING_MODULE:
4052 rc = selinux_kernel_module_from_file(file);
4053 break;
4054 default:
4055 break;
4056 }
4057
4058 return rc;
4059}
4060
Linus Torvalds1da177e2005-04-16 15:20:36 -07004061static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4062{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004063 return avc_has_perm(&selinux_state,
4064 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004065 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004066}
4067
4068static int selinux_task_getpgid(struct task_struct *p)
4069{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004070 return avc_has_perm(&selinux_state,
4071 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004072 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004073}
4074
4075static int selinux_task_getsid(struct task_struct *p)
4076{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004077 return avc_has_perm(&selinux_state,
4078 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004079 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004080}
4081
David Quigleyf9008e42006-06-30 01:55:46 -07004082static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4083{
David Howells275bb412008-11-14 10:39:19 +11004084 *secid = task_sid(p);
David Quigleyf9008e42006-06-30 01:55:46 -07004085}
4086
Linus Torvalds1da177e2005-04-16 15:20:36 -07004087static int selinux_task_setnice(struct task_struct *p, int nice)
4088{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004089 return avc_has_perm(&selinux_state,
4090 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004091 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004092}
4093
James Morris03e68062006-06-23 02:03:58 -07004094static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4095{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004096 return avc_has_perm(&selinux_state,
4097 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004098 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004099}
4100
David Quigleya1836a42006-06-30 01:55:49 -07004101static int selinux_task_getioprio(struct task_struct *p)
4102{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004103 return avc_has_perm(&selinux_state,
4104 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004105 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004106}
4107
Corentin LABBE42985552017-10-04 20:32:18 +02004108static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4109 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004110{
4111 u32 av = 0;
4112
Stephen Smalley84e68852017-02-28 09:35:08 -05004113 if (!flags)
4114 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004115 if (flags & LSM_PRLIMIT_WRITE)
4116 av |= PROCESS__SETRLIMIT;
4117 if (flags & LSM_PRLIMIT_READ)
4118 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004119 return avc_has_perm(&selinux_state,
4120 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05004121 SECCLASS_PROCESS, av, NULL);
4122}
4123
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004124static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4125 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004126{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004127 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004128
4129 /* Control the ability to change the hard limit (whether
4130 lowering or raising it), so that the hard limit can
4131 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004132 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004133 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004134 return avc_has_perm(&selinux_state,
4135 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004136 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004137
4138 return 0;
4139}
4140
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004141static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004142{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004143 return avc_has_perm(&selinux_state,
4144 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004145 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004146}
4147
4148static int selinux_task_getscheduler(struct task_struct *p)
4149{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004150 return avc_has_perm(&selinux_state,
4151 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004152 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004153}
4154
David Quigley35601542006-06-23 02:04:01 -07004155static int selinux_task_movememory(struct task_struct *p)
4156{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004157 return avc_has_perm(&selinux_state,
4158 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004159 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004160}
4161
David Quigleyf9008e42006-06-30 01:55:46 -07004162static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004163 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004164{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004165 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004166 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004167
Linus Torvalds1da177e2005-04-16 15:20:36 -07004168 if (!sig)
4169 perm = PROCESS__SIGNULL; /* null signal; existence test */
4170 else
4171 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004172 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004173 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004174 else
4175 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004176 return avc_has_perm(&selinux_state,
4177 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004178}
4179
Linus Torvalds1da177e2005-04-16 15:20:36 -07004180static void selinux_task_to_inode(struct task_struct *p,
4181 struct inode *inode)
4182{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004183 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004184 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004185
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004186 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004187 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004188 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004189 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004190 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004191}
4192
Linus Torvalds1da177e2005-04-16 15:20:36 -07004193/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004194static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004195 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004196{
4197 int offset, ihlen, ret = -EINVAL;
4198 struct iphdr _iph, *ih;
4199
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004200 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004201 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4202 if (ih == NULL)
4203 goto out;
4204
4205 ihlen = ih->ihl * 4;
4206 if (ihlen < sizeof(_iph))
4207 goto out;
4208
Eric Paris48c62af2012-04-02 13:15:44 -04004209 ad->u.net->v4info.saddr = ih->saddr;
4210 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004211 ret = 0;
4212
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004213 if (proto)
4214 *proto = ih->protocol;
4215
Linus Torvalds1da177e2005-04-16 15:20:36 -07004216 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004217 case IPPROTO_TCP: {
4218 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004219
Eric Paris828dfe12008-04-17 13:17:49 -04004220 if (ntohs(ih->frag_off) & IP_OFFSET)
4221 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004222
4223 offset += ihlen;
4224 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4225 if (th == NULL)
4226 break;
4227
Eric Paris48c62af2012-04-02 13:15:44 -04004228 ad->u.net->sport = th->source;
4229 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004230 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004231 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004232
Eric Paris828dfe12008-04-17 13:17:49 -04004233 case IPPROTO_UDP: {
4234 struct udphdr _udph, *uh;
4235
4236 if (ntohs(ih->frag_off) & IP_OFFSET)
4237 break;
4238
4239 offset += ihlen;
4240 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4241 if (uh == NULL)
4242 break;
4243
Eric Paris48c62af2012-04-02 13:15:44 -04004244 ad->u.net->sport = uh->source;
4245 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004246 break;
4247 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004248
James Morris2ee92d42006-11-13 16:09:01 -08004249 case IPPROTO_DCCP: {
4250 struct dccp_hdr _dccph, *dh;
4251
4252 if (ntohs(ih->frag_off) & IP_OFFSET)
4253 break;
4254
4255 offset += ihlen;
4256 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4257 if (dh == NULL)
4258 break;
4259
Eric Paris48c62af2012-04-02 13:15:44 -04004260 ad->u.net->sport = dh->dccph_sport;
4261 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004262 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004263 }
James Morris2ee92d42006-11-13 16:09:01 -08004264
Richard Hainesd4529302018-02-13 20:57:18 +00004265#if IS_ENABLED(CONFIG_IP_SCTP)
4266 case IPPROTO_SCTP: {
4267 struct sctphdr _sctph, *sh;
4268
4269 if (ntohs(ih->frag_off) & IP_OFFSET)
4270 break;
4271
4272 offset += ihlen;
4273 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4274 if (sh == NULL)
4275 break;
4276
4277 ad->u.net->sport = sh->source;
4278 ad->u.net->dport = sh->dest;
4279 break;
4280 }
4281#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004282 default:
4283 break;
4284 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004285out:
4286 return ret;
4287}
4288
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004289#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004290
4291/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004292static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004293 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004294{
4295 u8 nexthdr;
4296 int ret = -EINVAL, offset;
4297 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004298 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004299
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004300 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004301 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4302 if (ip6 == NULL)
4303 goto out;
4304
Eric Paris48c62af2012-04-02 13:15:44 -04004305 ad->u.net->v6info.saddr = ip6->saddr;
4306 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004307 ret = 0;
4308
4309 nexthdr = ip6->nexthdr;
4310 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004311 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004312 if (offset < 0)
4313 goto out;
4314
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004315 if (proto)
4316 *proto = nexthdr;
4317
Linus Torvalds1da177e2005-04-16 15:20:36 -07004318 switch (nexthdr) {
4319 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004320 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004321
4322 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4323 if (th == NULL)
4324 break;
4325
Eric Paris48c62af2012-04-02 13:15:44 -04004326 ad->u.net->sport = th->source;
4327 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004328 break;
4329 }
4330
4331 case IPPROTO_UDP: {
4332 struct udphdr _udph, *uh;
4333
4334 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4335 if (uh == NULL)
4336 break;
4337
Eric Paris48c62af2012-04-02 13:15:44 -04004338 ad->u.net->sport = uh->source;
4339 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004340 break;
4341 }
4342
James Morris2ee92d42006-11-13 16:09:01 -08004343 case IPPROTO_DCCP: {
4344 struct dccp_hdr _dccph, *dh;
4345
4346 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4347 if (dh == NULL)
4348 break;
4349
Eric Paris48c62af2012-04-02 13:15:44 -04004350 ad->u.net->sport = dh->dccph_sport;
4351 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004352 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004353 }
James Morris2ee92d42006-11-13 16:09:01 -08004354
Richard Hainesd4529302018-02-13 20:57:18 +00004355#if IS_ENABLED(CONFIG_IP_SCTP)
4356 case IPPROTO_SCTP: {
4357 struct sctphdr _sctph, *sh;
4358
4359 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4360 if (sh == NULL)
4361 break;
4362
4363 ad->u.net->sport = sh->source;
4364 ad->u.net->dport = sh->dest;
4365 break;
4366 }
4367#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004368 /* includes fragments */
4369 default:
4370 break;
4371 }
4372out:
4373 return ret;
4374}
4375
4376#endif /* IPV6 */
4377
Thomas Liu2bf49692009-07-14 12:14:09 -04004378static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004379 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004380{
David Howellscf9481e2008-07-27 21:31:07 +10004381 char *addrp;
4382 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004383
Eric Paris48c62af2012-04-02 13:15:44 -04004384 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004385 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004386 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004387 if (ret)
4388 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004389 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4390 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004391 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004392
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004393#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004394 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004395 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004396 if (ret)
4397 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004398 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4399 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004400 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004401#endif /* IPV6 */
4402 default:
David Howellscf9481e2008-07-27 21:31:07 +10004403 addrp = NULL;
4404 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004405 }
4406
David Howellscf9481e2008-07-27 21:31:07 +10004407parse_error:
4408 printk(KERN_WARNING
4409 "SELinux: failure in selinux_parse_skb(),"
4410 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004411 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004412
4413okay:
4414 if (_addrp)
4415 *_addrp = addrp;
4416 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004417}
4418
Paul Moore4f6a9932007-03-01 14:35:22 -05004419/**
Paul Moore220deb92008-01-29 08:38:23 -05004420 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004421 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004422 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004423 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004424 *
4425 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004426 * Check the various different forms of network peer labeling and determine
4427 * the peer label/SID for the packet; most of the magic actually occurs in
4428 * the security server function security_net_peersid_cmp(). The function
4429 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4430 * or -EACCES if @sid is invalid due to inconsistencies with the different
4431 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004432 *
4433 */
Paul Moore220deb92008-01-29 08:38:23 -05004434static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004435{
Paul Moore71f1cb02008-01-29 08:51:16 -05004436 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004437 u32 xfrm_sid;
4438 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004439 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004440
Paul Moore817eff72013-12-10 14:57:54 -05004441 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004442 if (unlikely(err))
4443 return -EACCES;
4444 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4445 if (unlikely(err))
4446 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004447
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004448 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4449 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004450 if (unlikely(err)) {
4451 printk(KERN_WARNING
4452 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4453 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004454 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004455 }
Paul Moore220deb92008-01-29 08:38:23 -05004456
4457 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004458}
4459
Paul Moore446b8022013-12-04 16:10:51 -05004460/**
4461 * selinux_conn_sid - Determine the child socket label for a connection
4462 * @sk_sid: the parent socket's SID
4463 * @skb_sid: the packet's SID
4464 * @conn_sid: the resulting connection SID
4465 *
4466 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4467 * combined with the MLS information from @skb_sid in order to create
4468 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4469 * of @sk_sid. Returns zero on success, negative values on failure.
4470 *
4471 */
4472static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4473{
4474 int err = 0;
4475
4476 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004477 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4478 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004479 else
4480 *conn_sid = sk_sid;
4481
4482 return err;
4483}
4484
Linus Torvalds1da177e2005-04-16 15:20:36 -07004485/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004486
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004487static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4488 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004489{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004490 if (tsec->sockcreate_sid > SECSID_NULL) {
4491 *socksid = tsec->sockcreate_sid;
4492 return 0;
4493 }
4494
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004495 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4496 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004497}
4498
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004499static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004500{
Paul Moore253bfae2010-04-22 14:46:19 -04004501 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004502 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004503 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004504
Paul Moore253bfae2010-04-22 14:46:19 -04004505 if (sksec->sid == SECINITSID_KERNEL)
4506 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004507
Eric Paris50c205f2012-04-04 15:01:43 -04004508 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004509 ad.u.net = &net;
4510 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004511
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004512 return avc_has_perm(&selinux_state,
4513 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004514 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004515}
4516
4517static int selinux_socket_create(int family, int type,
4518 int protocol, int kern)
4519{
Paul Moore5fb49872010-04-22 14:46:19 -04004520 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004521 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004522 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004523 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004524
4525 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004526 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004527
David Howells275bb412008-11-14 10:39:19 +11004528 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004529 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4530 if (rc)
4531 return rc;
4532
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004533 return avc_has_perm(&selinux_state,
4534 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004535}
4536
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004537static int selinux_socket_post_create(struct socket *sock, int family,
4538 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004539{
Paul Moore5fb49872010-04-22 14:46:19 -04004540 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004541 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004542 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004543 u16 sclass = socket_type_to_security_class(family, type, protocol);
4544 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004545 int err = 0;
4546
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004547 if (!kern) {
4548 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004549 if (err)
4550 return err;
4551 }
David Howells275bb412008-11-14 10:39:19 +11004552
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004553 isec->sclass = sclass;
4554 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004555 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004556
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004557 if (sock->sk) {
4558 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004559 sksec->sclass = sclass;
4560 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004561 /* Allows detection of the first association on this socket */
4562 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4563 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4564
Paul Moore389fb8002009-03-27 17:10:34 -04004565 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004566 }
4567
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004568 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004569}
4570
4571/* Range of port numbers used to automatically bind.
4572 Need to determine whether we should perform a name_bind
4573 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004574
4575static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4576{
Paul Moore253bfae2010-04-22 14:46:19 -04004577 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004578 u16 family;
4579 int err;
4580
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004581 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004582 if (err)
4583 goto out;
4584
Richard Hainesd4529302018-02-13 20:57:18 +00004585 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004586 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004587 if (family == PF_INET || family == PF_INET6) {
4588 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04004589 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004590 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004591 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004592 struct sockaddr_in *addr4 = NULL;
4593 struct sockaddr_in6 *addr6 = NULL;
4594 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004595 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004596
Richard Hainesd4529302018-02-13 20:57:18 +00004597 /*
4598 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4599 * that validates multiple binding addresses. Because of this
4600 * need to check address->sa_family as it is possible to have
4601 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4602 */
Richard Haines68741a82018-03-02 19:54:34 +00004603 switch (address->sa_family) {
4604 case AF_INET:
4605 if (addrlen < sizeof(struct sockaddr_in))
4606 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004607 addr4 = (struct sockaddr_in *)address;
4608 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004609 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a82018-03-02 19:54:34 +00004610 break;
4611 case AF_INET6:
4612 if (addrlen < SIN6_LEN_RFC2133)
4613 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004614 addr6 = (struct sockaddr_in6 *)address;
4615 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004616 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a82018-03-02 19:54:34 +00004617 break;
4618 default:
4619 /* Note that SCTP services expect -EINVAL, whereas
4620 * others expect -EAFNOSUPPORT.
4621 */
4622 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4623 return -EINVAL;
4624 else
4625 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004626 }
4627
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004628 if (snum) {
4629 int low, high;
4630
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004631 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004632
Krister Johansen4548b682017-01-20 17:49:11 -08004633 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4634 snum > high) {
Paul Moore3e112172008-04-10 10:48:14 -04004635 err = sel_netport_sid(sk->sk_protocol,
4636 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004637 if (err)
4638 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04004639 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004640 ad.u.net = &net;
4641 ad.u.net->sport = htons(snum);
4642 ad.u.net->family = family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004643 err = avc_has_perm(&selinux_state,
4644 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004645 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004646 SOCKET__NAME_BIND, &ad);
4647 if (err)
4648 goto out;
4649 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004650 }
Eric Paris828dfe12008-04-17 13:17:49 -04004651
Paul Moore253bfae2010-04-22 14:46:19 -04004652 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004653 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004654 node_perm = TCP_SOCKET__NODE_BIND;
4655 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004656
James Morris13402582005-09-30 14:24:34 -04004657 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004658 node_perm = UDP_SOCKET__NODE_BIND;
4659 break;
James Morris2ee92d42006-11-13 16:09:01 -08004660
4661 case SECCLASS_DCCP_SOCKET:
4662 node_perm = DCCP_SOCKET__NODE_BIND;
4663 break;
4664
Richard Hainesd4529302018-02-13 20:57:18 +00004665 case SECCLASS_SCTP_SOCKET:
4666 node_perm = SCTP_SOCKET__NODE_BIND;
4667 break;
4668
Linus Torvalds1da177e2005-04-16 15:20:36 -07004669 default:
4670 node_perm = RAWIP_SOCKET__NODE_BIND;
4671 break;
4672 }
Eric Paris828dfe12008-04-17 13:17:49 -04004673
Paul Moore224dfbd2008-01-29 08:38:13 -05004674 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004675 if (err)
4676 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004677
Eric Paris50c205f2012-04-04 15:01:43 -04004678 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004679 ad.u.net = &net;
4680 ad.u.net->sport = htons(snum);
4681 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004682
Richard Hainesd4529302018-02-13 20:57:18 +00004683 if (address->sa_family == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004684 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004685 else
Eric Paris48c62af2012-04-02 13:15:44 -04004686 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004687
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004688 err = avc_has_perm(&selinux_state,
4689 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004690 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004691 if (err)
4692 goto out;
4693 }
4694out:
4695 return err;
4696}
4697
Richard Hainesd4529302018-02-13 20:57:18 +00004698/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4699 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.txt
4700 */
4701static int selinux_socket_connect_helper(struct socket *sock,
4702 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004703{
Paul Moore014ab192008-10-10 10:16:33 -04004704 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004705 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004706 int err;
4707
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004708 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004709 if (err)
4710 return err;
4711
4712 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004713 * If a TCP, DCCP or SCTP socket, check name_connect permission
4714 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004715 */
Paul Moore253bfae2010-04-22 14:46:19 -04004716 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004717 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4718 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004719 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004720 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004721 struct sockaddr_in *addr4 = NULL;
4722 struct sockaddr_in6 *addr6 = NULL;
4723 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004724 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004725
Richard Hainesd4529302018-02-13 20:57:18 +00004726 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4727 * that validates multiple connect addresses. Because of this
4728 * need to check address->sa_family as it is possible to have
4729 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4730 */
Richard Haines68741a82018-03-02 19:54:34 +00004731 switch (address->sa_family) {
4732 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004733 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004734 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004735 return -EINVAL;
4736 snum = ntohs(addr4->sin_port);
Richard Haines68741a82018-03-02 19:54:34 +00004737 break;
4738 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004739 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004740 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004741 return -EINVAL;
4742 snum = ntohs(addr6->sin6_port);
Richard Haines68741a82018-03-02 19:54:34 +00004743 break;
4744 default:
4745 /* Note that SCTP services expect -EINVAL, whereas
4746 * others expect -EAFNOSUPPORT.
4747 */
4748 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4749 return -EINVAL;
4750 else
4751 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004752 }
4753
Paul Moore3e112172008-04-10 10:48:14 -04004754 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004755 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004756 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004757
Richard Hainesd4529302018-02-13 20:57:18 +00004758 switch (sksec->sclass) {
4759 case SECCLASS_TCP_SOCKET:
4760 perm = TCP_SOCKET__NAME_CONNECT;
4761 break;
4762 case SECCLASS_DCCP_SOCKET:
4763 perm = DCCP_SOCKET__NAME_CONNECT;
4764 break;
4765 case SECCLASS_SCTP_SOCKET:
4766 perm = SCTP_SOCKET__NAME_CONNECT;
4767 break;
4768 }
James Morris2ee92d42006-11-13 16:09:01 -08004769
Eric Paris50c205f2012-04-04 15:01:43 -04004770 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004771 ad.u.net = &net;
4772 ad.u.net->dport = htons(snum);
4773 ad.u.net->family = sk->sk_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004774 err = avc_has_perm(&selinux_state,
4775 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004776 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004777 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004778 }
4779
Richard Hainesd4529302018-02-13 20:57:18 +00004780 return 0;
4781}
Paul Moore014ab192008-10-10 10:16:33 -04004782
Richard Hainesd4529302018-02-13 20:57:18 +00004783/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4784static int selinux_socket_connect(struct socket *sock,
4785 struct sockaddr *address, int addrlen)
4786{
4787 int err;
4788 struct sock *sk = sock->sk;
4789
4790 err = selinux_socket_connect_helper(sock, address, addrlen);
4791 if (err)
4792 return err;
4793
4794 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004795}
4796
4797static int selinux_socket_listen(struct socket *sock, int backlog)
4798{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004799 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004800}
4801
4802static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4803{
4804 int err;
4805 struct inode_security_struct *isec;
4806 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004807 u16 sclass;
4808 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004809
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004810 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004811 if (err)
4812 return err;
4813
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004814 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004815 spin_lock(&isec->lock);
4816 sclass = isec->sclass;
4817 sid = isec->sid;
4818 spin_unlock(&isec->lock);
4819
4820 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4821 newisec->sclass = sclass;
4822 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004823 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004824
4825 return 0;
4826}
4827
4828static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004829 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004830{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004831 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004832}
4833
4834static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4835 int size, int flags)
4836{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004837 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004838}
4839
4840static int selinux_socket_getsockname(struct socket *sock)
4841{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004842 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004843}
4844
4845static int selinux_socket_getpeername(struct socket *sock)
4846{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004847 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004848}
4849
Eric Paris828dfe12008-04-17 13:17:49 -04004850static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004851{
Paul Mooref8687af2006-10-30 15:22:15 -08004852 int err;
4853
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004854 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004855 if (err)
4856 return err;
4857
4858 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004859}
4860
4861static int selinux_socket_getsockopt(struct socket *sock, int level,
4862 int optname)
4863{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004864 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004865}
4866
4867static int selinux_socket_shutdown(struct socket *sock, int how)
4868{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004869 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004870}
4871
David S. Miller3610cda2011-01-05 15:38:53 -08004872static int selinux_socket_unix_stream_connect(struct sock *sock,
4873 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004874 struct sock *newsk)
4875{
David S. Miller3610cda2011-01-05 15:38:53 -08004876 struct sk_security_struct *sksec_sock = sock->sk_security;
4877 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004878 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004879 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004880 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004881 int err;
4882
Eric Paris50c205f2012-04-04 15:01:43 -04004883 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004884 ad.u.net = &net;
4885 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004886
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004887 err = avc_has_perm(&selinux_state,
4888 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004889 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004890 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4891 if (err)
4892 return err;
4893
Linus Torvalds1da177e2005-04-16 15:20:36 -07004894 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004895 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004896 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4897 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004898 if (err)
4899 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004900
Paul Moore4d1e2452010-04-22 14:46:18 -04004901 /* connecting socket */
4902 sksec_sock->peer_sid = sksec_new->sid;
4903
4904 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004905}
4906
4907static int selinux_socket_unix_may_send(struct socket *sock,
4908 struct socket *other)
4909{
Paul Moore253bfae2010-04-22 14:46:19 -04004910 struct sk_security_struct *ssec = sock->sk->sk_security;
4911 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004912 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004913 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004914
Eric Paris50c205f2012-04-04 15:01:43 -04004915 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004916 ad.u.net = &net;
4917 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004918
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004919 return avc_has_perm(&selinux_state,
4920 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004921 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004922}
4923
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004924static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4925 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004926 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004927{
4928 int err;
4929 u32 if_sid;
4930 u32 node_sid;
4931
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004932 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004933 if (err)
4934 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004935 err = avc_has_perm(&selinux_state,
4936 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004937 SECCLASS_NETIF, NETIF__INGRESS, ad);
4938 if (err)
4939 return err;
4940
4941 err = sel_netnode_sid(addrp, family, &node_sid);
4942 if (err)
4943 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004944 return avc_has_perm(&selinux_state,
4945 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004946 SECCLASS_NODE, NODE__RECVFROM, ad);
4947}
4948
Paul Moore220deb92008-01-29 08:38:23 -05004949static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004950 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004951{
Paul Moore277d3422008-12-31 12:54:11 -05004952 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004953 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004954 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004955 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004956 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004957 char *addrp;
4958
Eric Paris50c205f2012-04-04 15:01:43 -04004959 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004960 ad.u.net = &net;
4961 ad.u.net->netif = skb->skb_iif;
4962 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004963 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4964 if (err)
4965 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004966
Paul Moore58bfbb52009-03-27 17:10:41 -04004967 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004968 err = avc_has_perm(&selinux_state,
4969 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004970 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004971 if (err)
4972 return err;
4973 }
Paul Moore220deb92008-01-29 08:38:23 -05004974
Steffen Klassertb9679a72011-02-23 12:55:21 +01004975 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4976 if (err)
4977 return err;
4978 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004979
James Morris4e5ab4c2006-06-09 00:33:33 -07004980 return err;
4981}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004982
James Morris4e5ab4c2006-06-09 00:33:33 -07004983static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4984{
Paul Moore220deb92008-01-29 08:38:23 -05004985 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004986 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004987 u16 family = sk->sk_family;
4988 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004989 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004990 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004991 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004992 u8 secmark_active;
4993 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004994
James Morris4e5ab4c2006-06-09 00:33:33 -07004995 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004996 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004997
4998 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004999 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07005000 family = PF_INET;
5001
Paul Moored8395c82008-10-10 10:16:30 -04005002 /* If any sort of compatibility mode is enabled then handoff processing
5003 * to the selinux_sock_rcv_skb_compat() function to deal with the
5004 * special handling. We do this in an attempt to keep this function
5005 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005006 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005007 return selinux_sock_rcv_skb_compat(sk, skb, family);
5008
5009 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005010 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04005011 if (!secmark_active && !peerlbl_active)
5012 return 0;
5013
Eric Paris50c205f2012-04-04 15:01:43 -04005014 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005015 ad.u.net = &net;
5016 ad.u.net->netif = skb->skb_iif;
5017 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05005018 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07005019 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05005020 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07005021
Paul Moored8395c82008-10-10 10:16:30 -04005022 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05005023 u32 peer_sid;
5024
5025 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5026 if (err)
5027 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005028 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5029 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005030 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005031 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005032 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04005033 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005034 err = avc_has_perm(&selinux_state,
5035 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05005036 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05005037 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005038 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05005039 return err;
5040 }
Paul Moored621d352008-01-29 08:43:36 -05005041 }
5042
Paul Moored8395c82008-10-10 10:16:30 -04005043 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005044 err = avc_has_perm(&selinux_state,
5045 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005046 PACKET__RECV, &ad);
5047 if (err)
5048 return err;
5049 }
5050
Paul Moored621d352008-01-29 08:43:36 -05005051 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005052}
5053
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005054static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5055 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005056{
5057 int err = 0;
5058 char *scontext;
5059 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04005060 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05005061 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005062
Paul Moore253bfae2010-04-22 14:46:19 -04005063 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00005064 sksec->sclass == SECCLASS_TCP_SOCKET ||
5065 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04005066 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04005067 if (peer_sid == SECSID_NULL)
5068 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005069
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005070 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5071 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005072 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04005073 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005074
5075 if (scontext_len > len) {
5076 err = -ERANGE;
5077 goto out_len;
5078 }
5079
5080 if (copy_to_user(optval, scontext, scontext_len))
5081 err = -EFAULT;
5082
5083out_len:
5084 if (put_user(scontext_len, optlen))
5085 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005086 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005087 return err;
5088}
5089
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005090static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005091{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005092 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05005093 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04005094 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07005095
Paul Mooreaa862902008-10-10 10:16:29 -04005096 if (skb && skb->protocol == htons(ETH_P_IP))
5097 family = PF_INET;
5098 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5099 family = PF_INET6;
5100 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05005101 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05005102 else
5103 goto out;
5104
Paul Moore899134f2016-03-28 15:19:10 -04005105 if (sock && family == PF_UNIX) {
5106 isec = inode_security_novalidate(SOCK_INODE(sock));
5107 peer_secid = isec->sid;
5108 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05005109 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005110
Paul Moore75e22912008-01-29 08:38:04 -05005111out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005112 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005113 if (peer_secid == SECSID_NULL)
5114 return -EINVAL;
5115 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005116}
5117
Al Viro7d877f32005-10-21 03:20:43 -04005118static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005119{
Paul Moore84914b72010-04-22 14:46:18 -04005120 struct sk_security_struct *sksec;
5121
5122 sksec = kzalloc(sizeof(*sksec), priority);
5123 if (!sksec)
5124 return -ENOMEM;
5125
5126 sksec->peer_sid = SECINITSID_UNLABELED;
5127 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005128 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005129 selinux_netlbl_sk_security_reset(sksec);
5130 sk->sk_security = sksec;
5131
5132 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005133}
5134
5135static void selinux_sk_free_security(struct sock *sk)
5136{
Paul Moore84914b72010-04-22 14:46:18 -04005137 struct sk_security_struct *sksec = sk->sk_security;
5138
5139 sk->sk_security = NULL;
5140 selinux_netlbl_sk_security_free(sksec);
5141 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005142}
5143
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005144static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5145{
Eric Parisdd3e7832010-04-07 15:08:46 -04005146 struct sk_security_struct *sksec = sk->sk_security;
5147 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005148
Eric Parisdd3e7832010-04-07 15:08:46 -04005149 newsksec->sid = sksec->sid;
5150 newsksec->peer_sid = sksec->peer_sid;
5151 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005152
Eric Parisdd3e7832010-04-07 15:08:46 -04005153 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005154}
5155
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005156static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005157{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005158 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005159 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005160 else {
5161 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005162
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005163 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005164 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005165}
5166
Eric Paris828dfe12008-04-17 13:17:49 -04005167static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005168{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005169 struct inode_security_struct *isec =
5170 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005171 struct sk_security_struct *sksec = sk->sk_security;
5172
Paul Moore2873ead2014-07-28 10:42:48 -04005173 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5174 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005175 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005176 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005177}
5178
Richard Hainesd4529302018-02-13 20:57:18 +00005179/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5180 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5181 * already present).
5182 */
5183static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5184 struct sk_buff *skb)
5185{
5186 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5187 struct common_audit_data ad;
5188 struct lsm_network_audit net = {0,};
5189 u8 peerlbl_active;
5190 u32 peer_sid = SECINITSID_UNLABELED;
5191 u32 conn_sid;
5192 int err = 0;
5193
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005194 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005195 return 0;
5196
5197 peerlbl_active = selinux_peerlbl_enabled();
5198
5199 if (peerlbl_active) {
5200 /* This will return peer_sid = SECSID_NULL if there are
5201 * no peer labels, see security_net_peersid_resolve().
5202 */
5203 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5204 &peer_sid);
5205 if (err)
5206 return err;
5207
5208 if (peer_sid == SECSID_NULL)
5209 peer_sid = SECINITSID_UNLABELED;
5210 }
5211
5212 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5213 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5214
5215 /* Here as first association on socket. As the peer SID
5216 * was allowed by peer recv (and the netif/node checks),
5217 * then it is approved by policy and used as the primary
5218 * peer SID for getpeercon(3).
5219 */
5220 sksec->peer_sid = peer_sid;
5221 } else if (sksec->peer_sid != peer_sid) {
5222 /* Other association peer SIDs are checked to enforce
5223 * consistency among the peer SIDs.
5224 */
5225 ad.type = LSM_AUDIT_DATA_NET;
5226 ad.u.net = &net;
5227 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005228 err = avc_has_perm(&selinux_state,
5229 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005230 SCTP_SOCKET__ASSOCIATION, &ad);
5231 if (err)
5232 return err;
5233 }
5234
5235 /* Compute the MLS component for the connection and store
5236 * the information in ep. This will be used by SCTP TCP type
5237 * sockets and peeled off connections as they cause a new
5238 * socket to be generated. selinux_sctp_sk_clone() will then
5239 * plug this into the new socket.
5240 */
5241 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5242 if (err)
5243 return err;
5244
5245 ep->secid = conn_sid;
5246 ep->peer_secid = peer_sid;
5247
5248 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5249 return selinux_netlbl_sctp_assoc_request(ep, skb);
5250}
5251
5252/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5253 * based on their @optname.
5254 */
5255static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5256 struct sockaddr *address,
5257 int addrlen)
5258{
5259 int len, err = 0, walk_size = 0;
5260 void *addr_buf;
5261 struct sockaddr *addr;
5262 struct socket *sock;
5263
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005264 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005265 return 0;
5266
5267 /* Process one or more addresses that may be IPv4 or IPv6 */
5268 sock = sk->sk_socket;
5269 addr_buf = address;
5270
5271 while (walk_size < addrlen) {
5272 addr = addr_buf;
5273 switch (addr->sa_family) {
5274 case AF_INET:
5275 len = sizeof(struct sockaddr_in);
5276 break;
5277 case AF_INET6:
5278 len = sizeof(struct sockaddr_in6);
5279 break;
5280 default:
5281 return -EAFNOSUPPORT;
5282 }
5283
5284 err = -EINVAL;
5285 switch (optname) {
5286 /* Bind checks */
5287 case SCTP_PRIMARY_ADDR:
5288 case SCTP_SET_PEER_PRIMARY_ADDR:
5289 case SCTP_SOCKOPT_BINDX_ADD:
5290 err = selinux_socket_bind(sock, addr, len);
5291 break;
5292 /* Connect checks */
5293 case SCTP_SOCKOPT_CONNECTX:
5294 case SCTP_PARAM_SET_PRIMARY:
5295 case SCTP_PARAM_ADD_IP:
5296 case SCTP_SENDMSG_CONNECT:
5297 err = selinux_socket_connect_helper(sock, addr, len);
5298 if (err)
5299 return err;
5300
5301 /* As selinux_sctp_bind_connect() is called by the
5302 * SCTP protocol layer, the socket is already locked,
5303 * therefore selinux_netlbl_socket_connect_locked() is
5304 * is called here. The situations handled are:
5305 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5306 * whenever a new IP address is added or when a new
5307 * primary address is selected.
5308 * Note that an SCTP connect(2) call happens before
5309 * the SCTP protocol layer and is handled via
5310 * selinux_socket_connect().
5311 */
5312 err = selinux_netlbl_socket_connect_locked(sk, addr);
5313 break;
5314 }
5315
5316 if (err)
5317 return err;
5318
5319 addr_buf += len;
5320 walk_size += len;
5321 }
5322
5323 return 0;
5324}
5325
5326/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5327static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5328 struct sock *newsk)
5329{
5330 struct sk_security_struct *sksec = sk->sk_security;
5331 struct sk_security_struct *newsksec = newsk->sk_security;
5332
5333 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5334 * the non-sctp clone version.
5335 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005336 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005337 return selinux_sk_clone_security(sk, newsk);
5338
5339 newsksec->sid = ep->secid;
5340 newsksec->peer_sid = ep->peer_secid;
5341 newsksec->sclass = sksec->sclass;
5342 selinux_netlbl_sctp_sk_clone(sk, newsk);
5343}
5344
Adrian Bunk9a673e52006-08-15 00:03:53 -07005345static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5346 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005347{
5348 struct sk_security_struct *sksec = sk->sk_security;
5349 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005350 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005351 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005352 u32 peersid;
5353
Paul Mooreaa862902008-10-10 10:16:29 -04005354 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005355 if (err)
5356 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005357 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5358 if (err)
5359 return err;
5360 req->secid = connsid;
5361 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005362
Paul Moore389fb8002009-03-27 17:10:34 -04005363 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005364}
5365
Adrian Bunk9a673e52006-08-15 00:03:53 -07005366static void selinux_inet_csk_clone(struct sock *newsk,
5367 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005368{
5369 struct sk_security_struct *newsksec = newsk->sk_security;
5370
5371 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005372 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005373 /* NOTE: Ideally, we should also get the isec->sid for the
5374 new socket in sync, but we don't have the isec available yet.
5375 So we will wait until sock_graft to do it, by which
5376 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005377
Paul Moore9f2ad662006-11-17 17:38:53 -05005378 /* We don't need to take any sort of lock here as we are the only
5379 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005380 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005381}
5382
Paul Moore014ab192008-10-10 10:16:33 -04005383static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005384{
Paul Mooreaa862902008-10-10 10:16:29 -04005385 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005386 struct sk_security_struct *sksec = sk->sk_security;
5387
Paul Mooreaa862902008-10-10 10:16:29 -04005388 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5389 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5390 family = PF_INET;
5391
5392 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005393}
5394
Eric Paris2606fd12010-10-13 16:24:41 -04005395static int selinux_secmark_relabel_packet(u32 sid)
5396{
5397 const struct task_security_struct *__tsec;
5398 u32 tsid;
5399
5400 __tsec = current_security();
5401 tsid = __tsec->sid;
5402
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005403 return avc_has_perm(&selinux_state,
5404 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5405 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005406}
5407
5408static void selinux_secmark_refcount_inc(void)
5409{
5410 atomic_inc(&selinux_secmark_refcount);
5411}
5412
5413static void selinux_secmark_refcount_dec(void)
5414{
5415 atomic_dec(&selinux_secmark_refcount);
5416}
5417
Adrian Bunk9a673e52006-08-15 00:03:53 -07005418static void selinux_req_classify_flow(const struct request_sock *req,
5419 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005420{
David S. Miller1d28f422011-03-12 00:29:39 -05005421 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005422}
5423
Paul Moore5dbbaf22013-01-14 07:12:19 +00005424static int selinux_tun_dev_alloc_security(void **security)
5425{
5426 struct tun_security_struct *tunsec;
5427
5428 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5429 if (!tunsec)
5430 return -ENOMEM;
5431 tunsec->sid = current_sid();
5432
5433 *security = tunsec;
5434 return 0;
5435}
5436
5437static void selinux_tun_dev_free_security(void *security)
5438{
5439 kfree(security);
5440}
5441
Paul Mooreed6d76e2009-08-28 18:12:49 -04005442static int selinux_tun_dev_create(void)
5443{
5444 u32 sid = current_sid();
5445
5446 /* we aren't taking into account the "sockcreate" SID since the socket
5447 * that is being created here is not a socket in the traditional sense,
5448 * instead it is a private sock, accessible only to the kernel, and
5449 * representing a wide range of network traffic spanning multiple
5450 * connections unlike traditional sockets - check the TUN driver to
5451 * get a better understanding of why this socket is special */
5452
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005453 return avc_has_perm(&selinux_state,
5454 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005455 NULL);
5456}
5457
Paul Moore5dbbaf22013-01-14 07:12:19 +00005458static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005459{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005460 struct tun_security_struct *tunsec = security;
5461
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005462 return avc_has_perm(&selinux_state,
5463 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005464 TUN_SOCKET__ATTACH_QUEUE, NULL);
5465}
5466
5467static int selinux_tun_dev_attach(struct sock *sk, void *security)
5468{
5469 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005470 struct sk_security_struct *sksec = sk->sk_security;
5471
5472 /* we don't currently perform any NetLabel based labeling here and it
5473 * isn't clear that we would want to do so anyway; while we could apply
5474 * labeling without the support of the TUN user the resulting labeled
5475 * traffic from the other end of the connection would almost certainly
5476 * cause confusion to the TUN user that had no idea network labeling
5477 * protocols were being used */
5478
Paul Moore5dbbaf22013-01-14 07:12:19 +00005479 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005480 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005481
5482 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005483}
5484
Paul Moore5dbbaf22013-01-14 07:12:19 +00005485static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005486{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005487 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005488 u32 sid = current_sid();
5489 int err;
5490
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005491 err = avc_has_perm(&selinux_state,
5492 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005493 TUN_SOCKET__RELABELFROM, NULL);
5494 if (err)
5495 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005496 err = avc_has_perm(&selinux_state,
5497 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005498 TUN_SOCKET__RELABELTO, NULL);
5499 if (err)
5500 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005501 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005502
5503 return 0;
5504}
5505
Linus Torvalds1da177e2005-04-16 15:20:36 -07005506static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5507{
5508 int err = 0;
5509 u32 perm;
5510 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005511 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005512
Hong zhi guo77954982013-03-27 06:49:35 +00005513 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005514 err = -EINVAL;
5515 goto out;
5516 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005517 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005518
Paul Moore253bfae2010-04-22 14:46:19 -04005519 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005520 if (err) {
5521 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005522 pr_warn_ratelimited("SELinux: unrecognized netlink"
5523 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5524 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005525 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005526 secclass_map[sksec->sclass - 1].name,
5527 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005528 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005529 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005530 err = 0;
5531 }
5532
5533 /* Ignore */
5534 if (err == -ENOENT)
5535 err = 0;
5536 goto out;
5537 }
5538
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005539 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005540out:
5541 return err;
5542}
5543
5544#ifdef CONFIG_NETFILTER
5545
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005546static unsigned int selinux_ip_forward(struct sk_buff *skb,
5547 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005548 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005549{
Paul Mooredfaebe92008-10-10 10:16:31 -04005550 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005551 char *addrp;
5552 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005553 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005554 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005555 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005556 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005557 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005558
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005559 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005560 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005561
Paul Mooreeffad8d2008-01-29 08:49:27 -05005562 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005563 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005564 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005565 if (!secmark_active && !peerlbl_active)
5566 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005567
Paul Moored8395c82008-10-10 10:16:30 -04005568 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5569 return NF_DROP;
5570
Eric Paris50c205f2012-04-04 15:01:43 -04005571 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005572 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005573 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005574 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005575 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5576 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005577
Paul Mooredfaebe92008-10-10 10:16:31 -04005578 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005579 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5580 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005581 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005582 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005583 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005584 }
5585 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005586
5587 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005588 if (avc_has_perm(&selinux_state,
5589 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005590 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5591 return NF_DROP;
5592
Paul Moore948bf852008-10-10 10:16:32 -04005593 if (netlbl_active)
5594 /* we do this in the FORWARD path and not the POST_ROUTING
5595 * path because we want to make sure we apply the necessary
5596 * labeling before IPsec is applied so we can leverage AH
5597 * protection */
5598 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5599 return NF_DROP;
5600
Paul Mooreeffad8d2008-01-29 08:49:27 -05005601 return NF_ACCEPT;
5602}
5603
Eric W. Biederman06198b32015-09-18 14:33:06 -05005604static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005605 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005606 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005607{
David S. Miller238e54c2015-04-03 20:32:56 -04005608 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005609}
5610
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005611#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005612static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005613 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005614 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005615{
David S. Miller238e54c2015-04-03 20:32:56 -04005616 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005617}
5618#endif /* IPV6 */
5619
Paul Moore948bf852008-10-10 10:16:32 -04005620static unsigned int selinux_ip_output(struct sk_buff *skb,
5621 u16 family)
5622{
Paul Moore47180062013-12-04 16:10:45 -05005623 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005624 u32 sid;
5625
5626 if (!netlbl_enabled())
5627 return NF_ACCEPT;
5628
5629 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5630 * because we want to make sure we apply the necessary labeling
5631 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005632 sk = skb->sk;
5633 if (sk) {
5634 struct sk_security_struct *sksec;
5635
Eric Dumazete446f9d2015-10-08 05:01:55 -07005636 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005637 /* if the socket is the listening state then this
5638 * packet is a SYN-ACK packet which means it needs to
5639 * be labeled based on the connection/request_sock and
5640 * not the parent socket. unfortunately, we can't
5641 * lookup the request_sock yet as it isn't queued on
5642 * the parent socket until after the SYN-ACK is sent.
5643 * the "solution" is to simply pass the packet as-is
5644 * as any IP option based labeling should be copied
5645 * from the initial connection request (in the IP
5646 * layer). it is far from ideal, but until we get a
5647 * security label in the packet itself this is the
5648 * best we can do. */
5649 return NF_ACCEPT;
5650
5651 /* standard practice, label using the parent socket */
5652 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005653 sid = sksec->sid;
5654 } else
5655 sid = SECINITSID_KERNEL;
5656 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5657 return NF_DROP;
5658
5659 return NF_ACCEPT;
5660}
5661
Eric W. Biederman06198b32015-09-18 14:33:06 -05005662static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005663 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005664 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005665{
5666 return selinux_ip_output(skb, PF_INET);
5667}
5668
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005669#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005670static unsigned int selinux_ipv6_output(void *priv,
5671 struct sk_buff *skb,
5672 const struct nf_hook_state *state)
5673{
5674 return selinux_ip_output(skb, PF_INET6);
5675}
5676#endif /* IPV6 */
5677
Paul Mooreeffad8d2008-01-29 08:49:27 -05005678static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5679 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005680 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005681{
Eric Dumazet54abc682015-11-08 10:54:07 -08005682 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005683 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005684 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005685 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005686 char *addrp;
5687 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005688
Paul Mooreeffad8d2008-01-29 08:49:27 -05005689 if (sk == NULL)
5690 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005691 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005692
Eric Paris50c205f2012-04-04 15:01:43 -04005693 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005694 ad.u.net = &net;
5695 ad.u.net->netif = ifindex;
5696 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005697 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5698 return NF_DROP;
5699
Paul Moore58bfbb52009-03-27 17:10:41 -04005700 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005701 if (avc_has_perm(&selinux_state,
5702 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005703 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005704 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005705
Steffen Klassertb9679a72011-02-23 12:55:21 +01005706 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5707 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005708
Paul Mooreeffad8d2008-01-29 08:49:27 -05005709 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005710}
5711
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005712static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5713 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005714 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005715{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005716 u32 secmark_perm;
5717 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005718 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005719 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005720 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005721 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005722 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005723 u8 secmark_active;
5724 u8 peerlbl_active;
5725
Paul Mooreeffad8d2008-01-29 08:49:27 -05005726 /* If any sort of compatibility mode is enabled then handoff processing
5727 * to the selinux_ip_postroute_compat() function to deal with the
5728 * special handling. We do this in an attempt to keep this function
5729 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005730 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005731 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005732
Paul Mooreeffad8d2008-01-29 08:49:27 -05005733 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005734 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005735 if (!secmark_active && !peerlbl_active)
5736 return NF_ACCEPT;
5737
Eric Dumazet54abc682015-11-08 10:54:07 -08005738 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005739
Paul Mooreeffad8d2008-01-29 08:49:27 -05005740#ifdef CONFIG_XFRM
5741 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5742 * packet transformation so allow the packet to pass without any checks
5743 * since we'll have another chance to perform access control checks
5744 * when the packet is on it's final way out.
5745 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005746 * is NULL, in this case go ahead and apply access control.
5747 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5748 * TCP listening state we cannot wait until the XFRM processing
5749 * is done as we will miss out on the SA label if we do;
5750 * unfortunately, this means more work, but it is only once per
5751 * connection. */
5752 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005753 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005754 return NF_ACCEPT;
5755#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005756
Paul Moored8395c82008-10-10 10:16:30 -04005757 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005758 /* Without an associated socket the packet is either coming
5759 * from the kernel or it is being forwarded; check the packet
5760 * to determine which and if the packet is being forwarded
5761 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005762 if (skb->skb_iif) {
5763 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005764 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005765 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005766 } else {
5767 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005768 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005769 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005770 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005771 /* Locally generated packet but the associated socket is in the
5772 * listening state which means this is a SYN-ACK packet. In
5773 * this particular case the correct security label is assigned
5774 * to the connection/request_sock but unfortunately we can't
5775 * query the request_sock as it isn't queued on the parent
5776 * socket until after the SYN-ACK packet is sent; the only
5777 * viable choice is to regenerate the label like we do in
5778 * selinux_inet_conn_request(). See also selinux_ip_output()
5779 * for similar problems. */
5780 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005781 struct sk_security_struct *sksec;
5782
Eric Dumazete446f9d2015-10-08 05:01:55 -07005783 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005784 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5785 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005786 /* At this point, if the returned skb peerlbl is SECSID_NULL
5787 * and the packet has been through at least one XFRM
5788 * transformation then we must be dealing with the "final"
5789 * form of labeled IPsec packet; since we've already applied
5790 * all of our access controls on this packet we can safely
5791 * pass the packet. */
5792 if (skb_sid == SECSID_NULL) {
5793 switch (family) {
5794 case PF_INET:
5795 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5796 return NF_ACCEPT;
5797 break;
5798 case PF_INET6:
5799 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5800 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005801 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005802 default:
5803 return NF_DROP_ERR(-ECONNREFUSED);
5804 }
5805 }
Paul Moore446b8022013-12-04 16:10:51 -05005806 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5807 return NF_DROP;
5808 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005809 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005810 /* Locally generated packet, fetch the security label from the
5811 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005812 struct sk_security_struct *sksec = sk->sk_security;
5813 peer_sid = sksec->sid;
5814 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005815 }
5816
Eric Paris50c205f2012-04-04 15:01:43 -04005817 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005818 ad.u.net = &net;
5819 ad.u.net->netif = ifindex;
5820 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005821 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005822 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005823
Paul Mooreeffad8d2008-01-29 08:49:27 -05005824 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005825 if (avc_has_perm(&selinux_state,
5826 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005827 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005828 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005829
5830 if (peerlbl_active) {
5831 u32 if_sid;
5832 u32 node_sid;
5833
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005834 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005835 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005836 if (avc_has_perm(&selinux_state,
5837 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005838 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005839 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005840
5841 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005842 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005843 if (avc_has_perm(&selinux_state,
5844 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005845 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005846 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005847 }
5848
5849 return NF_ACCEPT;
5850}
5851
Eric W. Biederman06198b32015-09-18 14:33:06 -05005852static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005853 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005854 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005855{
David S. Miller238e54c2015-04-03 20:32:56 -04005856 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005857}
5858
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005859#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005860static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005861 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005862 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005863{
David S. Miller238e54c2015-04-03 20:32:56 -04005864 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005865}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005866#endif /* IPV6 */
5867
5868#endif /* CONFIG_NETFILTER */
5869
Linus Torvalds1da177e2005-04-16 15:20:36 -07005870static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5871{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005872 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005873}
5874
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005875static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005876 u16 sclass)
5877{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005878 struct ipc_security_struct *isec;
5879
James Morris89d155e2005-10-30 14:59:21 -08005880 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005881 if (!isec)
5882 return -ENOMEM;
5883
Linus Torvalds1da177e2005-04-16 15:20:36 -07005884 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005885 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005886 perm->security = isec;
5887
5888 return 0;
5889}
5890
5891static void ipc_free_security(struct kern_ipc_perm *perm)
5892{
5893 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005894 perm->security = NULL;
5895 kfree(isec);
5896}
5897
5898static int msg_msg_alloc_security(struct msg_msg *msg)
5899{
5900 struct msg_security_struct *msec;
5901
James Morris89d155e2005-10-30 14:59:21 -08005902 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005903 if (!msec)
5904 return -ENOMEM;
5905
Linus Torvalds1da177e2005-04-16 15:20:36 -07005906 msec->sid = SECINITSID_UNLABELED;
5907 msg->security = msec;
5908
5909 return 0;
5910}
5911
5912static void msg_msg_free_security(struct msg_msg *msg)
5913{
5914 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005915
5916 msg->security = NULL;
5917 kfree(msec);
5918}
5919
5920static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005921 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005922{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005923 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005924 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005925 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005926
Linus Torvalds1da177e2005-04-16 15:20:36 -07005927 isec = ipc_perms->security;
5928
Eric Paris50c205f2012-04-04 15:01:43 -04005929 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005930 ad.u.ipc_id = ipc_perms->key;
5931
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005932 return avc_has_perm(&selinux_state,
5933 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005934}
5935
5936static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5937{
5938 return msg_msg_alloc_security(msg);
5939}
5940
5941static void selinux_msg_msg_free_security(struct msg_msg *msg)
5942{
5943 msg_msg_free_security(msg);
5944}
5945
5946/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005947static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005948{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005949 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005950 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005951 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005952 int rc;
5953
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005954 rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005955 if (rc)
5956 return rc;
5957
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005958 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005959
Eric Paris50c205f2012-04-04 15:01:43 -04005960 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005961 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005962
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005963 rc = avc_has_perm(&selinux_state,
5964 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005965 MSGQ__CREATE, &ad);
5966 if (rc) {
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005967 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005968 return rc;
5969 }
5970 return 0;
5971}
5972
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005973static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005974{
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005975 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005976}
5977
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005978static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005979{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005980 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005981 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005982 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005983
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005984 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005985
Eric Paris50c205f2012-04-04 15:01:43 -04005986 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005987 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005988
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005989 return avc_has_perm(&selinux_state,
5990 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005991 MSGQ__ASSOCIATE, &ad);
5992}
5993
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005994static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005995{
5996 int err;
5997 int perms;
5998
Eric Paris828dfe12008-04-17 13:17:49 -04005999 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006000 case IPC_INFO:
6001 case MSG_INFO:
6002 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006003 return avc_has_perm(&selinux_state,
6004 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006005 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006006 case IPC_STAT:
6007 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07006008 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006009 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6010 break;
6011 case IPC_SET:
6012 perms = MSGQ__SETATTR;
6013 break;
6014 case IPC_RMID:
6015 perms = MSGQ__DESTROY;
6016 break;
6017 default:
6018 return 0;
6019 }
6020
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006021 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006022 return err;
6023}
6024
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006025static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006026{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006027 struct ipc_security_struct *isec;
6028 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006029 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006030 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006031 int rc;
6032
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006033 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006034 msec = msg->security;
6035
6036 /*
6037 * First time through, need to assign label to the message
6038 */
6039 if (msec->sid == SECINITSID_UNLABELED) {
6040 /*
6041 * Compute new sid based on current process and
6042 * message queue this message will be stored in
6043 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006044 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6045 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006046 if (rc)
6047 return rc;
6048 }
6049
Eric Paris50c205f2012-04-04 15:01:43 -04006050 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006051 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006052
6053 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006054 rc = avc_has_perm(&selinux_state,
6055 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006056 MSGQ__WRITE, &ad);
6057 if (!rc)
6058 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006059 rc = avc_has_perm(&selinux_state,
6060 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11006061 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006062 if (!rc)
6063 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006064 rc = avc_has_perm(&selinux_state,
6065 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11006066 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006067
6068 return rc;
6069}
6070
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006071static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006072 struct task_struct *target,
6073 long type, int mode)
6074{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006075 struct ipc_security_struct *isec;
6076 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006077 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006078 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006079 int rc;
6080
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006081 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006082 msec = msg->security;
6083
Eric Paris50c205f2012-04-04 15:01:43 -04006084 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006085 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006086
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006087 rc = avc_has_perm(&selinux_state,
6088 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006089 SECCLASS_MSGQ, MSGQ__READ, &ad);
6090 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006091 rc = avc_has_perm(&selinux_state,
6092 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006093 SECCLASS_MSG, MSG__RECEIVE, &ad);
6094 return rc;
6095}
6096
6097/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006098static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006099{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006100 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006101 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006102 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006103 int rc;
6104
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006105 rc = ipc_alloc_security(shp, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006106 if (rc)
6107 return rc;
6108
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006109 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006110
Eric Paris50c205f2012-04-04 15:01:43 -04006111 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006112 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006113
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006114 rc = avc_has_perm(&selinux_state,
6115 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006116 SHM__CREATE, &ad);
6117 if (rc) {
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006118 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006119 return rc;
6120 }
6121 return 0;
6122}
6123
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006124static void selinux_shm_free_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006125{
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006126 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006127}
6128
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006129static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006130{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006131 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006132 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006133 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006134
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006135 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006136
Eric Paris50c205f2012-04-04 15:01:43 -04006137 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006138 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006139
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006140 return avc_has_perm(&selinux_state,
6141 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006142 SHM__ASSOCIATE, &ad);
6143}
6144
6145/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006146static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006147{
6148 int perms;
6149 int err;
6150
Eric Paris828dfe12008-04-17 13:17:49 -04006151 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006152 case IPC_INFO:
6153 case SHM_INFO:
6154 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006155 return avc_has_perm(&selinux_state,
6156 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006157 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006158 case IPC_STAT:
6159 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07006160 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006161 perms = SHM__GETATTR | SHM__ASSOCIATE;
6162 break;
6163 case IPC_SET:
6164 perms = SHM__SETATTR;
6165 break;
6166 case SHM_LOCK:
6167 case SHM_UNLOCK:
6168 perms = SHM__LOCK;
6169 break;
6170 case IPC_RMID:
6171 perms = SHM__DESTROY;
6172 break;
6173 default:
6174 return 0;
6175 }
6176
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006177 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006178 return err;
6179}
6180
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006181static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006182 char __user *shmaddr, int shmflg)
6183{
6184 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006185
6186 if (shmflg & SHM_RDONLY)
6187 perms = SHM__READ;
6188 else
6189 perms = SHM__READ | SHM__WRITE;
6190
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006191 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006192}
6193
6194/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006195static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006196{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006197 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006198 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006199 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006200 int rc;
6201
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006202 rc = ipc_alloc_security(sma, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006203 if (rc)
6204 return rc;
6205
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006206 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006207
Eric Paris50c205f2012-04-04 15:01:43 -04006208 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006209 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006210
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006211 rc = avc_has_perm(&selinux_state,
6212 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006213 SEM__CREATE, &ad);
6214 if (rc) {
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006215 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006216 return rc;
6217 }
6218 return 0;
6219}
6220
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006221static void selinux_sem_free_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006222{
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006223 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006224}
6225
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006226static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006227{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006228 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006229 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006230 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006231
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006232 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006233
Eric Paris50c205f2012-04-04 15:01:43 -04006234 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006235 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006236
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006237 return avc_has_perm(&selinux_state,
6238 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006239 SEM__ASSOCIATE, &ad);
6240}
6241
6242/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006243static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006244{
6245 int err;
6246 u32 perms;
6247
Eric Paris828dfe12008-04-17 13:17:49 -04006248 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006249 case IPC_INFO:
6250 case SEM_INFO:
6251 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006252 return avc_has_perm(&selinux_state,
6253 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006254 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006255 case GETPID:
6256 case GETNCNT:
6257 case GETZCNT:
6258 perms = SEM__GETATTR;
6259 break;
6260 case GETVAL:
6261 case GETALL:
6262 perms = SEM__READ;
6263 break;
6264 case SETVAL:
6265 case SETALL:
6266 perms = SEM__WRITE;
6267 break;
6268 case IPC_RMID:
6269 perms = SEM__DESTROY;
6270 break;
6271 case IPC_SET:
6272 perms = SEM__SETATTR;
6273 break;
6274 case IPC_STAT:
6275 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006276 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006277 perms = SEM__GETATTR | SEM__ASSOCIATE;
6278 break;
6279 default:
6280 return 0;
6281 }
6282
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006283 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006284 return err;
6285}
6286
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006287static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006288 struct sembuf *sops, unsigned nsops, int alter)
6289{
6290 u32 perms;
6291
6292 if (alter)
6293 perms = SEM__READ | SEM__WRITE;
6294 else
6295 perms = SEM__READ;
6296
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006297 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006298}
6299
6300static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6301{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006302 u32 av = 0;
6303
Linus Torvalds1da177e2005-04-16 15:20:36 -07006304 av = 0;
6305 if (flag & S_IRUGO)
6306 av |= IPC__UNIX_READ;
6307 if (flag & S_IWUGO)
6308 av |= IPC__UNIX_WRITE;
6309
6310 if (av == 0)
6311 return 0;
6312
Stephen Smalley6af963f2005-05-01 08:58:39 -07006313 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006314}
6315
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006316static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6317{
6318 struct ipc_security_struct *isec = ipcp->security;
6319 *secid = isec->sid;
6320}
6321
Eric Paris828dfe12008-04-17 13:17:49 -04006322static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006323{
6324 if (inode)
6325 inode_doinit_with_dentry(inode, dentry);
6326}
6327
6328static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006329 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006330{
David Howells275bb412008-11-14 10:39:19 +11006331 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006332 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006333 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006334 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006335
David Howells275bb412008-11-14 10:39:19 +11006336 rcu_read_lock();
6337 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006338
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006339 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006340 error = avc_has_perm(&selinux_state,
6341 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006342 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6343 if (error)
6344 goto bad;
6345 }
6346
Linus Torvalds1da177e2005-04-16 15:20:36 -07006347 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006348 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006349 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006350 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006351 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006352 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006353 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006354 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006355 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006356 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006357 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006358 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006359 else {
6360 error = -EINVAL;
6361 goto bad;
6362 }
David Howells275bb412008-11-14 10:39:19 +11006363 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006364
6365 if (!sid)
6366 return 0;
6367
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006368 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006369 if (error)
6370 return error;
6371 return len;
David Howells275bb412008-11-14 10:39:19 +11006372
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006373bad:
David Howells275bb412008-11-14 10:39:19 +11006374 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006375 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006376}
6377
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006378static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006379{
6380 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006381 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006382 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006383 int error;
6384 char *str = value;
6385
Linus Torvalds1da177e2005-04-16 15:20:36 -07006386 /*
6387 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006388 */
6389 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006390 error = avc_has_perm(&selinux_state,
6391 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006392 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006393 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006394 error = avc_has_perm(&selinux_state,
6395 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006396 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006397 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006398 error = avc_has_perm(&selinux_state,
6399 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006400 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006401 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006402 error = avc_has_perm(&selinux_state,
6403 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006404 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006405 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006406 error = avc_has_perm(&selinux_state,
6407 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006408 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006409 else
6410 error = -EINVAL;
6411 if (error)
6412 return error;
6413
6414 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006415 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006416 if (str[size-1] == '\n') {
6417 str[size-1] = 0;
6418 size--;
6419 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006420 error = security_context_to_sid(&selinux_state, value, size,
6421 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006422 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006423 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006424 struct audit_buffer *ab;
6425 size_t audit_size;
6426
6427 /* We strip a nul only if it is at the end, otherwise the
6428 * context contains a nul and we should audit that */
6429 if (str[size - 1] == '\0')
6430 audit_size = size - 1;
6431 else
6432 audit_size = size;
6433 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
6434 audit_log_format(ab, "op=fscreate invalid_context=");
6435 audit_log_n_untrustedstring(ab, value, audit_size);
6436 audit_log_end(ab);
6437
Stephen Smalley12b29f32008-05-07 13:03:20 -04006438 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006439 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006440 error = security_context_to_sid_force(
6441 &selinux_state,
6442 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006443 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006444 if (error)
6445 return error;
6446 }
6447
David Howellsd84f4f92008-11-14 10:39:23 +11006448 new = prepare_creds();
6449 if (!new)
6450 return -ENOMEM;
6451
Linus Torvalds1da177e2005-04-16 15:20:36 -07006452 /* Permission checking based on the specified context is
6453 performed during the actual operation (execve,
6454 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006455 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006456 checks and may_create for the file creation checks. The
6457 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006458 tsec = new->security;
6459 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006460 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006461 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006462 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006463 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006464 error = avc_has_perm(&selinux_state,
6465 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006466 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006467 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006468 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006469 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006470 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006471 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006472 } else if (!strcmp(name, "current")) {
6473 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006474 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006475 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006476
David Howellsd84f4f92008-11-14 10:39:23 +11006477 /* Only allow single threaded processes to change context */
6478 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006479 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006480 error = security_bounded_transition(&selinux_state,
6481 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006482 if (error)
6483 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006484 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006485
6486 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006487 error = avc_has_perm(&selinux_state,
6488 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006489 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006490 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006491 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006492
6493 /* Check for ptracing, and update the task SID if ok.
6494 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006495 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006496 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006497 error = avc_has_perm(&selinux_state,
6498 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006499 PROCESS__PTRACE, NULL);
6500 if (error)
6501 goto abort_change;
6502 }
6503
6504 tsec->sid = sid;
6505 } else {
6506 error = -EINVAL;
6507 goto abort_change;
6508 }
6509
6510 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006511 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006512
6513abort_change:
6514 abort_creds(new);
6515 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006516}
6517
David Quigley746df9b2013-05-22 12:50:35 -04006518static int selinux_ismaclabel(const char *name)
6519{
6520 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6521}
6522
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006523static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6524{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006525 return security_sid_to_context(&selinux_state, secid,
6526 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006527}
6528
David Howells7bf570d2008-04-29 20:52:51 +01006529static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006530{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006531 return security_context_to_sid(&selinux_state, secdata, seclen,
6532 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006533}
6534
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006535static void selinux_release_secctx(char *secdata, u32 seclen)
6536{
Paul Moore088999e2007-08-01 11:12:58 -04006537 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006538}
6539
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006540static void selinux_inode_invalidate_secctx(struct inode *inode)
6541{
6542 struct inode_security_struct *isec = inode->i_security;
6543
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006544 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006545 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006546 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006547}
6548
David P. Quigley1ee65e32009-09-03 14:25:57 -04006549/*
6550 * called with inode->i_mutex locked
6551 */
6552static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6553{
6554 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6555}
6556
6557/*
6558 * called with inode->i_mutex locked
6559 */
6560static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6561{
6562 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6563}
6564
6565static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6566{
6567 int len = 0;
6568 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6569 ctx, true);
6570 if (len < 0)
6571 return len;
6572 *ctxlen = len;
6573 return 0;
6574}
Michael LeMayd7200242006-06-22 14:47:17 -07006575#ifdef CONFIG_KEYS
6576
David Howellsd84f4f92008-11-14 10:39:23 +11006577static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006578 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006579{
David Howellsd84f4f92008-11-14 10:39:23 +11006580 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006581 struct key_security_struct *ksec;
6582
6583 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6584 if (!ksec)
6585 return -ENOMEM;
6586
David Howellsd84f4f92008-11-14 10:39:23 +11006587 tsec = cred->security;
6588 if (tsec->keycreate_sid)
6589 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006590 else
David Howellsd84f4f92008-11-14 10:39:23 +11006591 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006592
David Howells275bb412008-11-14 10:39:19 +11006593 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006594 return 0;
6595}
6596
6597static void selinux_key_free(struct key *k)
6598{
6599 struct key_security_struct *ksec = k->security;
6600
6601 k->security = NULL;
6602 kfree(ksec);
6603}
6604
6605static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006606 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006607 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006608{
6609 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006610 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006611 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006612
6613 /* if no specific permissions are requested, we skip the
6614 permission check. No serious, additional covert channels
6615 appear to be created. */
6616 if (perm == 0)
6617 return 0;
6618
David Howellsd84f4f92008-11-14 10:39:23 +11006619 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006620
6621 key = key_ref_to_ptr(key_ref);
6622 ksec = key->security;
6623
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006624 return avc_has_perm(&selinux_state,
6625 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006626}
6627
David Howells70a5bb72008-04-29 01:01:26 -07006628static int selinux_key_getsecurity(struct key *key, char **_buffer)
6629{
6630 struct key_security_struct *ksec = key->security;
6631 char *context = NULL;
6632 unsigned len;
6633 int rc;
6634
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006635 rc = security_sid_to_context(&selinux_state, ksec->sid,
6636 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006637 if (!rc)
6638 rc = len;
6639 *_buffer = context;
6640 return rc;
6641}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006642#endif
David Howells70a5bb72008-04-29 01:01:26 -07006643
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006644#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006645static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6646{
6647 struct common_audit_data ad;
6648 int err;
6649 u32 sid = 0;
6650 struct ib_security_struct *sec = ib_sec;
6651 struct lsm_ibpkey_audit ibpkey;
6652
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006653 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006654 if (err)
6655 return err;
6656
6657 ad.type = LSM_AUDIT_DATA_IBPKEY;
6658 ibpkey.subnet_prefix = subnet_prefix;
6659 ibpkey.pkey = pkey_val;
6660 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006661 return avc_has_perm(&selinux_state,
6662 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006663 SECCLASS_INFINIBAND_PKEY,
6664 INFINIBAND_PKEY__ACCESS, &ad);
6665}
6666
Daniel Jurgensab861df2017-05-19 15:48:58 +03006667static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6668 u8 port_num)
6669{
6670 struct common_audit_data ad;
6671 int err;
6672 u32 sid = 0;
6673 struct ib_security_struct *sec = ib_sec;
6674 struct lsm_ibendport_audit ibendport;
6675
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006676 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6677 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006678
6679 if (err)
6680 return err;
6681
6682 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6683 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6684 ibendport.port = port_num;
6685 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006686 return avc_has_perm(&selinux_state,
6687 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006688 SECCLASS_INFINIBAND_ENDPORT,
6689 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6690}
6691
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006692static int selinux_ib_alloc_security(void **ib_sec)
6693{
6694 struct ib_security_struct *sec;
6695
6696 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6697 if (!sec)
6698 return -ENOMEM;
6699 sec->sid = current_sid();
6700
6701 *ib_sec = sec;
6702 return 0;
6703}
6704
6705static void selinux_ib_free_security(void *ib_sec)
6706{
6707 kfree(ib_sec);
6708}
Michael LeMayd7200242006-06-22 14:47:17 -07006709#endif
6710
Chenbo Fengec27c352017-10-18 13:00:25 -07006711#ifdef CONFIG_BPF_SYSCALL
6712static int selinux_bpf(int cmd, union bpf_attr *attr,
6713 unsigned int size)
6714{
6715 u32 sid = current_sid();
6716 int ret;
6717
6718 switch (cmd) {
6719 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006720 ret = avc_has_perm(&selinux_state,
6721 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006722 NULL);
6723 break;
6724 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006725 ret = avc_has_perm(&selinux_state,
6726 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006727 NULL);
6728 break;
6729 default:
6730 ret = 0;
6731 break;
6732 }
6733
6734 return ret;
6735}
6736
6737static u32 bpf_map_fmode_to_av(fmode_t fmode)
6738{
6739 u32 av = 0;
6740
6741 if (fmode & FMODE_READ)
6742 av |= BPF__MAP_READ;
6743 if (fmode & FMODE_WRITE)
6744 av |= BPF__MAP_WRITE;
6745 return av;
6746}
6747
Chenbo Fengf66e4482017-10-18 13:00:26 -07006748/* This function will check the file pass through unix socket or binder to see
6749 * if it is a bpf related object. And apply correspinding checks on the bpf
6750 * object based on the type. The bpf maps and programs, not like other files and
6751 * socket, are using a shared anonymous inode inside the kernel as their inode.
6752 * So checking that inode cannot identify if the process have privilege to
6753 * access the bpf object and that's why we have to add this additional check in
6754 * selinux_file_receive and selinux_binder_transfer_files.
6755 */
6756static int bpf_fd_pass(struct file *file, u32 sid)
6757{
6758 struct bpf_security_struct *bpfsec;
6759 struct bpf_prog *prog;
6760 struct bpf_map *map;
6761 int ret;
6762
6763 if (file->f_op == &bpf_map_fops) {
6764 map = file->private_data;
6765 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006766 ret = avc_has_perm(&selinux_state,
6767 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006768 bpf_map_fmode_to_av(file->f_mode), NULL);
6769 if (ret)
6770 return ret;
6771 } else if (file->f_op == &bpf_prog_fops) {
6772 prog = file->private_data;
6773 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006774 ret = avc_has_perm(&selinux_state,
6775 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006776 BPF__PROG_RUN, NULL);
6777 if (ret)
6778 return ret;
6779 }
6780 return 0;
6781}
6782
Chenbo Fengec27c352017-10-18 13:00:25 -07006783static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6784{
6785 u32 sid = current_sid();
6786 struct bpf_security_struct *bpfsec;
6787
6788 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006789 return avc_has_perm(&selinux_state,
6790 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006791 bpf_map_fmode_to_av(fmode), NULL);
6792}
6793
6794static int selinux_bpf_prog(struct bpf_prog *prog)
6795{
6796 u32 sid = current_sid();
6797 struct bpf_security_struct *bpfsec;
6798
6799 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006800 return avc_has_perm(&selinux_state,
6801 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006802 BPF__PROG_RUN, NULL);
6803}
6804
6805static int selinux_bpf_map_alloc(struct bpf_map *map)
6806{
6807 struct bpf_security_struct *bpfsec;
6808
6809 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6810 if (!bpfsec)
6811 return -ENOMEM;
6812
6813 bpfsec->sid = current_sid();
6814 map->security = bpfsec;
6815
6816 return 0;
6817}
6818
6819static void selinux_bpf_map_free(struct bpf_map *map)
6820{
6821 struct bpf_security_struct *bpfsec = map->security;
6822
6823 map->security = NULL;
6824 kfree(bpfsec);
6825}
6826
6827static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6828{
6829 struct bpf_security_struct *bpfsec;
6830
6831 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6832 if (!bpfsec)
6833 return -ENOMEM;
6834
6835 bpfsec->sid = current_sid();
6836 aux->security = bpfsec;
6837
6838 return 0;
6839}
6840
6841static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6842{
6843 struct bpf_security_struct *bpfsec = aux->security;
6844
6845 aux->security = NULL;
6846 kfree(bpfsec);
6847}
6848#endif
6849
James Morrisca97d932017-02-15 00:18:51 +11006850static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006851 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6852 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6853 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6854 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006855
Casey Schauflere20b0432015-05-02 15:11:36 -07006856 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6857 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6858 LSM_HOOK_INIT(capget, selinux_capget),
6859 LSM_HOOK_INIT(capset, selinux_capset),
6860 LSM_HOOK_INIT(capable, selinux_capable),
6861 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6862 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6863 LSM_HOOK_INIT(syslog, selinux_syslog),
6864 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006865
Casey Schauflere20b0432015-05-02 15:11:36 -07006866 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006867
Casey Schauflere20b0432015-05-02 15:11:36 -07006868 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6869 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6870 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006871
Casey Schauflere20b0432015-05-02 15:11:36 -07006872 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6873 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6874 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6875 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6876 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6877 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6878 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6879 LSM_HOOK_INIT(sb_mount, selinux_mount),
6880 LSM_HOOK_INIT(sb_umount, selinux_umount),
6881 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6882 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6883 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006884
Casey Schauflere20b0432015-05-02 15:11:36 -07006885 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006886 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006887
Casey Schauflere20b0432015-05-02 15:11:36 -07006888 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6889 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6890 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6891 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6892 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6893 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6894 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6895 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6896 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6897 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6898 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6899 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6900 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6901 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6902 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6903 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6904 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6905 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6906 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6907 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6908 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6909 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6910 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6911 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6912 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006913 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006914 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006915
Casey Schauflere20b0432015-05-02 15:11:36 -07006916 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6917 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6918 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6919 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6920 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6921 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6922 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6923 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6924 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6925 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6926 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6927 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006928
Casey Schauflere20b0432015-05-02 15:11:36 -07006929 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006930
Tetsuo Handaa79be232017-03-28 23:08:45 +09006931 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006932 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6933 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6934 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6935 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006936 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006937 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6938 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6939 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Jeff Vander Stoep61d612e2016-04-05 13:06:27 -07006940 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006941 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6942 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6943 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6944 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6945 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6946 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6947 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006948 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006949 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6950 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6951 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6952 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6953 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006954 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006955
Casey Schauflere20b0432015-05-02 15:11:36 -07006956 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6957 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006958
Casey Schauflere20b0432015-05-02 15:11:36 -07006959 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6960 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006961
Casey Schauflere20b0432015-05-02 15:11:36 -07006962 LSM_HOOK_INIT(msg_queue_alloc_security,
6963 selinux_msg_queue_alloc_security),
6964 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6965 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6966 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6967 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6968 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006969
Casey Schauflere20b0432015-05-02 15:11:36 -07006970 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6971 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6972 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6973 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6974 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006975
Casey Schauflere20b0432015-05-02 15:11:36 -07006976 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6977 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6978 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6979 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6980 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006981
Casey Schauflere20b0432015-05-02 15:11:36 -07006982 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006983
Casey Schauflere20b0432015-05-02 15:11:36 -07006984 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6985 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006986
Casey Schauflere20b0432015-05-02 15:11:36 -07006987 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6988 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6989 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6990 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006991 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006992 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6993 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6994 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006995
Casey Schauflere20b0432015-05-02 15:11:36 -07006996 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6997 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006998
Casey Schauflere20b0432015-05-02 15:11:36 -07006999 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7000 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7001 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7002 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7003 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7004 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7005 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7006 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7007 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7008 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7009 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7010 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7011 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7012 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7013 LSM_HOOK_INIT(socket_getpeersec_stream,
7014 selinux_socket_getpeersec_stream),
7015 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7016 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7017 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7018 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7019 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7020 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00007021 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7022 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7023 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07007024 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7025 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7026 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7027 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7028 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7029 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7030 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7031 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7032 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7033 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7034 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7035 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7036 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007037#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03007038 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03007039 LSM_HOOK_INIT(ib_endport_manage_subnet,
7040 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007041 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7042 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7043#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08007044#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07007045 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7046 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7047 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7048 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7049 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7050 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7051 selinux_xfrm_state_alloc_acquire),
7052 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7053 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7054 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7055 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7056 selinux_xfrm_state_pol_flow_match),
7057 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007058#endif
Michael LeMayd7200242006-06-22 14:47:17 -07007059
7060#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07007061 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7062 LSM_HOOK_INIT(key_free, selinux_key_free),
7063 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7064 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07007065#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007066
7067#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07007068 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7069 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7070 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7071 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007072#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07007073
7074#ifdef CONFIG_BPF_SYSCALL
7075 LSM_HOOK_INIT(bpf, selinux_bpf),
7076 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7077 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7078 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7079 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7080 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7081 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7082#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07007083};
7084
7085static __init int selinux_init(void)
7086{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007087 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02007088 selinux_enabled = 0;
7089 return 0;
7090 }
7091
Linus Torvalds1da177e2005-04-16 15:20:36 -07007092 if (!selinux_enabled) {
7093 printk(KERN_INFO "SELinux: Disabled at boot.\n");
7094 return 0;
7095 }
7096
7097 printk(KERN_INFO "SELinux: Initializing.\n");
7098
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007099 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05007100 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007101 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7102 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05007103 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007104
Linus Torvalds1da177e2005-04-16 15:20:36 -07007105 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11007106 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07007107
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04007108 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7109
James Morris7cae7e22006-03-22 00:09:22 -08007110 sel_inode_cache = kmem_cache_create("selinux_inode_security",
7111 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09007112 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04007113 file_security_cache = kmem_cache_create("selinux_file_security",
7114 sizeof(struct file_security_struct),
7115 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007116 avc_init();
7117
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007118 avtab_cache_init();
7119
7120 ebitmap_cache_init();
7121
7122 hashtab_cache_init();
7123
Casey Schauflerd69dece2017-01-18 17:09:05 -08007124 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007125
Paul Moore615e51f2014-06-26 14:33:56 -04007126 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7127 panic("SELinux: Unable to register AVC netcache callback\n");
7128
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03007129 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7130 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7131
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007132 if (selinux_enforcing_boot)
Eric Parisfadcdb42007-02-22 18:11:31 -05007133 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04007134 else
Eric Parisfadcdb42007-02-22 18:11:31 -05007135 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07007136
Linus Torvalds1da177e2005-04-16 15:20:36 -07007137 return 0;
7138}
7139
Al Viroe8c26252010-03-23 06:36:54 -04007140static void delayed_superblock_init(struct super_block *sb, void *unused)
7141{
7142 superblock_doinit(sb, NULL);
7143}
7144
Linus Torvalds1da177e2005-04-16 15:20:36 -07007145void selinux_complete_init(void)
7146{
Eric Parisfadcdb42007-02-22 18:11:31 -05007147 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007148
7149 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05007150 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04007151 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007152}
7153
7154/* SELinux requires early initialization in order to label
7155 all processes and objects when they are created. */
7156security_initcall(selinux_init);
7157
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007158#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007159
Florian Westphal591bb272017-07-26 11:40:52 +02007160static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007161 {
7162 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007163 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007164 .hooknum = NF_INET_POST_ROUTING,
7165 .priority = NF_IP_PRI_SELINUX_LAST,
7166 },
7167 {
7168 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007169 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007170 .hooknum = NF_INET_FORWARD,
7171 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007172 },
7173 {
7174 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007175 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007176 .hooknum = NF_INET_LOCAL_OUT,
7177 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007178 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007179#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007180 {
7181 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007182 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007183 .hooknum = NF_INET_POST_ROUTING,
7184 .priority = NF_IP6_PRI_SELINUX_LAST,
7185 },
7186 {
7187 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007188 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007189 .hooknum = NF_INET_FORWARD,
7190 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007191 },
Huw Davies2917f572016-06-27 15:06:15 -04007192 {
7193 .hook = selinux_ipv6_output,
7194 .pf = NFPROTO_IPV6,
7195 .hooknum = NF_INET_LOCAL_OUT,
7196 .priority = NF_IP6_PRI_SELINUX_FIRST,
7197 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007198#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007199};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007200
Florian Westphal8e71bf72017-04-21 11:49:09 +02007201static int __net_init selinux_nf_register(struct net *net)
7202{
7203 return nf_register_net_hooks(net, selinux_nf_ops,
7204 ARRAY_SIZE(selinux_nf_ops));
7205}
7206
7207static void __net_exit selinux_nf_unregister(struct net *net)
7208{
7209 nf_unregister_net_hooks(net, selinux_nf_ops,
7210 ARRAY_SIZE(selinux_nf_ops));
7211}
7212
7213static struct pernet_operations selinux_net_ops = {
7214 .init = selinux_nf_register,
7215 .exit = selinux_nf_unregister,
7216};
7217
Linus Torvalds1da177e2005-04-16 15:20:36 -07007218static int __init selinux_nf_ip_init(void)
7219{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007220 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007221
7222 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007223 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007224
7225 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
7226
Florian Westphal8e71bf72017-04-21 11:49:09 +02007227 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007228 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007229 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007230
Jiri Pirko25db6be2014-09-03 17:42:13 +02007231 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007232}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007233__initcall(selinux_nf_ip_init);
7234
7235#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7236static void selinux_nf_ip_exit(void)
7237{
Eric Parisfadcdb42007-02-22 18:11:31 -05007238 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007239
Florian Westphal8e71bf72017-04-21 11:49:09 +02007240 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007241}
7242#endif
7243
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007244#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007245
7246#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7247#define selinux_nf_ip_exit()
7248#endif
7249
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007250#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007251
7252#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007253int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007254{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007255 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007256 /* Not permitted after initial policy load. */
7257 return -EINVAL;
7258 }
7259
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007260 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007261 /* Only do this once. */
7262 return -EINVAL;
7263 }
7264
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007265 state->disabled = 1;
7266
Linus Torvalds1da177e2005-04-16 15:20:36 -07007267 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
7268
Stephen Smalley30d55282006-05-03 10:52:36 -04007269 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007270
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007271 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007272
Eric Parisaf8ff042009-09-20 21:23:01 -04007273 /* Try to destroy the avc node cache */
7274 avc_disable();
7275
Linus Torvalds1da177e2005-04-16 15:20:36 -07007276 /* Unregister netfilter hooks. */
7277 selinux_nf_ip_exit();
7278
7279 /* Unregister selinuxfs. */
7280 exit_sel_fs();
7281
7282 return 0;
7283}
7284#endif