blob: f9c3764e48590e5737a0afddb63043b25675f23b [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050027#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070029#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070030#include <linux/errno.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050031#include <linux/ext2_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070032#include <linux/sched.h>
33#include <linux/security.h>
34#include <linux/xattr.h>
35#include <linux/capability.h>
36#include <linux/unistd.h>
37#include <linux/mm.h>
38#include <linux/mman.h>
39#include <linux/slab.h>
40#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050041#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070042#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/spinlock.h>
44#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050045#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070046#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040047#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070048#include <linux/namei.h>
49#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070050#include <linux/netfilter_ipv4.h>
51#include <linux/netfilter_ipv6.h>
52#include <linux/tty.h>
53#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070054#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070055#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore220deb92008-01-29 08:38:23 -050056#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050057#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040058#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070059#include <asm/ioctls.h>
Paul Moored621d352008-01-29 08:43:36 -050060#include <asm/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <linux/bitops.h>
62#include <linux/interrupt.h>
63#include <linux/netdevice.h> /* for network interface checks */
64#include <linux/netlink.h>
65#include <linux/tcp.h>
66#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080067#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070068#include <linux/quota.h>
69#include <linux/un.h> /* for Unix socket types */
70#include <net/af_unix.h> /* for Unix socket types */
71#include <linux/parser.h>
72#include <linux/nfs_mount.h>
73#include <net/ipv6.h>
74#include <linux/hugetlb.h>
75#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070076#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070077#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070078#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070079#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070080#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080081#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070082#include <linux/user_namespace.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070083
84#include "avc.h"
85#include "objsec.h"
86#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050087#include "netnode.h"
Paul Moore3e112172008-04-10 10:48:14 -040088#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080089#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050090#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020091#include "audit.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070092
David P. Quigley11689d42009-01-16 09:22:03 -050093#define NUM_SEL_MNT_OPTS 5
Eric Parisc9180a52007-11-30 13:00:35 -050094
Linus Torvalds1da177e2005-04-16 15:20:36 -070095extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
James Morris20510f22007-10-16 23:31:32 -070096extern struct security_operations *security_ops;
Linus Torvalds1da177e2005-04-16 15:20:36 -070097
Paul Moored621d352008-01-29 08:43:36 -050098/* SECMARK reference count */
99atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
Linus Torvalds1da177e2005-04-16 15:20:36 -0700101#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400102int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
104static int __init enforcing_setup(char *str)
105{
Eric Parisf5269712008-05-14 11:27:45 -0400106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109 return 1;
110}
111__setup("enforcing=", enforcing_setup);
112#endif
113
114#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117static int __init selinux_enabled_setup(char *str)
118{
Eric Parisf5269712008-05-14 11:27:45 -0400119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700122 return 1;
123}
124__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400125#else
126int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127#endif
128
Christoph Lametere18b8902006-12-06 20:33:20 -0800129static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800130
Paul Moored621d352008-01-29 08:43:36 -0500131/**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
139 *
140 */
141static int selinux_secmark_enabled(void)
142{
143 return (atomic_read(&selinux_secmark_refcount) > 0);
144}
145
David Howellsd84f4f92008-11-14 10:39:23 +1100146/*
147 * initialise the security for the init task
148 */
149static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700150{
David Howells3b11a1d2008-11-14 10:39:26 +1100151 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700152 struct task_security_struct *tsec;
153
James Morris89d155e2005-10-30 14:59:21 -0800154 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700155 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100156 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700157
David Howellsd84f4f92008-11-14 10:39:23 +1100158 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100159 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700160}
161
David Howells275bb412008-11-14 10:39:19 +1100162/*
David Howells88e67f32008-11-14 10:39:21 +1100163 * get the security ID of a set of credentials
164 */
165static inline u32 cred_sid(const struct cred *cred)
166{
167 const struct task_security_struct *tsec;
168
169 tsec = cred->security;
170 return tsec->sid;
171}
172
173/*
David Howells3b11a1d2008-11-14 10:39:26 +1100174 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100175 */
176static inline u32 task_sid(const struct task_struct *task)
177{
David Howells275bb412008-11-14 10:39:19 +1100178 u32 sid;
179
180 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100181 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100182 rcu_read_unlock();
183 return sid;
184}
185
186/*
David Howells3b11a1d2008-11-14 10:39:26 +1100187 * get the subjective security ID of the current task
David Howells275bb412008-11-14 10:39:19 +1100188 */
189static inline u32 current_sid(void)
190{
Paul Moore5fb49872010-04-22 14:46:19 -0400191 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +1100192
193 return tsec->sid;
194}
195
David Howells88e67f32008-11-14 10:39:21 +1100196/* Allocate and free functions for each kind of security blob. */
197
Linus Torvalds1da177e2005-04-16 15:20:36 -0700198static int inode_alloc_security(struct inode *inode)
199{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700200 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100201 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700202
Josef Bacika02fe132008-04-04 09:35:05 +1100203 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700204 if (!isec)
205 return -ENOMEM;
206
Eric Paris23970742006-09-25 23:32:01 -0700207 mutex_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209 isec->inode = inode;
210 isec->sid = SECINITSID_UNLABELED;
211 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100212 isec->task_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213 inode->i_security = isec;
214
215 return 0;
216}
217
218static void inode_free_security(struct inode *inode)
219{
220 struct inode_security_struct *isec = inode->i_security;
221 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
222
Linus Torvalds1da177e2005-04-16 15:20:36 -0700223 spin_lock(&sbsec->isec_lock);
224 if (!list_empty(&isec->list))
225 list_del_init(&isec->list);
226 spin_unlock(&sbsec->isec_lock);
227
228 inode->i_security = NULL;
James Morris7cae7e22006-03-22 00:09:22 -0800229 kmem_cache_free(sel_inode_cache, isec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700230}
231
232static int file_alloc_security(struct file *file)
233{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100235 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236
Stephen Smalley26d2a4b2006-02-01 03:05:55 -0800237 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700238 if (!fsec)
239 return -ENOMEM;
240
David Howells275bb412008-11-14 10:39:19 +1100241 fsec->sid = sid;
242 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700243 file->f_security = fsec;
244
245 return 0;
246}
247
248static void file_free_security(struct file *file)
249{
250 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251 file->f_security = NULL;
252 kfree(fsec);
253}
254
255static int superblock_alloc_security(struct super_block *sb)
256{
257 struct superblock_security_struct *sbsec;
258
James Morris89d155e2005-10-30 14:59:21 -0800259 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 if (!sbsec)
261 return -ENOMEM;
262
Eric Parisbc7e9822006-09-25 23:32:02 -0700263 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700264 INIT_LIST_HEAD(&sbsec->isec_head);
265 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266 sbsec->sb = sb;
267 sbsec->sid = SECINITSID_UNLABELED;
268 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700269 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700270 sb->s_security = sbsec;
271
272 return 0;
273}
274
275static void superblock_free_security(struct super_block *sb)
276{
277 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278 sb->s_security = NULL;
279 kfree(sbsec);
280}
281
Linus Torvalds1da177e2005-04-16 15:20:36 -0700282/* The security server must be initialized before
283 any labeling or access decisions can be provided. */
284extern int ss_initialized;
285
286/* The file system's label must be initialized prior to use. */
287
Stephen Hemminger634a5392010-03-04 21:59:03 -0800288static const char *labeling_behaviors[6] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700289 "uses xattr",
290 "uses transition SIDs",
291 "uses task SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
295};
296
297static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
298
299static inline int inode_doinit(struct inode *inode)
300{
301 return inode_doinit_with_dentry(inode, NULL);
302}
303
304enum {
Eric Paris31e87932007-09-19 17:19:12 -0400305 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700306 Opt_context = 1,
307 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500308 Opt_defcontext = 3,
309 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500310 Opt_labelsupport = 5,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700311};
312
Steven Whitehousea447c092008-10-13 10:46:57 +0100313static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400314 {Opt_context, CONTEXT_STR "%s"},
315 {Opt_fscontext, FSCONTEXT_STR "%s"},
316 {Opt_defcontext, DEFCONTEXT_STR "%s"},
317 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500318 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400319 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700320};
321
322#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
323
Eric Parisc312feb2006-07-10 04:43:53 -0700324static int may_context_mount_sb_relabel(u32 sid,
325 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100326 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700327{
David Howells275bb412008-11-14 10:39:19 +1100328 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700329 int rc;
330
331 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
332 FILESYSTEM__RELABELFROM, NULL);
333 if (rc)
334 return rc;
335
336 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
337 FILESYSTEM__RELABELTO, NULL);
338 return rc;
339}
340
Eric Paris08089252006-07-10 04:43:55 -0700341static int may_context_mount_inode_relabel(u32 sid,
342 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100343 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700344{
David Howells275bb412008-11-14 10:39:19 +1100345 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700346 int rc;
347 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELFROM, NULL);
349 if (rc)
350 return rc;
351
352 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
353 FILESYSTEM__ASSOCIATE, NULL);
354 return rc;
355}
356
Eric Parisc9180a52007-11-30 13:00:35 -0500357static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700358{
359 struct superblock_security_struct *sbsec = sb->s_security;
360 struct dentry *root = sb->s_root;
Eric Parisc9180a52007-11-30 13:00:35 -0500361 struct inode *root_inode = root->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362 int rc = 0;
363
Linus Torvalds1da177e2005-04-16 15:20:36 -0700364 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
365 /* Make sure that the xattr handler exists and that no
366 error other than -ENODATA is returned by getxattr on
367 the root directory. -ENODATA is ok, as this may be
368 the first boot of the SELinux kernel before we have
369 assigned xattr values to the filesystem. */
Eric Parisc9180a52007-11-30 13:00:35 -0500370 if (!root_inode->i_op->getxattr) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700371 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
372 "xattr support\n", sb->s_id, sb->s_type->name);
373 rc = -EOPNOTSUPP;
374 goto out;
375 }
Eric Parisc9180a52007-11-30 13:00:35 -0500376 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700377 if (rc < 0 && rc != -ENODATA) {
378 if (rc == -EOPNOTSUPP)
379 printk(KERN_WARNING "SELinux: (dev %s, type "
380 "%s) has no security xattr handler\n",
381 sb->s_id, sb->s_type->name);
382 else
383 printk(KERN_WARNING "SELinux: (dev %s, type "
384 "%s) getxattr errno %d\n", sb->s_id,
385 sb->s_type->name, -rc);
386 goto out;
387 }
388 }
389
David P. Quigley11689d42009-01-16 09:22:03 -0500390 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700391
Eric Parisc9180a52007-11-30 13:00:35 -0500392 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Eric Parisfadcdb42007-02-22 18:11:31 -0500393 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700394 sb->s_id, sb->s_type->name);
Eric Parisc9180a52007-11-30 13:00:35 -0500395 else
Eric Parisfadcdb42007-02-22 18:11:31 -0500396 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 sb->s_id, sb->s_type->name,
398 labeling_behaviors[sbsec->behavior-1]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700399
David P. Quigley11689d42009-01-16 09:22:03 -0500400 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
401 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
402 sbsec->behavior == SECURITY_FS_USE_NONE ||
403 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
404 sbsec->flags &= ~SE_SBLABELSUPP;
405
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400406 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
407 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
408 sbsec->flags |= SE_SBLABELSUPP;
409
Linus Torvalds1da177e2005-04-16 15:20:36 -0700410 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500411 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700412
413 /* Initialize any other inodes associated with the superblock, e.g.
414 inodes created prior to initial policy load or inodes created
415 during get_sb by a pseudo filesystem that directly
416 populates itself. */
417 spin_lock(&sbsec->isec_lock);
418next_inode:
419 if (!list_empty(&sbsec->isec_head)) {
420 struct inode_security_struct *isec =
421 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500422 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700423 struct inode *inode = isec->inode;
424 spin_unlock(&sbsec->isec_lock);
425 inode = igrab(inode);
426 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500427 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700428 inode_doinit(inode);
429 iput(inode);
430 }
431 spin_lock(&sbsec->isec_lock);
432 list_del_init(&isec->list);
433 goto next_inode;
434 }
435 spin_unlock(&sbsec->isec_lock);
436out:
Eric Parisc9180a52007-11-30 13:00:35 -0500437 return rc;
438}
439
440/*
441 * This function should allow an FS to ask what it's mount security
442 * options were so it can use those later for submounts, displaying
443 * mount options, or whatever.
444 */
445static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500446 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500447{
448 int rc = 0, i;
449 struct superblock_security_struct *sbsec = sb->s_security;
450 char *context = NULL;
451 u32 len;
452 char tmp;
453
Eric Parise0007522008-03-05 10:31:54 -0500454 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500455
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500456 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500457 return -EINVAL;
458
459 if (!ss_initialized)
460 return -EINVAL;
461
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500462 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500463 /* count the number of mount options for this sb */
464 for (i = 0; i < 8; i++) {
465 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500466 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500467 tmp >>= 1;
468 }
David P. Quigley11689d42009-01-16 09:22:03 -0500469 /* Check if the Label support flag is set */
470 if (sbsec->flags & SE_SBLABELSUPP)
471 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500472
Eric Parise0007522008-03-05 10:31:54 -0500473 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
474 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500475 rc = -ENOMEM;
476 goto out_free;
477 }
478
Eric Parise0007522008-03-05 10:31:54 -0500479 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
480 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500481 rc = -ENOMEM;
482 goto out_free;
483 }
484
485 i = 0;
486 if (sbsec->flags & FSCONTEXT_MNT) {
487 rc = security_sid_to_context(sbsec->sid, &context, &len);
488 if (rc)
489 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500490 opts->mnt_opts[i] = context;
491 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500492 }
493 if (sbsec->flags & CONTEXT_MNT) {
494 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
495 if (rc)
496 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500497 opts->mnt_opts[i] = context;
498 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500499 }
500 if (sbsec->flags & DEFCONTEXT_MNT) {
501 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
502 if (rc)
503 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500504 opts->mnt_opts[i] = context;
505 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500506 }
507 if (sbsec->flags & ROOTCONTEXT_MNT) {
508 struct inode *root = sbsec->sb->s_root->d_inode;
509 struct inode_security_struct *isec = root->i_security;
510
511 rc = security_sid_to_context(isec->sid, &context, &len);
512 if (rc)
513 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500514 opts->mnt_opts[i] = context;
515 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500516 }
David P. Quigley11689d42009-01-16 09:22:03 -0500517 if (sbsec->flags & SE_SBLABELSUPP) {
518 opts->mnt_opts[i] = NULL;
519 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
520 }
Eric Parisc9180a52007-11-30 13:00:35 -0500521
Eric Parise0007522008-03-05 10:31:54 -0500522 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500523
524 return 0;
525
526out_free:
Eric Parise0007522008-03-05 10:31:54 -0500527 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500528 return rc;
529}
530
531static int bad_option(struct superblock_security_struct *sbsec, char flag,
532 u32 old_sid, u32 new_sid)
533{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500534 char mnt_flags = sbsec->flags & SE_MNTMASK;
535
Eric Parisc9180a52007-11-30 13:00:35 -0500536 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500537 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500538 if (!(sbsec->flags & flag) ||
539 (old_sid != new_sid))
540 return 1;
541
542 /* check if we were passed the same options twice,
543 * aka someone passed context=a,context=b
544 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500545 if (!(sbsec->flags & SE_SBINITIALIZED))
546 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500547 return 1;
548 return 0;
549}
Eric Parise0007522008-03-05 10:31:54 -0500550
Eric Parisc9180a52007-11-30 13:00:35 -0500551/*
552 * Allow filesystems with binary mount data to explicitly set mount point
553 * labeling information.
554 */
Eric Parise0007522008-03-05 10:31:54 -0500555static int selinux_set_mnt_opts(struct super_block *sb,
556 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500557{
David Howells275bb412008-11-14 10:39:19 +1100558 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500559 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500560 struct superblock_security_struct *sbsec = sb->s_security;
561 const char *name = sb->s_type->name;
James Morris089be432008-07-15 18:32:49 +1000562 struct inode *inode = sbsec->sb->s_root->d_inode;
563 struct inode_security_struct *root_isec = inode->i_security;
Eric Parisc9180a52007-11-30 13:00:35 -0500564 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
565 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500566 char **mount_options = opts->mnt_opts;
567 int *flags = opts->mnt_opts_flags;
568 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500569
570 mutex_lock(&sbsec->lock);
571
572 if (!ss_initialized) {
573 if (!num_opts) {
574 /* Defer initialization until selinux_complete_init,
575 after the initial policy is loaded and the security
576 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500577 goto out;
578 }
579 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400580 printk(KERN_WARNING "SELinux: Unable to set superblock options "
581 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500582 goto out;
583 }
584
585 /*
Eric Parise0007522008-03-05 10:31:54 -0500586 * Binary mount data FS will come through this function twice. Once
587 * from an explicit call and once from the generic calls from the vfs.
588 * Since the generic VFS calls will not contain any security mount data
589 * we need to skip the double mount verification.
590 *
591 * This does open a hole in which we will not notice if the first
592 * mount using this sb set explict options and a second mount using
593 * this sb does not set any security options. (The first options
594 * will be used for both mounts)
595 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500596 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500597 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400598 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500599
600 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500601 * parse the mount options, check if they are valid sids.
602 * also check if someone is trying to mount the same sb more
603 * than once with different security options.
604 */
605 for (i = 0; i < num_opts; i++) {
606 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500607
608 if (flags[i] == SE_SBLABELSUPP)
609 continue;
Eric Parisc9180a52007-11-30 13:00:35 -0500610 rc = security_context_to_sid(mount_options[i],
611 strlen(mount_options[i]), &sid);
612 if (rc) {
613 printk(KERN_WARNING "SELinux: security_context_to_sid"
614 "(%s) failed for (dev %s, type %s) errno=%d\n",
615 mount_options[i], sb->s_id, name, rc);
616 goto out;
617 }
618 switch (flags[i]) {
619 case FSCONTEXT_MNT:
620 fscontext_sid = sid;
621
622 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
623 fscontext_sid))
624 goto out_double_mount;
625
626 sbsec->flags |= FSCONTEXT_MNT;
627 break;
628 case CONTEXT_MNT:
629 context_sid = sid;
630
631 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
632 context_sid))
633 goto out_double_mount;
634
635 sbsec->flags |= CONTEXT_MNT;
636 break;
637 case ROOTCONTEXT_MNT:
638 rootcontext_sid = sid;
639
640 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
641 rootcontext_sid))
642 goto out_double_mount;
643
644 sbsec->flags |= ROOTCONTEXT_MNT;
645
646 break;
647 case DEFCONTEXT_MNT:
648 defcontext_sid = sid;
649
650 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
651 defcontext_sid))
652 goto out_double_mount;
653
654 sbsec->flags |= DEFCONTEXT_MNT;
655
656 break;
657 default:
658 rc = -EINVAL;
659 goto out;
660 }
661 }
662
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500663 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500664 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500665 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500666 goto out_double_mount;
667 rc = 0;
668 goto out;
669 }
670
James Morris089be432008-07-15 18:32:49 +1000671 if (strcmp(sb->s_type->name, "proc") == 0)
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500672 sbsec->flags |= SE_SBPROC;
Eric Parisc9180a52007-11-30 13:00:35 -0500673
674 /* Determine the labeling behavior to use for this filesystem type. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500675 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
Eric Parisc9180a52007-11-30 13:00:35 -0500676 if (rc) {
677 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
James Morris089be432008-07-15 18:32:49 +1000678 __func__, sb->s_type->name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500679 goto out;
680 }
681
682 /* sets the context of the superblock for the fs being mounted. */
683 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100684 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500685 if (rc)
686 goto out;
687
688 sbsec->sid = fscontext_sid;
689 }
690
691 /*
692 * Switch to using mount point labeling behavior.
693 * sets the label used on all file below the mountpoint, and will set
694 * the superblock context if not already set.
695 */
696 if (context_sid) {
697 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100698 rc = may_context_mount_sb_relabel(context_sid, sbsec,
699 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500700 if (rc)
701 goto out;
702 sbsec->sid = context_sid;
703 } else {
David Howells275bb412008-11-14 10:39:19 +1100704 rc = may_context_mount_inode_relabel(context_sid, sbsec,
705 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500706 if (rc)
707 goto out;
708 }
709 if (!rootcontext_sid)
710 rootcontext_sid = context_sid;
711
712 sbsec->mntpoint_sid = context_sid;
713 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
714 }
715
716 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100717 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
718 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500719 if (rc)
720 goto out;
721
722 root_isec->sid = rootcontext_sid;
723 root_isec->initialized = 1;
724 }
725
726 if (defcontext_sid) {
727 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
728 rc = -EINVAL;
729 printk(KERN_WARNING "SELinux: defcontext option is "
730 "invalid for this filesystem type\n");
731 goto out;
732 }
733
734 if (defcontext_sid != sbsec->def_sid) {
735 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100736 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500737 if (rc)
738 goto out;
739 }
740
741 sbsec->def_sid = defcontext_sid;
742 }
743
744 rc = sb_finish_set_opts(sb);
745out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700746 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700747 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500748out_double_mount:
749 rc = -EINVAL;
750 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
751 "security settings for (dev %s, type %s)\n", sb->s_id, name);
752 goto out;
753}
754
755static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
756 struct super_block *newsb)
757{
758 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
759 struct superblock_security_struct *newsbsec = newsb->s_security;
760
761 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
762 int set_context = (oldsbsec->flags & CONTEXT_MNT);
763 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
764
Eric Paris0f5e6422008-04-21 16:24:11 -0400765 /*
766 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400767 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400768 */
Al Viroe8c26252010-03-23 06:36:54 -0400769 if (!ss_initialized)
Eric Paris0f5e6422008-04-21 16:24:11 -0400770 return;
Eric Parisc9180a52007-11-30 13:00:35 -0500771
Eric Parisc9180a52007-11-30 13:00:35 -0500772 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500773 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500774
Eric Paris5a552612008-04-09 14:08:35 -0400775 /* if fs is reusing a sb, just let its options stand... */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500776 if (newsbsec->flags & SE_SBINITIALIZED)
Eric Paris5a552612008-04-09 14:08:35 -0400777 return;
778
Eric Parisc9180a52007-11-30 13:00:35 -0500779 mutex_lock(&newsbsec->lock);
780
781 newsbsec->flags = oldsbsec->flags;
782
783 newsbsec->sid = oldsbsec->sid;
784 newsbsec->def_sid = oldsbsec->def_sid;
785 newsbsec->behavior = oldsbsec->behavior;
786
787 if (set_context) {
788 u32 sid = oldsbsec->mntpoint_sid;
789
790 if (!set_fscontext)
791 newsbsec->sid = sid;
792 if (!set_rootcontext) {
793 struct inode *newinode = newsb->s_root->d_inode;
794 struct inode_security_struct *newisec = newinode->i_security;
795 newisec->sid = sid;
796 }
797 newsbsec->mntpoint_sid = sid;
798 }
799 if (set_rootcontext) {
800 const struct inode *oldinode = oldsb->s_root->d_inode;
801 const struct inode_security_struct *oldisec = oldinode->i_security;
802 struct inode *newinode = newsb->s_root->d_inode;
803 struct inode_security_struct *newisec = newinode->i_security;
804
805 newisec->sid = oldisec->sid;
806 }
807
808 sb_finish_set_opts(newsb);
809 mutex_unlock(&newsbsec->lock);
810}
811
Adrian Bunk2e1479d2008-03-17 22:29:23 +0200812static int selinux_parse_opts_str(char *options,
813 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500814{
Eric Parise0007522008-03-05 10:31:54 -0500815 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -0500816 char *context = NULL, *defcontext = NULL;
817 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -0500818 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500819
Eric Parise0007522008-03-05 10:31:54 -0500820 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500821
822 /* Standard string-based options. */
823 while ((p = strsep(&options, "|")) != NULL) {
824 int token;
825 substring_t args[MAX_OPT_ARGS];
826
827 if (!*p)
828 continue;
829
830 token = match_token(p, tokens, args);
831
832 switch (token) {
833 case Opt_context:
834 if (context || defcontext) {
835 rc = -EINVAL;
836 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
837 goto out_err;
838 }
839 context = match_strdup(&args[0]);
840 if (!context) {
841 rc = -ENOMEM;
842 goto out_err;
843 }
844 break;
845
846 case Opt_fscontext:
847 if (fscontext) {
848 rc = -EINVAL;
849 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
850 goto out_err;
851 }
852 fscontext = match_strdup(&args[0]);
853 if (!fscontext) {
854 rc = -ENOMEM;
855 goto out_err;
856 }
857 break;
858
859 case Opt_rootcontext:
860 if (rootcontext) {
861 rc = -EINVAL;
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
863 goto out_err;
864 }
865 rootcontext = match_strdup(&args[0]);
866 if (!rootcontext) {
867 rc = -ENOMEM;
868 goto out_err;
869 }
870 break;
871
872 case Opt_defcontext:
873 if (context || defcontext) {
874 rc = -EINVAL;
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
876 goto out_err;
877 }
878 defcontext = match_strdup(&args[0]);
879 if (!defcontext) {
880 rc = -ENOMEM;
881 goto out_err;
882 }
883 break;
David P. Quigley11689d42009-01-16 09:22:03 -0500884 case Opt_labelsupport:
885 break;
Eric Parisc9180a52007-11-30 13:00:35 -0500886 default:
887 rc = -EINVAL;
888 printk(KERN_WARNING "SELinux: unknown mount option\n");
889 goto out_err;
890
891 }
892 }
893
Eric Parise0007522008-03-05 10:31:54 -0500894 rc = -ENOMEM;
895 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
896 if (!opts->mnt_opts)
897 goto out_err;
898
899 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
900 if (!opts->mnt_opts_flags) {
901 kfree(opts->mnt_opts);
902 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -0500903 }
904
Eric Parise0007522008-03-05 10:31:54 -0500905 if (fscontext) {
906 opts->mnt_opts[num_mnt_opts] = fscontext;
907 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
908 }
909 if (context) {
910 opts->mnt_opts[num_mnt_opts] = context;
911 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
912 }
913 if (rootcontext) {
914 opts->mnt_opts[num_mnt_opts] = rootcontext;
915 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
916 }
917 if (defcontext) {
918 opts->mnt_opts[num_mnt_opts] = defcontext;
919 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
920 }
921
922 opts->num_mnt_opts = num_mnt_opts;
923 return 0;
924
Eric Parisc9180a52007-11-30 13:00:35 -0500925out_err:
926 kfree(context);
927 kfree(defcontext);
928 kfree(fscontext);
929 kfree(rootcontext);
930 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700931}
Eric Parise0007522008-03-05 10:31:54 -0500932/*
933 * string mount options parsing and call set the sbsec
934 */
935static int superblock_doinit(struct super_block *sb, void *data)
936{
937 int rc = 0;
938 char *options = data;
939 struct security_mnt_opts opts;
940
941 security_init_mnt_opts(&opts);
942
943 if (!data)
944 goto out;
945
946 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
947
948 rc = selinux_parse_opts_str(options, &opts);
949 if (rc)
950 goto out_err;
951
952out:
953 rc = selinux_set_mnt_opts(sb, &opts);
954
955out_err:
956 security_free_mnt_opts(&opts);
957 return rc;
958}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700959
Adrian Bunk3583a712008-07-22 20:21:23 +0300960static void selinux_write_opts(struct seq_file *m,
961 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +1000962{
963 int i;
964 char *prefix;
965
966 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -0500967 char *has_comma;
968
969 if (opts->mnt_opts[i])
970 has_comma = strchr(opts->mnt_opts[i], ',');
971 else
972 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +1000973
974 switch (opts->mnt_opts_flags[i]) {
975 case CONTEXT_MNT:
976 prefix = CONTEXT_STR;
977 break;
978 case FSCONTEXT_MNT:
979 prefix = FSCONTEXT_STR;
980 break;
981 case ROOTCONTEXT_MNT:
982 prefix = ROOTCONTEXT_STR;
983 break;
984 case DEFCONTEXT_MNT:
985 prefix = DEFCONTEXT_STR;
986 break;
David P. Quigley11689d42009-01-16 09:22:03 -0500987 case SE_SBLABELSUPP:
988 seq_putc(m, ',');
989 seq_puts(m, LABELSUPP_STR);
990 continue;
Eric Paris2069f452008-07-04 09:47:13 +1000991 default:
992 BUG();
993 };
994 /* we need a comma before each option */
995 seq_putc(m, ',');
996 seq_puts(m, prefix);
997 if (has_comma)
998 seq_putc(m, '\"');
999 seq_puts(m, opts->mnt_opts[i]);
1000 if (has_comma)
1001 seq_putc(m, '\"');
1002 }
1003}
1004
1005static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1006{
1007 struct security_mnt_opts opts;
1008 int rc;
1009
1010 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001011 if (rc) {
1012 /* before policy load we may get EINVAL, don't show anything */
1013 if (rc == -EINVAL)
1014 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001015 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001016 }
Eric Paris2069f452008-07-04 09:47:13 +10001017
1018 selinux_write_opts(m, &opts);
1019
1020 security_free_mnt_opts(&opts);
1021
1022 return rc;
1023}
1024
Linus Torvalds1da177e2005-04-16 15:20:36 -07001025static inline u16 inode_mode_to_security_class(umode_t mode)
1026{
1027 switch (mode & S_IFMT) {
1028 case S_IFSOCK:
1029 return SECCLASS_SOCK_FILE;
1030 case S_IFLNK:
1031 return SECCLASS_LNK_FILE;
1032 case S_IFREG:
1033 return SECCLASS_FILE;
1034 case S_IFBLK:
1035 return SECCLASS_BLK_FILE;
1036 case S_IFDIR:
1037 return SECCLASS_DIR;
1038 case S_IFCHR:
1039 return SECCLASS_CHR_FILE;
1040 case S_IFIFO:
1041 return SECCLASS_FIFO_FILE;
1042
1043 }
1044
1045 return SECCLASS_FILE;
1046}
1047
James Morris13402582005-09-30 14:24:34 -04001048static inline int default_protocol_stream(int protocol)
1049{
1050 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1051}
1052
1053static inline int default_protocol_dgram(int protocol)
1054{
1055 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1056}
1057
Linus Torvalds1da177e2005-04-16 15:20:36 -07001058static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1059{
1060 switch (family) {
1061 case PF_UNIX:
1062 switch (type) {
1063 case SOCK_STREAM:
1064 case SOCK_SEQPACKET:
1065 return SECCLASS_UNIX_STREAM_SOCKET;
1066 case SOCK_DGRAM:
1067 return SECCLASS_UNIX_DGRAM_SOCKET;
1068 }
1069 break;
1070 case PF_INET:
1071 case PF_INET6:
1072 switch (type) {
1073 case SOCK_STREAM:
James Morris13402582005-09-30 14:24:34 -04001074 if (default_protocol_stream(protocol))
1075 return SECCLASS_TCP_SOCKET;
1076 else
1077 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001078 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001079 if (default_protocol_dgram(protocol))
1080 return SECCLASS_UDP_SOCKET;
1081 else
1082 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001083 case SOCK_DCCP:
1084 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001085 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001086 return SECCLASS_RAWIP_SOCKET;
1087 }
1088 break;
1089 case PF_NETLINK:
1090 switch (protocol) {
1091 case NETLINK_ROUTE:
1092 return SECCLASS_NETLINK_ROUTE_SOCKET;
1093 case NETLINK_FIREWALL:
1094 return SECCLASS_NETLINK_FIREWALL_SOCKET;
James Morris216efaa2005-08-15 20:34:48 -07001095 case NETLINK_INET_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001096 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1097 case NETLINK_NFLOG:
1098 return SECCLASS_NETLINK_NFLOG_SOCKET;
1099 case NETLINK_XFRM:
1100 return SECCLASS_NETLINK_XFRM_SOCKET;
1101 case NETLINK_SELINUX:
1102 return SECCLASS_NETLINK_SELINUX_SOCKET;
1103 case NETLINK_AUDIT:
1104 return SECCLASS_NETLINK_AUDIT_SOCKET;
1105 case NETLINK_IP6_FW:
1106 return SECCLASS_NETLINK_IP6FW_SOCKET;
1107 case NETLINK_DNRTMSG:
1108 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001109 case NETLINK_KOBJECT_UEVENT:
1110 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001111 default:
1112 return SECCLASS_NETLINK_SOCKET;
1113 }
1114 case PF_PACKET:
1115 return SECCLASS_PACKET_SOCKET;
1116 case PF_KEY:
1117 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001118 case PF_APPLETALK:
1119 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001120 }
1121
1122 return SECCLASS_SOCKET;
1123}
1124
1125#ifdef CONFIG_PROC_FS
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001126static int selinux_proc_get_sid(struct dentry *dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001127 u16 tclass,
1128 u32 *sid)
1129{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001130 int rc;
1131 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001132
Eric Paris828dfe12008-04-17 13:17:49 -04001133 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001134 if (!buffer)
1135 return -ENOMEM;
1136
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001137 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1138 if (IS_ERR(path))
1139 rc = PTR_ERR(path);
1140 else {
1141 /* each process gets a /proc/PID/ entry. Strip off the
1142 * PID part to get a valid selinux labeling.
1143 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1144 while (path[1] >= '0' && path[1] <= '9') {
1145 path[1] = '/';
1146 path++;
1147 }
1148 rc = security_genfs_sid("proc", path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001149 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001150 free_page((unsigned long)buffer);
1151 return rc;
1152}
1153#else
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001154static int selinux_proc_get_sid(struct dentry *dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001155 u16 tclass,
1156 u32 *sid)
1157{
1158 return -EINVAL;
1159}
1160#endif
1161
1162/* The inode's security attributes must be initialized before first use. */
1163static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1164{
1165 struct superblock_security_struct *sbsec = NULL;
1166 struct inode_security_struct *isec = inode->i_security;
1167 u32 sid;
1168 struct dentry *dentry;
1169#define INITCONTEXTLEN 255
1170 char *context = NULL;
1171 unsigned len = 0;
1172 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001173
1174 if (isec->initialized)
1175 goto out;
1176
Eric Paris23970742006-09-25 23:32:01 -07001177 mutex_lock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001178 if (isec->initialized)
Eric Paris23970742006-09-25 23:32:01 -07001179 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001180
1181 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001182 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001183 /* Defer initialization until selinux_complete_init,
1184 after the initial policy is loaded and the security
1185 server is ready to handle calls. */
1186 spin_lock(&sbsec->isec_lock);
1187 if (list_empty(&isec->list))
1188 list_add(&isec->list, &sbsec->isec_head);
1189 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001190 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001191 }
1192
1193 switch (sbsec->behavior) {
1194 case SECURITY_FS_USE_XATTR:
1195 if (!inode->i_op->getxattr) {
1196 isec->sid = sbsec->def_sid;
1197 break;
1198 }
1199
1200 /* Need a dentry, since the xattr API requires one.
1201 Life would be simpler if we could just pass the inode. */
1202 if (opt_dentry) {
1203 /* Called from d_instantiate or d_splice_alias. */
1204 dentry = dget(opt_dentry);
1205 } else {
1206 /* Called from selinux_complete_init, try to find a dentry. */
1207 dentry = d_find_alias(inode);
1208 }
1209 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001210 /*
1211 * this is can be hit on boot when a file is accessed
1212 * before the policy is loaded. When we load policy we
1213 * may find inodes that have no dentry on the
1214 * sbsec->isec_head list. No reason to complain as these
1215 * will get fixed up the next time we go through
1216 * inode_doinit with a dentry, before these inodes could
1217 * be used again by userspace.
1218 */
Eric Paris23970742006-09-25 23:32:01 -07001219 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001220 }
1221
1222 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001223 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001224 if (!context) {
1225 rc = -ENOMEM;
1226 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001227 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001228 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001229 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001230 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1231 context, len);
1232 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001233 kfree(context);
1234
Linus Torvalds1da177e2005-04-16 15:20:36 -07001235 /* Need a larger buffer. Query for the right size. */
1236 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1237 NULL, 0);
1238 if (rc < 0) {
1239 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001240 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001241 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001242 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001243 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001244 if (!context) {
1245 rc = -ENOMEM;
1246 dput(dentry);
Eric Paris23970742006-09-25 23:32:01 -07001247 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001248 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001249 context[len] = '\0';
Linus Torvalds1da177e2005-04-16 15:20:36 -07001250 rc = inode->i_op->getxattr(dentry,
1251 XATTR_NAME_SELINUX,
1252 context, len);
1253 }
1254 dput(dentry);
1255 if (rc < 0) {
1256 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001257 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001258 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001259 -rc, inode->i_sb->s_id, inode->i_ino);
1260 kfree(context);
Eric Paris23970742006-09-25 23:32:01 -07001261 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001262 }
1263 /* Map ENODATA to the default file SID */
1264 sid = sbsec->def_sid;
1265 rc = 0;
1266 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001267 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001268 sbsec->def_sid,
1269 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001270 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001271 char *dev = inode->i_sb->s_id;
1272 unsigned long ino = inode->i_ino;
1273
1274 if (rc == -EINVAL) {
1275 if (printk_ratelimit())
1276 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1277 "context=%s. This indicates you may need to relabel the inode or the "
1278 "filesystem in question.\n", ino, dev, context);
1279 } else {
1280 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1281 "returned %d for dev=%s ino=%ld\n",
1282 __func__, context, -rc, dev, ino);
1283 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001284 kfree(context);
1285 /* Leave with the unlabeled SID */
1286 rc = 0;
1287 break;
1288 }
1289 }
1290 kfree(context);
1291 isec->sid = sid;
1292 break;
1293 case SECURITY_FS_USE_TASK:
1294 isec->sid = isec->task_sid;
1295 break;
1296 case SECURITY_FS_USE_TRANS:
1297 /* Default to the fs SID. */
1298 isec->sid = sbsec->sid;
1299
1300 /* Try to obtain a transition SID. */
1301 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Eric Paris652bb9b2011-02-01 11:05:40 -05001302 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1303 isec->sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001304 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001305 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001306 isec->sid = sid;
1307 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001308 case SECURITY_FS_USE_MNTPOINT:
1309 isec->sid = sbsec->mntpoint_sid;
1310 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001311 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001312 /* Default to the fs superblock SID. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001313 isec->sid = sbsec->sid;
1314
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001315 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001316 if (opt_dentry) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001317 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001318 rc = selinux_proc_get_sid(opt_dentry,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001319 isec->sclass,
1320 &sid);
1321 if (rc)
Eric Paris23970742006-09-25 23:32:01 -07001322 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001323 isec->sid = sid;
1324 }
1325 }
1326 break;
1327 }
1328
1329 isec->initialized = 1;
1330
Eric Paris23970742006-09-25 23:32:01 -07001331out_unlock:
1332 mutex_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001333out:
1334 if (isec->sclass == SECCLASS_FILE)
1335 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001336 return rc;
1337}
1338
1339/* Convert a Linux signal to an access vector. */
1340static inline u32 signal_to_av(int sig)
1341{
1342 u32 perm = 0;
1343
1344 switch (sig) {
1345 case SIGCHLD:
1346 /* Commonly granted from child to parent. */
1347 perm = PROCESS__SIGCHLD;
1348 break;
1349 case SIGKILL:
1350 /* Cannot be caught or ignored */
1351 perm = PROCESS__SIGKILL;
1352 break;
1353 case SIGSTOP:
1354 /* Cannot be caught or ignored */
1355 perm = PROCESS__SIGSTOP;
1356 break;
1357 default:
1358 /* All other signals. */
1359 perm = PROCESS__SIGNAL;
1360 break;
1361 }
1362
1363 return perm;
1364}
1365
David Howells275bb412008-11-14 10:39:19 +11001366/*
David Howellsd84f4f92008-11-14 10:39:23 +11001367 * Check permission between a pair of credentials
1368 * fork check, ptrace check, etc.
1369 */
1370static int cred_has_perm(const struct cred *actor,
1371 const struct cred *target,
1372 u32 perms)
1373{
1374 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1375
1376 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1377}
1378
1379/*
David Howells88e67f32008-11-14 10:39:21 +11001380 * Check permission between a pair of tasks, e.g. signal checks,
David Howells275bb412008-11-14 10:39:19 +11001381 * fork check, ptrace check, etc.
1382 * tsk1 is the actor and tsk2 is the target
David Howells3b11a1d2008-11-14 10:39:26 +11001383 * - this uses the default subjective creds of tsk1
David Howells275bb412008-11-14 10:39:19 +11001384 */
1385static int task_has_perm(const struct task_struct *tsk1,
1386 const struct task_struct *tsk2,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001387 u32 perms)
1388{
David Howells275bb412008-11-14 10:39:19 +11001389 const struct task_security_struct *__tsec1, *__tsec2;
1390 u32 sid1, sid2;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001391
David Howells275bb412008-11-14 10:39:19 +11001392 rcu_read_lock();
1393 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1394 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1395 rcu_read_unlock();
1396 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001397}
1398
David Howells3b11a1d2008-11-14 10:39:26 +11001399/*
1400 * Check permission between current and another task, e.g. signal checks,
1401 * fork check, ptrace check, etc.
1402 * current is the actor and tsk2 is the target
1403 * - this uses current's subjective creds
1404 */
1405static int current_has_perm(const struct task_struct *tsk,
1406 u32 perms)
1407{
1408 u32 sid, tsid;
1409
1410 sid = current_sid();
1411 tsid = task_sid(tsk);
1412 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1413}
1414
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001415#if CAP_LAST_CAP > 63
1416#error Fix SELinux to handle capabilities > 63.
1417#endif
1418
Linus Torvalds1da177e2005-04-16 15:20:36 -07001419/* Check whether a task is allowed to use a capability. */
1420static int task_has_capability(struct task_struct *tsk,
David Howells3699c532009-01-06 22:27:01 +00001421 const struct cred *cred,
Eric Paris06112162008-11-11 22:02:50 +11001422 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001423{
Thomas Liu2bf49692009-07-14 12:14:09 -04001424 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001425 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001426 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001427 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001428 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001429 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001430
Thomas Liu2bf49692009-07-14 12:14:09 -04001431 COMMON_AUDIT_DATA_INIT(&ad, CAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001432 ad.tsk = tsk;
1433 ad.u.cap = cap;
1434
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001435 switch (CAP_TO_INDEX(cap)) {
1436 case 0:
1437 sclass = SECCLASS_CAPABILITY;
1438 break;
1439 case 1:
1440 sclass = SECCLASS_CAPABILITY2;
1441 break;
1442 default:
1443 printk(KERN_ERR
1444 "SELinux: out of range capability %d\n", cap);
1445 BUG();
1446 }
Eric Paris06112162008-11-11 22:02:50 +11001447
David Howells275bb412008-11-14 10:39:19 +11001448 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris06112162008-11-11 22:02:50 +11001449 if (audit == SECURITY_CAP_AUDIT)
David Howells275bb412008-11-14 10:39:19 +11001450 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
Eric Paris06112162008-11-11 22:02:50 +11001451 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001452}
1453
1454/* Check whether a task is allowed to use a system operation. */
1455static int task_has_system(struct task_struct *tsk,
1456 u32 perms)
1457{
David Howells275bb412008-11-14 10:39:19 +11001458 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001459
David Howells275bb412008-11-14 10:39:19 +11001460 return avc_has_perm(sid, SECINITSID_KERNEL,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001461 SECCLASS_SYSTEM, perms, NULL);
1462}
1463
1464/* Check whether a task has a particular permission to an inode.
1465 The 'adp' parameter is optional and allows other audit
1466 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001467static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001468 struct inode *inode,
1469 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001470 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001471{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001472 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001473 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001474 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001475
David Howellse0e81732009-09-02 09:13:40 +01001476 validate_creds(cred);
1477
Eric Paris828dfe12008-04-17 13:17:49 -04001478 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001479 return 0;
1480
David Howells88e67f32008-11-14 10:39:21 +11001481 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001482 isec = inode->i_security;
1483
1484 if (!adp) {
1485 adp = &ad;
Thomas Liu2bf49692009-07-14 12:14:09 -04001486 COMMON_AUDIT_DATA_INIT(&ad, FS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001487 ad.u.fs.inode = inode;
1488 }
1489
David Howells275bb412008-11-14 10:39:19 +11001490 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001491}
1492
1493/* Same as inode_has_perm, but pass explicit audit data containing
1494 the dentry to help the auditing code to more easily generate the
1495 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001496static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001497 struct vfsmount *mnt,
1498 struct dentry *dentry,
1499 u32 av)
1500{
1501 struct inode *inode = dentry->d_inode;
Thomas Liu2bf49692009-07-14 12:14:09 -04001502 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001503
Thomas Liu2bf49692009-07-14 12:14:09 -04001504 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001505 ad.u.fs.path.mnt = mnt;
1506 ad.u.fs.path.dentry = dentry;
David Howells88e67f32008-11-14 10:39:21 +11001507 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001508}
1509
1510/* Check whether a task can use an open file descriptor to
1511 access an inode in a given way. Check access to the
1512 descriptor itself, and then use dentry_has_perm to
1513 check a particular permission to the file.
1514 Access to the descriptor is implicitly granted if it
1515 has the same SID as the process. If av is zero, then
1516 access to the file is not checked, e.g. for cases
1517 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001518static int file_has_perm(const struct cred *cred,
1519 struct file *file,
1520 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001521{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001522 struct file_security_struct *fsec = file->f_security;
Jan Blunck44707fd2008-02-14 19:38:33 -08001523 struct inode *inode = file->f_path.dentry->d_inode;
Thomas Liu2bf49692009-07-14 12:14:09 -04001524 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001525 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001526 int rc;
1527
Thomas Liu2bf49692009-07-14 12:14:09 -04001528 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001529 ad.u.fs.path = file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001530
David Howells275bb412008-11-14 10:39:19 +11001531 if (sid != fsec->sid) {
1532 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001533 SECCLASS_FD,
1534 FD__USE,
1535 &ad);
1536 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001537 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001538 }
1539
1540 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001541 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001542 if (av)
David Howells88e67f32008-11-14 10:39:21 +11001543 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001544
David Howells88e67f32008-11-14 10:39:21 +11001545out:
1546 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001547}
1548
1549/* Check whether a task can create a file. */
1550static int may_create(struct inode *dir,
1551 struct dentry *dentry,
1552 u16 tclass)
1553{
Paul Moore5fb49872010-04-22 14:46:19 -04001554 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001555 struct inode_security_struct *dsec;
1556 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001557 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001558 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001559 int rc;
1560
Linus Torvalds1da177e2005-04-16 15:20:36 -07001561 dsec = dir->i_security;
1562 sbsec = dir->i_sb->s_security;
1563
David Howells275bb412008-11-14 10:39:19 +11001564 sid = tsec->sid;
1565 newsid = tsec->create_sid;
1566
Thomas Liu2bf49692009-07-14 12:14:09 -04001567 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001568 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001569
David Howells275bb412008-11-14 10:39:19 +11001570 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001571 DIR__ADD_NAME | DIR__SEARCH,
1572 &ad);
1573 if (rc)
1574 return rc;
1575
David P. Quigleycd895962009-01-16 09:22:04 -05001576 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
Eric Paris652bb9b2011-02-01 11:05:40 -05001577 rc = security_transition_sid(sid, dsec->sid, tclass, NULL, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001578 if (rc)
1579 return rc;
1580 }
1581
David Howells275bb412008-11-14 10:39:19 +11001582 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001583 if (rc)
1584 return rc;
1585
1586 return avc_has_perm(newsid, sbsec->sid,
1587 SECCLASS_FILESYSTEM,
1588 FILESYSTEM__ASSOCIATE, &ad);
1589}
1590
Michael LeMay4eb582c2006-06-26 00:24:57 -07001591/* Check whether a task can create a key. */
1592static int may_create_key(u32 ksid,
1593 struct task_struct *ctx)
1594{
David Howells275bb412008-11-14 10:39:19 +11001595 u32 sid = task_sid(ctx);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001596
David Howells275bb412008-11-14 10:39:19 +11001597 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001598}
1599
Eric Paris828dfe12008-04-17 13:17:49 -04001600#define MAY_LINK 0
1601#define MAY_UNLINK 1
1602#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001603
1604/* Check whether a task can link, unlink, or rmdir a file/directory. */
1605static int may_link(struct inode *dir,
1606 struct dentry *dentry,
1607 int kind)
1608
1609{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001610 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001611 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001612 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001613 u32 av;
1614 int rc;
1615
Linus Torvalds1da177e2005-04-16 15:20:36 -07001616 dsec = dir->i_security;
1617 isec = dentry->d_inode->i_security;
1618
Thomas Liu2bf49692009-07-14 12:14:09 -04001619 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001620 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001621
1622 av = DIR__SEARCH;
1623 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001624 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001625 if (rc)
1626 return rc;
1627
1628 switch (kind) {
1629 case MAY_LINK:
1630 av = FILE__LINK;
1631 break;
1632 case MAY_UNLINK:
1633 av = FILE__UNLINK;
1634 break;
1635 case MAY_RMDIR:
1636 av = DIR__RMDIR;
1637 break;
1638 default:
Eric Paris744ba352008-04-17 11:52:44 -04001639 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1640 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001641 return 0;
1642 }
1643
David Howells275bb412008-11-14 10:39:19 +11001644 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001645 return rc;
1646}
1647
1648static inline int may_rename(struct inode *old_dir,
1649 struct dentry *old_dentry,
1650 struct inode *new_dir,
1651 struct dentry *new_dentry)
1652{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001653 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001654 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001655 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001656 u32 av;
1657 int old_is_dir, new_is_dir;
1658 int rc;
1659
Linus Torvalds1da177e2005-04-16 15:20:36 -07001660 old_dsec = old_dir->i_security;
1661 old_isec = old_dentry->d_inode->i_security;
1662 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1663 new_dsec = new_dir->i_security;
1664
Thomas Liu2bf49692009-07-14 12:14:09 -04001665 COMMON_AUDIT_DATA_INIT(&ad, FS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001666
Jan Blunck44707fd2008-02-14 19:38:33 -08001667 ad.u.fs.path.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11001668 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001669 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1670 if (rc)
1671 return rc;
David Howells275bb412008-11-14 10:39:19 +11001672 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001673 old_isec->sclass, FILE__RENAME, &ad);
1674 if (rc)
1675 return rc;
1676 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11001677 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001678 old_isec->sclass, DIR__REPARENT, &ad);
1679 if (rc)
1680 return rc;
1681 }
1682
Jan Blunck44707fd2008-02-14 19:38:33 -08001683 ad.u.fs.path.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001684 av = DIR__ADD_NAME | DIR__SEARCH;
1685 if (new_dentry->d_inode)
1686 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11001687 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001688 if (rc)
1689 return rc;
1690 if (new_dentry->d_inode) {
1691 new_isec = new_dentry->d_inode->i_security;
1692 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11001693 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001694 new_isec->sclass,
1695 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1696 if (rc)
1697 return rc;
1698 }
1699
1700 return 0;
1701}
1702
1703/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001704static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001705 struct super_block *sb,
1706 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001707 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001708{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001709 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11001710 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001711
Linus Torvalds1da177e2005-04-16 15:20:36 -07001712 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11001713 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001714}
1715
1716/* Convert a Linux mode and permission mask to an access vector. */
1717static inline u32 file_mask_to_av(int mode, int mask)
1718{
1719 u32 av = 0;
1720
1721 if ((mode & S_IFMT) != S_IFDIR) {
1722 if (mask & MAY_EXEC)
1723 av |= FILE__EXECUTE;
1724 if (mask & MAY_READ)
1725 av |= FILE__READ;
1726
1727 if (mask & MAY_APPEND)
1728 av |= FILE__APPEND;
1729 else if (mask & MAY_WRITE)
1730 av |= FILE__WRITE;
1731
1732 } else {
1733 if (mask & MAY_EXEC)
1734 av |= DIR__SEARCH;
1735 if (mask & MAY_WRITE)
1736 av |= DIR__WRITE;
1737 if (mask & MAY_READ)
1738 av |= DIR__READ;
1739 }
1740
1741 return av;
1742}
1743
1744/* Convert a Linux file to an access vector. */
1745static inline u32 file_to_av(struct file *file)
1746{
1747 u32 av = 0;
1748
1749 if (file->f_mode & FMODE_READ)
1750 av |= FILE__READ;
1751 if (file->f_mode & FMODE_WRITE) {
1752 if (file->f_flags & O_APPEND)
1753 av |= FILE__APPEND;
1754 else
1755 av |= FILE__WRITE;
1756 }
Stephen Smalley0794c662008-03-17 08:55:18 -04001757 if (!av) {
1758 /*
1759 * Special file opened with flags 3 for ioctl-only use.
1760 */
1761 av = FILE__IOCTL;
1762 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001763
1764 return av;
1765}
1766
Eric Paris8b6a5a32008-10-29 17:06:46 -04001767/*
1768 * Convert a file to an access vector and include the correct open
1769 * open permission.
1770 */
1771static inline u32 open_file_to_av(struct file *file)
1772{
1773 u32 av = file_to_av(file);
1774
Eric Paris49b7b8d2010-07-23 11:44:09 -04001775 if (selinux_policycap_openperm)
1776 av |= FILE__OPEN;
1777
Eric Paris8b6a5a32008-10-29 17:06:46 -04001778 return av;
1779}
1780
Linus Torvalds1da177e2005-04-16 15:20:36 -07001781/* Hook functions begin here. */
1782
Ingo Molnar9e488582009-05-07 19:26:19 +10001783static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01001784 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001785{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001786 int rc;
1787
Ingo Molnar9e488582009-05-07 19:26:19 +10001788 rc = cap_ptrace_access_check(child, mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001789 if (rc)
1790 return rc;
1791
Stephen Smalley006ebb42008-05-19 08:32:49 -04001792 if (mode == PTRACE_MODE_READ) {
David Howells275bb412008-11-14 10:39:19 +11001793 u32 sid = current_sid();
1794 u32 csid = task_sid(child);
1795 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalley006ebb42008-05-19 08:32:49 -04001796 }
1797
David Howells3b11a1d2008-11-14 10:39:26 +11001798 return current_has_perm(child, PROCESS__PTRACE);
David Howells5cd9c582008-08-14 11:37:28 +01001799}
1800
1801static int selinux_ptrace_traceme(struct task_struct *parent)
1802{
1803 int rc;
1804
Eric Paris200ac532009-02-12 15:01:04 -05001805 rc = cap_ptrace_traceme(parent);
David Howells5cd9c582008-08-14 11:37:28 +01001806 if (rc)
1807 return rc;
1808
1809 return task_has_perm(parent, current, PROCESS__PTRACE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001810}
1811
1812static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04001813 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001814{
1815 int error;
1816
David Howells3b11a1d2008-11-14 10:39:26 +11001817 error = current_has_perm(target, PROCESS__GETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001818 if (error)
1819 return error;
1820
Eric Paris200ac532009-02-12 15:01:04 -05001821 return cap_capget(target, effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001822}
1823
David Howellsd84f4f92008-11-14 10:39:23 +11001824static int selinux_capset(struct cred *new, const struct cred *old,
1825 const kernel_cap_t *effective,
1826 const kernel_cap_t *inheritable,
1827 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001828{
1829 int error;
1830
Eric Paris200ac532009-02-12 15:01:04 -05001831 error = cap_capset(new, old,
David Howellsd84f4f92008-11-14 10:39:23 +11001832 effective, inheritable, permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001833 if (error)
1834 return error;
1835
David Howellsd84f4f92008-11-14 10:39:23 +11001836 return cred_has_perm(old, new, PROCESS__SETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001837}
1838
James Morris5626d3e2009-01-30 10:05:06 +11001839/*
1840 * (This comment used to live with the selinux_task_setuid hook,
1841 * which was removed).
1842 *
1843 * Since setuid only affects the current process, and since the SELinux
1844 * controls are not based on the Linux identity attributes, SELinux does not
1845 * need to control this operation. However, SELinux does control the use of
1846 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1847 */
1848
David Howells3699c532009-01-06 22:27:01 +00001849static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
Serge E. Hallyn34867402011-03-23 16:43:17 -07001850 struct user_namespace *ns, int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001851{
1852 int rc;
1853
Serge E. Hallyn34867402011-03-23 16:43:17 -07001854 rc = cap_capable(tsk, cred, ns, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001855 if (rc)
1856 return rc;
1857
David Howells3699c532009-01-06 22:27:01 +00001858 return task_has_capability(tsk, cred, cap, audit);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001859}
1860
Linus Torvalds1da177e2005-04-16 15:20:36 -07001861static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1862{
David Howells88e67f32008-11-14 10:39:21 +11001863 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001864 int rc = 0;
1865
1866 if (!sb)
1867 return 0;
1868
1869 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04001870 case Q_SYNC:
1871 case Q_QUOTAON:
1872 case Q_QUOTAOFF:
1873 case Q_SETINFO:
1874 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001875 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001876 break;
1877 case Q_GETFMT:
1878 case Q_GETINFO:
1879 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11001880 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04001881 break;
1882 default:
1883 rc = 0; /* let the kernel handle invalid cmds */
1884 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001885 }
1886 return rc;
1887}
1888
1889static int selinux_quota_on(struct dentry *dentry)
1890{
David Howells88e67f32008-11-14 10:39:21 +11001891 const struct cred *cred = current_cred();
1892
1893 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001894}
1895
Eric Paris12b30522010-11-15 18:36:29 -05001896static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001897{
1898 int rc;
1899
Linus Torvalds1da177e2005-04-16 15:20:36 -07001900 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08001901 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1902 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04001903 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1904 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08001905 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1906 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1907 /* Set level of messages printed to console */
1908 case SYSLOG_ACTION_CONSOLE_LEVEL:
Eric Paris828dfe12008-04-17 13:17:49 -04001909 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1910 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08001911 case SYSLOG_ACTION_CLOSE: /* Close log */
1912 case SYSLOG_ACTION_OPEN: /* Open log */
1913 case SYSLOG_ACTION_READ: /* Read from log */
1914 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1915 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04001916 default:
1917 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1918 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001919 }
1920 return rc;
1921}
1922
1923/*
1924 * Check that a process has enough memory to allocate a new virtual
1925 * mapping. 0 means there is enough memory for the allocation to
1926 * succeed and -ENOMEM implies there is not.
1927 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07001928 * Do not audit the selinux permission check, as this is applied to all
1929 * processes that allocate mappings.
1930 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07001931static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001932{
1933 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001934
Serge E. Hallyn34867402011-03-23 16:43:17 -07001935 rc = selinux_capable(current, current_cred(),
1936 &init_user_ns, CAP_SYS_ADMIN,
David Howells3699c532009-01-06 22:27:01 +00001937 SECURITY_CAP_NOAUDIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001938 if (rc == 0)
1939 cap_sys_admin = 1;
1940
Alan Cox34b4e4a2007-08-22 14:01:28 -07001941 return __vm_enough_memory(mm, pages, cap_sys_admin);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001942}
1943
1944/* binprm security operations */
1945
David Howellsa6f76f22008-11-14 10:39:24 +11001946static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001947{
David Howellsa6f76f22008-11-14 10:39:24 +11001948 const struct task_security_struct *old_tsec;
1949 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001950 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001951 struct common_audit_data ad;
David Howellsa6f76f22008-11-14 10:39:24 +11001952 struct inode *inode = bprm->file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001953 int rc;
1954
Eric Paris200ac532009-02-12 15:01:04 -05001955 rc = cap_bprm_set_creds(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001956 if (rc)
1957 return rc;
1958
David Howellsa6f76f22008-11-14 10:39:24 +11001959 /* SELinux context only depends on initial program or script and not
1960 * the script interpreter */
1961 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001962 return 0;
1963
David Howellsa6f76f22008-11-14 10:39:24 +11001964 old_tsec = current_security();
1965 new_tsec = bprm->cred->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001966 isec = inode->i_security;
1967
1968 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11001969 new_tsec->sid = old_tsec->sid;
1970 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001971
Michael LeMay28eba5b2006-06-27 02:53:42 -07001972 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11001973 new_tsec->create_sid = 0;
1974 new_tsec->keycreate_sid = 0;
1975 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001976
David Howellsa6f76f22008-11-14 10:39:24 +11001977 if (old_tsec->exec_sid) {
1978 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001979 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11001980 new_tsec->exec_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001981 } else {
1982 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11001983 rc = security_transition_sid(old_tsec->sid, isec->sid,
Eric Paris652bb9b2011-02-01 11:05:40 -05001984 SECCLASS_PROCESS, NULL,
1985 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001986 if (rc)
1987 return rc;
1988 }
1989
Thomas Liu2bf49692009-07-14 12:14:09 -04001990 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08001991 ad.u.fs.path = bprm->file->f_path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001992
Josef Sipek3d5ff522006-12-08 02:37:38 -08001993 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
David Howellsa6f76f22008-11-14 10:39:24 +11001994 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001995
David Howellsa6f76f22008-11-14 10:39:24 +11001996 if (new_tsec->sid == old_tsec->sid) {
1997 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001998 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1999 if (rc)
2000 return rc;
2001 } else {
2002 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002003 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002004 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2005 if (rc)
2006 return rc;
2007
David Howellsa6f76f22008-11-14 10:39:24 +11002008 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002009 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2010 if (rc)
2011 return rc;
2012
David Howellsa6f76f22008-11-14 10:39:24 +11002013 /* Check for shared state */
2014 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2015 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2016 SECCLASS_PROCESS, PROCESS__SHARE,
2017 NULL);
2018 if (rc)
2019 return -EPERM;
2020 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002021
David Howellsa6f76f22008-11-14 10:39:24 +11002022 /* Make sure that anyone attempting to ptrace over a task that
2023 * changes its SID has the appropriate permit */
2024 if (bprm->unsafe &
2025 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2026 struct task_struct *tracer;
2027 struct task_security_struct *sec;
2028 u32 ptsid = 0;
2029
2030 rcu_read_lock();
2031 tracer = tracehook_tracer_task(current);
2032 if (likely(tracer != NULL)) {
2033 sec = __task_cred(tracer)->security;
2034 ptsid = sec->sid;
2035 }
2036 rcu_read_unlock();
2037
2038 if (ptsid != 0) {
2039 rc = avc_has_perm(ptsid, new_tsec->sid,
2040 SECCLASS_PROCESS,
2041 PROCESS__PTRACE, NULL);
2042 if (rc)
2043 return -EPERM;
2044 }
2045 }
2046
2047 /* Clear any possibly unsafe personality bits on exec: */
2048 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002049 }
2050
Linus Torvalds1da177e2005-04-16 15:20:36 -07002051 return 0;
2052}
2053
Eric Paris828dfe12008-04-17 13:17:49 -04002054static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002055{
Paul Moore5fb49872010-04-22 14:46:19 -04002056 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +11002057 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002058 int atsecure = 0;
2059
David Howells275bb412008-11-14 10:39:19 +11002060 sid = tsec->sid;
2061 osid = tsec->osid;
2062
2063 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002064 /* Enable secure mode for SIDs transitions unless
2065 the noatsecure permission is granted between
2066 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002067 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002068 SECCLASS_PROCESS,
2069 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002070 }
2071
Eric Paris200ac532009-02-12 15:01:04 -05002072 return (atsecure || cap_bprm_secureexec(bprm));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002073}
2074
Linus Torvalds1da177e2005-04-16 15:20:36 -07002075extern struct vfsmount *selinuxfs_mount;
2076extern struct dentry *selinux_null;
2077
2078/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002079static inline void flush_unauthorized_files(const struct cred *cred,
2080 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002081{
Thomas Liu2bf49692009-07-14 12:14:09 -04002082 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002083 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002084 struct tty_struct *tty;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002085 struct fdtable *fdt;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002086 long j = -1;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002087 int drop_tty = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002088
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002089 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002090 if (tty) {
Nick Pigginee2ffa02010-08-18 04:37:35 +10002091 spin_lock(&tty_files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002092 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002093 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002094 struct inode *inode;
2095
Linus Torvalds1da177e2005-04-16 15:20:36 -07002096 /* Revalidate access to controlling tty.
2097 Use inode_has_perm on the tty inode directly rather
2098 than using file_has_perm, as this particular open
2099 file may belong to another process and we are only
2100 interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002101 file_priv = list_first_entry(&tty->tty_files,
2102 struct tty_file_private, list);
2103 file = file_priv->file;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002104 inode = file->f_path.dentry->d_inode;
David Howells88e67f32008-11-14 10:39:21 +11002105 if (inode_has_perm(cred, inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002106 FILE__READ | FILE__WRITE, NULL)) {
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002107 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002108 }
2109 }
Nick Pigginee2ffa02010-08-18 04:37:35 +10002110 spin_unlock(&tty_files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002111 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002112 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002113 /* Reset controlling tty. */
2114 if (drop_tty)
2115 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002116
2117 /* Revalidate access to inherited open files. */
2118
Thomas Liu2bf49692009-07-14 12:14:09 -04002119 COMMON_AUDIT_DATA_INIT(&ad, FS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002120
2121 spin_lock(&files->file_lock);
2122 for (;;) {
2123 unsigned long set, i;
2124 int fd;
2125
2126 j++;
2127 i = j * __NFDBITS;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002128 fdt = files_fdtable(files);
Vadim Lobanovbbea9f62006-12-10 02:21:12 -08002129 if (i >= fdt->max_fds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002130 break;
Dipankar Sarmabadf1662005-09-09 13:04:10 -07002131 set = fdt->open_fds->fds_bits[j];
Linus Torvalds1da177e2005-04-16 15:20:36 -07002132 if (!set)
2133 continue;
2134 spin_unlock(&files->file_lock);
Eric Paris828dfe12008-04-17 13:17:49 -04002135 for ( ; set ; i++, set >>= 1) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002136 if (set & 1) {
2137 file = fget(i);
2138 if (!file)
2139 continue;
David Howells88e67f32008-11-14 10:39:21 +11002140 if (file_has_perm(cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002141 file,
2142 file_to_av(file))) {
2143 sys_close(i);
2144 fd = get_unused_fd();
2145 if (fd != i) {
2146 if (fd >= 0)
2147 put_unused_fd(fd);
2148 fput(file);
2149 continue;
2150 }
2151 if (devnull) {
Nick Piggin095975d2006-01-08 01:02:19 -08002152 get_file(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002153 } else {
David Howells745ca242008-11-14 10:39:22 +11002154 devnull = dentry_open(
2155 dget(selinux_null),
2156 mntget(selinuxfs_mount),
2157 O_RDWR, cred);
Akinobu Mitafc5d81e2006-11-27 15:16:48 +09002158 if (IS_ERR(devnull)) {
2159 devnull = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002160 put_unused_fd(fd);
2161 fput(file);
2162 continue;
2163 }
2164 }
2165 fd_install(fd, devnull);
2166 }
2167 fput(file);
2168 }
2169 }
2170 spin_lock(&files->file_lock);
2171
2172 }
2173 spin_unlock(&files->file_lock);
2174}
2175
Linus Torvalds1da177e2005-04-16 15:20:36 -07002176/*
David Howellsa6f76f22008-11-14 10:39:24 +11002177 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002178 */
David Howellsa6f76f22008-11-14 10:39:24 +11002179static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002180{
David Howellsa6f76f22008-11-14 10:39:24 +11002181 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002182 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002183 int rc, i;
2184
David Howellsa6f76f22008-11-14 10:39:24 +11002185 new_tsec = bprm->cred->security;
2186 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002187 return;
2188
2189 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002190 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002191
David Howellsa6f76f22008-11-14 10:39:24 +11002192 /* Always clear parent death signal on SID transitions. */
2193 current->pdeath_signal = 0;
2194
2195 /* Check whether the new SID can inherit resource limits from the old
2196 * SID. If not, reset all soft limits to the lower of the current
2197 * task's hard limit and the init task's soft limit.
2198 *
2199 * Note that the setting of hard limits (even to lower them) can be
2200 * controlled by the setrlimit check. The inclusion of the init task's
2201 * soft limit into the computation is to avoid resetting soft limits
2202 * higher than the default soft limit for cases where the default is
2203 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2204 */
2205 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2206 PROCESS__RLIMITINH, NULL);
2207 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002208 /* protect against do_prlimit() */
2209 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002210 for (i = 0; i < RLIM_NLIMITS; i++) {
2211 rlim = current->signal->rlim + i;
2212 initrlim = init_task.signal->rlim + i;
2213 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2214 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002215 task_unlock(current);
2216 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002217 }
2218}
2219
2220/*
2221 * Clean up the process immediately after the installation of new credentials
2222 * due to exec
2223 */
2224static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2225{
2226 const struct task_security_struct *tsec = current_security();
2227 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002228 u32 osid, sid;
2229 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002230
David Howellsa6f76f22008-11-14 10:39:24 +11002231 osid = tsec->osid;
2232 sid = tsec->sid;
2233
2234 if (sid == osid)
2235 return;
2236
2237 /* Check whether the new SID can inherit signal state from the old SID.
2238 * If not, clear itimers to avoid subsequent signal generation and
2239 * flush and unblock signals.
2240 *
2241 * This must occur _after_ the task SID has been updated so that any
2242 * kill done after the flush will be checked against the new SID.
2243 */
2244 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002245 if (rc) {
2246 memset(&itimer, 0, sizeof itimer);
2247 for (i = 0; i < 3; i++)
2248 do_setitimer(i, &itimer, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002249 spin_lock_irq(&current->sighand->siglock);
David Howells3bcac022009-04-29 13:45:05 +01002250 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2251 __flush_signals(current);
2252 flush_signal_handlers(current, 1);
2253 sigemptyset(&current->blocked);
2254 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002255 spin_unlock_irq(&current->sighand->siglock);
2256 }
2257
David Howellsa6f76f22008-11-14 10:39:24 +11002258 /* Wake up the parent if it is waiting so that it can recheck
2259 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002260 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002261 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002262 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002263}
2264
2265/* superblock security operations */
2266
2267static int selinux_sb_alloc_security(struct super_block *sb)
2268{
2269 return superblock_alloc_security(sb);
2270}
2271
2272static void selinux_sb_free_security(struct super_block *sb)
2273{
2274 superblock_free_security(sb);
2275}
2276
2277static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2278{
2279 if (plen > olen)
2280 return 0;
2281
2282 return !memcmp(prefix, option, plen);
2283}
2284
2285static inline int selinux_option(char *option, int len)
2286{
Eric Paris832cbd92008-04-01 13:24:09 -04002287 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2288 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2289 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002290 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2291 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002292}
2293
2294static inline void take_option(char **to, char *from, int *first, int len)
2295{
2296 if (!*first) {
2297 **to = ',';
2298 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002299 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002300 *first = 0;
2301 memcpy(*to, from, len);
2302 *to += len;
2303}
2304
Eric Paris828dfe12008-04-17 13:17:49 -04002305static inline void take_selinux_option(char **to, char *from, int *first,
2306 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002307{
2308 int current_size = 0;
2309
2310 if (!*first) {
2311 **to = '|';
2312 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002313 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002314 *first = 0;
2315
2316 while (current_size < len) {
2317 if (*from != '"') {
2318 **to = *from;
2319 *to += 1;
2320 }
2321 from += 1;
2322 current_size += 1;
2323 }
2324}
2325
Eric Parise0007522008-03-05 10:31:54 -05002326static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002327{
2328 int fnosec, fsec, rc = 0;
2329 char *in_save, *in_curr, *in_end;
2330 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002331 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002332
2333 in_curr = orig;
2334 sec_curr = copy;
2335
Linus Torvalds1da177e2005-04-16 15:20:36 -07002336 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2337 if (!nosec) {
2338 rc = -ENOMEM;
2339 goto out;
2340 }
2341
2342 nosec_save = nosec;
2343 fnosec = fsec = 1;
2344 in_save = in_end = orig;
2345
2346 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002347 if (*in_end == '"')
2348 open_quote = !open_quote;
2349 if ((*in_end == ',' && open_quote == 0) ||
2350 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002351 int len = in_end - in_curr;
2352
2353 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002354 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002355 else
2356 take_option(&nosec, in_curr, &fnosec, len);
2357
2358 in_curr = in_end + 1;
2359 }
2360 } while (*in_end++);
2361
Eric Paris6931dfc2005-06-30 02:58:51 -07002362 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002363 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002364out:
2365 return rc;
2366}
2367
Eric Paris026eb162011-03-03 16:09:14 -05002368static int selinux_sb_remount(struct super_block *sb, void *data)
2369{
2370 int rc, i, *flags;
2371 struct security_mnt_opts opts;
2372 char *secdata, **mount_options;
2373 struct superblock_security_struct *sbsec = sb->s_security;
2374
2375 if (!(sbsec->flags & SE_SBINITIALIZED))
2376 return 0;
2377
2378 if (!data)
2379 return 0;
2380
2381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2382 return 0;
2383
2384 security_init_mnt_opts(&opts);
2385 secdata = alloc_secdata();
2386 if (!secdata)
2387 return -ENOMEM;
2388 rc = selinux_sb_copy_data(data, secdata);
2389 if (rc)
2390 goto out_free_secdata;
2391
2392 rc = selinux_parse_opts_str(secdata, &opts);
2393 if (rc)
2394 goto out_free_secdata;
2395
2396 mount_options = opts.mnt_opts;
2397 flags = opts.mnt_opts_flags;
2398
2399 for (i = 0; i < opts.num_mnt_opts; i++) {
2400 u32 sid;
2401 size_t len;
2402
2403 if (flags[i] == SE_SBLABELSUPP)
2404 continue;
2405 len = strlen(mount_options[i]);
2406 rc = security_context_to_sid(mount_options[i], len, &sid);
2407 if (rc) {
2408 printk(KERN_WARNING "SELinux: security_context_to_sid"
2409 "(%s) failed for (dev %s, type %s) errno=%d\n",
2410 mount_options[i], sb->s_id, sb->s_type->name, rc);
2411 goto out_free_opts;
2412 }
2413 rc = -EINVAL;
2414 switch (flags[i]) {
2415 case FSCONTEXT_MNT:
2416 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2417 goto out_bad_option;
2418 break;
2419 case CONTEXT_MNT:
2420 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2421 goto out_bad_option;
2422 break;
2423 case ROOTCONTEXT_MNT: {
2424 struct inode_security_struct *root_isec;
2425 root_isec = sb->s_root->d_inode->i_security;
2426
2427 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2428 goto out_bad_option;
2429 break;
2430 }
2431 case DEFCONTEXT_MNT:
2432 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2433 goto out_bad_option;
2434 break;
2435 default:
2436 goto out_free_opts;
2437 }
2438 }
2439
2440 rc = 0;
2441out_free_opts:
2442 security_free_mnt_opts(&opts);
2443out_free_secdata:
2444 free_secdata(secdata);
2445 return rc;
2446out_bad_option:
2447 printk(KERN_WARNING "SELinux: unable to change security options "
2448 "during remount (dev %s, type=%s)\n", sb->s_id,
2449 sb->s_type->name);
2450 goto out_free_opts;
2451}
2452
James Morris12204e22008-12-19 10:44:42 +11002453static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002454{
David Howells88e67f32008-11-14 10:39:21 +11002455 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002456 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002457 int rc;
2458
2459 rc = superblock_doinit(sb, data);
2460 if (rc)
2461 return rc;
2462
James Morris74192242008-12-19 11:41:10 +11002463 /* Allow all mounts performed by the kernel */
2464 if (flags & MS_KERNMOUNT)
2465 return 0;
2466
Thomas Liu2bf49692009-07-14 12:14:09 -04002467 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002468 ad.u.fs.path.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002469 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002470}
2471
David Howells726c3342006-06-23 02:02:58 -07002472static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002473{
David Howells88e67f32008-11-14 10:39:21 +11002474 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002475 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002476
Thomas Liu2bf49692009-07-14 12:14:09 -04002477 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002478 ad.u.fs.path.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002479 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002480}
2481
Eric Paris828dfe12008-04-17 13:17:49 -04002482static int selinux_mount(char *dev_name,
Al Virob5266eb2008-03-22 17:48:24 -04002483 struct path *path,
Eric Paris828dfe12008-04-17 13:17:49 -04002484 char *type,
2485 unsigned long flags,
2486 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002487{
David Howells88e67f32008-11-14 10:39:21 +11002488 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002489
2490 if (flags & MS_REMOUNT)
David Howells88e67f32008-11-14 10:39:21 +11002491 return superblock_has_perm(cred, path->mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002492 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002493 else
David Howells88e67f32008-11-14 10:39:21 +11002494 return dentry_has_perm(cred, path->mnt, path->dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002495 FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002496}
2497
2498static int selinux_umount(struct vfsmount *mnt, int flags)
2499{
David Howells88e67f32008-11-14 10:39:21 +11002500 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002501
David Howells88e67f32008-11-14 10:39:21 +11002502 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002503 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002504}
2505
2506/* inode security operations */
2507
2508static int selinux_inode_alloc_security(struct inode *inode)
2509{
2510 return inode_alloc_security(inode);
2511}
2512
2513static void selinux_inode_free_security(struct inode *inode)
2514{
2515 inode_free_security(inode);
2516}
2517
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002518static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Eric Paris2a7dba32011-02-01 11:05:39 -05002519 const struct qstr *qstr, char **name,
2520 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002521{
Paul Moore5fb49872010-04-22 14:46:19 -04002522 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002523 struct inode_security_struct *dsec;
2524 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002525 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002526 int rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002527 char *namep = NULL, *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002528
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002529 dsec = dir->i_security;
2530 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002531
David Howells275bb412008-11-14 10:39:19 +11002532 sid = tsec->sid;
2533 newsid = tsec->create_sid;
2534
Eric Paris415103f2010-12-02 16:13:40 -05002535 if ((sbsec->flags & SE_SBINITIALIZED) &&
2536 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2537 newsid = sbsec->mntpoint_sid;
2538 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
David Howells275bb412008-11-14 10:39:19 +11002539 rc = security_transition_sid(sid, dsec->sid,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002540 inode_mode_to_security_class(inode->i_mode),
Eric Paris652bb9b2011-02-01 11:05:40 -05002541 qstr, &newsid);
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002542 if (rc) {
2543 printk(KERN_WARNING "%s: "
2544 "security_transition_sid failed, rc=%d (dev=%s "
2545 "ino=%ld)\n",
Harvey Harrisondd6f9532008-03-06 10:03:59 +11002546 __func__,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002547 -rc, inode->i_sb->s_id, inode->i_ino);
2548 return rc;
2549 }
2550 }
2551
Eric Paris296fddf2006-09-25 23:32:00 -07002552 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002553 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002554 struct inode_security_struct *isec = inode->i_security;
2555 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2556 isec->sid = newsid;
2557 isec->initialized = 1;
2558 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002559
David P. Quigleycd895962009-01-16 09:22:04 -05002560 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002561 return -EOPNOTSUPP;
2562
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002563 if (name) {
Josef Bacika02fe132008-04-04 09:35:05 +11002564 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002565 if (!namep)
2566 return -ENOMEM;
2567 *name = namep;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002568 }
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002569
2570 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002571 rc = security_sid_to_context_force(newsid, &context, &clen);
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002572 if (rc) {
2573 kfree(namep);
2574 return rc;
2575 }
2576 *value = context;
2577 *len = clen;
2578 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002579
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002580 return 0;
2581}
2582
Linus Torvalds1da177e2005-04-16 15:20:36 -07002583static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2584{
2585 return may_create(dir, dentry, SECCLASS_FILE);
2586}
2587
Linus Torvalds1da177e2005-04-16 15:20:36 -07002588static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2589{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002590 return may_link(dir, old_dentry, MAY_LINK);
2591}
2592
Linus Torvalds1da177e2005-04-16 15:20:36 -07002593static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2594{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002595 return may_link(dir, dentry, MAY_UNLINK);
2596}
2597
2598static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2599{
2600 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2601}
2602
Linus Torvalds1da177e2005-04-16 15:20:36 -07002603static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2604{
2605 return may_create(dir, dentry, SECCLASS_DIR);
2606}
2607
Linus Torvalds1da177e2005-04-16 15:20:36 -07002608static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2609{
2610 return may_link(dir, dentry, MAY_RMDIR);
2611}
2612
2613static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2614{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002615 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2616}
2617
Linus Torvalds1da177e2005-04-16 15:20:36 -07002618static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002619 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002620{
2621 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2622}
2623
Linus Torvalds1da177e2005-04-16 15:20:36 -07002624static int selinux_inode_readlink(struct dentry *dentry)
2625{
David Howells88e67f32008-11-14 10:39:21 +11002626 const struct cred *cred = current_cred();
2627
2628 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002629}
2630
2631static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2632{
David Howells88e67f32008-11-14 10:39:21 +11002633 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002634
David Howells88e67f32008-11-14 10:39:21 +11002635 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002636}
2637
Al Virob77b0642008-07-17 09:37:02 -04002638static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002639{
David Howells88e67f32008-11-14 10:39:21 +11002640 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04002641 struct common_audit_data ad;
2642 u32 perms;
2643 bool from_access;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002644
Eric Parisb782e0a2010-07-23 11:44:03 -04002645 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04002646 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2647
Eric Parisb782e0a2010-07-23 11:44:03 -04002648 /* No permission to check. Existence test. */
2649 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002650 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002651
Eric Parisb782e0a2010-07-23 11:44:03 -04002652 COMMON_AUDIT_DATA_INIT(&ad, FS);
2653 ad.u.fs.inode = inode;
2654
2655 if (from_access)
2656 ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
2657
2658 perms = file_mask_to_av(inode->i_mode, mask);
2659
2660 return inode_has_perm(cred, inode, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002661}
2662
2663static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2664{
David Howells88e67f32008-11-14 10:39:21 +11002665 const struct cred *cred = current_cred();
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002666 unsigned int ia_valid = iattr->ia_valid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002667
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002668 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2669 if (ia_valid & ATTR_FORCE) {
2670 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2671 ATTR_FORCE);
2672 if (!ia_valid)
2673 return 0;
2674 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002675
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002676 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2677 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
David Howells88e67f32008-11-14 10:39:21 +11002678 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002679
David Howells88e67f32008-11-14 10:39:21 +11002680 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002681}
2682
2683static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2684{
David Howells88e67f32008-11-14 10:39:21 +11002685 const struct cred *cred = current_cred();
2686
2687 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002688}
2689
David Howells8f0cfa52008-04-29 00:59:41 -07002690static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07002691{
David Howells88e67f32008-11-14 10:39:21 +11002692 const struct cred *cred = current_cred();
2693
Serge E. Hallynb5376772007-10-16 23:31:36 -07002694 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2695 sizeof XATTR_SECURITY_PREFIX - 1)) {
2696 if (!strcmp(name, XATTR_NAME_CAPS)) {
2697 if (!capable(CAP_SETFCAP))
2698 return -EPERM;
2699 } else if (!capable(CAP_SYS_ADMIN)) {
2700 /* A different attribute in the security namespace.
2701 Restrict to administrator. */
2702 return -EPERM;
2703 }
2704 }
2705
2706 /* Not an attribute we recognize, so just check the
2707 ordinary setattr permission. */
David Howells88e67f32008-11-14 10:39:21 +11002708 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07002709}
2710
David Howells8f0cfa52008-04-29 00:59:41 -07002711static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2712 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002713{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002714 struct inode *inode = dentry->d_inode;
2715 struct inode_security_struct *isec = inode->i_security;
2716 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002717 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002718 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002719 int rc = 0;
2720
Serge E. Hallynb5376772007-10-16 23:31:36 -07002721 if (strcmp(name, XATTR_NAME_SELINUX))
2722 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002723
2724 sbsec = inode->i_sb->s_security;
David P. Quigleycd895962009-01-16 09:22:04 -05002725 if (!(sbsec->flags & SE_SBLABELSUPP))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002726 return -EOPNOTSUPP;
2727
Serge E. Hallyn2e149672011-03-23 16:43:26 -07002728 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002729 return -EPERM;
2730
Thomas Liu2bf49692009-07-14 12:14:09 -04002731 COMMON_AUDIT_DATA_INIT(&ad, FS);
Jan Blunck44707fd2008-02-14 19:38:33 -08002732 ad.u.fs.path.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002733
David Howells275bb412008-11-14 10:39:19 +11002734 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002735 FILE__RELABELFROM, &ad);
2736 if (rc)
2737 return rc;
2738
2739 rc = security_context_to_sid(value, size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04002740 if (rc == -EINVAL) {
2741 if (!capable(CAP_MAC_ADMIN))
2742 return rc;
2743 rc = security_context_to_sid_force(value, size, &newsid);
2744 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002745 if (rc)
2746 return rc;
2747
David Howells275bb412008-11-14 10:39:19 +11002748 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002749 FILE__RELABELTO, &ad);
2750 if (rc)
2751 return rc;
2752
David Howells275bb412008-11-14 10:39:19 +11002753 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04002754 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002755 if (rc)
2756 return rc;
2757
2758 return avc_has_perm(newsid,
2759 sbsec->sid,
2760 SECCLASS_FILESYSTEM,
2761 FILESYSTEM__ASSOCIATE,
2762 &ad);
2763}
2764
David Howells8f0cfa52008-04-29 00:59:41 -07002765static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04002766 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07002767 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002768{
2769 struct inode *inode = dentry->d_inode;
2770 struct inode_security_struct *isec = inode->i_security;
2771 u32 newsid;
2772 int rc;
2773
2774 if (strcmp(name, XATTR_NAME_SELINUX)) {
2775 /* Not an attribute we recognize, so nothing to do. */
2776 return;
2777 }
2778
Stephen Smalley12b29f32008-05-07 13:03:20 -04002779 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002780 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002781 printk(KERN_ERR "SELinux: unable to map context to SID"
2782 "for (%s, %lu), rc=%d\n",
2783 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002784 return;
2785 }
2786
2787 isec->sid = newsid;
2788 return;
2789}
2790
David Howells8f0cfa52008-04-29 00:59:41 -07002791static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002792{
David Howells88e67f32008-11-14 10:39:21 +11002793 const struct cred *cred = current_cred();
2794
2795 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002796}
2797
Eric Paris828dfe12008-04-17 13:17:49 -04002798static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002799{
David Howells88e67f32008-11-14 10:39:21 +11002800 const struct cred *cred = current_cred();
2801
2802 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002803}
2804
David Howells8f0cfa52008-04-29 00:59:41 -07002805static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002806{
Serge E. Hallynb5376772007-10-16 23:31:36 -07002807 if (strcmp(name, XATTR_NAME_SELINUX))
2808 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002809
2810 /* No one is allowed to remove a SELinux security label.
2811 You can change the label, but all data must be labeled. */
2812 return -EACCES;
2813}
2814
James Morrisd381d8a2005-10-30 14:59:22 -08002815/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002816 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08002817 *
2818 * Permission check is handled by selinux_inode_getxattr hook.
2819 */
David P. Quigley42492592008-02-04 22:29:39 -08002820static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002821{
David P. Quigley42492592008-02-04 22:29:39 -08002822 u32 size;
2823 int error;
2824 char *context = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002825 struct inode_security_struct *isec = inode->i_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002826
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002827 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2828 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002829
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002830 /*
2831 * If the caller has CAP_MAC_ADMIN, then get the raw context
2832 * value even if it is not defined by current policy; otherwise,
2833 * use the in-core value under current policy.
2834 * Use the non-auditing forms of the permission checks since
2835 * getxattr may be called by unprivileged processes commonly
2836 * and lack of permission just means that we fall back to the
2837 * in-core context value, not a denial.
2838 */
Serge E. Hallyn34867402011-03-23 16:43:17 -07002839 error = selinux_capable(current, current_cred(),
2840 &init_user_ns, CAP_MAC_ADMIN,
David Howells3699c532009-01-06 22:27:01 +00002841 SECURITY_CAP_NOAUDIT);
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04002842 if (!error)
2843 error = security_sid_to_context_force(isec->sid, &context,
2844 &size);
2845 else
2846 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08002847 if (error)
2848 return error;
2849 error = size;
2850 if (alloc) {
2851 *buffer = context;
2852 goto out_nofree;
2853 }
2854 kfree(context);
2855out_nofree:
2856 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002857}
2858
2859static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04002860 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002861{
2862 struct inode_security_struct *isec = inode->i_security;
2863 u32 newsid;
2864 int rc;
2865
2866 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2867 return -EOPNOTSUPP;
2868
2869 if (!value || !size)
2870 return -EACCES;
2871
Eric Paris828dfe12008-04-17 13:17:49 -04002872 rc = security_context_to_sid((void *)value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002873 if (rc)
2874 return rc;
2875
2876 isec->sid = newsid;
David P. Quigleyddd29ec2009-09-09 14:25:37 -04002877 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002878 return 0;
2879}
2880
2881static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2882{
2883 const int len = sizeof(XATTR_NAME_SELINUX);
2884 if (buffer && len <= buffer_size)
2885 memcpy(buffer, XATTR_NAME_SELINUX, len);
2886 return len;
2887}
2888
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02002889static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2890{
2891 struct inode_security_struct *isec = inode->i_security;
2892 *secid = isec->sid;
2893}
2894
Linus Torvalds1da177e2005-04-16 15:20:36 -07002895/* file security operations */
2896
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002897static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002898{
David Howells88e67f32008-11-14 10:39:21 +11002899 const struct cred *cred = current_cred();
Josef Sipek3d5ff522006-12-08 02:37:38 -08002900 struct inode *inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002901
Linus Torvalds1da177e2005-04-16 15:20:36 -07002902 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2903 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2904 mask |= MAY_APPEND;
2905
Paul Moore389fb802009-03-27 17:10:34 -04002906 return file_has_perm(cred, file,
2907 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002908}
2909
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002910static int selinux_file_permission(struct file *file, int mask)
2911{
Stephen Smalley20dda182009-06-22 14:54:53 -04002912 struct inode *inode = file->f_path.dentry->d_inode;
2913 struct file_security_struct *fsec = file->f_security;
2914 struct inode_security_struct *isec = inode->i_security;
2915 u32 sid = current_sid();
2916
Paul Moore389fb802009-03-27 17:10:34 -04002917 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002918 /* No permission to check. Existence test. */
2919 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002920
Stephen Smalley20dda182009-06-22 14:54:53 -04002921 if (sid == fsec->sid && fsec->isid == isec->sid &&
2922 fsec->pseqno == avc_policy_seqno())
2923 /* No change since dentry_open check. */
2924 return 0;
2925
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09002926 return selinux_revalidate_file_permission(file, mask);
2927}
2928
Linus Torvalds1da177e2005-04-16 15:20:36 -07002929static int selinux_file_alloc_security(struct file *file)
2930{
2931 return file_alloc_security(file);
2932}
2933
2934static void selinux_file_free_security(struct file *file)
2935{
2936 file_free_security(file);
2937}
2938
2939static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2940 unsigned long arg)
2941{
David Howells88e67f32008-11-14 10:39:21 +11002942 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05002943 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002944
Eric Paris0b24dcb2011-02-25 15:39:20 -05002945 switch (cmd) {
2946 case FIONREAD:
2947 /* fall through */
2948 case FIBMAP:
2949 /* fall through */
2950 case FIGETBSZ:
2951 /* fall through */
2952 case EXT2_IOC_GETFLAGS:
2953 /* fall through */
2954 case EXT2_IOC_GETVERSION:
2955 error = file_has_perm(cred, file, FILE__GETATTR);
2956 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002957
Eric Paris0b24dcb2011-02-25 15:39:20 -05002958 case EXT2_IOC_SETFLAGS:
2959 /* fall through */
2960 case EXT2_IOC_SETVERSION:
2961 error = file_has_perm(cred, file, FILE__SETATTR);
2962 break;
2963
2964 /* sys_ioctl() checks */
2965 case FIONBIO:
2966 /* fall through */
2967 case FIOASYNC:
2968 error = file_has_perm(cred, file, 0);
2969 break;
2970
2971 case KDSKBENT:
2972 case KDSKBSENT:
2973 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
Serge E. Hallyn34867402011-03-23 16:43:17 -07002974 SECURITY_CAP_AUDIT);
Eric Paris0b24dcb2011-02-25 15:39:20 -05002975 break;
2976
2977 /* default case assumes that the command will go
2978 * to the file's ioctl() function.
2979 */
2980 default:
2981 error = file_has_perm(cred, file, FILE__IOCTL);
2982 }
2983 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002984}
2985
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04002986static int default_noexec;
2987
Linus Torvalds1da177e2005-04-16 15:20:36 -07002988static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2989{
David Howells88e67f32008-11-14 10:39:21 +11002990 const struct cred *cred = current_cred();
David Howellsd84f4f92008-11-14 10:39:23 +11002991 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11002992
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04002993 if (default_noexec &&
2994 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002995 /*
2996 * We are making executable an anonymous mapping or a
2997 * private file mapping that will also be writable.
2998 * This has an additional check.
2999 */
David Howellsd84f4f92008-11-14 10:39:23 +11003000 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003001 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003002 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003003 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003004
3005 if (file) {
3006 /* read access is always possible with a mapping */
3007 u32 av = FILE__READ;
3008
3009 /* write access only matters if the mapping is shared */
3010 if (shared && (prot & PROT_WRITE))
3011 av |= FILE__WRITE;
3012
3013 if (prot & PROT_EXEC)
3014 av |= FILE__EXECUTE;
3015
David Howells88e67f32008-11-14 10:39:21 +11003016 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003017 }
David Howellsd84f4f92008-11-14 10:39:23 +11003018
3019error:
3020 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003021}
3022
3023static int selinux_file_mmap(struct file *file, unsigned long reqprot,
Eric Parised032182007-06-28 15:55:21 -04003024 unsigned long prot, unsigned long flags,
3025 unsigned long addr, unsigned long addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003026{
Eric Parised032182007-06-28 15:55:21 -04003027 int rc = 0;
David Howells275bb412008-11-14 10:39:19 +11003028 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003029
Eric Paris84336d1a2009-07-31 12:54:05 -04003030 /*
3031 * notice that we are intentionally putting the SELinux check before
3032 * the secondary cap_file_mmap check. This is such a likely attempt
3033 * at bad behaviour/exploit that we always want to get the AVC, even
3034 * if DAC would have also denied the operation.
3035 */
Eric Parisa2551df2009-07-31 12:54:11 -04003036 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
Eric Parised032182007-06-28 15:55:21 -04003037 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3038 MEMPROTECT__MMAP_ZERO, NULL);
Eric Paris84336d1a2009-07-31 12:54:05 -04003039 if (rc)
3040 return rc;
3041 }
3042
3043 /* do DAC check on address space usage */
3044 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
Eric Parised032182007-06-28 15:55:21 -04003045 if (rc || addr_only)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003046 return rc;
3047
3048 if (selinux_checkreqprot)
3049 prot = reqprot;
3050
3051 return file_map_prot_check(file, prot,
3052 (flags & MAP_TYPE) == MAP_SHARED);
3053}
3054
3055static int selinux_file_mprotect(struct vm_area_struct *vma,
3056 unsigned long reqprot,
3057 unsigned long prot)
3058{
David Howells88e67f32008-11-14 10:39:21 +11003059 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003060
3061 if (selinux_checkreqprot)
3062 prot = reqprot;
3063
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003064 if (default_noexec &&
3065 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003066 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003067 if (vma->vm_start >= vma->vm_mm->start_brk &&
3068 vma->vm_end <= vma->vm_mm->brk) {
David Howellsd84f4f92008-11-14 10:39:23 +11003069 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003070 } else if (!vma->vm_file &&
3071 vma->vm_start <= vma->vm_mm->start_stack &&
3072 vma->vm_end >= vma->vm_mm->start_stack) {
David Howells3b11a1d2008-11-14 10:39:26 +11003073 rc = current_has_perm(current, PROCESS__EXECSTACK);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003074 } else if (vma->vm_file && vma->anon_vma) {
3075 /*
3076 * We are making executable a file mapping that has
3077 * had some COW done. Since pages might have been
3078 * written, check ability to execute the possibly
3079 * modified content. This typically should only
3080 * occur for text relocations.
3081 */
David Howellsd84f4f92008-11-14 10:39:23 +11003082 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003083 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003084 if (rc)
3085 return rc;
3086 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003087
3088 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3089}
3090
3091static int selinux_file_lock(struct file *file, unsigned int cmd)
3092{
David Howells88e67f32008-11-14 10:39:21 +11003093 const struct cred *cred = current_cred();
3094
3095 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003096}
3097
3098static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3099 unsigned long arg)
3100{
David Howells88e67f32008-11-14 10:39:21 +11003101 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003102 int err = 0;
3103
3104 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003105 case F_SETFL:
3106 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3107 err = -EINVAL;
3108 break;
3109 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003110
Eric Paris828dfe12008-04-17 13:17:49 -04003111 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003112 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003113 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003114 }
3115 /* fall through */
3116 case F_SETOWN:
3117 case F_SETSIG:
3118 case F_GETFL:
3119 case F_GETOWN:
3120 case F_GETSIG:
3121 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003122 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003123 break;
3124 case F_GETLK:
3125 case F_SETLK:
3126 case F_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003127#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003128 case F_GETLK64:
3129 case F_SETLK64:
3130 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003131#endif
Eric Paris828dfe12008-04-17 13:17:49 -04003132 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3133 err = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003134 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003135 }
David Howells88e67f32008-11-14 10:39:21 +11003136 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003137 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003138 }
3139
3140 return err;
3141}
3142
3143static int selinux_file_set_fowner(struct file *file)
3144{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003145 struct file_security_struct *fsec;
3146
Linus Torvalds1da177e2005-04-16 15:20:36 -07003147 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003148 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003149
3150 return 0;
3151}
3152
3153static int selinux_file_send_sigiotask(struct task_struct *tsk,
3154 struct fown_struct *fown, int signum)
3155{
Eric Paris828dfe12008-04-17 13:17:49 -04003156 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003157 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003158 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003159 struct file_security_struct *fsec;
3160
3161 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003162 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003163
Linus Torvalds1da177e2005-04-16 15:20:36 -07003164 fsec = file->f_security;
3165
3166 if (!signum)
3167 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3168 else
3169 perm = signal_to_av(signum);
3170
David Howells275bb412008-11-14 10:39:19 +11003171 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003172 SECCLASS_PROCESS, perm, NULL);
3173}
3174
3175static int selinux_file_receive(struct file *file)
3176{
David Howells88e67f32008-11-14 10:39:21 +11003177 const struct cred *cred = current_cred();
3178
3179 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003180}
3181
David Howells745ca242008-11-14 10:39:22 +11003182static int selinux_dentry_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003183{
3184 struct file_security_struct *fsec;
3185 struct inode *inode;
3186 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003187
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003188 inode = file->f_path.dentry->d_inode;
3189 fsec = file->f_security;
3190 isec = inode->i_security;
3191 /*
3192 * Save inode label and policy sequence number
3193 * at open-time so that selinux_file_permission
3194 * can determine whether revalidation is necessary.
3195 * Task label is already saved in the file security
3196 * struct as its SID.
3197 */
3198 fsec->isid = isec->sid;
3199 fsec->pseqno = avc_policy_seqno();
3200 /*
3201 * Since the inode label or policy seqno may have changed
3202 * between the selinux_inode_permission check and the saving
3203 * of state above, recheck that access is still permitted.
3204 * Otherwise, access might never be revalidated against the
3205 * new inode label or new policy.
3206 * This check is not redundant - do not remove.
3207 */
David Howells88e67f32008-11-14 10:39:21 +11003208 return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003209}
3210
Linus Torvalds1da177e2005-04-16 15:20:36 -07003211/* task security operations */
3212
3213static int selinux_task_create(unsigned long clone_flags)
3214{
David Howells3b11a1d2008-11-14 10:39:26 +11003215 return current_has_perm(current, PROCESS__FORK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003216}
3217
David Howellsf1752ee2008-11-14 10:39:17 +11003218/*
David Howellsee18d642009-09-02 09:14:21 +01003219 * allocate the SELinux part of blank credentials
3220 */
3221static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3222{
3223 struct task_security_struct *tsec;
3224
3225 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3226 if (!tsec)
3227 return -ENOMEM;
3228
3229 cred->security = tsec;
3230 return 0;
3231}
3232
3233/*
David Howellsf1752ee2008-11-14 10:39:17 +11003234 * detach and free the LSM part of a set of credentials
3235 */
3236static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003237{
David Howellsf1752ee2008-11-14 10:39:17 +11003238 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003239
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003240 /*
3241 * cred->security == NULL if security_cred_alloc_blank() or
3242 * security_prepare_creds() returned an error.
3243 */
3244 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003245 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003246 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003247}
3248
David Howellsd84f4f92008-11-14 10:39:23 +11003249/*
3250 * prepare a new set of credentials for modification
3251 */
3252static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3253 gfp_t gfp)
3254{
3255 const struct task_security_struct *old_tsec;
3256 struct task_security_struct *tsec;
3257
3258 old_tsec = old->security;
3259
3260 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3261 if (!tsec)
3262 return -ENOMEM;
3263
3264 new->security = tsec;
3265 return 0;
3266}
3267
3268/*
David Howellsee18d642009-09-02 09:14:21 +01003269 * transfer the SELinux data to a blank set of creds
3270 */
3271static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3272{
3273 const struct task_security_struct *old_tsec = old->security;
3274 struct task_security_struct *tsec = new->security;
3275
3276 *tsec = *old_tsec;
3277}
3278
3279/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003280 * set the security data for a kernel service
3281 * - all the creation contexts are set to unlabelled
3282 */
3283static int selinux_kernel_act_as(struct cred *new, u32 secid)
3284{
3285 struct task_security_struct *tsec = new->security;
3286 u32 sid = current_sid();
3287 int ret;
3288
3289 ret = avc_has_perm(sid, secid,
3290 SECCLASS_KERNEL_SERVICE,
3291 KERNEL_SERVICE__USE_AS_OVERRIDE,
3292 NULL);
3293 if (ret == 0) {
3294 tsec->sid = secid;
3295 tsec->create_sid = 0;
3296 tsec->keycreate_sid = 0;
3297 tsec->sockcreate_sid = 0;
3298 }
3299 return ret;
3300}
3301
3302/*
3303 * set the file creation context in a security record to the same as the
3304 * objective context of the specified inode
3305 */
3306static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3307{
3308 struct inode_security_struct *isec = inode->i_security;
3309 struct task_security_struct *tsec = new->security;
3310 u32 sid = current_sid();
3311 int ret;
3312
3313 ret = avc_has_perm(sid, isec->sid,
3314 SECCLASS_KERNEL_SERVICE,
3315 KERNEL_SERVICE__CREATE_FILES_AS,
3316 NULL);
3317
3318 if (ret == 0)
3319 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003320 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003321}
3322
Eric Parisdd8dbf22009-11-03 16:35:32 +11003323static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003324{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003325 u32 sid;
3326 struct common_audit_data ad;
3327
3328 sid = task_sid(current);
3329
3330 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3331 ad.u.kmod_name = kmod_name;
3332
3333 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3334 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003335}
3336
Linus Torvalds1da177e2005-04-16 15:20:36 -07003337static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3338{
David Howells3b11a1d2008-11-14 10:39:26 +11003339 return current_has_perm(p, PROCESS__SETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003340}
3341
3342static int selinux_task_getpgid(struct task_struct *p)
3343{
David Howells3b11a1d2008-11-14 10:39:26 +11003344 return current_has_perm(p, PROCESS__GETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003345}
3346
3347static int selinux_task_getsid(struct task_struct *p)
3348{
David Howells3b11a1d2008-11-14 10:39:26 +11003349 return current_has_perm(p, PROCESS__GETSESSION);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003350}
3351
David Quigleyf9008e42006-06-30 01:55:46 -07003352static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3353{
David Howells275bb412008-11-14 10:39:19 +11003354 *secid = task_sid(p);
David Quigleyf9008e42006-06-30 01:55:46 -07003355}
3356
Linus Torvalds1da177e2005-04-16 15:20:36 -07003357static int selinux_task_setnice(struct task_struct *p, int nice)
3358{
3359 int rc;
3360
Eric Paris200ac532009-02-12 15:01:04 -05003361 rc = cap_task_setnice(p, nice);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003362 if (rc)
3363 return rc;
3364
David Howells3b11a1d2008-11-14 10:39:26 +11003365 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003366}
3367
James Morris03e68062006-06-23 02:03:58 -07003368static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3369{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003370 int rc;
3371
Eric Paris200ac532009-02-12 15:01:04 -05003372 rc = cap_task_setioprio(p, ioprio);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003373 if (rc)
3374 return rc;
3375
David Howells3b11a1d2008-11-14 10:39:26 +11003376 return current_has_perm(p, PROCESS__SETSCHED);
James Morris03e68062006-06-23 02:03:58 -07003377}
3378
David Quigleya1836a42006-06-30 01:55:49 -07003379static int selinux_task_getioprio(struct task_struct *p)
3380{
David Howells3b11a1d2008-11-14 10:39:26 +11003381 return current_has_perm(p, PROCESS__GETSCHED);
David Quigleya1836a42006-06-30 01:55:49 -07003382}
3383
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003384static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3385 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003386{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003387 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003388
3389 /* Control the ability to change the hard limit (whether
3390 lowering or raising it), so that the hard limit can
3391 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003392 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003393 if (old_rlim->rlim_max != new_rlim->rlim_max)
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003394 return current_has_perm(p, PROCESS__SETRLIMIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003395
3396 return 0;
3397}
3398
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003399static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003400{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003401 int rc;
3402
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003403 rc = cap_task_setscheduler(p);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003404 if (rc)
3405 return rc;
3406
David Howells3b11a1d2008-11-14 10:39:26 +11003407 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003408}
3409
3410static int selinux_task_getscheduler(struct task_struct *p)
3411{
David Howells3b11a1d2008-11-14 10:39:26 +11003412 return current_has_perm(p, PROCESS__GETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003413}
3414
David Quigley35601542006-06-23 02:04:01 -07003415static int selinux_task_movememory(struct task_struct *p)
3416{
David Howells3b11a1d2008-11-14 10:39:26 +11003417 return current_has_perm(p, PROCESS__SETSCHED);
David Quigley35601542006-06-23 02:04:01 -07003418}
3419
David Quigleyf9008e42006-06-30 01:55:46 -07003420static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3421 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003422{
3423 u32 perm;
3424 int rc;
3425
Linus Torvalds1da177e2005-04-16 15:20:36 -07003426 if (!sig)
3427 perm = PROCESS__SIGNULL; /* null signal; existence test */
3428 else
3429 perm = signal_to_av(sig);
David Quigleyf9008e42006-06-30 01:55:46 -07003430 if (secid)
David Howells275bb412008-11-14 10:39:19 +11003431 rc = avc_has_perm(secid, task_sid(p),
3432 SECCLASS_PROCESS, perm, NULL);
David Quigleyf9008e42006-06-30 01:55:46 -07003433 else
David Howells3b11a1d2008-11-14 10:39:26 +11003434 rc = current_has_perm(p, perm);
David Quigleyf9008e42006-06-30 01:55:46 -07003435 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003436}
3437
Linus Torvalds1da177e2005-04-16 15:20:36 -07003438static int selinux_task_wait(struct task_struct *p)
3439{
Eric Paris8a535142007-10-22 16:10:31 -04003440 return task_has_perm(p, current, PROCESS__SIGCHLD);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003441}
3442
Linus Torvalds1da177e2005-04-16 15:20:36 -07003443static void selinux_task_to_inode(struct task_struct *p,
3444 struct inode *inode)
3445{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003446 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11003447 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003448
David Howells275bb412008-11-14 10:39:19 +11003449 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003450 isec->initialized = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003451}
3452
Linus Torvalds1da177e2005-04-16 15:20:36 -07003453/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003454static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003455 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003456{
3457 int offset, ihlen, ret = -EINVAL;
3458 struct iphdr _iph, *ih;
3459
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003460 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003461 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3462 if (ih == NULL)
3463 goto out;
3464
3465 ihlen = ih->ihl * 4;
3466 if (ihlen < sizeof(_iph))
3467 goto out;
3468
3469 ad->u.net.v4info.saddr = ih->saddr;
3470 ad->u.net.v4info.daddr = ih->daddr;
3471 ret = 0;
3472
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003473 if (proto)
3474 *proto = ih->protocol;
3475
Linus Torvalds1da177e2005-04-16 15:20:36 -07003476 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04003477 case IPPROTO_TCP: {
3478 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003479
Eric Paris828dfe12008-04-17 13:17:49 -04003480 if (ntohs(ih->frag_off) & IP_OFFSET)
3481 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003482
3483 offset += ihlen;
3484 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3485 if (th == NULL)
3486 break;
3487
3488 ad->u.net.sport = th->source;
3489 ad->u.net.dport = th->dest;
3490 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003491 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003492
Eric Paris828dfe12008-04-17 13:17:49 -04003493 case IPPROTO_UDP: {
3494 struct udphdr _udph, *uh;
3495
3496 if (ntohs(ih->frag_off) & IP_OFFSET)
3497 break;
3498
3499 offset += ihlen;
3500 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3501 if (uh == NULL)
3502 break;
3503
3504 ad->u.net.sport = uh->source;
3505 ad->u.net.dport = uh->dest;
3506 break;
3507 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003508
James Morris2ee92d42006-11-13 16:09:01 -08003509 case IPPROTO_DCCP: {
3510 struct dccp_hdr _dccph, *dh;
3511
3512 if (ntohs(ih->frag_off) & IP_OFFSET)
3513 break;
3514
3515 offset += ihlen;
3516 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3517 if (dh == NULL)
3518 break;
3519
3520 ad->u.net.sport = dh->dccph_sport;
3521 ad->u.net.dport = dh->dccph_dport;
3522 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003523 }
James Morris2ee92d42006-11-13 16:09:01 -08003524
Eric Paris828dfe12008-04-17 13:17:49 -04003525 default:
3526 break;
3527 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003528out:
3529 return ret;
3530}
3531
3532#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3533
3534/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003535static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003536 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003537{
3538 u8 nexthdr;
3539 int ret = -EINVAL, offset;
3540 struct ipv6hdr _ipv6h, *ip6;
3541
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003542 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003543 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3544 if (ip6 == NULL)
3545 goto out;
3546
3547 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3548 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3549 ret = 0;
3550
3551 nexthdr = ip6->nexthdr;
3552 offset += sizeof(_ipv6h);
Herbert Xu0d3d0772005-04-24 20:16:19 -07003553 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003554 if (offset < 0)
3555 goto out;
3556
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003557 if (proto)
3558 *proto = nexthdr;
3559
Linus Torvalds1da177e2005-04-16 15:20:36 -07003560 switch (nexthdr) {
3561 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04003562 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003563
3564 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3565 if (th == NULL)
3566 break;
3567
3568 ad->u.net.sport = th->source;
3569 ad->u.net.dport = th->dest;
3570 break;
3571 }
3572
3573 case IPPROTO_UDP: {
3574 struct udphdr _udph, *uh;
3575
3576 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3577 if (uh == NULL)
3578 break;
3579
3580 ad->u.net.sport = uh->source;
3581 ad->u.net.dport = uh->dest;
3582 break;
3583 }
3584
James Morris2ee92d42006-11-13 16:09:01 -08003585 case IPPROTO_DCCP: {
3586 struct dccp_hdr _dccph, *dh;
3587
3588 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3589 if (dh == NULL)
3590 break;
3591
3592 ad->u.net.sport = dh->dccph_sport;
3593 ad->u.net.dport = dh->dccph_dport;
3594 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003595 }
James Morris2ee92d42006-11-13 16:09:01 -08003596
Linus Torvalds1da177e2005-04-16 15:20:36 -07003597 /* includes fragments */
3598 default:
3599 break;
3600 }
3601out:
3602 return ret;
3603}
3604
3605#endif /* IPV6 */
3606
Thomas Liu2bf49692009-07-14 12:14:09 -04003607static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10003608 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003609{
David Howellscf9481e2008-07-27 21:31:07 +10003610 char *addrp;
3611 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003612
3613 switch (ad->u.net.family) {
3614 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003615 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003616 if (ret)
3617 goto parse_error;
3618 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3619 &ad->u.net.v4info.daddr);
3620 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003621
3622#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3623 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003624 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10003625 if (ret)
3626 goto parse_error;
3627 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3628 &ad->u.net.v6info.daddr);
3629 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003630#endif /* IPV6 */
3631 default:
David Howellscf9481e2008-07-27 21:31:07 +10003632 addrp = NULL;
3633 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003634 }
3635
David Howellscf9481e2008-07-27 21:31:07 +10003636parse_error:
3637 printk(KERN_WARNING
3638 "SELinux: failure in selinux_parse_skb(),"
3639 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07003640 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10003641
3642okay:
3643 if (_addrp)
3644 *_addrp = addrp;
3645 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003646}
3647
Paul Moore4f6a9932007-03-01 14:35:22 -05003648/**
Paul Moore220deb92008-01-29 08:38:23 -05003649 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05003650 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05003651 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05003652 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05003653 *
3654 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05003655 * Check the various different forms of network peer labeling and determine
3656 * the peer label/SID for the packet; most of the magic actually occurs in
3657 * the security server function security_net_peersid_cmp(). The function
3658 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3659 * or -EACCES if @sid is invalid due to inconsistencies with the different
3660 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05003661 *
3662 */
Paul Moore220deb92008-01-29 08:38:23 -05003663static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05003664{
Paul Moore71f1cb02008-01-29 08:51:16 -05003665 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05003666 u32 xfrm_sid;
3667 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05003668 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05003669
3670 selinux_skb_xfrm_sid(skb, &xfrm_sid);
Paul Moore5dbe1eb2008-01-29 08:44:18 -05003671 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
Paul Moore220deb92008-01-29 08:38:23 -05003672
Paul Moore71f1cb02008-01-29 08:51:16 -05003673 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3674 if (unlikely(err)) {
3675 printk(KERN_WARNING
3676 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3677 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05003678 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05003679 }
Paul Moore220deb92008-01-29 08:38:23 -05003680
3681 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05003682}
3683
Linus Torvalds1da177e2005-04-16 15:20:36 -07003684/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04003685
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003686static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3687 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04003688{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003689 if (tsec->sockcreate_sid > SECSID_NULL) {
3690 *socksid = tsec->sockcreate_sid;
3691 return 0;
3692 }
3693
3694 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3695 socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04003696}
3697
Paul Moore253bfae2010-04-22 14:46:19 -04003698static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003699{
Paul Moore253bfae2010-04-22 14:46:19 -04003700 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04003701 struct common_audit_data ad;
Paul Moore253bfae2010-04-22 14:46:19 -04003702 u32 tsid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003703
Paul Moore253bfae2010-04-22 14:46:19 -04003704 if (sksec->sid == SECINITSID_KERNEL)
3705 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003706
Thomas Liu2bf49692009-07-14 12:14:09 -04003707 COMMON_AUDIT_DATA_INIT(&ad, NET);
Paul Moore253bfae2010-04-22 14:46:19 -04003708 ad.u.net.sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003709
Paul Moore253bfae2010-04-22 14:46:19 -04003710 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003711}
3712
3713static int selinux_socket_create(int family, int type,
3714 int protocol, int kern)
3715{
Paul Moore5fb49872010-04-22 14:46:19 -04003716 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04003717 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11003718 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003719 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003720
3721 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04003722 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003723
David Howells275bb412008-11-14 10:39:19 +11003724 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003725 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3726 if (rc)
3727 return rc;
3728
Paul Moored4f2d972010-04-22 14:46:18 -04003729 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003730}
3731
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003732static int selinux_socket_post_create(struct socket *sock, int family,
3733 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003734{
Paul Moore5fb49872010-04-22 14:46:19 -04003735 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04003736 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003737 struct sk_security_struct *sksec;
David Howells275bb412008-11-14 10:39:19 +11003738 int err = 0;
3739
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003740 isec->sclass = socket_type_to_security_class(family, type, protocol);
3741
David Howells275bb412008-11-14 10:39:19 +11003742 if (kern)
3743 isec->sid = SECINITSID_KERNEL;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08003744 else {
3745 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3746 if (err)
3747 return err;
3748 }
David Howells275bb412008-11-14 10:39:19 +11003749
Linus Torvalds1da177e2005-04-16 15:20:36 -07003750 isec->initialized = 1;
3751
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003752 if (sock->sk) {
3753 sksec = sock->sk->sk_security;
3754 sksec->sid = isec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05003755 sksec->sclass = isec->sclass;
Paul Moore389fb802009-03-27 17:10:34 -04003756 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07003757 }
3758
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07003759 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003760}
3761
3762/* Range of port numbers used to automatically bind.
3763 Need to determine whether we should perform a name_bind
3764 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003765
3766static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3767{
Paul Moore253bfae2010-04-22 14:46:19 -04003768 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003769 u16 family;
3770 int err;
3771
Paul Moore253bfae2010-04-22 14:46:19 -04003772 err = sock_has_perm(current, sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003773 if (err)
3774 goto out;
3775
3776 /*
3777 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04003778 * Multiple address binding for SCTP is not supported yet: we just
3779 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003780 */
Paul Moore253bfae2010-04-22 14:46:19 -04003781 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003782 if (family == PF_INET || family == PF_INET6) {
3783 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04003784 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04003785 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003786 struct sockaddr_in *addr4 = NULL;
3787 struct sockaddr_in6 *addr6 = NULL;
3788 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10003789 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003790
Linus Torvalds1da177e2005-04-16 15:20:36 -07003791 if (family == PF_INET) {
3792 addr4 = (struct sockaddr_in *)address;
3793 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003794 addrp = (char *)&addr4->sin_addr.s_addr;
3795 } else {
3796 addr6 = (struct sockaddr_in6 *)address;
3797 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003798 addrp = (char *)&addr6->sin6_addr.s6_addr;
3799 }
3800
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003801 if (snum) {
3802 int low, high;
3803
3804 inet_get_local_port_range(&low, &high);
3805
3806 if (snum < max(PROT_SOCK, low) || snum > high) {
Paul Moore3e112172008-04-10 10:48:14 -04003807 err = sel_netport_sid(sk->sk_protocol,
3808 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003809 if (err)
3810 goto out;
Thomas Liu2bf49692009-07-14 12:14:09 -04003811 COMMON_AUDIT_DATA_INIT(&ad, NET);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003812 ad.u.net.sport = htons(snum);
3813 ad.u.net.family = family;
Paul Moore253bfae2010-04-22 14:46:19 -04003814 err = avc_has_perm(sksec->sid, sid,
3815 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07003816 SOCKET__NAME_BIND, &ad);
3817 if (err)
3818 goto out;
3819 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003820 }
Eric Paris828dfe12008-04-17 13:17:49 -04003821
Paul Moore253bfae2010-04-22 14:46:19 -04003822 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04003823 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003824 node_perm = TCP_SOCKET__NODE_BIND;
3825 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003826
James Morris13402582005-09-30 14:24:34 -04003827 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003828 node_perm = UDP_SOCKET__NODE_BIND;
3829 break;
James Morris2ee92d42006-11-13 16:09:01 -08003830
3831 case SECCLASS_DCCP_SOCKET:
3832 node_perm = DCCP_SOCKET__NODE_BIND;
3833 break;
3834
Linus Torvalds1da177e2005-04-16 15:20:36 -07003835 default:
3836 node_perm = RAWIP_SOCKET__NODE_BIND;
3837 break;
3838 }
Eric Paris828dfe12008-04-17 13:17:49 -04003839
Paul Moore224dfbd2008-01-29 08:38:13 -05003840 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003841 if (err)
3842 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04003843
Thomas Liu2bf49692009-07-14 12:14:09 -04003844 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003845 ad.u.net.sport = htons(snum);
3846 ad.u.net.family = family;
3847
3848 if (family == PF_INET)
3849 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3850 else
3851 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3852
Paul Moore253bfae2010-04-22 14:46:19 -04003853 err = avc_has_perm(sksec->sid, sid,
3854 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003855 if (err)
3856 goto out;
3857 }
3858out:
3859 return err;
3860}
3861
3862static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3863{
Paul Moore014ab192008-10-10 10:16:33 -04003864 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04003865 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003866 int err;
3867
Paul Moore253bfae2010-04-22 14:46:19 -04003868 err = sock_has_perm(current, sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003869 if (err)
3870 return err;
3871
3872 /*
James Morris2ee92d42006-11-13 16:09:01 -08003873 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07003874 */
Paul Moore253bfae2010-04-22 14:46:19 -04003875 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3876 sksec->sclass == SECCLASS_DCCP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04003877 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003878 struct sockaddr_in *addr4 = NULL;
3879 struct sockaddr_in6 *addr6 = NULL;
3880 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08003881 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003882
3883 if (sk->sk_family == PF_INET) {
3884 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003885 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003886 return -EINVAL;
3887 snum = ntohs(addr4->sin_port);
3888 } else {
3889 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07003890 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003891 return -EINVAL;
3892 snum = ntohs(addr6->sin6_port);
3893 }
3894
Paul Moore3e112172008-04-10 10:48:14 -04003895 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003896 if (err)
3897 goto out;
3898
Paul Moore253bfae2010-04-22 14:46:19 -04003899 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
James Morris2ee92d42006-11-13 16:09:01 -08003900 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3901
Thomas Liu2bf49692009-07-14 12:14:09 -04003902 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003903 ad.u.net.dport = htons(snum);
3904 ad.u.net.family = sk->sk_family;
Paul Moore253bfae2010-04-22 14:46:19 -04003905 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003906 if (err)
3907 goto out;
3908 }
3909
Paul Moore014ab192008-10-10 10:16:33 -04003910 err = selinux_netlbl_socket_connect(sk, address);
3911
Linus Torvalds1da177e2005-04-16 15:20:36 -07003912out:
3913 return err;
3914}
3915
3916static int selinux_socket_listen(struct socket *sock, int backlog)
3917{
Paul Moore253bfae2010-04-22 14:46:19 -04003918 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003919}
3920
3921static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3922{
3923 int err;
3924 struct inode_security_struct *isec;
3925 struct inode_security_struct *newisec;
3926
Paul Moore253bfae2010-04-22 14:46:19 -04003927 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003928 if (err)
3929 return err;
3930
3931 newisec = SOCK_INODE(newsock)->i_security;
3932
3933 isec = SOCK_INODE(sock)->i_security;
3934 newisec->sclass = isec->sclass;
3935 newisec->sid = isec->sid;
3936 newisec->initialized = 1;
3937
3938 return 0;
3939}
3940
3941static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04003942 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003943{
Paul Moore253bfae2010-04-22 14:46:19 -04003944 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003945}
3946
3947static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3948 int size, int flags)
3949{
Paul Moore253bfae2010-04-22 14:46:19 -04003950 return sock_has_perm(current, sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003951}
3952
3953static int selinux_socket_getsockname(struct socket *sock)
3954{
Paul Moore253bfae2010-04-22 14:46:19 -04003955 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003956}
3957
3958static int selinux_socket_getpeername(struct socket *sock)
3959{
Paul Moore253bfae2010-04-22 14:46:19 -04003960 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003961}
3962
Eric Paris828dfe12008-04-17 13:17:49 -04003963static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003964{
Paul Mooref8687af2006-10-30 15:22:15 -08003965 int err;
3966
Paul Moore253bfae2010-04-22 14:46:19 -04003967 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08003968 if (err)
3969 return err;
3970
3971 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003972}
3973
3974static int selinux_socket_getsockopt(struct socket *sock, int level,
3975 int optname)
3976{
Paul Moore253bfae2010-04-22 14:46:19 -04003977 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003978}
3979
3980static int selinux_socket_shutdown(struct socket *sock, int how)
3981{
Paul Moore253bfae2010-04-22 14:46:19 -04003982 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003983}
3984
David S. Miller3610cda2011-01-05 15:38:53 -08003985static int selinux_socket_unix_stream_connect(struct sock *sock,
3986 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003987 struct sock *newsk)
3988{
David S. Miller3610cda2011-01-05 15:38:53 -08003989 struct sk_security_struct *sksec_sock = sock->sk_security;
3990 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04003991 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04003992 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003993 int err;
3994
Thomas Liu2bf49692009-07-14 12:14:09 -04003995 COMMON_AUDIT_DATA_INIT(&ad, NET);
David S. Miller3610cda2011-01-05 15:38:53 -08003996 ad.u.net.sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003997
Paul Moore4d1e2452010-04-22 14:46:18 -04003998 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
3999 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004000 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4001 if (err)
4002 return err;
4003
Linus Torvalds1da177e2005-04-16 15:20:36 -07004004 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004005 sksec_new->peer_sid = sksec_sock->sid;
4006 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4007 &sksec_new->sid);
4008 if (err)
4009 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004010
Paul Moore4d1e2452010-04-22 14:46:18 -04004011 /* connecting socket */
4012 sksec_sock->peer_sid = sksec_new->sid;
4013
4014 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004015}
4016
4017static int selinux_socket_unix_may_send(struct socket *sock,
4018 struct socket *other)
4019{
Paul Moore253bfae2010-04-22 14:46:19 -04004020 struct sk_security_struct *ssec = sock->sk->sk_security;
4021 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004022 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004023
Thomas Liu2bf49692009-07-14 12:14:09 -04004024 COMMON_AUDIT_DATA_INIT(&ad, NET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004025 ad.u.net.sk = other->sk;
4026
Paul Moore253bfae2010-04-22 14:46:19 -04004027 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4028 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004029}
4030
Paul Mooreeffad8d2008-01-29 08:49:27 -05004031static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4032 u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004033 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004034{
4035 int err;
4036 u32 if_sid;
4037 u32 node_sid;
4038
4039 err = sel_netif_sid(ifindex, &if_sid);
4040 if (err)
4041 return err;
4042 err = avc_has_perm(peer_sid, if_sid,
4043 SECCLASS_NETIF, NETIF__INGRESS, ad);
4044 if (err)
4045 return err;
4046
4047 err = sel_netnode_sid(addrp, family, &node_sid);
4048 if (err)
4049 return err;
4050 return avc_has_perm(peer_sid, node_sid,
4051 SECCLASS_NODE, NODE__RECVFROM, ad);
4052}
4053
Paul Moore220deb92008-01-29 08:38:23 -05004054static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004055 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004056{
Paul Moore277d3422008-12-31 12:54:11 -05004057 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004058 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004059 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004060 struct common_audit_data ad;
Paul Moored8395c82008-10-10 10:16:30 -04004061 char *addrp;
4062
Thomas Liu2bf49692009-07-14 12:14:09 -04004063 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Dumazet8964be42009-11-20 15:35:04 -08004064 ad.u.net.netif = skb->skb_iif;
Paul Moored8395c82008-10-10 10:16:30 -04004065 ad.u.net.family = family;
4066 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4067 if (err)
4068 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004069
Paul Moore58bfbb52009-03-27 17:10:41 -04004070 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004071 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004072 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004073 if (err)
4074 return err;
4075 }
Paul Moore220deb92008-01-29 08:38:23 -05004076
Steffen Klassertb9679a72011-02-23 12:55:21 +01004077 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4078 if (err)
4079 return err;
4080 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004081
James Morris4e5ab4c2006-06-09 00:33:33 -07004082 return err;
4083}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004084
James Morris4e5ab4c2006-06-09 00:33:33 -07004085static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4086{
Paul Moore220deb92008-01-29 08:38:23 -05004087 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004088 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004089 u16 family = sk->sk_family;
4090 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004091 struct common_audit_data ad;
Paul Moore220deb92008-01-29 08:38:23 -05004092 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004093 u8 secmark_active;
4094 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004095
James Morris4e5ab4c2006-06-09 00:33:33 -07004096 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004097 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004098
4099 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004100 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004101 family = PF_INET;
4102
Paul Moored8395c82008-10-10 10:16:30 -04004103 /* If any sort of compatibility mode is enabled then handoff processing
4104 * to the selinux_sock_rcv_skb_compat() function to deal with the
4105 * special handling. We do this in an attempt to keep this function
4106 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004107 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004108 return selinux_sock_rcv_skb_compat(sk, skb, family);
4109
4110 secmark_active = selinux_secmark_enabled();
4111 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4112 if (!secmark_active && !peerlbl_active)
4113 return 0;
4114
Thomas Liu2bf49692009-07-14 12:14:09 -04004115 COMMON_AUDIT_DATA_INIT(&ad, NET);
Eric Dumazet8964be42009-11-20 15:35:04 -08004116 ad.u.net.netif = skb->skb_iif;
James Morris4e5ab4c2006-06-09 00:33:33 -07004117 ad.u.net.family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004118 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004119 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004120 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004121
Paul Moored8395c82008-10-10 10:16:30 -04004122 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004123 u32 peer_sid;
4124
4125 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4126 if (err)
4127 return err;
Eric Dumazet8964be42009-11-20 15:35:04 -08004128 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004129 peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004130 if (err) {
4131 selinux_netlbl_err(skb, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004132 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004133 }
Paul Moored621d352008-01-29 08:43:36 -05004134 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4135 PEER__RECV, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004136 if (err)
4137 selinux_netlbl_err(skb, err, 0);
Paul Moored621d352008-01-29 08:43:36 -05004138 }
4139
Paul Moored8395c82008-10-10 10:16:30 -04004140 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004141 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4142 PACKET__RECV, &ad);
4143 if (err)
4144 return err;
4145 }
4146
Paul Moored621d352008-01-29 08:43:36 -05004147 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004148}
4149
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004150static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4151 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004152{
4153 int err = 0;
4154 char *scontext;
4155 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004156 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004157 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004158
Paul Moore253bfae2010-04-22 14:46:19 -04004159 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4160 sksec->sclass == SECCLASS_TCP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004161 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004162 if (peer_sid == SECSID_NULL)
4163 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004164
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004165 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004166 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004167 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004168
4169 if (scontext_len > len) {
4170 err = -ERANGE;
4171 goto out_len;
4172 }
4173
4174 if (copy_to_user(optval, scontext, scontext_len))
4175 err = -EFAULT;
4176
4177out_len:
4178 if (put_user(scontext_len, optlen))
4179 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004180 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004181 return err;
4182}
4183
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004184static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004185{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004186 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004187 u16 family;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004188
Paul Mooreaa862902008-10-10 10:16:29 -04004189 if (skb && skb->protocol == htons(ETH_P_IP))
4190 family = PF_INET;
4191 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4192 family = PF_INET6;
4193 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004194 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004195 else
4196 goto out;
4197
4198 if (sock && family == PF_UNIX)
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02004199 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
Paul Moore3de4bab2006-11-17 17:38:54 -05004200 else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004201 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004202
Paul Moore75e22912008-01-29 08:38:04 -05004203out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004204 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004205 if (peer_secid == SECSID_NULL)
4206 return -EINVAL;
4207 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004208}
4209
Al Viro7d877f32005-10-21 03:20:43 -04004210static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004211{
Paul Moore84914b72010-04-22 14:46:18 -04004212 struct sk_security_struct *sksec;
4213
4214 sksec = kzalloc(sizeof(*sksec), priority);
4215 if (!sksec)
4216 return -ENOMEM;
4217
4218 sksec->peer_sid = SECINITSID_UNLABELED;
4219 sksec->sid = SECINITSID_UNLABELED;
4220 selinux_netlbl_sk_security_reset(sksec);
4221 sk->sk_security = sksec;
4222
4223 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004224}
4225
4226static void selinux_sk_free_security(struct sock *sk)
4227{
Paul Moore84914b72010-04-22 14:46:18 -04004228 struct sk_security_struct *sksec = sk->sk_security;
4229
4230 sk->sk_security = NULL;
4231 selinux_netlbl_sk_security_free(sksec);
4232 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004233}
4234
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004235static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4236{
Eric Parisdd3e7832010-04-07 15:08:46 -04004237 struct sk_security_struct *sksec = sk->sk_security;
4238 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004239
Eric Parisdd3e7832010-04-07 15:08:46 -04004240 newsksec->sid = sksec->sid;
4241 newsksec->peer_sid = sksec->peer_sid;
4242 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004243
Eric Parisdd3e7832010-04-07 15:08:46 -04004244 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004245}
4246
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004247static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004248{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004249 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004250 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004251 else {
4252 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004253
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004254 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004255 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004256}
4257
Eric Paris828dfe12008-04-17 13:17:49 -04004258static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004259{
4260 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4261 struct sk_security_struct *sksec = sk->sk_security;
4262
David Woodhouse2148ccc2006-09-29 15:50:25 -07004263 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4264 sk->sk_family == PF_UNIX)
4265 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004266 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004267}
4268
Adrian Bunk9a673e52006-08-15 00:03:53 -07004269static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4270 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004271{
4272 struct sk_security_struct *sksec = sk->sk_security;
4273 int err;
Paul Mooreaa862902008-10-10 10:16:29 -04004274 u16 family = sk->sk_family;
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004275 u32 newsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004276 u32 peersid;
4277
Paul Mooreaa862902008-10-10 10:16:29 -04004278 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4279 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4280 family = PF_INET;
4281
4282 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004283 if (err)
4284 return err;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004285 if (peersid == SECSID_NULL) {
4286 req->secid = sksec->sid;
Paul Moore3de4bab2006-11-17 17:38:54 -05004287 req->peer_secid = SECSID_NULL;
Paul Moore389fb802009-03-27 17:10:34 -04004288 } else {
4289 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4290 if (err)
4291 return err;
4292 req->secid = newsid;
4293 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004294 }
4295
Paul Moore389fb802009-03-27 17:10:34 -04004296 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004297}
4298
Adrian Bunk9a673e52006-08-15 00:03:53 -07004299static void selinux_inet_csk_clone(struct sock *newsk,
4300 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004301{
4302 struct sk_security_struct *newsksec = newsk->sk_security;
4303
4304 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004305 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004306 /* NOTE: Ideally, we should also get the isec->sid for the
4307 new socket in sync, but we don't have the isec available yet.
4308 So we will wait until sock_graft to do it, by which
4309 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004310
Paul Moore9f2ad662006-11-17 17:38:53 -05004311 /* We don't need to take any sort of lock here as we are the only
4312 * thread with access to newsksec */
Paul Moore389fb802009-03-27 17:10:34 -04004313 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004314}
4315
Paul Moore014ab192008-10-10 10:16:33 -04004316static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004317{
Paul Mooreaa862902008-10-10 10:16:29 -04004318 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004319 struct sk_security_struct *sksec = sk->sk_security;
4320
Paul Mooreaa862902008-10-10 10:16:29 -04004321 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4322 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4323 family = PF_INET;
4324
4325 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004326}
4327
Eric Paris2606fd12010-10-13 16:24:41 -04004328static int selinux_secmark_relabel_packet(u32 sid)
4329{
4330 const struct task_security_struct *__tsec;
4331 u32 tsid;
4332
4333 __tsec = current_security();
4334 tsid = __tsec->sid;
4335
4336 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4337}
4338
4339static void selinux_secmark_refcount_inc(void)
4340{
4341 atomic_inc(&selinux_secmark_refcount);
4342}
4343
4344static void selinux_secmark_refcount_dec(void)
4345{
4346 atomic_dec(&selinux_secmark_refcount);
4347}
4348
Adrian Bunk9a673e52006-08-15 00:03:53 -07004349static void selinux_req_classify_flow(const struct request_sock *req,
4350 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004351{
David S. Miller1d28f422011-03-12 00:29:39 -05004352 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004353}
4354
Paul Mooreed6d76e2009-08-28 18:12:49 -04004355static int selinux_tun_dev_create(void)
4356{
4357 u32 sid = current_sid();
4358
4359 /* we aren't taking into account the "sockcreate" SID since the socket
4360 * that is being created here is not a socket in the traditional sense,
4361 * instead it is a private sock, accessible only to the kernel, and
4362 * representing a wide range of network traffic spanning multiple
4363 * connections unlike traditional sockets - check the TUN driver to
4364 * get a better understanding of why this socket is special */
4365
4366 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4367 NULL);
4368}
4369
4370static void selinux_tun_dev_post_create(struct sock *sk)
4371{
4372 struct sk_security_struct *sksec = sk->sk_security;
4373
4374 /* we don't currently perform any NetLabel based labeling here and it
4375 * isn't clear that we would want to do so anyway; while we could apply
4376 * labeling without the support of the TUN user the resulting labeled
4377 * traffic from the other end of the connection would almost certainly
4378 * cause confusion to the TUN user that had no idea network labeling
4379 * protocols were being used */
4380
4381 /* see the comments in selinux_tun_dev_create() about why we don't use
4382 * the sockcreate SID here */
4383
4384 sksec->sid = current_sid();
4385 sksec->sclass = SECCLASS_TUN_SOCKET;
4386}
4387
4388static int selinux_tun_dev_attach(struct sock *sk)
4389{
4390 struct sk_security_struct *sksec = sk->sk_security;
4391 u32 sid = current_sid();
4392 int err;
4393
4394 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4395 TUN_SOCKET__RELABELFROM, NULL);
4396 if (err)
4397 return err;
4398 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4399 TUN_SOCKET__RELABELTO, NULL);
4400 if (err)
4401 return err;
4402
4403 sksec->sid = sid;
4404
4405 return 0;
4406}
4407
Linus Torvalds1da177e2005-04-16 15:20:36 -07004408static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4409{
4410 int err = 0;
4411 u32 perm;
4412 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04004413 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04004414
Linus Torvalds1da177e2005-04-16 15:20:36 -07004415 if (skb->len < NLMSG_SPACE(0)) {
4416 err = -EINVAL;
4417 goto out;
4418 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07004419 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04004420
Paul Moore253bfae2010-04-22 14:46:19 -04004421 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004422 if (err) {
4423 if (err == -EINVAL) {
David Woodhouse9ad9ad32005-06-22 15:04:33 +01004424 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004425 "SELinux: unrecognized netlink message"
4426 " type=%hu for sclass=%hu\n",
Paul Moore253bfae2010-04-22 14:46:19 -04004427 nlh->nlmsg_type, sksec->sclass);
Eric Paris39c9aed2008-11-05 09:34:42 -05004428 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07004429 err = 0;
4430 }
4431
4432 /* Ignore */
4433 if (err == -ENOENT)
4434 err = 0;
4435 goto out;
4436 }
4437
Paul Moore253bfae2010-04-22 14:46:19 -04004438 err = sock_has_perm(current, sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004439out:
4440 return err;
4441}
4442
4443#ifdef CONFIG_NETFILTER
4444
Paul Mooreeffad8d2008-01-29 08:49:27 -05004445static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4446 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004447{
Paul Mooredfaebe92008-10-10 10:16:31 -04004448 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004449 char *addrp;
4450 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004451 struct common_audit_data ad;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004452 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04004453 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004454 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004455
Paul Mooreeffad8d2008-01-29 08:49:27 -05004456 if (!selinux_policycap_netpeer)
4457 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004458
Paul Mooreeffad8d2008-01-29 08:49:27 -05004459 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04004460 netlbl_active = netlbl_enabled();
4461 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05004462 if (!secmark_active && !peerlbl_active)
4463 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004464
Paul Moored8395c82008-10-10 10:16:30 -04004465 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4466 return NF_DROP;
4467
Thomas Liu2bf49692009-07-14 12:14:09 -04004468 COMMON_AUDIT_DATA_INIT(&ad, NET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004469 ad.u.net.netif = ifindex;
4470 ad.u.net.family = family;
4471 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4472 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004473
Paul Mooredfaebe92008-10-10 10:16:31 -04004474 if (peerlbl_active) {
4475 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4476 peer_sid, &ad);
4477 if (err) {
4478 selinux_netlbl_err(skb, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004479 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04004480 }
4481 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05004482
4483 if (secmark_active)
4484 if (avc_has_perm(peer_sid, skb->secmark,
4485 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4486 return NF_DROP;
4487
Paul Moore948bf852008-10-10 10:16:32 -04004488 if (netlbl_active)
4489 /* we do this in the FORWARD path and not the POST_ROUTING
4490 * path because we want to make sure we apply the necessary
4491 * labeling before IPsec is applied so we can leverage AH
4492 * protection */
4493 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4494 return NF_DROP;
4495
Paul Mooreeffad8d2008-01-29 08:49:27 -05004496 return NF_ACCEPT;
4497}
4498
4499static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4500 struct sk_buff *skb,
4501 const struct net_device *in,
4502 const struct net_device *out,
4503 int (*okfn)(struct sk_buff *))
4504{
4505 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4506}
4507
4508#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4509static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4510 struct sk_buff *skb,
4511 const struct net_device *in,
4512 const struct net_device *out,
4513 int (*okfn)(struct sk_buff *))
4514{
4515 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4516}
4517#endif /* IPV6 */
4518
Paul Moore948bf852008-10-10 10:16:32 -04004519static unsigned int selinux_ip_output(struct sk_buff *skb,
4520 u16 family)
4521{
4522 u32 sid;
4523
4524 if (!netlbl_enabled())
4525 return NF_ACCEPT;
4526
4527 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4528 * because we want to make sure we apply the necessary labeling
4529 * before IPsec is applied so we can leverage AH protection */
4530 if (skb->sk) {
4531 struct sk_security_struct *sksec = skb->sk->sk_security;
4532 sid = sksec->sid;
4533 } else
4534 sid = SECINITSID_KERNEL;
4535 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4536 return NF_DROP;
4537
4538 return NF_ACCEPT;
4539}
4540
4541static unsigned int selinux_ipv4_output(unsigned int hooknum,
4542 struct sk_buff *skb,
4543 const struct net_device *in,
4544 const struct net_device *out,
4545 int (*okfn)(struct sk_buff *))
4546{
4547 return selinux_ip_output(skb, PF_INET);
4548}
4549
Paul Mooreeffad8d2008-01-29 08:49:27 -05004550static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4551 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04004552 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07004553{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004554 struct sock *sk = skb->sk;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004555 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004556 struct common_audit_data ad;
Paul Moored8395c82008-10-10 10:16:30 -04004557 char *addrp;
4558 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07004559
Paul Mooreeffad8d2008-01-29 08:49:27 -05004560 if (sk == NULL)
4561 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004562 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07004563
Thomas Liu2bf49692009-07-14 12:14:09 -04004564 COMMON_AUDIT_DATA_INIT(&ad, NET);
Paul Moored8395c82008-10-10 10:16:30 -04004565 ad.u.net.netif = ifindex;
4566 ad.u.net.family = family;
4567 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4568 return NF_DROP;
4569
Paul Moore58bfbb52009-03-27 17:10:41 -04004570 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05004571 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04004572 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00004573 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07004574
Steffen Klassertb9679a72011-02-23 12:55:21 +01004575 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4576 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07004577
Paul Mooreeffad8d2008-01-29 08:49:27 -05004578 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004579}
4580
Paul Mooreeffad8d2008-01-29 08:49:27 -05004581static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4582 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004583{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004584 u32 secmark_perm;
4585 u32 peer_sid;
4586 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04004587 struct common_audit_data ad;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004588 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004589 u8 secmark_active;
4590 u8 peerlbl_active;
4591
Paul Mooreeffad8d2008-01-29 08:49:27 -05004592 /* If any sort of compatibility mode is enabled then handoff processing
4593 * to the selinux_ip_postroute_compat() function to deal with the
4594 * special handling. We do this in an attempt to keep this function
4595 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004596 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004597 return selinux_ip_postroute_compat(skb, ifindex, family);
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004598#ifdef CONFIG_XFRM
Paul Mooreeffad8d2008-01-29 08:49:27 -05004599 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4600 * packet transformation so allow the packet to pass without any checks
4601 * since we'll have another chance to perform access control checks
4602 * when the packet is on it's final way out.
4603 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4604 * is NULL, in this case go ahead and apply access control. */
Eric Dumazetadf30902009-06-02 05:19:30 +00004605 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004606 return NF_ACCEPT;
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07004607#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05004608 secmark_active = selinux_secmark_enabled();
4609 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4610 if (!secmark_active && !peerlbl_active)
4611 return NF_ACCEPT;
4612
Paul Moored8395c82008-10-10 10:16:30 -04004613 /* if the packet is being forwarded then get the peer label from the
4614 * packet itself; otherwise check to see if it is from a local
4615 * application or the kernel, if from an application get the peer label
4616 * from the sending socket, otherwise use the kernel's sid */
Paul Mooreeffad8d2008-01-29 08:49:27 -05004617 sk = skb->sk;
Paul Moored8395c82008-10-10 10:16:30 -04004618 if (sk == NULL) {
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004619 if (skb->skb_iif) {
4620 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04004621 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004622 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004623 } else {
4624 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04004625 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01004626 }
Paul Moored8395c82008-10-10 10:16:30 -04004627 } else {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004628 struct sk_security_struct *sksec = sk->sk_security;
4629 peer_sid = sksec->sid;
4630 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004631 }
4632
Thomas Liu2bf49692009-07-14 12:14:09 -04004633 COMMON_AUDIT_DATA_INIT(&ad, NET);
Paul Moored8395c82008-10-10 10:16:30 -04004634 ad.u.net.netif = ifindex;
4635 ad.u.net.family = family;
4636 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00004637 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04004638
Paul Mooreeffad8d2008-01-29 08:49:27 -05004639 if (secmark_active)
4640 if (avc_has_perm(peer_sid, skb->secmark,
4641 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004642 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004643
4644 if (peerlbl_active) {
4645 u32 if_sid;
4646 u32 node_sid;
4647
4648 if (sel_netif_sid(ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004649 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004650 if (avc_has_perm(peer_sid, if_sid,
4651 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004652 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004653
4654 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00004655 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05004656 if (avc_has_perm(peer_sid, node_sid,
4657 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00004658 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004659 }
4660
4661 return NF_ACCEPT;
4662}
4663
4664static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4665 struct sk_buff *skb,
4666 const struct net_device *in,
4667 const struct net_device *out,
4668 int (*okfn)(struct sk_buff *))
4669{
4670 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004671}
4672
4673#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004674static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4675 struct sk_buff *skb,
4676 const struct net_device *in,
4677 const struct net_device *out,
4678 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004679{
Paul Mooreeffad8d2008-01-29 08:49:27 -05004680 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004681}
Linus Torvalds1da177e2005-04-16 15:20:36 -07004682#endif /* IPV6 */
4683
4684#endif /* CONFIG_NETFILTER */
4685
Linus Torvalds1da177e2005-04-16 15:20:36 -07004686static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4687{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004688 int err;
4689
Eric Paris200ac532009-02-12 15:01:04 -05004690 err = cap_netlink_send(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004691 if (err)
4692 return err;
4693
Stephen Smalley941fc5b2009-10-01 14:48:23 -04004694 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004695}
4696
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004697static int selinux_netlink_recv(struct sk_buff *skb, int capability)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004698{
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004699 int err;
Thomas Liu2bf49692009-07-14 12:14:09 -04004700 struct common_audit_data ad;
Patrick McHardyc53fa1e2011-03-03 10:55:40 -08004701 u32 sid;
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004702
Eric Paris200ac532009-02-12 15:01:04 -05004703 err = cap_netlink_recv(skb, capability);
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004704 if (err)
4705 return err;
4706
Thomas Liu2bf49692009-07-14 12:14:09 -04004707 COMMON_AUDIT_DATA_INIT(&ad, CAP);
Darrel Goeddelc7bdb542006-06-27 13:26:11 -07004708 ad.u.cap = capability;
4709
Patrick McHardyc53fa1e2011-03-03 10:55:40 -08004710 security_task_getsecid(current, &sid);
4711 return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
4712 CAP_TO_MASK(capability), &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004713}
4714
4715static int ipc_alloc_security(struct task_struct *task,
4716 struct kern_ipc_perm *perm,
4717 u16 sclass)
4718{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004719 struct ipc_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11004720 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004721
James Morris89d155e2005-10-30 14:59:21 -08004722 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004723 if (!isec)
4724 return -ENOMEM;
4725
David Howells275bb412008-11-14 10:39:19 +11004726 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004727 isec->sclass = sclass;
David Howells275bb412008-11-14 10:39:19 +11004728 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004729 perm->security = isec;
4730
4731 return 0;
4732}
4733
4734static void ipc_free_security(struct kern_ipc_perm *perm)
4735{
4736 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004737 perm->security = NULL;
4738 kfree(isec);
4739}
4740
4741static int msg_msg_alloc_security(struct msg_msg *msg)
4742{
4743 struct msg_security_struct *msec;
4744
James Morris89d155e2005-10-30 14:59:21 -08004745 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004746 if (!msec)
4747 return -ENOMEM;
4748
Linus Torvalds1da177e2005-04-16 15:20:36 -07004749 msec->sid = SECINITSID_UNLABELED;
4750 msg->security = msec;
4751
4752 return 0;
4753}
4754
4755static void msg_msg_free_security(struct msg_msg *msg)
4756{
4757 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004758
4759 msg->security = NULL;
4760 kfree(msec);
4761}
4762
4763static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07004764 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004765{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004766 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004767 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004768 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004769
Linus Torvalds1da177e2005-04-16 15:20:36 -07004770 isec = ipc_perms->security;
4771
Thomas Liu2bf49692009-07-14 12:14:09 -04004772 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004773 ad.u.ipc_id = ipc_perms->key;
4774
David Howells275bb412008-11-14 10:39:19 +11004775 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004776}
4777
4778static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4779{
4780 return msg_msg_alloc_security(msg);
4781}
4782
4783static void selinux_msg_msg_free_security(struct msg_msg *msg)
4784{
4785 msg_msg_free_security(msg);
4786}
4787
4788/* message queue security operations */
4789static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4790{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004791 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004792 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004793 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004794 int rc;
4795
4796 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4797 if (rc)
4798 return rc;
4799
Linus Torvalds1da177e2005-04-16 15:20:36 -07004800 isec = msq->q_perm.security;
4801
Thomas Liu2bf49692009-07-14 12:14:09 -04004802 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04004803 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004804
David Howells275bb412008-11-14 10:39:19 +11004805 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004806 MSGQ__CREATE, &ad);
4807 if (rc) {
4808 ipc_free_security(&msq->q_perm);
4809 return rc;
4810 }
4811 return 0;
4812}
4813
4814static void selinux_msg_queue_free_security(struct msg_queue *msq)
4815{
4816 ipc_free_security(&msq->q_perm);
4817}
4818
4819static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4820{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004821 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004822 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004823 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004824
Linus Torvalds1da177e2005-04-16 15:20:36 -07004825 isec = msq->q_perm.security;
4826
Thomas Liu2bf49692009-07-14 12:14:09 -04004827 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004828 ad.u.ipc_id = msq->q_perm.key;
4829
David Howells275bb412008-11-14 10:39:19 +11004830 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004831 MSGQ__ASSOCIATE, &ad);
4832}
4833
4834static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4835{
4836 int err;
4837 int perms;
4838
Eric Paris828dfe12008-04-17 13:17:49 -04004839 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004840 case IPC_INFO:
4841 case MSG_INFO:
4842 /* No specific object, just general system-wide information. */
4843 return task_has_system(current, SYSTEM__IPC_INFO);
4844 case IPC_STAT:
4845 case MSG_STAT:
4846 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4847 break;
4848 case IPC_SET:
4849 perms = MSGQ__SETATTR;
4850 break;
4851 case IPC_RMID:
4852 perms = MSGQ__DESTROY;
4853 break;
4854 default:
4855 return 0;
4856 }
4857
Stephen Smalley6af963f2005-05-01 08:58:39 -07004858 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004859 return err;
4860}
4861
4862static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4863{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004864 struct ipc_security_struct *isec;
4865 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004866 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004867 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004868 int rc;
4869
Linus Torvalds1da177e2005-04-16 15:20:36 -07004870 isec = msq->q_perm.security;
4871 msec = msg->security;
4872
4873 /*
4874 * First time through, need to assign label to the message
4875 */
4876 if (msec->sid == SECINITSID_UNLABELED) {
4877 /*
4878 * Compute new sid based on current process and
4879 * message queue this message will be stored in
4880 */
David Howells275bb412008-11-14 10:39:19 +11004881 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Eric Paris652bb9b2011-02-01 11:05:40 -05004882 NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004883 if (rc)
4884 return rc;
4885 }
4886
Thomas Liu2bf49692009-07-14 12:14:09 -04004887 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004888 ad.u.ipc_id = msq->q_perm.key;
4889
4890 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11004891 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004892 MSGQ__WRITE, &ad);
4893 if (!rc)
4894 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11004895 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4896 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004897 if (!rc)
4898 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11004899 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4900 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004901
4902 return rc;
4903}
4904
4905static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4906 struct task_struct *target,
4907 long type, int mode)
4908{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004909 struct ipc_security_struct *isec;
4910 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004911 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004912 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004913 int rc;
4914
Linus Torvalds1da177e2005-04-16 15:20:36 -07004915 isec = msq->q_perm.security;
4916 msec = msg->security;
4917
Thomas Liu2bf49692009-07-14 12:14:09 -04004918 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04004919 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004920
David Howells275bb412008-11-14 10:39:19 +11004921 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004922 SECCLASS_MSGQ, MSGQ__READ, &ad);
4923 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11004924 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004925 SECCLASS_MSG, MSG__RECEIVE, &ad);
4926 return rc;
4927}
4928
4929/* Shared Memory security operations */
4930static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4931{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004932 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004933 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004934 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004935 int rc;
4936
4937 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4938 if (rc)
4939 return rc;
4940
Linus Torvalds1da177e2005-04-16 15:20:36 -07004941 isec = shp->shm_perm.security;
4942
Thomas Liu2bf49692009-07-14 12:14:09 -04004943 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04004944 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004945
David Howells275bb412008-11-14 10:39:19 +11004946 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004947 SHM__CREATE, &ad);
4948 if (rc) {
4949 ipc_free_security(&shp->shm_perm);
4950 return rc;
4951 }
4952 return 0;
4953}
4954
4955static void selinux_shm_free_security(struct shmid_kernel *shp)
4956{
4957 ipc_free_security(&shp->shm_perm);
4958}
4959
4960static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4961{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004962 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04004963 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11004964 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07004965
Linus Torvalds1da177e2005-04-16 15:20:36 -07004966 isec = shp->shm_perm.security;
4967
Thomas Liu2bf49692009-07-14 12:14:09 -04004968 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004969 ad.u.ipc_id = shp->shm_perm.key;
4970
David Howells275bb412008-11-14 10:39:19 +11004971 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004972 SHM__ASSOCIATE, &ad);
4973}
4974
4975/* Note, at this point, shp is locked down */
4976static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4977{
4978 int perms;
4979 int err;
4980
Eric Paris828dfe12008-04-17 13:17:49 -04004981 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004982 case IPC_INFO:
4983 case SHM_INFO:
4984 /* No specific object, just general system-wide information. */
4985 return task_has_system(current, SYSTEM__IPC_INFO);
4986 case IPC_STAT:
4987 case SHM_STAT:
4988 perms = SHM__GETATTR | SHM__ASSOCIATE;
4989 break;
4990 case IPC_SET:
4991 perms = SHM__SETATTR;
4992 break;
4993 case SHM_LOCK:
4994 case SHM_UNLOCK:
4995 perms = SHM__LOCK;
4996 break;
4997 case IPC_RMID:
4998 perms = SHM__DESTROY;
4999 break;
5000 default:
5001 return 0;
5002 }
5003
Stephen Smalley6af963f2005-05-01 08:58:39 -07005004 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005005 return err;
5006}
5007
5008static int selinux_shm_shmat(struct shmid_kernel *shp,
5009 char __user *shmaddr, int shmflg)
5010{
5011 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005012
5013 if (shmflg & SHM_RDONLY)
5014 perms = SHM__READ;
5015 else
5016 perms = SHM__READ | SHM__WRITE;
5017
Stephen Smalley6af963f2005-05-01 08:58:39 -07005018 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005019}
5020
5021/* Semaphore security operations */
5022static int selinux_sem_alloc_security(struct sem_array *sma)
5023{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005024 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005025 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005026 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005027 int rc;
5028
5029 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5030 if (rc)
5031 return rc;
5032
Linus Torvalds1da177e2005-04-16 15:20:36 -07005033 isec = sma->sem_perm.security;
5034
Thomas Liu2bf49692009-07-14 12:14:09 -04005035 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Eric Paris828dfe12008-04-17 13:17:49 -04005036 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005037
David Howells275bb412008-11-14 10:39:19 +11005038 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005039 SEM__CREATE, &ad);
5040 if (rc) {
5041 ipc_free_security(&sma->sem_perm);
5042 return rc;
5043 }
5044 return 0;
5045}
5046
5047static void selinux_sem_free_security(struct sem_array *sma)
5048{
5049 ipc_free_security(&sma->sem_perm);
5050}
5051
5052static int selinux_sem_associate(struct sem_array *sma, int semflg)
5053{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005054 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005055 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005056 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005057
Linus Torvalds1da177e2005-04-16 15:20:36 -07005058 isec = sma->sem_perm.security;
5059
Thomas Liu2bf49692009-07-14 12:14:09 -04005060 COMMON_AUDIT_DATA_INIT(&ad, IPC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005061 ad.u.ipc_id = sma->sem_perm.key;
5062
David Howells275bb412008-11-14 10:39:19 +11005063 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005064 SEM__ASSOCIATE, &ad);
5065}
5066
5067/* Note, at this point, sma is locked down */
5068static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5069{
5070 int err;
5071 u32 perms;
5072
Eric Paris828dfe12008-04-17 13:17:49 -04005073 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005074 case IPC_INFO:
5075 case SEM_INFO:
5076 /* No specific object, just general system-wide information. */
5077 return task_has_system(current, SYSTEM__IPC_INFO);
5078 case GETPID:
5079 case GETNCNT:
5080 case GETZCNT:
5081 perms = SEM__GETATTR;
5082 break;
5083 case GETVAL:
5084 case GETALL:
5085 perms = SEM__READ;
5086 break;
5087 case SETVAL:
5088 case SETALL:
5089 perms = SEM__WRITE;
5090 break;
5091 case IPC_RMID:
5092 perms = SEM__DESTROY;
5093 break;
5094 case IPC_SET:
5095 perms = SEM__SETATTR;
5096 break;
5097 case IPC_STAT:
5098 case SEM_STAT:
5099 perms = SEM__GETATTR | SEM__ASSOCIATE;
5100 break;
5101 default:
5102 return 0;
5103 }
5104
Stephen Smalley6af963f2005-05-01 08:58:39 -07005105 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005106 return err;
5107}
5108
5109static int selinux_sem_semop(struct sem_array *sma,
5110 struct sembuf *sops, unsigned nsops, int alter)
5111{
5112 u32 perms;
5113
5114 if (alter)
5115 perms = SEM__READ | SEM__WRITE;
5116 else
5117 perms = SEM__READ;
5118
Stephen Smalley6af963f2005-05-01 08:58:39 -07005119 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005120}
5121
5122static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5123{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005124 u32 av = 0;
5125
Linus Torvalds1da177e2005-04-16 15:20:36 -07005126 av = 0;
5127 if (flag & S_IRUGO)
5128 av |= IPC__UNIX_READ;
5129 if (flag & S_IWUGO)
5130 av |= IPC__UNIX_WRITE;
5131
5132 if (av == 0)
5133 return 0;
5134
Stephen Smalley6af963f2005-05-01 08:58:39 -07005135 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005136}
5137
Ahmed S. Darwish713a04a2008-03-01 21:52:30 +02005138static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5139{
5140 struct ipc_security_struct *isec = ipcp->security;
5141 *secid = isec->sid;
5142}
5143
Eric Paris828dfe12008-04-17 13:17:49 -04005144static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005145{
5146 if (inode)
5147 inode_doinit_with_dentry(inode, dentry);
5148}
5149
5150static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005151 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005152{
David Howells275bb412008-11-14 10:39:19 +11005153 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005154 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005155 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005156 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005157
5158 if (current != p) {
David Howells3b11a1d2008-11-14 10:39:26 +11005159 error = current_has_perm(p, PROCESS__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005160 if (error)
5161 return error;
5162 }
5163
David Howells275bb412008-11-14 10:39:19 +11005164 rcu_read_lock();
5165 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005166
5167 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005168 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005169 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005170 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005171 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005172 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005173 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005174 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005175 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005176 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005177 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005178 sid = __tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005179 else
David Howells275bb412008-11-14 10:39:19 +11005180 goto invalid;
5181 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005182
5183 if (!sid)
5184 return 0;
5185
Al Viro04ff9702007-03-12 16:17:58 +00005186 error = security_sid_to_context(sid, value, &len);
5187 if (error)
5188 return error;
5189 return len;
David Howells275bb412008-11-14 10:39:19 +11005190
5191invalid:
5192 rcu_read_unlock();
5193 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005194}
5195
5196static int selinux_setprocattr(struct task_struct *p,
5197 char *name, void *value, size_t size)
5198{
5199 struct task_security_struct *tsec;
Roland McGrath03563572008-03-26 15:46:39 -07005200 struct task_struct *tracer;
David Howellsd84f4f92008-11-14 10:39:23 +11005201 struct cred *new;
5202 u32 sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005203 int error;
5204 char *str = value;
5205
5206 if (current != p) {
5207 /* SELinux only allows a process to change its own
5208 security attributes. */
5209 return -EACCES;
5210 }
5211
5212 /*
5213 * Basic control over ability to set these attributes at all.
5214 * current == p, but we'll pass them separately in case the
5215 * above restriction is ever removed.
5216 */
5217 if (!strcmp(name, "exec"))
David Howells3b11a1d2008-11-14 10:39:26 +11005218 error = current_has_perm(p, PROCESS__SETEXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005219 else if (!strcmp(name, "fscreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005220 error = current_has_perm(p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005221 else if (!strcmp(name, "keycreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005222 error = current_has_perm(p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07005223 else if (!strcmp(name, "sockcreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005224 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005225 else if (!strcmp(name, "current"))
David Howells3b11a1d2008-11-14 10:39:26 +11005226 error = current_has_perm(p, PROCESS__SETCURRENT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005227 else
5228 error = -EINVAL;
5229 if (error)
5230 return error;
5231
5232 /* Obtain a SID for the context, if one was specified. */
5233 if (size && str[1] && str[1] != '\n') {
5234 if (str[size-1] == '\n') {
5235 str[size-1] = 0;
5236 size--;
5237 }
5238 error = security_context_to_sid(value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005239 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5240 if (!capable(CAP_MAC_ADMIN))
5241 return error;
5242 error = security_context_to_sid_force(value, size,
5243 &sid);
5244 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005245 if (error)
5246 return error;
5247 }
5248
David Howellsd84f4f92008-11-14 10:39:23 +11005249 new = prepare_creds();
5250 if (!new)
5251 return -ENOMEM;
5252
Linus Torvalds1da177e2005-04-16 15:20:36 -07005253 /* Permission checking based on the specified context is
5254 performed during the actual operation (execve,
5255 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11005256 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07005257 checks and may_create for the file creation checks. The
5258 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11005259 tsec = new->security;
5260 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005261 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005262 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005263 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005264 } else if (!strcmp(name, "keycreate")) {
Michael LeMay4eb582c2006-06-26 00:24:57 -07005265 error = may_create_key(sid, p);
5266 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005267 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005268 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005269 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07005270 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005271 } else if (!strcmp(name, "current")) {
5272 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005273 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11005274 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09005275
David Howellsd84f4f92008-11-14 10:39:23 +11005276 /* Only allow single threaded processes to change context */
5277 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02005278 if (!current_is_single_threaded()) {
David Howellsd84f4f92008-11-14 10:39:23 +11005279 error = security_bounded_transition(tsec->sid, sid);
5280 if (error)
5281 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04005282 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005283
5284 /* Check permissions for the transition. */
5285 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04005286 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005287 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005288 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005289
5290 /* Check for ptracing, and update the task SID if ok.
5291 Otherwise, leave SID unchanged and fail. */
David Howellsd84f4f92008-11-14 10:39:23 +11005292 ptsid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005293 task_lock(p);
Roland McGrath0d094ef2008-07-25 19:45:49 -07005294 tracer = tracehook_tracer_task(p);
David Howellsd84f4f92008-11-14 10:39:23 +11005295 if (tracer)
5296 ptsid = task_sid(tracer);
5297 task_unlock(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005298
David Howellsd84f4f92008-11-14 10:39:23 +11005299 if (tracer) {
5300 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5301 PROCESS__PTRACE, NULL);
5302 if (error)
5303 goto abort_change;
5304 }
5305
5306 tsec->sid = sid;
5307 } else {
5308 error = -EINVAL;
5309 goto abort_change;
5310 }
5311
5312 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005313 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11005314
5315abort_change:
5316 abort_creds(new);
5317 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005318}
5319
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005320static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5321{
5322 return security_sid_to_context(secid, secdata, seclen);
5323}
5324
David Howells7bf570d2008-04-29 20:52:51 +01005325static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00005326{
5327 return security_context_to_sid(secdata, seclen, secid);
5328}
5329
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005330static void selinux_release_secctx(char *secdata, u32 seclen)
5331{
Paul Moore088999e2007-08-01 11:12:58 -04005332 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005333}
5334
David P. Quigley1ee65e32009-09-03 14:25:57 -04005335/*
5336 * called with inode->i_mutex locked
5337 */
5338static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5339{
5340 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5341}
5342
5343/*
5344 * called with inode->i_mutex locked
5345 */
5346static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5347{
5348 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5349}
5350
5351static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5352{
5353 int len = 0;
5354 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5355 ctx, true);
5356 if (len < 0)
5357 return len;
5358 *ctxlen = len;
5359 return 0;
5360}
Michael LeMayd7200242006-06-22 14:47:17 -07005361#ifdef CONFIG_KEYS
5362
David Howellsd84f4f92008-11-14 10:39:23 +11005363static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07005364 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07005365{
David Howellsd84f4f92008-11-14 10:39:23 +11005366 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07005367 struct key_security_struct *ksec;
5368
5369 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5370 if (!ksec)
5371 return -ENOMEM;
5372
David Howellsd84f4f92008-11-14 10:39:23 +11005373 tsec = cred->security;
5374 if (tsec->keycreate_sid)
5375 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005376 else
David Howellsd84f4f92008-11-14 10:39:23 +11005377 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005378
David Howells275bb412008-11-14 10:39:19 +11005379 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07005380 return 0;
5381}
5382
5383static void selinux_key_free(struct key *k)
5384{
5385 struct key_security_struct *ksec = k->security;
5386
5387 k->security = NULL;
5388 kfree(ksec);
5389}
5390
5391static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11005392 const struct cred *cred,
5393 key_perm_t perm)
Michael LeMayd7200242006-06-22 14:47:17 -07005394{
5395 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07005396 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11005397 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07005398
5399 /* if no specific permissions are requested, we skip the
5400 permission check. No serious, additional covert channels
5401 appear to be created. */
5402 if (perm == 0)
5403 return 0;
5404
David Howellsd84f4f92008-11-14 10:39:23 +11005405 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11005406
5407 key = key_ref_to_ptr(key_ref);
5408 ksec = key->security;
5409
5410 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07005411}
5412
David Howells70a5bb72008-04-29 01:01:26 -07005413static int selinux_key_getsecurity(struct key *key, char **_buffer)
5414{
5415 struct key_security_struct *ksec = key->security;
5416 char *context = NULL;
5417 unsigned len;
5418 int rc;
5419
5420 rc = security_sid_to_context(ksec->sid, &context, &len);
5421 if (!rc)
5422 rc = len;
5423 *_buffer = context;
5424 return rc;
5425}
5426
Michael LeMayd7200242006-06-22 14:47:17 -07005427#endif
5428
Linus Torvalds1da177e2005-04-16 15:20:36 -07005429static struct security_operations selinux_ops = {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005430 .name = "selinux",
5431
Ingo Molnar9e488582009-05-07 19:26:19 +10005432 .ptrace_access_check = selinux_ptrace_access_check,
David Howells5cd9c582008-08-14 11:37:28 +01005433 .ptrace_traceme = selinux_ptrace_traceme,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005434 .capget = selinux_capget,
David Howellsd84f4f92008-11-14 10:39:23 +11005435 .capset = selinux_capset,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005436 .capable = selinux_capable,
5437 .quotactl = selinux_quotactl,
5438 .quota_on = selinux_quota_on,
5439 .syslog = selinux_syslog,
5440 .vm_enough_memory = selinux_vm_enough_memory,
5441
5442 .netlink_send = selinux_netlink_send,
Eric Paris828dfe12008-04-17 13:17:49 -04005443 .netlink_recv = selinux_netlink_recv,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005444
David Howellsa6f76f22008-11-14 10:39:24 +11005445 .bprm_set_creds = selinux_bprm_set_creds,
David Howellsa6f76f22008-11-14 10:39:24 +11005446 .bprm_committing_creds = selinux_bprm_committing_creds,
5447 .bprm_committed_creds = selinux_bprm_committed_creds,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005448 .bprm_secureexec = selinux_bprm_secureexec,
5449
5450 .sb_alloc_security = selinux_sb_alloc_security,
5451 .sb_free_security = selinux_sb_free_security,
5452 .sb_copy_data = selinux_sb_copy_data,
Eric Paris026eb162011-03-03 16:09:14 -05005453 .sb_remount = selinux_sb_remount,
Eric Paris828dfe12008-04-17 13:17:49 -04005454 .sb_kern_mount = selinux_sb_kern_mount,
Eric Paris2069f452008-07-04 09:47:13 +10005455 .sb_show_options = selinux_sb_show_options,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005456 .sb_statfs = selinux_sb_statfs,
5457 .sb_mount = selinux_mount,
5458 .sb_umount = selinux_umount,
Eric Parisc9180a52007-11-30 13:00:35 -05005459 .sb_set_mnt_opts = selinux_set_mnt_opts,
Eric Paris828dfe12008-04-17 13:17:49 -04005460 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
Eric Parise0007522008-03-05 10:31:54 -05005461 .sb_parse_opts_str = selinux_parse_opts_str,
5462
Linus Torvalds1da177e2005-04-16 15:20:36 -07005463
5464 .inode_alloc_security = selinux_inode_alloc_security,
5465 .inode_free_security = selinux_inode_free_security,
Stephen Smalley5e41ff92005-09-09 13:01:35 -07005466 .inode_init_security = selinux_inode_init_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005467 .inode_create = selinux_inode_create,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005468 .inode_link = selinux_inode_link,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005469 .inode_unlink = selinux_inode_unlink,
5470 .inode_symlink = selinux_inode_symlink,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005471 .inode_mkdir = selinux_inode_mkdir,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005472 .inode_rmdir = selinux_inode_rmdir,
5473 .inode_mknod = selinux_inode_mknod,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005474 .inode_rename = selinux_inode_rename,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005475 .inode_readlink = selinux_inode_readlink,
5476 .inode_follow_link = selinux_inode_follow_link,
5477 .inode_permission = selinux_inode_permission,
5478 .inode_setattr = selinux_inode_setattr,
5479 .inode_getattr = selinux_inode_getattr,
5480 .inode_setxattr = selinux_inode_setxattr,
5481 .inode_post_setxattr = selinux_inode_post_setxattr,
5482 .inode_getxattr = selinux_inode_getxattr,
5483 .inode_listxattr = selinux_inode_listxattr,
5484 .inode_removexattr = selinux_inode_removexattr,
Eric Paris828dfe12008-04-17 13:17:49 -04005485 .inode_getsecurity = selinux_inode_getsecurity,
5486 .inode_setsecurity = selinux_inode_setsecurity,
5487 .inode_listsecurity = selinux_inode_listsecurity,
Eric Parisf5269712008-05-14 11:27:45 -04005488 .inode_getsecid = selinux_inode_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005489
5490 .file_permission = selinux_file_permission,
5491 .file_alloc_security = selinux_file_alloc_security,
5492 .file_free_security = selinux_file_free_security,
5493 .file_ioctl = selinux_file_ioctl,
5494 .file_mmap = selinux_file_mmap,
5495 .file_mprotect = selinux_file_mprotect,
5496 .file_lock = selinux_file_lock,
5497 .file_fcntl = selinux_file_fcntl,
5498 .file_set_fowner = selinux_file_set_fowner,
5499 .file_send_sigiotask = selinux_file_send_sigiotask,
5500 .file_receive = selinux_file_receive,
5501
Eric Paris828dfe12008-04-17 13:17:49 -04005502 .dentry_open = selinux_dentry_open,
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09005503
Linus Torvalds1da177e2005-04-16 15:20:36 -07005504 .task_create = selinux_task_create,
David Howellsee18d642009-09-02 09:14:21 +01005505 .cred_alloc_blank = selinux_cred_alloc_blank,
David Howellsf1752ee2008-11-14 10:39:17 +11005506 .cred_free = selinux_cred_free,
David Howellsd84f4f92008-11-14 10:39:23 +11005507 .cred_prepare = selinux_cred_prepare,
David Howellsee18d642009-09-02 09:14:21 +01005508 .cred_transfer = selinux_cred_transfer,
David Howells3a3b7ce2008-11-14 10:39:28 +11005509 .kernel_act_as = selinux_kernel_act_as,
5510 .kernel_create_files_as = selinux_kernel_create_files_as,
Eric Paris25354c42009-08-13 09:45:03 -04005511 .kernel_module_request = selinux_kernel_module_request,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005512 .task_setpgid = selinux_task_setpgid,
5513 .task_getpgid = selinux_task_getpgid,
Eric Paris828dfe12008-04-17 13:17:49 -04005514 .task_getsid = selinux_task_getsid,
David Quigleyf9008e42006-06-30 01:55:46 -07005515 .task_getsecid = selinux_task_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005516 .task_setnice = selinux_task_setnice,
James Morris03e68062006-06-23 02:03:58 -07005517 .task_setioprio = selinux_task_setioprio,
David Quigleya1836a42006-06-30 01:55:49 -07005518 .task_getioprio = selinux_task_getioprio,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005519 .task_setrlimit = selinux_task_setrlimit,
5520 .task_setscheduler = selinux_task_setscheduler,
5521 .task_getscheduler = selinux_task_getscheduler,
David Quigley35601542006-06-23 02:04:01 -07005522 .task_movememory = selinux_task_movememory,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005523 .task_kill = selinux_task_kill,
5524 .task_wait = selinux_task_wait,
Eric Paris828dfe12008-04-17 13:17:49 -04005525 .task_to_inode = selinux_task_to_inode,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005526
5527 .ipc_permission = selinux_ipc_permission,
Eric Parisf5269712008-05-14 11:27:45 -04005528 .ipc_getsecid = selinux_ipc_getsecid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005529
5530 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5531 .msg_msg_free_security = selinux_msg_msg_free_security,
5532
5533 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5534 .msg_queue_free_security = selinux_msg_queue_free_security,
5535 .msg_queue_associate = selinux_msg_queue_associate,
5536 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5537 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5538 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5539
5540 .shm_alloc_security = selinux_shm_alloc_security,
5541 .shm_free_security = selinux_shm_free_security,
5542 .shm_associate = selinux_shm_associate,
5543 .shm_shmctl = selinux_shm_shmctl,
5544 .shm_shmat = selinux_shm_shmat,
5545
Eric Paris828dfe12008-04-17 13:17:49 -04005546 .sem_alloc_security = selinux_sem_alloc_security,
5547 .sem_free_security = selinux_sem_free_security,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005548 .sem_associate = selinux_sem_associate,
5549 .sem_semctl = selinux_sem_semctl,
5550 .sem_semop = selinux_sem_semop,
5551
Eric Paris828dfe12008-04-17 13:17:49 -04005552 .d_instantiate = selinux_d_instantiate,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005553
Eric Paris828dfe12008-04-17 13:17:49 -04005554 .getprocattr = selinux_getprocattr,
5555 .setprocattr = selinux_setprocattr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005556
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005557 .secid_to_secctx = selinux_secid_to_secctx,
David Howells63cb3442008-01-15 23:47:35 +00005558 .secctx_to_secid = selinux_secctx_to_secid,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005559 .release_secctx = selinux_release_secctx,
David P. Quigley1ee65e32009-09-03 14:25:57 -04005560 .inode_notifysecctx = selinux_inode_notifysecctx,
5561 .inode_setsecctx = selinux_inode_setsecctx,
5562 .inode_getsecctx = selinux_inode_getsecctx,
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005563
Eric Paris828dfe12008-04-17 13:17:49 -04005564 .unix_stream_connect = selinux_socket_unix_stream_connect,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005565 .unix_may_send = selinux_socket_unix_may_send,
5566
5567 .socket_create = selinux_socket_create,
5568 .socket_post_create = selinux_socket_post_create,
5569 .socket_bind = selinux_socket_bind,
5570 .socket_connect = selinux_socket_connect,
5571 .socket_listen = selinux_socket_listen,
5572 .socket_accept = selinux_socket_accept,
5573 .socket_sendmsg = selinux_socket_sendmsg,
5574 .socket_recvmsg = selinux_socket_recvmsg,
5575 .socket_getsockname = selinux_socket_getsockname,
5576 .socket_getpeername = selinux_socket_getpeername,
5577 .socket_getsockopt = selinux_socket_getsockopt,
5578 .socket_setsockopt = selinux_socket_setsockopt,
5579 .socket_shutdown = selinux_socket_shutdown,
5580 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005581 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5582 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005583 .sk_alloc_security = selinux_sk_alloc_security,
5584 .sk_free_security = selinux_sk_free_security,
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005585 .sk_clone_security = selinux_sk_clone_security,
Eric Paris828dfe12008-04-17 13:17:49 -04005586 .sk_getsecid = selinux_sk_getsecid,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005587 .sock_graft = selinux_sock_graft,
5588 .inet_conn_request = selinux_inet_conn_request,
5589 .inet_csk_clone = selinux_inet_csk_clone,
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005590 .inet_conn_established = selinux_inet_conn_established,
Eric Paris2606fd12010-10-13 16:24:41 -04005591 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5592 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5593 .secmark_refcount_dec = selinux_secmark_refcount_dec,
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005594 .req_classify_flow = selinux_req_classify_flow,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005595 .tun_dev_create = selinux_tun_dev_create,
5596 .tun_dev_post_create = selinux_tun_dev_post_create,
5597 .tun_dev_attach = selinux_tun_dev_attach,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005598
5599#ifdef CONFIG_SECURITY_NETWORK_XFRM
5600 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5601 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5602 .xfrm_policy_free_security = selinux_xfrm_policy_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005603 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005604 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5605 .xfrm_state_free_security = selinux_xfrm_state_free,
Catherine Zhangc8c05a82006-06-08 23:39:49 -07005606 .xfrm_state_delete_security = selinux_xfrm_state_delete,
Eric Paris828dfe12008-04-17 13:17:49 -04005607 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005608 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -07005609 .xfrm_decode_session = selinux_xfrm_decode_session,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005610#endif
Michael LeMayd7200242006-06-22 14:47:17 -07005611
5612#ifdef CONFIG_KEYS
Eric Paris828dfe12008-04-17 13:17:49 -04005613 .key_alloc = selinux_key_alloc,
5614 .key_free = selinux_key_free,
5615 .key_permission = selinux_key_permission,
David Howells70a5bb72008-04-29 01:01:26 -07005616 .key_getsecurity = selinux_key_getsecurity,
Michael LeMayd7200242006-06-22 14:47:17 -07005617#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02005618
5619#ifdef CONFIG_AUDIT
5620 .audit_rule_init = selinux_audit_rule_init,
5621 .audit_rule_known = selinux_audit_rule_known,
5622 .audit_rule_match = selinux_audit_rule_match,
5623 .audit_rule_free = selinux_audit_rule_free,
5624#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07005625};
5626
5627static __init int selinux_init(void)
5628{
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02005629 if (!security_module_enable(&selinux_ops)) {
5630 selinux_enabled = 0;
5631 return 0;
5632 }
5633
Linus Torvalds1da177e2005-04-16 15:20:36 -07005634 if (!selinux_enabled) {
5635 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5636 return 0;
5637 }
5638
5639 printk(KERN_INFO "SELinux: Initializing.\n");
5640
5641 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11005642 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005643
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04005644 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5645
James Morris7cae7e22006-03-22 00:09:22 -08005646 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5647 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09005648 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005649 avc_init();
5650
Eric Paris828dfe12008-04-17 13:17:49 -04005651 if (register_security(&selinux_ops))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005652 panic("SELinux: Unable to register with kernel.\n");
5653
Eric Paris828dfe12008-04-17 13:17:49 -04005654 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05005655 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04005656 else
Eric Parisfadcdb42007-02-22 18:11:31 -05005657 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07005658
Linus Torvalds1da177e2005-04-16 15:20:36 -07005659 return 0;
5660}
5661
Al Viroe8c26252010-03-23 06:36:54 -04005662static void delayed_superblock_init(struct super_block *sb, void *unused)
5663{
5664 superblock_doinit(sb, NULL);
5665}
5666
Linus Torvalds1da177e2005-04-16 15:20:36 -07005667void selinux_complete_init(void)
5668{
Eric Parisfadcdb42007-02-22 18:11:31 -05005669 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005670
5671 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05005672 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04005673 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005674}
5675
5676/* SELinux requires early initialization in order to label
5677 all processes and objects when they are created. */
5678security_initcall(selinux_init);
5679
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005680#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005681
Paul Mooreeffad8d2008-01-29 08:49:27 -05005682static struct nf_hook_ops selinux_ipv4_ops[] = {
5683 {
5684 .hook = selinux_ipv4_postroute,
5685 .owner = THIS_MODULE,
5686 .pf = PF_INET,
5687 .hooknum = NF_INET_POST_ROUTING,
5688 .priority = NF_IP_PRI_SELINUX_LAST,
5689 },
5690 {
5691 .hook = selinux_ipv4_forward,
5692 .owner = THIS_MODULE,
5693 .pf = PF_INET,
5694 .hooknum = NF_INET_FORWARD,
5695 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04005696 },
5697 {
5698 .hook = selinux_ipv4_output,
5699 .owner = THIS_MODULE,
5700 .pf = PF_INET,
5701 .hooknum = NF_INET_LOCAL_OUT,
5702 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005703 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005704};
5705
5706#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5707
Paul Mooreeffad8d2008-01-29 08:49:27 -05005708static struct nf_hook_ops selinux_ipv6_ops[] = {
5709 {
5710 .hook = selinux_ipv6_postroute,
5711 .owner = THIS_MODULE,
5712 .pf = PF_INET6,
5713 .hooknum = NF_INET_POST_ROUTING,
5714 .priority = NF_IP6_PRI_SELINUX_LAST,
5715 },
5716 {
5717 .hook = selinux_ipv6_forward,
5718 .owner = THIS_MODULE,
5719 .pf = PF_INET6,
5720 .hooknum = NF_INET_FORWARD,
5721 .priority = NF_IP6_PRI_SELINUX_FIRST,
5722 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005723};
5724
5725#endif /* IPV6 */
5726
5727static int __init selinux_nf_ip_init(void)
5728{
5729 int err = 0;
5730
5731 if (!selinux_enabled)
5732 goto out;
Eric Parisfadcdb42007-02-22 18:11:31 -05005733
5734 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5735
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005736 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5737 if (err)
5738 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005739
5740#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005741 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5742 if (err)
5743 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005744#endif /* IPV6 */
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005745
Linus Torvalds1da177e2005-04-16 15:20:36 -07005746out:
5747 return err;
5748}
5749
5750__initcall(selinux_nf_ip_init);
5751
5752#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5753static void selinux_nf_ip_exit(void)
5754{
Eric Parisfadcdb42007-02-22 18:11:31 -05005755 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07005756
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005757 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005758#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07005759 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07005760#endif /* IPV6 */
5761}
5762#endif
5763
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005764#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005765
5766#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5767#define selinux_nf_ip_exit()
5768#endif
5769
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08005770#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07005771
5772#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04005773static int selinux_disabled;
5774
Linus Torvalds1da177e2005-04-16 15:20:36 -07005775int selinux_disable(void)
5776{
5777 extern void exit_sel_fs(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005778
5779 if (ss_initialized) {
5780 /* Not permitted after initial policy load. */
5781 return -EINVAL;
5782 }
5783
5784 if (selinux_disabled) {
5785 /* Only do this once. */
5786 return -EINVAL;
5787 }
5788
5789 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5790
5791 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04005792 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005793
wzt.wzt@gmail.com189b3b12010-02-23 23:15:28 +08005794 reset_security_ops();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005795
Eric Parisaf8ff042009-09-20 21:23:01 -04005796 /* Try to destroy the avc node cache */
5797 avc_disable();
5798
Linus Torvalds1da177e2005-04-16 15:20:36 -07005799 /* Unregister netfilter hooks. */
5800 selinux_nf_ip_exit();
5801
5802 /* Unregister selinuxfs. */
5803 exit_sel_fs();
5804
5805 return 0;
5806}
5807#endif