?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
SELinux: clean up printks
[firewire-audio.git] / security / selinux / hooks.c
blobc507f67e2ba763dda5e8108db4ed21c8c54ba73f
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
16 * Paul Moore <paul.moore@hp.com>
17 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
18 * Yuichi Nakamura <ynakam@hitachisoft.jp>
19 *
20 * This program is free software; you can redistribute it and/or modify
21 * it under the terms of the GNU General Public License version 2,
22 * as published by the Free Software Foundation.
23 */
24
25 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/ptrace.h>
28 #include <linux/errno.h>
29 #include <linux/sched.h>
30 #include <linux/security.h>
31 #include <linux/xattr.h>
32 #include <linux/capability.h>
33 #include <linux/unistd.h>
34 #include <linux/mm.h>
35 #include <linux/mman.h>
36 #include <linux/slab.h>
37 #include <linux/pagemap.h>
38 #include <linux/swap.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <asm/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78
79 #include "avc.h"
80 #include "objsec.h"
81 #include "netif.h"
82 #include "netnode.h"
83 #include "netport.h"
84 #include "xfrm.h"
85 #include "netlabel.h"
86 #include "audit.h"
87
88 #define XATTR_SELINUX_SUFFIX "selinux"
89 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
90
91 #define NUM_SEL_MNT_OPTS 4
92
93 extern unsigned int policydb_loaded_version;
94 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
95 extern int selinux_compat_net;
96 extern struct security_operations *security_ops;
97
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing = 0;
103
104 static int __init enforcing_setup(char *str)
105 {
106 selinux_enforcing = simple_strtol(str,NULL,0);
107 return 1;
108 }
109 __setup("enforcing=", enforcing_setup);
110 #endif
111
112 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
113 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
114
115 static int __init selinux_enabled_setup(char *str)
116 {
117 selinux_enabled = simple_strtol(str, NULL, 0);
118 return 1;
119 }
120 __setup("selinux=", selinux_enabled_setup);
121 #else
122 int selinux_enabled = 1;
123 #endif
124
125 /* Original (dummy) security module. */
126 static struct security_operations *original_ops = NULL;
127
128 /* Minimal support for a secondary security module,
129 just to allow the use of the dummy or capability modules.
130 The owlsm module can alternatively be used as a secondary
131 module as long as CONFIG_OWLSM_FD is not enabled. */
132 static struct security_operations *secondary_ops = NULL;
133
134 /* Lists of inode and superblock security structures initialized
135 before the policy was loaded. */
136 static LIST_HEAD(superblock_security_head);
137 static DEFINE_SPINLOCK(sb_security_lock);
138
139 static struct kmem_cache *sel_inode_cache;
140
141 /**
142 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
143 *
144 * Description:
145 * This function checks the SECMARK reference counter to see if any SECMARK
146 * targets are currently configured, if the reference counter is greater than
147 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
148 * enabled, false (0) if SECMARK is disabled.
149 *
150 */
151 static int selinux_secmark_enabled(void)
152 {
153 return (atomic_read(&selinux_secmark_refcount) > 0);
154 }
155
156 /* Allocate and free functions for each kind of security blob. */
157
158 static int task_alloc_security(struct task_struct *task)
159 {
160 struct task_security_struct *tsec;
161
162 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
163 if (!tsec)
164 return -ENOMEM;
165
166 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
167 task->security = tsec;
168
169 return 0;
170 }
171
172 static void task_free_security(struct task_struct *task)
173 {
174 struct task_security_struct *tsec = task->security;
175 task->security = NULL;
176 kfree(tsec);
177 }
178
179 static int inode_alloc_security(struct inode *inode)
180 {
181 struct task_security_struct *tsec = current->security;
182 struct inode_security_struct *isec;
183
184 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
185 if (!isec)
186 return -ENOMEM;
187
188 mutex_init(&isec->lock);
189 INIT_LIST_HEAD(&isec->list);
190 isec->inode = inode;
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
193 isec->task_sid = tsec->sid;
194 inode->i_security = isec;
195
196 return 0;
197 }
198
199 static void inode_free_security(struct inode *inode)
200 {
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
203
204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
208
209 inode->i_security = NULL;
210 kmem_cache_free(sel_inode_cache, isec);
211 }
212
213 static int file_alloc_security(struct file *file)
214 {
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
217
218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219 if (!fsec)
220 return -ENOMEM;
221
222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
224 file->f_security = fsec;
225
226 return 0;
227 }
228
229 static void file_free_security(struct file *file)
230 {
231 struct file_security_struct *fsec = file->f_security;
232 file->f_security = NULL;
233 kfree(fsec);
234 }
235
236 static int superblock_alloc_security(struct super_block *sb)
237 {
238 struct superblock_security_struct *sbsec;
239
240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
241 if (!sbsec)
242 return -ENOMEM;
243
244 mutex_init(&sbsec->lock);
245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
252 sb->s_security = sbsec;
253
254 return 0;
255 }
256
257 static void superblock_free_security(struct super_block *sb)
258 {
259 struct superblock_security_struct *sbsec = sb->s_security;
260
261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268 }
269
270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
271 {
272 struct sk_security_struct *ssec;
273
274 ssec = kzalloc(sizeof(*ssec), priority);
275 if (!ssec)
276 return -ENOMEM;
277
278 ssec->peer_sid = SECINITSID_UNLABELED;
279 ssec->sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
281
282 selinux_netlbl_sk_security_reset(ssec, family);
283
284 return 0;
285 }
286
287 static void sk_free_security(struct sock *sk)
288 {
289 struct sk_security_struct *ssec = sk->sk_security;
290
291 sk->sk_security = NULL;
292 kfree(ssec);
293 }
294
295 /* The security server must be initialized before
296 any labeling or access decisions can be provided. */
297 extern int ss_initialized;
298
299 /* The file system's label must be initialized prior to use. */
300
301 static char *labeling_behaviors[6] = {
302 "uses xattr",
303 "uses transition SIDs",
304 "uses task SIDs",
305 "uses genfs_contexts",
306 "not configured for labeling",
307 "uses mountpoint labeling",
308 };
309
310 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
311
312 static inline int inode_doinit(struct inode *inode)
313 {
314 return inode_doinit_with_dentry(inode, NULL);
315 }
316
317 enum {
318 Opt_error = -1,
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 3,
322 Opt_rootcontext = 4,
323 };
324
325 static match_table_t tokens = {
326 {Opt_context, CONTEXT_STR "%s"},
327 {Opt_fscontext, FSCONTEXT_STR "%s"},
328 {Opt_defcontext, DEFCONTEXT_STR "%s"},
329 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
330 {Opt_error, NULL},
331 };
332
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
334
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
338 {
339 int rc;
340
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
343 if (rc)
344 return rc;
345
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
348 return rc;
349 }
350
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
354 {
355 int rc;
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
358 if (rc)
359 return rc;
360
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
363 return rc;
364 }
365
366 static int sb_finish_set_opts(struct super_block *sb)
367 {
368 struct superblock_security_struct *sbsec = sb->s_security;
369 struct dentry *root = sb->s_root;
370 struct inode *root_inode = root->d_inode;
371 int rc = 0;
372
373 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
374 /* Make sure that the xattr handler exists and that no
375 error other than -ENODATA is returned by getxattr on
376 the root directory. -ENODATA is ok, as this may be
377 the first boot of the SELinux kernel before we have
378 assigned xattr values to the filesystem. */
379 if (!root_inode->i_op->getxattr) {
380 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
381 "xattr support\n", sb->s_id, sb->s_type->name);
382 rc = -EOPNOTSUPP;
383 goto out;
384 }
385 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
386 if (rc < 0 && rc != -ENODATA) {
387 if (rc == -EOPNOTSUPP)
388 printk(KERN_WARNING "SELinux: (dev %s, type "
389 "%s) has no security xattr handler\n",
390 sb->s_id, sb->s_type->name);
391 else
392 printk(KERN_WARNING "SELinux: (dev %s, type "
393 "%s) getxattr errno %d\n", sb->s_id,
394 sb->s_type->name, -rc);
395 goto out;
396 }
397 }
398
399 sbsec->initialized = 1;
400
401 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
402 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
403 sb->s_id, sb->s_type->name);
404 else
405 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
406 sb->s_id, sb->s_type->name,
407 labeling_behaviors[sbsec->behavior-1]);
408
409 /* Initialize the root inode. */
410 rc = inode_doinit_with_dentry(root_inode, root);
411
412 /* Initialize any other inodes associated with the superblock, e.g.
413 inodes created prior to initial policy load or inodes created
414 during get_sb by a pseudo filesystem that directly
415 populates itself. */
416 spin_lock(&sbsec->isec_lock);
417 next_inode:
418 if (!list_empty(&sbsec->isec_head)) {
419 struct inode_security_struct *isec =
420 list_entry(sbsec->isec_head.next,
421 struct inode_security_struct, list);
422 struct inode *inode = isec->inode;
423 spin_unlock(&sbsec->isec_lock);
424 inode = igrab(inode);
425 if (inode) {
426 if (!IS_PRIVATE(inode))
427 inode_doinit(inode);
428 iput(inode);
429 }
430 spin_lock(&sbsec->isec_lock);
431 list_del_init(&isec->list);
432 goto next_inode;
433 }
434 spin_unlock(&sbsec->isec_lock);
435 out:
436 return rc;
437 }
438
439 /*
440 * This function should allow an FS to ask what it's mount security
441 * options were so it can use those later for submounts, displaying
442 * mount options, or whatever.
443 */
444 static int selinux_get_mnt_opts(const struct super_block *sb,
445 struct security_mnt_opts *opts)
446 {
447 int rc = 0, i;
448 struct superblock_security_struct *sbsec = sb->s_security;
449 char *context = NULL;
450 u32 len;
451 char tmp;
452
453 security_init_mnt_opts(opts);
454
455 if (!sbsec->initialized)
456 return -EINVAL;
457
458 if (!ss_initialized)
459 return -EINVAL;
460
461 /*
462 * if we ever use sbsec flags for anything other than tracking mount
463 * settings this is going to need a mask
464 */
465 tmp = sbsec->flags;
466 /* count the number of mount options for this sb */
467 for (i = 0; i < 8; i++) {
468 if (tmp & 0x01)
469 opts->num_mnt_opts++;
470 tmp >>= 1;
471 }
472
473 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
474 if (!opts->mnt_opts) {
475 rc = -ENOMEM;
476 goto out_free;
477 }
478
479 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
480 if (!opts->mnt_opts_flags) {
481 rc = -ENOMEM;
482 goto out_free;
483 }
484
485 i = 0;
486 if (sbsec->flags & FSCONTEXT_MNT) {
487 rc = security_sid_to_context(sbsec->sid, &context, &len);
488 if (rc)
489 goto out_free;
490 opts->mnt_opts[i] = context;
491 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
492 }
493 if (sbsec->flags & CONTEXT_MNT) {
494 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
495 if (rc)
496 goto out_free;
497 opts->mnt_opts[i] = context;
498 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
499 }
500 if (sbsec->flags & DEFCONTEXT_MNT) {
501 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
502 if (rc)
503 goto out_free;
504 opts->mnt_opts[i] = context;
505 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
506 }
507 if (sbsec->flags & ROOTCONTEXT_MNT) {
508 struct inode *root = sbsec->sb->s_root->d_inode;
509 struct inode_security_struct *isec = root->i_security;
510
511 rc = security_sid_to_context(isec->sid, &context, &len);
512 if (rc)
513 goto out_free;
514 opts->mnt_opts[i] = context;
515 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
516 }
517
518 BUG_ON(i != opts->num_mnt_opts);
519
520 return 0;
521
522 out_free:
523 security_free_mnt_opts(opts);
524 return rc;
525 }
526
527 static int bad_option(struct superblock_security_struct *sbsec, char flag,
528 u32 old_sid, u32 new_sid)
529 {
530 /* check if the old mount command had the same options */
531 if (sbsec->initialized)
532 if (!(sbsec->flags & flag) ||
533 (old_sid != new_sid))
534 return 1;
535
536 /* check if we were passed the same options twice,
537 * aka someone passed context=a,context=b
538 */
539 if (!sbsec->initialized)
540 if (sbsec->flags & flag)
541 return 1;
542 return 0;
543 }
544
545 /*
546 * Allow filesystems with binary mount data to explicitly set mount point
547 * labeling information.
548 */
549 static int selinux_set_mnt_opts(struct super_block *sb,
550 struct security_mnt_opts *opts)
551 {
552 int rc = 0, i;
553 struct task_security_struct *tsec = current->security;
554 struct superblock_security_struct *sbsec = sb->s_security;
555 const char *name = sb->s_type->name;
556 struct inode *inode = sbsec->sb->s_root->d_inode;
557 struct inode_security_struct *root_isec = inode->i_security;
558 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
559 u32 defcontext_sid = 0;
560 char **mount_options = opts->mnt_opts;
561 int *flags = opts->mnt_opts_flags;
562 int num_opts = opts->num_mnt_opts;
563
564 mutex_lock(&sbsec->lock);
565
566 if (!ss_initialized) {
567 if (!num_opts) {
568 /* Defer initialization until selinux_complete_init,
569 after the initial policy is loaded and the security
570 server is ready to handle calls. */
571 spin_lock(&sb_security_lock);
572 if (list_empty(&sbsec->list))
573 list_add(&sbsec->list, &superblock_security_head);
574 spin_unlock(&sb_security_lock);
575 goto out;
576 }
577 rc = -EINVAL;
578 printk(KERN_WARNING "SELinux: Unable to set superblock options "
579 "before the security server is initialized\n");
580 goto out;
581 }
582
583 /*
584 * Binary mount data FS will come through this function twice. Once
585 * from an explicit call and once from the generic calls from the vfs.
586 * Since the generic VFS calls will not contain any security mount data
587 * we need to skip the double mount verification.
588 *
589 * This does open a hole in which we will not notice if the first
590 * mount using this sb set explict options and a second mount using
591 * this sb does not set any security options. (The first options
592 * will be used for both mounts)
593 */
594 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
595 && (num_opts == 0))
596 goto out;
597
598 /*
599 * parse the mount options, check if they are valid sids.
600 * also check if someone is trying to mount the same sb more
601 * than once with different security options.
602 */
603 for (i = 0; i < num_opts; i++) {
604 u32 sid;
605 rc = security_context_to_sid(mount_options[i],
606 strlen(mount_options[i]), &sid);
607 if (rc) {
608 printk(KERN_WARNING "SELinux: security_context_to_sid"
609 "(%s) failed for (dev %s, type %s) errno=%d\n",
610 mount_options[i], sb->s_id, name, rc);
611 goto out;
612 }
613 switch (flags[i]) {
614 case FSCONTEXT_MNT:
615 fscontext_sid = sid;
616
617 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
618 fscontext_sid))
619 goto out_double_mount;
620
621 sbsec->flags |= FSCONTEXT_MNT;
622 break;
623 case CONTEXT_MNT:
624 context_sid = sid;
625
626 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
627 context_sid))
628 goto out_double_mount;
629
630 sbsec->flags |= CONTEXT_MNT;
631 break;
632 case ROOTCONTEXT_MNT:
633 rootcontext_sid = sid;
634
635 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
636 rootcontext_sid))
637 goto out_double_mount;
638
639 sbsec->flags |= ROOTCONTEXT_MNT;
640
641 break;
642 case DEFCONTEXT_MNT:
643 defcontext_sid = sid;
644
645 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
646 defcontext_sid))
647 goto out_double_mount;
648
649 sbsec->flags |= DEFCONTEXT_MNT;
650
651 break;
652 default:
653 rc = -EINVAL;
654 goto out;
655 }
656 }
657
658 if (sbsec->initialized) {
659 /* previously mounted with options, but not on this attempt? */
660 if (sbsec->flags && !num_opts)
661 goto out_double_mount;
662 rc = 0;
663 goto out;
664 }
665
666 if (strcmp(sb->s_type->name, "proc") == 0)
667 sbsec->proc = 1;
668
669 /* Determine the labeling behavior to use for this filesystem type. */
670 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
671 if (rc) {
672 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
673 __func__, sb->s_type->name, rc);
674 goto out;
675 }
676
677 /* sets the context of the superblock for the fs being mounted. */
678 if (fscontext_sid) {
679
680 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
681 if (rc)
682 goto out;
683
684 sbsec->sid = fscontext_sid;
685 }
686
687 /*
688 * Switch to using mount point labeling behavior.
689 * sets the label used on all file below the mountpoint, and will set
690 * the superblock context if not already set.
691 */
692 if (context_sid) {
693 if (!fscontext_sid) {
694 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
695 if (rc)
696 goto out;
697 sbsec->sid = context_sid;
698 } else {
699 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
700 if (rc)
701 goto out;
702 }
703 if (!rootcontext_sid)
704 rootcontext_sid = context_sid;
705
706 sbsec->mntpoint_sid = context_sid;
707 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
708 }
709
710 if (rootcontext_sid) {
711 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
712 if (rc)
713 goto out;
714
715 root_isec->sid = rootcontext_sid;
716 root_isec->initialized = 1;
717 }
718
719 if (defcontext_sid) {
720 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
721 rc = -EINVAL;
722 printk(KERN_WARNING "SELinux: defcontext option is "
723 "invalid for this filesystem type\n");
724 goto out;
725 }
726
727 if (defcontext_sid != sbsec->def_sid) {
728 rc = may_context_mount_inode_relabel(defcontext_sid,
729 sbsec, tsec);
730 if (rc)
731 goto out;
732 }
733
734 sbsec->def_sid = defcontext_sid;
735 }
736
737 rc = sb_finish_set_opts(sb);
738 out:
739 mutex_unlock(&sbsec->lock);
740 return rc;
741 out_double_mount:
742 rc = -EINVAL;
743 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
744 "security settings for (dev %s, type %s)\n", sb->s_id, name);
745 goto out;
746 }
747
748 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
749 struct super_block *newsb)
750 {
751 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
752 struct superblock_security_struct *newsbsec = newsb->s_security;
753
754 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
755 int set_context = (oldsbsec->flags & CONTEXT_MNT);
756 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
757
758 /* we can't error, we can't save the info, this shouldn't get called
759 * this early in the boot process. */
760 BUG_ON(!ss_initialized);
761
762 /* how can we clone if the old one wasn't set up?? */
763 BUG_ON(!oldsbsec->initialized);
764
765 /* if fs is reusing a sb, just let its options stand... */
766 if (newsbsec->initialized)
767 return;
768
769 mutex_lock(&newsbsec->lock);
770
771 newsbsec->flags = oldsbsec->flags;
772
773 newsbsec->sid = oldsbsec->sid;
774 newsbsec->def_sid = oldsbsec->def_sid;
775 newsbsec->behavior = oldsbsec->behavior;
776
777 if (set_context) {
778 u32 sid = oldsbsec->mntpoint_sid;
779
780 if (!set_fscontext)
781 newsbsec->sid = sid;
782 if (!set_rootcontext) {
783 struct inode *newinode = newsb->s_root->d_inode;
784 struct inode_security_struct *newisec = newinode->i_security;
785 newisec->sid = sid;
786 }
787 newsbsec->mntpoint_sid = sid;
788 }
789 if (set_rootcontext) {
790 const struct inode *oldinode = oldsb->s_root->d_inode;
791 const struct inode_security_struct *oldisec = oldinode->i_security;
792 struct inode *newinode = newsb->s_root->d_inode;
793 struct inode_security_struct *newisec = newinode->i_security;
794
795 newisec->sid = oldisec->sid;
796 }
797
798 sb_finish_set_opts(newsb);
799 mutex_unlock(&newsbsec->lock);
800 }
801
802 static int selinux_parse_opts_str(char *options,
803 struct security_mnt_opts *opts)
804 {
805 char *p;
806 char *context = NULL, *defcontext = NULL;
807 char *fscontext = NULL, *rootcontext = NULL;
808 int rc, num_mnt_opts = 0;
809
810 opts->num_mnt_opts = 0;
811
812 /* Standard string-based options. */
813 while ((p = strsep(&options, "|")) != NULL) {
814 int token;
815 substring_t args[MAX_OPT_ARGS];
816
817 if (!*p)
818 continue;
819
820 token = match_token(p, tokens, args);
821
822 switch (token) {
823 case Opt_context:
824 if (context || defcontext) {
825 rc = -EINVAL;
826 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
827 goto out_err;
828 }
829 context = match_strdup(&args[0]);
830 if (!context) {
831 rc = -ENOMEM;
832 goto out_err;
833 }
834 break;
835
836 case Opt_fscontext:
837 if (fscontext) {
838 rc = -EINVAL;
839 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
840 goto out_err;
841 }
842 fscontext = match_strdup(&args[0]);
843 if (!fscontext) {
844 rc = -ENOMEM;
845 goto out_err;
846 }
847 break;
848
849 case Opt_rootcontext:
850 if (rootcontext) {
851 rc = -EINVAL;
852 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
853 goto out_err;
854 }
855 rootcontext = match_strdup(&args[0]);
856 if (!rootcontext) {
857 rc = -ENOMEM;
858 goto out_err;
859 }
860 break;
861
862 case Opt_defcontext:
863 if (context || defcontext) {
864 rc = -EINVAL;
865 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
866 goto out_err;
867 }
868 defcontext = match_strdup(&args[0]);
869 if (!defcontext) {
870 rc = -ENOMEM;
871 goto out_err;
872 }
873 break;
874
875 default:
876 rc = -EINVAL;
877 printk(KERN_WARNING "SELinux: unknown mount option\n");
878 goto out_err;
879
880 }
881 }
882
883 rc = -ENOMEM;
884 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
885 if (!opts->mnt_opts)
886 goto out_err;
887
888 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
889 if (!opts->mnt_opts_flags) {
890 kfree(opts->mnt_opts);
891 goto out_err;
892 }
893
894 if (fscontext) {
895 opts->mnt_opts[num_mnt_opts] = fscontext;
896 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
897 }
898 if (context) {
899 opts->mnt_opts[num_mnt_opts] = context;
900 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
901 }
902 if (rootcontext) {
903 opts->mnt_opts[num_mnt_opts] = rootcontext;
904 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
905 }
906 if (defcontext) {
907 opts->mnt_opts[num_mnt_opts] = defcontext;
908 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
909 }
910
911 opts->num_mnt_opts = num_mnt_opts;
912 return 0;
913
914 out_err:
915 kfree(context);
916 kfree(defcontext);
917 kfree(fscontext);
918 kfree(rootcontext);
919 return rc;
920 }
921 /*
922 * string mount options parsing and call set the sbsec
923 */
924 static int superblock_doinit(struct super_block *sb, void *data)
925 {
926 int rc = 0;
927 char *options = data;
928 struct security_mnt_opts opts;
929
930 security_init_mnt_opts(&opts);
931
932 if (!data)
933 goto out;
934
935 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
936
937 rc = selinux_parse_opts_str(options, &opts);
938 if (rc)
939 goto out_err;
940
941 out:
942 rc = selinux_set_mnt_opts(sb, &opts);
943
944 out_err:
945 security_free_mnt_opts(&opts);
946 return rc;
947 }
948
949 static inline u16 inode_mode_to_security_class(umode_t mode)
950 {
951 switch (mode & S_IFMT) {
952 case S_IFSOCK:
953 return SECCLASS_SOCK_FILE;
954 case S_IFLNK:
955 return SECCLASS_LNK_FILE;
956 case S_IFREG:
957 return SECCLASS_FILE;
958 case S_IFBLK:
959 return SECCLASS_BLK_FILE;
960 case S_IFDIR:
961 return SECCLASS_DIR;
962 case S_IFCHR:
963 return SECCLASS_CHR_FILE;
964 case S_IFIFO:
965 return SECCLASS_FIFO_FILE;
966
967 }
968
969 return SECCLASS_FILE;
970 }
971
972 static inline int default_protocol_stream(int protocol)
973 {
974 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
975 }
976
977 static inline int default_protocol_dgram(int protocol)
978 {
979 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
980 }
981
982 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
983 {
984 switch (family) {
985 case PF_UNIX:
986 switch (type) {
987 case SOCK_STREAM:
988 case SOCK_SEQPACKET:
989 return SECCLASS_UNIX_STREAM_SOCKET;
990 case SOCK_DGRAM:
991 return SECCLASS_UNIX_DGRAM_SOCKET;
992 }
993 break;
994 case PF_INET:
995 case PF_INET6:
996 switch (type) {
997 case SOCK_STREAM:
998 if (default_protocol_stream(protocol))
999 return SECCLASS_TCP_SOCKET;
1000 else
1001 return SECCLASS_RAWIP_SOCKET;
1002 case SOCK_DGRAM:
1003 if (default_protocol_dgram(protocol))
1004 return SECCLASS_UDP_SOCKET;
1005 else
1006 return SECCLASS_RAWIP_SOCKET;
1007 case SOCK_DCCP:
1008 return SECCLASS_DCCP_SOCKET;
1009 default:
1010 return SECCLASS_RAWIP_SOCKET;
1011 }
1012 break;
1013 case PF_NETLINK:
1014 switch (protocol) {
1015 case NETLINK_ROUTE:
1016 return SECCLASS_NETLINK_ROUTE_SOCKET;
1017 case NETLINK_FIREWALL:
1018 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1019 case NETLINK_INET_DIAG:
1020 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1021 case NETLINK_NFLOG:
1022 return SECCLASS_NETLINK_NFLOG_SOCKET;
1023 case NETLINK_XFRM:
1024 return SECCLASS_NETLINK_XFRM_SOCKET;
1025 case NETLINK_SELINUX:
1026 return SECCLASS_NETLINK_SELINUX_SOCKET;
1027 case NETLINK_AUDIT:
1028 return SECCLASS_NETLINK_AUDIT_SOCKET;
1029 case NETLINK_IP6_FW:
1030 return SECCLASS_NETLINK_IP6FW_SOCKET;
1031 case NETLINK_DNRTMSG:
1032 return SECCLASS_NETLINK_DNRT_SOCKET;
1033 case NETLINK_KOBJECT_UEVENT:
1034 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1035 default:
1036 return SECCLASS_NETLINK_SOCKET;
1037 }
1038 case PF_PACKET:
1039 return SECCLASS_PACKET_SOCKET;
1040 case PF_KEY:
1041 return SECCLASS_KEY_SOCKET;
1042 case PF_APPLETALK:
1043 return SECCLASS_APPLETALK_SOCKET;
1044 }
1045
1046 return SECCLASS_SOCKET;
1047 }
1048
1049 #ifdef CONFIG_PROC_FS
1050 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1051 u16 tclass,
1052 u32 *sid)
1053 {
1054 int buflen, rc;
1055 char *buffer, *path, *end;
1056
1057 buffer = (char*)__get_free_page(GFP_KERNEL);
1058 if (!buffer)
1059 return -ENOMEM;
1060
1061 buflen = PAGE_SIZE;
1062 end = buffer+buflen;
1063 *--end = '\0';
1064 buflen--;
1065 path = end-1;
1066 *path = '/';
1067 while (de && de != de->parent) {
1068 buflen -= de->namelen + 1;
1069 if (buflen < 0)
1070 break;
1071 end -= de->namelen;
1072 memcpy(end, de->name, de->namelen);
1073 *--end = '/';
1074 path = end;
1075 de = de->parent;
1076 }
1077 rc = security_genfs_sid("proc", path, tclass, sid);
1078 free_page((unsigned long)buffer);
1079 return rc;
1080 }
1081 #else
1082 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1083 u16 tclass,
1084 u32 *sid)
1085 {
1086 return -EINVAL;
1087 }
1088 #endif
1089
1090 /* The inode's security attributes must be initialized before first use. */
1091 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1092 {
1093 struct superblock_security_struct *sbsec = NULL;
1094 struct inode_security_struct *isec = inode->i_security;
1095 u32 sid;
1096 struct dentry *dentry;
1097 #define INITCONTEXTLEN 255
1098 char *context = NULL;
1099 unsigned len = 0;
1100 int rc = 0;
1101
1102 if (isec->initialized)
1103 goto out;
1104
1105 mutex_lock(&isec->lock);
1106 if (isec->initialized)
1107 goto out_unlock;
1108
1109 sbsec = inode->i_sb->s_security;
1110 if (!sbsec->initialized) {
1111 /* Defer initialization until selinux_complete_init,
1112 after the initial policy is loaded and the security
1113 server is ready to handle calls. */
1114 spin_lock(&sbsec->isec_lock);
1115 if (list_empty(&isec->list))
1116 list_add(&isec->list, &sbsec->isec_head);
1117 spin_unlock(&sbsec->isec_lock);
1118 goto out_unlock;
1119 }
1120
1121 switch (sbsec->behavior) {
1122 case SECURITY_FS_USE_XATTR:
1123 if (!inode->i_op->getxattr) {
1124 isec->sid = sbsec->def_sid;
1125 break;
1126 }
1127
1128 /* Need a dentry, since the xattr API requires one.
1129 Life would be simpler if we could just pass the inode. */
1130 if (opt_dentry) {
1131 /* Called from d_instantiate or d_splice_alias. */
1132 dentry = dget(opt_dentry);
1133 } else {
1134 /* Called from selinux_complete_init, try to find a dentry. */
1135 dentry = d_find_alias(inode);
1136 }
1137 if (!dentry) {
1138 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
1139 "ino=%ld\n", __func__, inode->i_sb->s_id,
1140 inode->i_ino);
1141 goto out_unlock;
1142 }
1143
1144 len = INITCONTEXTLEN;
1145 context = kmalloc(len, GFP_NOFS);
1146 if (!context) {
1147 rc = -ENOMEM;
1148 dput(dentry);
1149 goto out_unlock;
1150 }
1151 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1152 context, len);
1153 if (rc == -ERANGE) {
1154 /* Need a larger buffer. Query for the right size. */
1155 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1156 NULL, 0);
1157 if (rc < 0) {
1158 dput(dentry);
1159 goto out_unlock;
1160 }
1161 kfree(context);
1162 len = rc;
1163 context = kmalloc(len, GFP_NOFS);
1164 if (!context) {
1165 rc = -ENOMEM;
1166 dput(dentry);
1167 goto out_unlock;
1168 }
1169 rc = inode->i_op->getxattr(dentry,
1170 XATTR_NAME_SELINUX,
1171 context, len);
1172 }
1173 dput(dentry);
1174 if (rc < 0) {
1175 if (rc != -ENODATA) {
1176 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1177 "%d for dev=%s ino=%ld\n", __func__,
1178 -rc, inode->i_sb->s_id, inode->i_ino);
1179 kfree(context);
1180 goto out_unlock;
1181 }
1182 /* Map ENODATA to the default file SID */
1183 sid = sbsec->def_sid;
1184 rc = 0;
1185 } else {
1186 rc = security_context_to_sid_default(context, rc, &sid,
1187 sbsec->def_sid,
1188 GFP_NOFS);
1189 if (rc) {
1190 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1191 "returned %d for dev=%s ino=%ld\n",
1192 __func__, context, -rc,
1193 inode->i_sb->s_id, inode->i_ino);
1194 kfree(context);
1195 /* Leave with the unlabeled SID */
1196 rc = 0;
1197 break;
1198 }
1199 }
1200 kfree(context);
1201 isec->sid = sid;
1202 break;
1203 case SECURITY_FS_USE_TASK:
1204 isec->sid = isec->task_sid;
1205 break;
1206 case SECURITY_FS_USE_TRANS:
1207 /* Default to the fs SID. */
1208 isec->sid = sbsec->sid;
1209
1210 /* Try to obtain a transition SID. */
1211 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1212 rc = security_transition_sid(isec->task_sid,
1213 sbsec->sid,
1214 isec->sclass,
1215 &sid);
1216 if (rc)
1217 goto out_unlock;
1218 isec->sid = sid;
1219 break;
1220 case SECURITY_FS_USE_MNTPOINT:
1221 isec->sid = sbsec->mntpoint_sid;
1222 break;
1223 default:
1224 /* Default to the fs superblock SID. */
1225 isec->sid = sbsec->sid;
1226
1227 if (sbsec->proc) {
1228 struct proc_inode *proci = PROC_I(inode);
1229 if (proci->pde) {
1230 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1231 rc = selinux_proc_get_sid(proci->pde,
1232 isec->sclass,
1233 &sid);
1234 if (rc)
1235 goto out_unlock;
1236 isec->sid = sid;
1237 }
1238 }
1239 break;
1240 }
1241
1242 isec->initialized = 1;
1243
1244 out_unlock:
1245 mutex_unlock(&isec->lock);
1246 out:
1247 if (isec->sclass == SECCLASS_FILE)
1248 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1249 return rc;
1250 }
1251
1252 /* Convert a Linux signal to an access vector. */
1253 static inline u32 signal_to_av(int sig)
1254 {
1255 u32 perm = 0;
1256
1257 switch (sig) {
1258 case SIGCHLD:
1259 /* Commonly granted from child to parent. */
1260 perm = PROCESS__SIGCHLD;
1261 break;
1262 case SIGKILL:
1263 /* Cannot be caught or ignored */
1264 perm = PROCESS__SIGKILL;
1265 break;
1266 case SIGSTOP:
1267 /* Cannot be caught or ignored */
1268 perm = PROCESS__SIGSTOP;
1269 break;
1270 default:
1271 /* All other signals. */
1272 perm = PROCESS__SIGNAL;
1273 break;
1274 }
1275
1276 return perm;
1277 }
1278
1279 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1280 fork check, ptrace check, etc. */
1281 static int task_has_perm(struct task_struct *tsk1,
1282 struct task_struct *tsk2,
1283 u32 perms)
1284 {
1285 struct task_security_struct *tsec1, *tsec2;
1286
1287 tsec1 = tsk1->security;
1288 tsec2 = tsk2->security;
1289 return avc_has_perm(tsec1->sid, tsec2->sid,
1290 SECCLASS_PROCESS, perms, NULL);
1291 }
1292
1293 #if CAP_LAST_CAP > 63
1294 #error Fix SELinux to handle capabilities > 63.
1295 #endif
1296
1297 /* Check whether a task is allowed to use a capability. */
1298 static int task_has_capability(struct task_struct *tsk,
1299 int cap)
1300 {
1301 struct task_security_struct *tsec;
1302 struct avc_audit_data ad;
1303 u16 sclass;
1304 u32 av = CAP_TO_MASK(cap);
1305
1306 tsec = tsk->security;
1307
1308 AVC_AUDIT_DATA_INIT(&ad,CAP);
1309 ad.tsk = tsk;
1310 ad.u.cap = cap;
1311
1312 switch (CAP_TO_INDEX(cap)) {
1313 case 0:
1314 sclass = SECCLASS_CAPABILITY;
1315 break;
1316 case 1:
1317 sclass = SECCLASS_CAPABILITY2;
1318 break;
1319 default:
1320 printk(KERN_ERR
1321 "SELinux: out of range capability %d\n", cap);
1322 BUG();
1323 }
1324 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1325 }
1326
1327 /* Check whether a task is allowed to use a system operation. */
1328 static int task_has_system(struct task_struct *tsk,
1329 u32 perms)
1330 {
1331 struct task_security_struct *tsec;
1332
1333 tsec = tsk->security;
1334
1335 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1336 SECCLASS_SYSTEM, perms, NULL);
1337 }
1338
1339 /* Check whether a task has a particular permission to an inode.
1340 The 'adp' parameter is optional and allows other audit
1341 data to be passed (e.g. the dentry). */
1342 static int inode_has_perm(struct task_struct *tsk,
1343 struct inode *inode,
1344 u32 perms,
1345 struct avc_audit_data *adp)
1346 {
1347 struct task_security_struct *tsec;
1348 struct inode_security_struct *isec;
1349 struct avc_audit_data ad;
1350
1351 if (unlikely (IS_PRIVATE (inode)))
1352 return 0;
1353
1354 tsec = tsk->security;
1355 isec = inode->i_security;
1356
1357 if (!adp) {
1358 adp = &ad;
1359 AVC_AUDIT_DATA_INIT(&ad, FS);
1360 ad.u.fs.inode = inode;
1361 }
1362
1363 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1364 }
1365
1366 /* Same as inode_has_perm, but pass explicit audit data containing
1367 the dentry to help the auditing code to more easily generate the
1368 pathname if needed. */
1369 static inline int dentry_has_perm(struct task_struct *tsk,
1370 struct vfsmount *mnt,
1371 struct dentry *dentry,
1372 u32 av)
1373 {
1374 struct inode *inode = dentry->d_inode;
1375 struct avc_audit_data ad;
1376 AVC_AUDIT_DATA_INIT(&ad,FS);
1377 ad.u.fs.path.mnt = mnt;
1378 ad.u.fs.path.dentry = dentry;
1379 return inode_has_perm(tsk, inode, av, &ad);
1380 }
1381
1382 /* Check whether a task can use an open file descriptor to
1383 access an inode in a given way. Check access to the
1384 descriptor itself, and then use dentry_has_perm to
1385 check a particular permission to the file.
1386 Access to the descriptor is implicitly granted if it
1387 has the same SID as the process. If av is zero, then
1388 access to the file is not checked, e.g. for cases
1389 where only the descriptor is affected like seek. */
1390 static int file_has_perm(struct task_struct *tsk,
1391 struct file *file,
1392 u32 av)
1393 {
1394 struct task_security_struct *tsec = tsk->security;
1395 struct file_security_struct *fsec = file->f_security;
1396 struct inode *inode = file->f_path.dentry->d_inode;
1397 struct avc_audit_data ad;
1398 int rc;
1399
1400 AVC_AUDIT_DATA_INIT(&ad, FS);
1401 ad.u.fs.path = file->f_path;
1402
1403 if (tsec->sid != fsec->sid) {
1404 rc = avc_has_perm(tsec->sid, fsec->sid,
1405 SECCLASS_FD,
1406 FD__USE,
1407 &ad);
1408 if (rc)
1409 return rc;
1410 }
1411
1412 /* av is zero if only checking access to the descriptor. */
1413 if (av)
1414 return inode_has_perm(tsk, inode, av, &ad);
1415
1416 return 0;
1417 }
1418
1419 /* Check whether a task can create a file. */
1420 static int may_create(struct inode *dir,
1421 struct dentry *dentry,
1422 u16 tclass)
1423 {
1424 struct task_security_struct *tsec;
1425 struct inode_security_struct *dsec;
1426 struct superblock_security_struct *sbsec;
1427 u32 newsid;
1428 struct avc_audit_data ad;
1429 int rc;
1430
1431 tsec = current->security;
1432 dsec = dir->i_security;
1433 sbsec = dir->i_sb->s_security;
1434
1435 AVC_AUDIT_DATA_INIT(&ad, FS);
1436 ad.u.fs.path.dentry = dentry;
1437
1438 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1439 DIR__ADD_NAME | DIR__SEARCH,
1440 &ad);
1441 if (rc)
1442 return rc;
1443
1444 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1445 newsid = tsec->create_sid;
1446 } else {
1447 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1448 &newsid);
1449 if (rc)
1450 return rc;
1451 }
1452
1453 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1454 if (rc)
1455 return rc;
1456
1457 return avc_has_perm(newsid, sbsec->sid,
1458 SECCLASS_FILESYSTEM,
1459 FILESYSTEM__ASSOCIATE, &ad);
1460 }
1461
1462 /* Check whether a task can create a key. */
1463 static int may_create_key(u32 ksid,
1464 struct task_struct *ctx)
1465 {
1466 struct task_security_struct *tsec;
1467
1468 tsec = ctx->security;
1469
1470 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1471 }
1472
1473 #define MAY_LINK 0
1474 #define MAY_UNLINK 1
1475 #define MAY_RMDIR 2
1476
1477 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1478 static int may_link(struct inode *dir,
1479 struct dentry *dentry,
1480 int kind)
1481
1482 {
1483 struct task_security_struct *tsec;
1484 struct inode_security_struct *dsec, *isec;
1485 struct avc_audit_data ad;
1486 u32 av;
1487 int rc;
1488
1489 tsec = current->security;
1490 dsec = dir->i_security;
1491 isec = dentry->d_inode->i_security;
1492
1493 AVC_AUDIT_DATA_INIT(&ad, FS);
1494 ad.u.fs.path.dentry = dentry;
1495
1496 av = DIR__SEARCH;
1497 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1498 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1499 if (rc)
1500 return rc;
1501
1502 switch (kind) {
1503 case MAY_LINK:
1504 av = FILE__LINK;
1505 break;
1506 case MAY_UNLINK:
1507 av = FILE__UNLINK;
1508 break;
1509 case MAY_RMDIR:
1510 av = DIR__RMDIR;
1511 break;
1512 default:
1513 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1514 __func__, kind);
1515 return 0;
1516 }
1517
1518 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1519 return rc;
1520 }
1521
1522 static inline int may_rename(struct inode *old_dir,
1523 struct dentry *old_dentry,
1524 struct inode *new_dir,
1525 struct dentry *new_dentry)
1526 {
1527 struct task_security_struct *tsec;
1528 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1529 struct avc_audit_data ad;
1530 u32 av;
1531 int old_is_dir, new_is_dir;
1532 int rc;
1533
1534 tsec = current->security;
1535 old_dsec = old_dir->i_security;
1536 old_isec = old_dentry->d_inode->i_security;
1537 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1538 new_dsec = new_dir->i_security;
1539
1540 AVC_AUDIT_DATA_INIT(&ad, FS);
1541
1542 ad.u.fs.path.dentry = old_dentry;
1543 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1544 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1545 if (rc)
1546 return rc;
1547 rc = avc_has_perm(tsec->sid, old_isec->sid,
1548 old_isec->sclass, FILE__RENAME, &ad);
1549 if (rc)
1550 return rc;
1551 if (old_is_dir && new_dir != old_dir) {
1552 rc = avc_has_perm(tsec->sid, old_isec->sid,
1553 old_isec->sclass, DIR__REPARENT, &ad);
1554 if (rc)
1555 return rc;
1556 }
1557
1558 ad.u.fs.path.dentry = new_dentry;
1559 av = DIR__ADD_NAME | DIR__SEARCH;
1560 if (new_dentry->d_inode)
1561 av |= DIR__REMOVE_NAME;
1562 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1563 if (rc)
1564 return rc;
1565 if (new_dentry->d_inode) {
1566 new_isec = new_dentry->d_inode->i_security;
1567 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1568 rc = avc_has_perm(tsec->sid, new_isec->sid,
1569 new_isec->sclass,
1570 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1571 if (rc)
1572 return rc;
1573 }
1574
1575 return 0;
1576 }
1577
1578 /* Check whether a task can perform a filesystem operation. */
1579 static int superblock_has_perm(struct task_struct *tsk,
1580 struct super_block *sb,
1581 u32 perms,
1582 struct avc_audit_data *ad)
1583 {
1584 struct task_security_struct *tsec;
1585 struct superblock_security_struct *sbsec;
1586
1587 tsec = tsk->security;
1588 sbsec = sb->s_security;
1589 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1590 perms, ad);
1591 }
1592
1593 /* Convert a Linux mode and permission mask to an access vector. */
1594 static inline u32 file_mask_to_av(int mode, int mask)
1595 {
1596 u32 av = 0;
1597
1598 if ((mode & S_IFMT) != S_IFDIR) {
1599 if (mask & MAY_EXEC)
1600 av |= FILE__EXECUTE;
1601 if (mask & MAY_READ)
1602 av |= FILE__READ;
1603
1604 if (mask & MAY_APPEND)
1605 av |= FILE__APPEND;
1606 else if (mask & MAY_WRITE)
1607 av |= FILE__WRITE;
1608
1609 } else {
1610 if (mask & MAY_EXEC)
1611 av |= DIR__SEARCH;
1612 if (mask & MAY_WRITE)
1613 av |= DIR__WRITE;
1614 if (mask & MAY_READ)
1615 av |= DIR__READ;
1616 }
1617
1618 return av;
1619 }
1620
1621 /*
1622 * Convert a file mask to an access vector and include the correct open
1623 * open permission.
1624 */
1625 static inline u32 open_file_mask_to_av(int mode, int mask)
1626 {
1627 u32 av = file_mask_to_av(mode, mask);
1628
1629 if (selinux_policycap_openperm) {
1630 /*
1631 * lnk files and socks do not really have an 'open'
1632 */
1633 if (S_ISREG(mode))
1634 av |= FILE__OPEN;
1635 else if (S_ISCHR(mode))
1636 av |= CHR_FILE__OPEN;
1637 else if (S_ISBLK(mode))
1638 av |= BLK_FILE__OPEN;
1639 else if (S_ISFIFO(mode))
1640 av |= FIFO_FILE__OPEN;
1641 else if (S_ISDIR(mode))
1642 av |= DIR__OPEN;
1643 else
1644 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1645 "unknown mode:%x\n", __func__, mode);
1646 }
1647 return av;
1648 }
1649
1650 /* Convert a Linux file to an access vector. */
1651 static inline u32 file_to_av(struct file *file)
1652 {
1653 u32 av = 0;
1654
1655 if (file->f_mode & FMODE_READ)
1656 av |= FILE__READ;
1657 if (file->f_mode & FMODE_WRITE) {
1658 if (file->f_flags & O_APPEND)
1659 av |= FILE__APPEND;
1660 else
1661 av |= FILE__WRITE;
1662 }
1663 if (!av) {
1664 /*
1665 * Special file opened with flags 3 for ioctl-only use.
1666 */
1667 av = FILE__IOCTL;
1668 }
1669
1670 return av;
1671 }
1672
1673 /* Hook functions begin here. */
1674
1675 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1676 {
1677 int rc;
1678
1679 rc = secondary_ops->ptrace(parent,child);
1680 if (rc)
1681 return rc;
1682
1683 return task_has_perm(parent, child, PROCESS__PTRACE);
1684 }
1685
1686 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1687 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1688 {
1689 int error;
1690
1691 error = task_has_perm(current, target, PROCESS__GETCAP);
1692 if (error)
1693 return error;
1694
1695 return secondary_ops->capget(target, effective, inheritable, permitted);
1696 }
1697
1698 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1699 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1700 {
1701 int error;
1702
1703 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1704 if (error)
1705 return error;
1706
1707 return task_has_perm(current, target, PROCESS__SETCAP);
1708 }
1709
1710 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1711 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1712 {
1713 secondary_ops->capset_set(target, effective, inheritable, permitted);
1714 }
1715
1716 static int selinux_capable(struct task_struct *tsk, int cap)
1717 {
1718 int rc;
1719
1720 rc = secondary_ops->capable(tsk, cap);
1721 if (rc)
1722 return rc;
1723
1724 return task_has_capability(tsk,cap);
1725 }
1726
1727 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1728 {
1729 int buflen, rc;
1730 char *buffer, *path, *end;
1731
1732 rc = -ENOMEM;
1733 buffer = (char*)__get_free_page(GFP_KERNEL);
1734 if (!buffer)
1735 goto out;
1736
1737 buflen = PAGE_SIZE;
1738 end = buffer+buflen;
1739 *--end = '\0';
1740 buflen--;
1741 path = end-1;
1742 *path = '/';
1743 while (table) {
1744 const char *name = table->procname;
1745 size_t namelen = strlen(name);
1746 buflen -= namelen + 1;
1747 if (buflen < 0)
1748 goto out_free;
1749 end -= namelen;
1750 memcpy(end, name, namelen);
1751 *--end = '/';
1752 path = end;
1753 table = table->parent;
1754 }
1755 buflen -= 4;
1756 if (buflen < 0)
1757 goto out_free;
1758 end -= 4;
1759 memcpy(end, "/sys", 4);
1760 path = end;
1761 rc = security_genfs_sid("proc", path, tclass, sid);
1762 out_free:
1763 free_page((unsigned long)buffer);
1764 out:
1765 return rc;
1766 }
1767
1768 static int selinux_sysctl(ctl_table *table, int op)
1769 {
1770 int error = 0;
1771 u32 av;
1772 struct task_security_struct *tsec;
1773 u32 tsid;
1774 int rc;
1775
1776 rc = secondary_ops->sysctl(table, op);
1777 if (rc)
1778 return rc;
1779
1780 tsec = current->security;
1781
1782 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1783 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1784 if (rc) {
1785 /* Default to the well-defined sysctl SID. */
1786 tsid = SECINITSID_SYSCTL;
1787 }
1788
1789 /* The op values are "defined" in sysctl.c, thereby creating
1790 * a bad coupling between this module and sysctl.c */
1791 if(op == 001) {
1792 error = avc_has_perm(tsec->sid, tsid,
1793 SECCLASS_DIR, DIR__SEARCH, NULL);
1794 } else {
1795 av = 0;
1796 if (op & 004)
1797 av |= FILE__READ;
1798 if (op & 002)
1799 av |= FILE__WRITE;
1800 if (av)
1801 error = avc_has_perm(tsec->sid, tsid,
1802 SECCLASS_FILE, av, NULL);
1803 }
1804
1805 return error;
1806 }
1807
1808 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1809 {
1810 int rc = 0;
1811
1812 if (!sb)
1813 return 0;
1814
1815 switch (cmds) {
1816 case Q_SYNC:
1817 case Q_QUOTAON:
1818 case Q_QUOTAOFF:
1819 case Q_SETINFO:
1820 case Q_SETQUOTA:
1821 rc = superblock_has_perm(current,
1822 sb,
1823 FILESYSTEM__QUOTAMOD, NULL);
1824 break;
1825 case Q_GETFMT:
1826 case Q_GETINFO:
1827 case Q_GETQUOTA:
1828 rc = superblock_has_perm(current,
1829 sb,
1830 FILESYSTEM__QUOTAGET, NULL);
1831 break;
1832 default:
1833 rc = 0; /* let the kernel handle invalid cmds */
1834 break;
1835 }
1836 return rc;
1837 }
1838
1839 static int selinux_quota_on(struct dentry *dentry)
1840 {
1841 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1842 }
1843
1844 static int selinux_syslog(int type)
1845 {
1846 int rc;
1847
1848 rc = secondary_ops->syslog(type);
1849 if (rc)
1850 return rc;
1851
1852 switch (type) {
1853 case 3: /* Read last kernel messages */
1854 case 10: /* Return size of the log buffer */
1855 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1856 break;
1857 case 6: /* Disable logging to console */
1858 case 7: /* Enable logging to console */
1859 case 8: /* Set level of messages printed to console */
1860 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1861 break;
1862 case 0: /* Close log */
1863 case 1: /* Open log */
1864 case 2: /* Read from log */
1865 case 4: /* Read/clear last kernel messages */
1866 case 5: /* Clear ring buffer */
1867 default:
1868 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1869 break;
1870 }
1871 return rc;
1872 }
1873
1874 /*
1875 * Check that a process has enough memory to allocate a new virtual
1876 * mapping. 0 means there is enough memory for the allocation to
1877 * succeed and -ENOMEM implies there is not.
1878 *
1879 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1880 * if the capability is granted, but __vm_enough_memory requires 1 if
1881 * the capability is granted.
1882 *
1883 * Do not audit the selinux permission check, as this is applied to all
1884 * processes that allocate mappings.
1885 */
1886 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1887 {
1888 int rc, cap_sys_admin = 0;
1889 struct task_security_struct *tsec = current->security;
1890
1891 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1892 if (rc == 0)
1893 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1894 SECCLASS_CAPABILITY,
1895 CAP_TO_MASK(CAP_SYS_ADMIN),
1896 0,
1897 NULL);
1898
1899 if (rc == 0)
1900 cap_sys_admin = 1;
1901
1902 return __vm_enough_memory(mm, pages, cap_sys_admin);
1903 }
1904
1905 /**
1906 * task_tracer_task - return the task that is tracing the given task
1907 * @task: task to consider
1908 *
1909 * Returns NULL if noone is tracing @task, or the &struct task_struct
1910 * pointer to its tracer.
1911 *
1912 * Must be called under rcu_read_lock().
1913 */
1914 static struct task_struct *task_tracer_task(struct task_struct *task)
1915 {
1916 if (task->ptrace & PT_PTRACED)
1917 return rcu_dereference(task->parent);
1918 return NULL;
1919 }
1920
1921 /* binprm security operations */
1922
1923 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1924 {
1925 struct bprm_security_struct *bsec;
1926
1927 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1928 if (!bsec)
1929 return -ENOMEM;
1930
1931 bsec->sid = SECINITSID_UNLABELED;
1932 bsec->set = 0;
1933
1934 bprm->security = bsec;
1935 return 0;
1936 }
1937
1938 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1939 {
1940 struct task_security_struct *tsec;
1941 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1942 struct inode_security_struct *isec;
1943 struct bprm_security_struct *bsec;
1944 u32 newsid;
1945 struct avc_audit_data ad;
1946 int rc;
1947
1948 rc = secondary_ops->bprm_set_security(bprm);
1949 if (rc)
1950 return rc;
1951
1952 bsec = bprm->security;
1953
1954 if (bsec->set)
1955 return 0;
1956
1957 tsec = current->security;
1958 isec = inode->i_security;
1959
1960 /* Default to the current task SID. */
1961 bsec->sid = tsec->sid;
1962
1963 /* Reset fs, key, and sock SIDs on execve. */
1964 tsec->create_sid = 0;
1965 tsec->keycreate_sid = 0;
1966 tsec->sockcreate_sid = 0;
1967
1968 if (tsec->exec_sid) {
1969 newsid = tsec->exec_sid;
1970 /* Reset exec SID on execve. */
1971 tsec->exec_sid = 0;
1972 } else {
1973 /* Check for a default transition on this program. */
1974 rc = security_transition_sid(tsec->sid, isec->sid,
1975 SECCLASS_PROCESS, &newsid);
1976 if (rc)
1977 return rc;
1978 }
1979
1980 AVC_AUDIT_DATA_INIT(&ad, FS);
1981 ad.u.fs.path = bprm->file->f_path;
1982
1983 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1984 newsid = tsec->sid;
1985
1986 if (tsec->sid == newsid) {
1987 rc = avc_has_perm(tsec->sid, isec->sid,
1988 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1989 if (rc)
1990 return rc;
1991 } else {
1992 /* Check permissions for the transition. */
1993 rc = avc_has_perm(tsec->sid, newsid,
1994 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1995 if (rc)
1996 return rc;
1997
1998 rc = avc_has_perm(newsid, isec->sid,
1999 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2000 if (rc)
2001 return rc;
2002
2003 /* Clear any possibly unsafe personality bits on exec: */
2004 current->personality &= ~PER_CLEAR_ON_SETID;
2005
2006 /* Set the security field to the new SID. */
2007 bsec->sid = newsid;
2008 }
2009
2010 bsec->set = 1;
2011 return 0;
2012 }
2013
2014 static int selinux_bprm_check_security (struct linux_binprm *bprm)
2015 {
2016 return secondary_ops->bprm_check_security(bprm);
2017 }
2018
2019
2020 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
2021 {
2022 struct task_security_struct *tsec = current->security;
2023 int atsecure = 0;
2024
2025 if (tsec->osid != tsec->sid) {
2026 /* Enable secure mode for SIDs transitions unless
2027 the noatsecure permission is granted between
2028 the two SIDs, i.e. ahp returns 0. */
2029 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2030 SECCLASS_PROCESS,
2031 PROCESS__NOATSECURE, NULL);
2032 }
2033
2034 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2035 }
2036
2037 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2038 {
2039 kfree(bprm->security);
2040 bprm->security = NULL;
2041 }
2042
2043 extern struct vfsmount *selinuxfs_mount;
2044 extern struct dentry *selinux_null;
2045
2046 /* Derived from fs/exec.c:flush_old_files. */
2047 static inline void flush_unauthorized_files(struct files_struct * files)
2048 {
2049 struct avc_audit_data ad;
2050 struct file *file, *devnull = NULL;
2051 struct tty_struct *tty;
2052 struct fdtable *fdt;
2053 long j = -1;
2054 int drop_tty = 0;
2055
2056 mutex_lock(&tty_mutex);
2057 tty = get_current_tty();
2058 if (tty) {
2059 file_list_lock();
2060 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2061 if (file) {
2062 /* Revalidate access to controlling tty.
2063 Use inode_has_perm on the tty inode directly rather
2064 than using file_has_perm, as this particular open
2065 file may belong to another process and we are only
2066 interested in the inode-based check here. */
2067 struct inode *inode = file->f_path.dentry->d_inode;
2068 if (inode_has_perm(current, inode,
2069 FILE__READ | FILE__WRITE, NULL)) {
2070 drop_tty = 1;
2071 }
2072 }
2073 file_list_unlock();
2074 }
2075 mutex_unlock(&tty_mutex);
2076 /* Reset controlling tty. */
2077 if (drop_tty)
2078 no_tty();
2079
2080 /* Revalidate access to inherited open files. */
2081
2082 AVC_AUDIT_DATA_INIT(&ad,FS);
2083
2084 spin_lock(&files->file_lock);
2085 for (;;) {
2086 unsigned long set, i;
2087 int fd;
2088
2089 j++;
2090 i = j * __NFDBITS;
2091 fdt = files_fdtable(files);
2092 if (i >= fdt->max_fds)
2093 break;
2094 set = fdt->open_fds->fds_bits[j];
2095 if (!set)
2096 continue;
2097 spin_unlock(&files->file_lock);
2098 for ( ; set ; i++,set >>= 1) {
2099 if (set & 1) {
2100 file = fget(i);
2101 if (!file)
2102 continue;
2103 if (file_has_perm(current,
2104 file,
2105 file_to_av(file))) {
2106 sys_close(i);
2107 fd = get_unused_fd();
2108 if (fd != i) {
2109 if (fd >= 0)
2110 put_unused_fd(fd);
2111 fput(file);
2112 continue;
2113 }
2114 if (devnull) {
2115 get_file(devnull);
2116 } else {
2117 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2118 if (IS_ERR(devnull)) {
2119 devnull = NULL;
2120 put_unused_fd(fd);
2121 fput(file);
2122 continue;
2123 }
2124 }
2125 fd_install(fd, devnull);
2126 }
2127 fput(file);
2128 }
2129 }
2130 spin_lock(&files->file_lock);
2131
2132 }
2133 spin_unlock(&files->file_lock);
2134 }
2135
2136 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2137 {
2138 struct task_security_struct *tsec;
2139 struct bprm_security_struct *bsec;
2140 u32 sid;
2141 int rc;
2142
2143 secondary_ops->bprm_apply_creds(bprm, unsafe);
2144
2145 tsec = current->security;
2146
2147 bsec = bprm->security;
2148 sid = bsec->sid;
2149
2150 tsec->osid = tsec->sid;
2151 bsec->unsafe = 0;
2152 if (tsec->sid != sid) {
2153 /* Check for shared state. If not ok, leave SID
2154 unchanged and kill. */
2155 if (unsafe & LSM_UNSAFE_SHARE) {
2156 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2157 PROCESS__SHARE, NULL);
2158 if (rc) {
2159 bsec->unsafe = 1;
2160 return;
2161 }
2162 }
2163
2164 /* Check for ptracing, and update the task SID if ok.
2165 Otherwise, leave SID unchanged and kill. */
2166 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2167 struct task_struct *tracer;
2168 struct task_security_struct *sec;
2169 u32 ptsid = 0;
2170
2171 rcu_read_lock();
2172 tracer = task_tracer_task(current);
2173 if (likely(tracer != NULL)) {
2174 sec = tracer->security;
2175 ptsid = sec->sid;
2176 }
2177 rcu_read_unlock();
2178
2179 if (ptsid != 0) {
2180 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2181 PROCESS__PTRACE, NULL);
2182 if (rc) {
2183 bsec->unsafe = 1;
2184 return;
2185 }
2186 }
2187 }
2188 tsec->sid = sid;
2189 }
2190 }
2191
2192 /*
2193 * called after apply_creds without the task lock held
2194 */
2195 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2196 {
2197 struct task_security_struct *tsec;
2198 struct rlimit *rlim, *initrlim;
2199 struct itimerval itimer;
2200 struct bprm_security_struct *bsec;
2201 int rc, i;
2202
2203 tsec = current->security;
2204 bsec = bprm->security;
2205
2206 if (bsec->unsafe) {
2207 force_sig_specific(SIGKILL, current);
2208 return;
2209 }
2210 if (tsec->osid == tsec->sid)
2211 return;
2212
2213 /* Close files for which the new task SID is not authorized. */
2214 flush_unauthorized_files(current->files);
2215
2216 /* Check whether the new SID can inherit signal state
2217 from the old SID. If not, clear itimers to avoid
2218 subsequent signal generation and flush and unblock
2219 signals. This must occur _after_ the task SID has
2220 been updated so that any kill done after the flush
2221 will be checked against the new SID. */
2222 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2223 PROCESS__SIGINH, NULL);
2224 if (rc) {
2225 memset(&itimer, 0, sizeof itimer);
2226 for (i = 0; i < 3; i++)
2227 do_setitimer(i, &itimer, NULL);
2228 flush_signals(current);
2229 spin_lock_irq(&current->sighand->siglock);
2230 flush_signal_handlers(current, 1);
2231 sigemptyset(&current->blocked);
2232 recalc_sigpending();
2233 spin_unlock_irq(&current->sighand->siglock);
2234 }
2235
2236 /* Always clear parent death signal on SID transitions. */
2237 current->pdeath_signal = 0;
2238
2239 /* Check whether the new SID can inherit resource limits
2240 from the old SID. If not, reset all soft limits to
2241 the lower of the current task's hard limit and the init
2242 task's soft limit. Note that the setting of hard limits
2243 (even to lower them) can be controlled by the setrlimit
2244 check. The inclusion of the init task's soft limit into
2245 the computation is to avoid resetting soft limits higher
2246 than the default soft limit for cases where the default
2247 is lower than the hard limit, e.g. RLIMIT_CORE or
2248 RLIMIT_STACK.*/
2249 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2250 PROCESS__RLIMITINH, NULL);
2251 if (rc) {
2252 for (i = 0; i < RLIM_NLIMITS; i++) {
2253 rlim = current->signal->rlim + i;
2254 initrlim = init_task.signal->rlim+i;
2255 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2256 }
2257 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2258 /*
2259 * This will cause RLIMIT_CPU calculations
2260 * to be refigured.
2261 */
2262 current->it_prof_expires = jiffies_to_cputime(1);
2263 }
2264 }
2265
2266 /* Wake up the parent if it is waiting so that it can
2267 recheck wait permission to the new task SID. */
2268 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2269 }
2270
2271 /* superblock security operations */
2272
2273 static int selinux_sb_alloc_security(struct super_block *sb)
2274 {
2275 return superblock_alloc_security(sb);
2276 }
2277
2278 static void selinux_sb_free_security(struct super_block *sb)
2279 {
2280 superblock_free_security(sb);
2281 }
2282
2283 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2284 {
2285 if (plen > olen)
2286 return 0;
2287
2288 return !memcmp(prefix, option, plen);
2289 }
2290
2291 static inline int selinux_option(char *option, int len)
2292 {
2293 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2294 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2295 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2296 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2297 }
2298
2299 static inline void take_option(char **to, char *from, int *first, int len)
2300 {
2301 if (!*first) {
2302 **to = ',';
2303 *to += 1;
2304 } else
2305 *first = 0;
2306 memcpy(*to, from, len);
2307 *to += len;
2308 }
2309
2310 static inline void take_selinux_option(char **to, char *from, int *first,
2311 int len)
2312 {
2313 int current_size = 0;
2314
2315 if (!*first) {
2316 **to = '|';
2317 *to += 1;
2318 }
2319 else
2320 *first = 0;
2321
2322 while (current_size < len) {
2323 if (*from != '"') {
2324 **to = *from;
2325 *to += 1;
2326 }
2327 from += 1;
2328 current_size += 1;
2329 }
2330 }
2331
2332 static int selinux_sb_copy_data(char *orig, char *copy)
2333 {
2334 int fnosec, fsec, rc = 0;
2335 char *in_save, *in_curr, *in_end;
2336 char *sec_curr, *nosec_save, *nosec;
2337 int open_quote = 0;
2338
2339 in_curr = orig;
2340 sec_curr = copy;
2341
2342 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2343 if (!nosec) {
2344 rc = -ENOMEM;
2345 goto out;
2346 }
2347
2348 nosec_save = nosec;
2349 fnosec = fsec = 1;
2350 in_save = in_end = orig;
2351
2352 do {
2353 if (*in_end == '"')
2354 open_quote = !open_quote;
2355 if ((*in_end == ',' && open_quote == 0) ||
2356 *in_end == '\0') {
2357 int len = in_end - in_curr;
2358
2359 if (selinux_option(in_curr, len))
2360 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2361 else
2362 take_option(&nosec, in_curr, &fnosec, len);
2363
2364 in_curr = in_end + 1;
2365 }
2366 } while (*in_end++);
2367
2368 strcpy(in_save, nosec_save);
2369 free_page((unsigned long)nosec_save);
2370 out:
2371 return rc;
2372 }
2373
2374 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2375 {
2376 struct avc_audit_data ad;
2377 int rc;
2378
2379 rc = superblock_doinit(sb, data);
2380 if (rc)
2381 return rc;
2382
2383 AVC_AUDIT_DATA_INIT(&ad,FS);
2384 ad.u.fs.path.dentry = sb->s_root;
2385 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2386 }
2387
2388 static int selinux_sb_statfs(struct dentry *dentry)
2389 {
2390 struct avc_audit_data ad;
2391
2392 AVC_AUDIT_DATA_INIT(&ad,FS);
2393 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2394 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2395 }
2396
2397 static int selinux_mount(char * dev_name,
2398 struct nameidata *nd,
2399 char * type,
2400 unsigned long flags,
2401 void * data)
2402 {
2403 int rc;
2404
2405 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2406 if (rc)
2407 return rc;
2408
2409 if (flags & MS_REMOUNT)
2410 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2411 FILESYSTEM__REMOUNT, NULL);
2412 else
2413 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2414 FILE__MOUNTON);
2415 }
2416
2417 static int selinux_umount(struct vfsmount *mnt, int flags)
2418 {
2419 int rc;
2420
2421 rc = secondary_ops->sb_umount(mnt, flags);
2422 if (rc)
2423 return rc;
2424
2425 return superblock_has_perm(current,mnt->mnt_sb,
2426 FILESYSTEM__UNMOUNT,NULL);
2427 }
2428
2429 /* inode security operations */
2430
2431 static int selinux_inode_alloc_security(struct inode *inode)
2432 {
2433 return inode_alloc_security(inode);
2434 }
2435
2436 static void selinux_inode_free_security(struct inode *inode)
2437 {
2438 inode_free_security(inode);
2439 }
2440
2441 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2442 char **name, void **value,
2443 size_t *len)
2444 {
2445 struct task_security_struct *tsec;
2446 struct inode_security_struct *dsec;
2447 struct superblock_security_struct *sbsec;
2448 u32 newsid, clen;
2449 int rc;
2450 char *namep = NULL, *context;
2451
2452 tsec = current->security;
2453 dsec = dir->i_security;
2454 sbsec = dir->i_sb->s_security;
2455
2456 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2457 newsid = tsec->create_sid;
2458 } else {
2459 rc = security_transition_sid(tsec->sid, dsec->sid,
2460 inode_mode_to_security_class(inode->i_mode),
2461 &newsid);
2462 if (rc) {
2463 printk(KERN_WARNING "%s: "
2464 "security_transition_sid failed, rc=%d (dev=%s "
2465 "ino=%ld)\n",
2466 __func__,
2467 -rc, inode->i_sb->s_id, inode->i_ino);
2468 return rc;
2469 }
2470 }
2471
2472 /* Possibly defer initialization to selinux_complete_init. */
2473 if (sbsec->initialized) {
2474 struct inode_security_struct *isec = inode->i_security;
2475 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2476 isec->sid = newsid;
2477 isec->initialized = 1;
2478 }
2479
2480 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2481 return -EOPNOTSUPP;
2482
2483 if (name) {
2484 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2485 if (!namep)
2486 return -ENOMEM;
2487 *name = namep;
2488 }
2489
2490 if (value && len) {
2491 rc = security_sid_to_context(newsid, &context, &clen);
2492 if (rc) {
2493 kfree(namep);
2494 return rc;
2495 }
2496 *value = context;
2497 *len = clen;
2498 }
2499
2500 return 0;
2501 }
2502
2503 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2504 {
2505 return may_create(dir, dentry, SECCLASS_FILE);
2506 }
2507
2508 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2509 {
2510 int rc;
2511
2512 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2513 if (rc)
2514 return rc;
2515 return may_link(dir, old_dentry, MAY_LINK);
2516 }
2517
2518 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2519 {
2520 int rc;
2521
2522 rc = secondary_ops->inode_unlink(dir, dentry);
2523 if (rc)
2524 return rc;
2525 return may_link(dir, dentry, MAY_UNLINK);
2526 }
2527
2528 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2529 {
2530 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2531 }
2532
2533 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2534 {
2535 return may_create(dir, dentry, SECCLASS_DIR);
2536 }
2537
2538 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2539 {
2540 return may_link(dir, dentry, MAY_RMDIR);
2541 }
2542
2543 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2544 {
2545 int rc;
2546
2547 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2548 if (rc)
2549 return rc;
2550
2551 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2552 }
2553
2554 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2555 struct inode *new_inode, struct dentry *new_dentry)
2556 {
2557 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2558 }
2559
2560 static int selinux_inode_readlink(struct dentry *dentry)
2561 {
2562 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2563 }
2564
2565 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2566 {
2567 int rc;
2568
2569 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2570 if (rc)
2571 return rc;
2572 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2573 }
2574
2575 static int selinux_inode_permission(struct inode *inode, int mask,
2576 struct nameidata *nd)
2577 {
2578 int rc;
2579
2580 rc = secondary_ops->inode_permission(inode, mask, nd);
2581 if (rc)
2582 return rc;
2583
2584 if (!mask) {
2585 /* No permission to check. Existence test. */
2586 return 0;
2587 }
2588
2589 return inode_has_perm(current, inode,
2590 open_file_mask_to_av(inode->i_mode, mask), NULL);
2591 }
2592
2593 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2594 {
2595 int rc;
2596
2597 rc = secondary_ops->inode_setattr(dentry, iattr);
2598 if (rc)
2599 return rc;
2600
2601 if (iattr->ia_valid & ATTR_FORCE)
2602 return 0;
2603
2604 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2605 ATTR_ATIME_SET | ATTR_MTIME_SET))
2606 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2607
2608 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2609 }
2610
2611 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2612 {
2613 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2614 }
2615
2616 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2617 {
2618 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2619 sizeof XATTR_SECURITY_PREFIX - 1)) {
2620 if (!strcmp(name, XATTR_NAME_CAPS)) {
2621 if (!capable(CAP_SETFCAP))
2622 return -EPERM;
2623 } else if (!capable(CAP_SYS_ADMIN)) {
2624 /* A different attribute in the security namespace.
2625 Restrict to administrator. */
2626 return -EPERM;
2627 }
2628 }
2629
2630 /* Not an attribute we recognize, so just check the
2631 ordinary setattr permission. */
2632 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2633 }
2634
2635 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2636 {
2637 struct task_security_struct *tsec = current->security;
2638 struct inode *inode = dentry->d_inode;
2639 struct inode_security_struct *isec = inode->i_security;
2640 struct superblock_security_struct *sbsec;
2641 struct avc_audit_data ad;
2642 u32 newsid;
2643 int rc = 0;
2644
2645 if (strcmp(name, XATTR_NAME_SELINUX))
2646 return selinux_inode_setotherxattr(dentry, name);
2647
2648 sbsec = inode->i_sb->s_security;
2649 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2650 return -EOPNOTSUPP;
2651
2652 if (!is_owner_or_cap(inode))
2653 return -EPERM;
2654
2655 AVC_AUDIT_DATA_INIT(&ad,FS);
2656 ad.u.fs.path.dentry = dentry;
2657
2658 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2659 FILE__RELABELFROM, &ad);
2660 if (rc)
2661 return rc;
2662
2663 rc = security_context_to_sid(value, size, &newsid);
2664 if (rc)
2665 return rc;
2666
2667 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2668 FILE__RELABELTO, &ad);
2669 if (rc)
2670 return rc;
2671
2672 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2673 isec->sclass);
2674 if (rc)
2675 return rc;
2676
2677 return avc_has_perm(newsid,
2678 sbsec->sid,
2679 SECCLASS_FILESYSTEM,
2680 FILESYSTEM__ASSOCIATE,
2681 &ad);
2682 }
2683
2684 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2685 void *value, size_t size, int flags)
2686 {
2687 struct inode *inode = dentry->d_inode;
2688 struct inode_security_struct *isec = inode->i_security;
2689 u32 newsid;
2690 int rc;
2691
2692 if (strcmp(name, XATTR_NAME_SELINUX)) {
2693 /* Not an attribute we recognize, so nothing to do. */
2694 return;
2695 }
2696
2697 rc = security_context_to_sid(value, size, &newsid);
2698 if (rc) {
2699 printk(KERN_WARNING "%s: unable to obtain SID for context "
2700 "%s, rc=%d\n", __func__, (char *)value, -rc);
2701 return;
2702 }
2703
2704 isec->sid = newsid;
2705 return;
2706 }
2707
2708 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2709 {
2710 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2711 }
2712
2713 static int selinux_inode_listxattr (struct dentry *dentry)
2714 {
2715 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2716 }
2717
2718 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2719 {
2720 if (strcmp(name, XATTR_NAME_SELINUX))
2721 return selinux_inode_setotherxattr(dentry, name);
2722
2723 /* No one is allowed to remove a SELinux security label.
2724 You can change the label, but all data must be labeled. */
2725 return -EACCES;
2726 }
2727
2728 /*
2729 * Copy the in-core inode security context value to the user. If the
2730 * getxattr() prior to this succeeded, check to see if we need to
2731 * canonicalize the value to be finally returned to the user.
2732 *
2733 * Permission check is handled by selinux_inode_getxattr hook.
2734 */
2735 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2736 {
2737 u32 size;
2738 int error;
2739 char *context = NULL;
2740 struct inode_security_struct *isec = inode->i_security;
2741
2742 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2743 return -EOPNOTSUPP;
2744
2745 error = security_sid_to_context(isec->sid, &context, &size);
2746 if (error)
2747 return error;
2748 error = size;
2749 if (alloc) {
2750 *buffer = context;
2751 goto out_nofree;
2752 }
2753 kfree(context);
2754 out_nofree:
2755 return error;
2756 }
2757
2758 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2759 const void *value, size_t size, int flags)
2760 {
2761 struct inode_security_struct *isec = inode->i_security;
2762 u32 newsid;
2763 int rc;
2764
2765 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2766 return -EOPNOTSUPP;
2767
2768 if (!value || !size)
2769 return -EACCES;
2770
2771 rc = security_context_to_sid((void*)value, size, &newsid);
2772 if (rc)
2773 return rc;
2774
2775 isec->sid = newsid;
2776 return 0;
2777 }
2778
2779 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2780 {
2781 const int len = sizeof(XATTR_NAME_SELINUX);
2782 if (buffer && len <= buffer_size)
2783 memcpy(buffer, XATTR_NAME_SELINUX, len);
2784 return len;
2785 }
2786
2787 static int selinux_inode_need_killpriv(struct dentry *dentry)
2788 {
2789 return secondary_ops->inode_need_killpriv(dentry);
2790 }
2791
2792 static int selinux_inode_killpriv(struct dentry *dentry)
2793 {
2794 return secondary_ops->inode_killpriv(dentry);
2795 }
2796
2797 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2798 {
2799 struct inode_security_struct *isec = inode->i_security;
2800 *secid = isec->sid;
2801 }
2802
2803 /* file security operations */
2804
2805 static int selinux_revalidate_file_permission(struct file *file, int mask)
2806 {
2807 int rc;
2808 struct inode *inode = file->f_path.dentry->d_inode;
2809
2810 if (!mask) {
2811 /* No permission to check. Existence test. */
2812 return 0;
2813 }
2814
2815 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2816 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2817 mask |= MAY_APPEND;
2818
2819 rc = file_has_perm(current, file,
2820 file_mask_to_av(inode->i_mode, mask));
2821 if (rc)
2822 return rc;
2823
2824 return selinux_netlbl_inode_permission(inode, mask);
2825 }
2826
2827 static int selinux_file_permission(struct file *file, int mask)
2828 {
2829 struct inode *inode = file->f_path.dentry->d_inode;
2830 struct task_security_struct *tsec = current->security;
2831 struct file_security_struct *fsec = file->f_security;
2832 struct inode_security_struct *isec = inode->i_security;
2833
2834 if (!mask) {
2835 /* No permission to check. Existence test. */
2836 return 0;
2837 }
2838
2839 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2840 && fsec->pseqno == avc_policy_seqno())
2841 return selinux_netlbl_inode_permission(inode, mask);
2842
2843 return selinux_revalidate_file_permission(file, mask);
2844 }
2845
2846 static int selinux_file_alloc_security(struct file *file)
2847 {
2848 return file_alloc_security(file);
2849 }
2850
2851 static void selinux_file_free_security(struct file *file)
2852 {
2853 file_free_security(file);
2854 }
2855
2856 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2857 unsigned long arg)
2858 {
2859 int error = 0;
2860
2861 switch (cmd) {
2862 case FIONREAD:
2863 /* fall through */
2864 case FIBMAP:
2865 /* fall through */
2866 case FIGETBSZ:
2867 /* fall through */
2868 case EXT2_IOC_GETFLAGS:
2869 /* fall through */
2870 case EXT2_IOC_GETVERSION:
2871 error = file_has_perm(current, file, FILE__GETATTR);
2872 break;
2873
2874 case EXT2_IOC_SETFLAGS:
2875 /* fall through */
2876 case EXT2_IOC_SETVERSION:
2877 error = file_has_perm(current, file, FILE__SETATTR);
2878 break;
2879
2880 /* sys_ioctl() checks */
2881 case FIONBIO:
2882 /* fall through */
2883 case FIOASYNC:
2884 error = file_has_perm(current, file, 0);
2885 break;
2886
2887 case KDSKBENT:
2888 case KDSKBSENT:
2889 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2890 break;
2891
2892 /* default case assumes that the command will go
2893 * to the file's ioctl() function.
2894 */
2895 default:
2896 error = file_has_perm(current, file, FILE__IOCTL);
2897
2898 }
2899 return error;
2900 }
2901
2902 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2903 {
2904 #ifndef CONFIG_PPC32
2905 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2906 /*
2907 * We are making executable an anonymous mapping or a
2908 * private file mapping that will also be writable.
2909 * This has an additional check.
2910 */
2911 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2912 if (rc)
2913 return rc;
2914 }
2915 #endif
2916
2917 if (file) {
2918 /* read access is always possible with a mapping */
2919 u32 av = FILE__READ;
2920
2921 /* write access only matters if the mapping is shared */
2922 if (shared && (prot & PROT_WRITE))
2923 av |= FILE__WRITE;
2924
2925 if (prot & PROT_EXEC)
2926 av |= FILE__EXECUTE;
2927
2928 return file_has_perm(current, file, av);
2929 }
2930 return 0;
2931 }
2932
2933 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2934 unsigned long prot, unsigned long flags,
2935 unsigned long addr, unsigned long addr_only)
2936 {
2937 int rc = 0;
2938 u32 sid = ((struct task_security_struct*)(current->security))->sid;
2939
2940 if (addr < mmap_min_addr)
2941 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2942 MEMPROTECT__MMAP_ZERO, NULL);
2943 if (rc || addr_only)
2944 return rc;
2945
2946 if (selinux_checkreqprot)
2947 prot = reqprot;
2948
2949 return file_map_prot_check(file, prot,
2950 (flags & MAP_TYPE) == MAP_SHARED);
2951 }
2952
2953 static int selinux_file_mprotect(struct vm_area_struct *vma,
2954 unsigned long reqprot,
2955 unsigned long prot)
2956 {
2957 int rc;
2958
2959 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2960 if (rc)
2961 return rc;
2962
2963 if (selinux_checkreqprot)
2964 prot = reqprot;
2965
2966 #ifndef CONFIG_PPC32
2967 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2968 rc = 0;
2969 if (vma->vm_start >= vma->vm_mm->start_brk &&
2970 vma->vm_end <= vma->vm_mm->brk) {
2971 rc = task_has_perm(current, current,
2972 PROCESS__EXECHEAP);
2973 } else if (!vma->vm_file &&
2974 vma->vm_start <= vma->vm_mm->start_stack &&
2975 vma->vm_end >= vma->vm_mm->start_stack) {
2976 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2977 } else if (vma->vm_file && vma->anon_vma) {
2978 /*
2979 * We are making executable a file mapping that has
2980 * had some COW done. Since pages might have been
2981 * written, check ability to execute the possibly
2982 * modified content. This typically should only
2983 * occur for text relocations.
2984 */
2985 rc = file_has_perm(current, vma->vm_file,
2986 FILE__EXECMOD);
2987 }
2988 if (rc)
2989 return rc;
2990 }
2991 #endif
2992
2993 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2994 }
2995
2996 static int selinux_file_lock(struct file *file, unsigned int cmd)
2997 {
2998 return file_has_perm(current, file, FILE__LOCK);
2999 }
3000
3001 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3002 unsigned long arg)
3003 {
3004 int err = 0;
3005
3006 switch (cmd) {
3007 case F_SETFL:
3008 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3009 err = -EINVAL;
3010 break;
3011 }
3012
3013 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3014 err = file_has_perm(current, file,FILE__WRITE);
3015 break;
3016 }
3017 /* fall through */
3018 case F_SETOWN:
3019 case F_SETSIG:
3020 case F_GETFL:
3021 case F_GETOWN:
3022 case F_GETSIG:
3023 /* Just check FD__USE permission */
3024 err = file_has_perm(current, file, 0);
3025 break;
3026 case F_GETLK:
3027 case F_SETLK:
3028 case F_SETLKW:
3029 #if BITS_PER_LONG == 32
3030 case F_GETLK64:
3031 case F_SETLK64:
3032 case F_SETLKW64:
3033 #endif
3034 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3035 err = -EINVAL;
3036 break;
3037 }
3038 err = file_has_perm(current, file, FILE__LOCK);
3039 break;
3040 }
3041
3042 return err;
3043 }
3044
3045 static int selinux_file_set_fowner(struct file *file)
3046 {
3047 struct task_security_struct *tsec;
3048 struct file_security_struct *fsec;
3049
3050 tsec = current->security;
3051 fsec = file->f_security;
3052 fsec->fown_sid = tsec->sid;
3053
3054 return 0;
3055 }
3056
3057 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3058 struct fown_struct *fown, int signum)
3059 {
3060 struct file *file;
3061 u32 perm;
3062 struct task_security_struct *tsec;
3063 struct file_security_struct *fsec;
3064
3065 /* struct fown_struct is never outside the context of a struct file */
3066 file = container_of(fown, struct file, f_owner);
3067
3068 tsec = tsk->security;
3069 fsec = file->f_security;
3070
3071 if (!signum)
3072 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3073 else
3074 perm = signal_to_av(signum);
3075
3076 return avc_has_perm(fsec->fown_sid, tsec->sid,
3077 SECCLASS_PROCESS, perm, NULL);
3078 }
3079
3080 static int selinux_file_receive(struct file *file)
3081 {
3082 return file_has_perm(current, file, file_to_av(file));
3083 }
3084
3085 static int selinux_dentry_open(struct file *file)
3086 {
3087 struct file_security_struct *fsec;
3088 struct inode *inode;
3089 struct inode_security_struct *isec;
3090 inode = file->f_path.dentry->d_inode;
3091 fsec = file->f_security;
3092 isec = inode->i_security;
3093 /*
3094 * Save inode label and policy sequence number
3095 * at open-time so that selinux_file_permission
3096 * can determine whether revalidation is necessary.
3097 * Task label is already saved in the file security
3098 * struct as its SID.
3099 */
3100 fsec->isid = isec->sid;
3101 fsec->pseqno = avc_policy_seqno();
3102 /*
3103 * Since the inode label or policy seqno may have changed
3104 * between the selinux_inode_permission check and the saving
3105 * of state above, recheck that access is still permitted.
3106 * Otherwise, access might never be revalidated against the
3107 * new inode label or new policy.
3108 * This check is not redundant - do not remove.
3109 */
3110 return inode_has_perm(current, inode, file_to_av(file), NULL);
3111 }
3112
3113 /* task security operations */
3114
3115 static int selinux_task_create(unsigned long clone_flags)
3116 {
3117 int rc;
3118
3119 rc = secondary_ops->task_create(clone_flags);
3120 if (rc)
3121 return rc;
3122
3123 return task_has_perm(current, current, PROCESS__FORK);
3124 }
3125
3126 static int selinux_task_alloc_security(struct task_struct *tsk)
3127 {
3128 struct task_security_struct *tsec1, *tsec2;
3129 int rc;
3130
3131 tsec1 = current->security;
3132
3133 rc = task_alloc_security(tsk);
3134 if (rc)
3135 return rc;
3136 tsec2 = tsk->security;
3137
3138 tsec2->osid = tsec1->osid;
3139 tsec2->sid = tsec1->sid;
3140
3141 /* Retain the exec, fs, key, and sock SIDs across fork */
3142 tsec2->exec_sid = tsec1->exec_sid;
3143 tsec2->create_sid = tsec1->create_sid;
3144 tsec2->keycreate_sid = tsec1->keycreate_sid;
3145 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3146
3147 return 0;
3148 }
3149
3150 static void selinux_task_free_security(struct task_struct *tsk)
3151 {
3152 task_free_security(tsk);
3153 }
3154
3155 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3156 {
3157 /* Since setuid only affects the current process, and
3158 since the SELinux controls are not based on the Linux
3159 identity attributes, SELinux does not need to control
3160 this operation. However, SELinux does control the use
3161 of the CAP_SETUID and CAP_SETGID capabilities using the
3162 capable hook. */
3163 return 0;
3164 }
3165
3166 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3167 {
3168 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3169 }
3170
3171 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3172 {
3173 /* See the comment for setuid above. */
3174 return 0;
3175 }
3176
3177 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3178 {
3179 return task_has_perm(current, p, PROCESS__SETPGID);
3180 }
3181
3182 static int selinux_task_getpgid(struct task_struct *p)
3183 {
3184 return task_has_perm(current, p, PROCESS__GETPGID);
3185 }
3186
3187 static int selinux_task_getsid(struct task_struct *p)
3188 {
3189 return task_has_perm(current, p, PROCESS__GETSESSION);
3190 }
3191
3192 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3193 {
3194 struct task_security_struct *tsec = p->security;
3195 *secid = tsec->sid;
3196 }
3197
3198 static int selinux_task_setgroups(struct group_info *group_info)
3199 {
3200 /* See the comment for setuid above. */
3201 return 0;
3202 }
3203
3204 static int selinux_task_setnice(struct task_struct *p, int nice)
3205 {
3206 int rc;
3207
3208 rc = secondary_ops->task_setnice(p, nice);
3209 if (rc)
3210 return rc;
3211
3212 return task_has_perm(current,p, PROCESS__SETSCHED);
3213 }
3214
3215 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3216 {
3217 int rc;
3218
3219 rc = secondary_ops->task_setioprio(p, ioprio);
3220 if (rc)
3221 return rc;
3222
3223 return task_has_perm(current, p, PROCESS__SETSCHED);
3224 }
3225
3226 static int selinux_task_getioprio(struct task_struct *p)
3227 {
3228 return task_has_perm(current, p, PROCESS__GETSCHED);
3229 }
3230
3231 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3232 {
3233 struct rlimit *old_rlim = current->signal->rlim + resource;
3234 int rc;
3235
3236 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3237 if (rc)
3238 return rc;
3239
3240 /* Control the ability to change the hard limit (whether
3241 lowering or raising it), so that the hard limit can
3242 later be used as a safe reset point for the soft limit
3243 upon context transitions. See selinux_bprm_apply_creds. */
3244 if (old_rlim->rlim_max != new_rlim->rlim_max)
3245 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3246
3247 return 0;
3248 }
3249
3250 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3251 {
3252 int rc;
3253
3254 rc = secondary_ops->task_setscheduler(p, policy, lp);
3255 if (rc)
3256 return rc;
3257
3258 return task_has_perm(current, p, PROCESS__SETSCHED);
3259 }
3260
3261 static int selinux_task_getscheduler(struct task_struct *p)
3262 {
3263 return task_has_perm(current, p, PROCESS__GETSCHED);
3264 }
3265
3266 static int selinux_task_movememory(struct task_struct *p)
3267 {
3268 return task_has_perm(current, p, PROCESS__SETSCHED);
3269 }
3270
3271 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3272 int sig, u32 secid)
3273 {
3274 u32 perm;
3275 int rc;
3276 struct task_security_struct *tsec;
3277
3278 rc = secondary_ops->task_kill(p, info, sig, secid);
3279 if (rc)
3280 return rc;
3281
3282 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3283 return 0;
3284
3285 if (!sig)
3286 perm = PROCESS__SIGNULL; /* null signal; existence test */
3287 else
3288 perm = signal_to_av(sig);
3289 tsec = p->security;
3290 if (secid)
3291 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3292 else
3293 rc = task_has_perm(current, p, perm);
3294 return rc;
3295 }
3296
3297 static int selinux_task_prctl(int option,
3298 unsigned long arg2,
3299 unsigned long arg3,
3300 unsigned long arg4,
3301 unsigned long arg5)
3302 {
3303 /* The current prctl operations do not appear to require
3304 any SELinux controls since they merely observe or modify
3305 the state of the current process. */
3306 return 0;
3307 }
3308
3309 static int selinux_task_wait(struct task_struct *p)
3310 {
3311 return task_has_perm(p, current, PROCESS__SIGCHLD);
3312 }
3313
3314 static void selinux_task_reparent_to_init(struct task_struct *p)
3315 {
3316 struct task_security_struct *tsec;
3317
3318 secondary_ops->task_reparent_to_init(p);
3319
3320 tsec = p->security;
3321 tsec->osid = tsec->sid;
3322 tsec->sid = SECINITSID_KERNEL;
3323 return;
3324 }
3325
3326 static void selinux_task_to_inode(struct task_struct *p,
3327 struct inode *inode)
3328 {
3329 struct task_security_struct *tsec = p->security;
3330 struct inode_security_struct *isec = inode->i_security;
3331
3332 isec->sid = tsec->sid;
3333 isec->initialized = 1;
3334 return;
3335 }
3336
3337 /* Returns error only if unable to parse addresses */
3338 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3339 struct avc_audit_data *ad, u8 *proto)
3340 {
3341 int offset, ihlen, ret = -EINVAL;
3342 struct iphdr _iph, *ih;
3343
3344 offset = skb_network_offset(skb);
3345 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3346 if (ih == NULL)
3347 goto out;
3348
3349 ihlen = ih->ihl * 4;
3350 if (ihlen < sizeof(_iph))
3351 goto out;
3352
3353 ad->u.net.v4info.saddr = ih->saddr;
3354 ad->u.net.v4info.daddr = ih->daddr;
3355 ret = 0;
3356
3357 if (proto)
3358 *proto = ih->protocol;
3359
3360 switch (ih->protocol) {
3361 case IPPROTO_TCP: {
3362 struct tcphdr _tcph, *th;
3363
3364 if (ntohs(ih->frag_off) & IP_OFFSET)
3365 break;
3366
3367 offset += ihlen;
3368 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3369 if (th == NULL)
3370 break;
3371
3372 ad->u.net.sport = th->source;
3373 ad->u.net.dport = th->dest;
3374 break;
3375 }
3376
3377 case IPPROTO_UDP: {
3378 struct udphdr _udph, *uh;
3379
3380 if (ntohs(ih->frag_off) & IP_OFFSET)
3381 break;
3382
3383 offset += ihlen;
3384 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3385 if (uh == NULL)
3386 break;
3387
3388 ad->u.net.sport = uh->source;
3389 ad->u.net.dport = uh->dest;
3390 break;
3391 }
3392
3393 case IPPROTO_DCCP: {
3394 struct dccp_hdr _dccph, *dh;
3395
3396 if (ntohs(ih->frag_off) & IP_OFFSET)
3397 break;
3398
3399 offset += ihlen;
3400 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3401 if (dh == NULL)
3402 break;
3403
3404 ad->u.net.sport = dh->dccph_sport;
3405 ad->u.net.dport = dh->dccph_dport;
3406 break;
3407 }
3408
3409 default:
3410 break;
3411 }
3412 out:
3413 return ret;
3414 }
3415
3416 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3417
3418 /* Returns error only if unable to parse addresses */
3419 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3420 struct avc_audit_data *ad, u8 *proto)
3421 {
3422 u8 nexthdr;
3423 int ret = -EINVAL, offset;
3424 struct ipv6hdr _ipv6h, *ip6;
3425
3426 offset = skb_network_offset(skb);
3427 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3428 if (ip6 == NULL)
3429 goto out;
3430
3431 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3432 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3433 ret = 0;
3434
3435 nexthdr = ip6->nexthdr;
3436 offset += sizeof(_ipv6h);
3437 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3438 if (offset < 0)
3439 goto out;
3440
3441 if (proto)
3442 *proto = nexthdr;
3443
3444 switch (nexthdr) {
3445 case IPPROTO_TCP: {
3446 struct tcphdr _tcph, *th;
3447
3448 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3449 if (th == NULL)
3450 break;
3451
3452 ad->u.net.sport = th->source;
3453 ad->u.net.dport = th->dest;
3454 break;
3455 }
3456
3457 case IPPROTO_UDP: {
3458 struct udphdr _udph, *uh;
3459
3460 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3461 if (uh == NULL)
3462 break;
3463
3464 ad->u.net.sport = uh->source;
3465 ad->u.net.dport = uh->dest;
3466 break;
3467 }
3468
3469 case IPPROTO_DCCP: {
3470 struct dccp_hdr _dccph, *dh;
3471
3472 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3473 if (dh == NULL)
3474 break;
3475
3476 ad->u.net.sport = dh->dccph_sport;
3477 ad->u.net.dport = dh->dccph_dport;
3478 break;
3479 }
3480
3481 /* includes fragments */
3482 default:
3483 break;
3484 }
3485 out:
3486 return ret;
3487 }
3488
3489 #endif /* IPV6 */
3490
3491 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3492 char **addrp, int src, u8 *proto)
3493 {
3494 int ret = 0;
3495
3496 switch (ad->u.net.family) {
3497 case PF_INET:
3498 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3499 if (ret || !addrp)
3500 break;
3501 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3502 &ad->u.net.v4info.daddr);
3503 break;
3504
3505 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3506 case PF_INET6:
3507 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3508 if (ret || !addrp)
3509 break;
3510 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3511 &ad->u.net.v6info.daddr);
3512 break;
3513 #endif /* IPV6 */
3514 default:
3515 break;
3516 }
3517
3518 if (unlikely(ret))
3519 printk(KERN_WARNING
3520 "SELinux: failure in selinux_parse_skb(),"
3521 " unable to parse packet\n");
3522
3523 return ret;
3524 }
3525
3526 /**
3527 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3528 * @skb: the packet
3529 * @family: protocol family
3530 * @sid: the packet's peer label SID
3531 *
3532 * Description:
3533 * Check the various different forms of network peer labeling and determine
3534 * the peer label/SID for the packet; most of the magic actually occurs in
3535 * the security server function security_net_peersid_cmp(). The function
3536 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3537 * or -EACCES if @sid is invalid due to inconsistencies with the different
3538 * peer labels.
3539 *
3540 */
3541 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3542 {
3543 int err;
3544 u32 xfrm_sid;
3545 u32 nlbl_sid;
3546 u32 nlbl_type;
3547
3548 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3549 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3550
3551 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3552 if (unlikely(err)) {
3553 printk(KERN_WARNING
3554 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3555 " unable to determine packet's peer label\n");
3556 return -EACCES;
3557 }
3558
3559 return 0;
3560 }
3561
3562 /* socket security operations */
3563 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3564 u32 perms)
3565 {
3566 struct inode_security_struct *isec;
3567 struct task_security_struct *tsec;
3568 struct avc_audit_data ad;
3569 int err = 0;
3570
3571 tsec = task->security;
3572 isec = SOCK_INODE(sock)->i_security;
3573
3574 if (isec->sid == SECINITSID_KERNEL)
3575 goto out;
3576
3577 AVC_AUDIT_DATA_INIT(&ad,NET);
3578 ad.u.net.sk = sock->sk;
3579 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3580
3581 out:
3582 return err;
3583 }
3584
3585 static int selinux_socket_create(int family, int type,
3586 int protocol, int kern)
3587 {
3588 int err = 0;
3589 struct task_security_struct *tsec;
3590 u32 newsid;
3591
3592 if (kern)
3593 goto out;
3594
3595 tsec = current->security;
3596 newsid = tsec->sockcreate_sid ? : tsec->sid;
3597 err = avc_has_perm(tsec->sid, newsid,
3598 socket_type_to_security_class(family, type,
3599 protocol), SOCKET__CREATE, NULL);
3600
3601 out:
3602 return err;
3603 }
3604
3605 static int selinux_socket_post_create(struct socket *sock, int family,
3606 int type, int protocol, int kern)
3607 {
3608 int err = 0;
3609 struct inode_security_struct *isec;
3610 struct task_security_struct *tsec;
3611 struct sk_security_struct *sksec;
3612 u32 newsid;
3613
3614 isec = SOCK_INODE(sock)->i_security;
3615
3616 tsec = current->security;
3617 newsid = tsec->sockcreate_sid ? : tsec->sid;
3618 isec->sclass = socket_type_to_security_class(family, type, protocol);
3619 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3620 isec->initialized = 1;
3621
3622 if (sock->sk) {
3623 sksec = sock->sk->sk_security;
3624 sksec->sid = isec->sid;
3625 sksec->sclass = isec->sclass;
3626 err = selinux_netlbl_socket_post_create(sock);
3627 }
3628
3629 return err;
3630 }
3631
3632 /* Range of port numbers used to automatically bind.
3633 Need to determine whether we should perform a name_bind
3634 permission check between the socket and the port number. */
3635
3636 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3637 {
3638 u16 family;
3639 int err;
3640
3641 err = socket_has_perm(current, sock, SOCKET__BIND);
3642 if (err)
3643 goto out;
3644
3645 /*
3646 * If PF_INET or PF_INET6, check name_bind permission for the port.
3647 * Multiple address binding for SCTP is not supported yet: we just
3648 * check the first address now.
3649 */
3650 family = sock->sk->sk_family;
3651 if (family == PF_INET || family == PF_INET6) {
3652 char *addrp;
3653 struct inode_security_struct *isec;
3654 struct task_security_struct *tsec;
3655 struct avc_audit_data ad;
3656 struct sockaddr_in *addr4 = NULL;
3657 struct sockaddr_in6 *addr6 = NULL;
3658 unsigned short snum;
3659 struct sock *sk = sock->sk;
3660 u32 sid, node_perm, addrlen;
3661
3662 tsec = current->security;
3663 isec = SOCK_INODE(sock)->i_security;
3664
3665 if (family == PF_INET) {
3666 addr4 = (struct sockaddr_in *)address;
3667 snum = ntohs(addr4->sin_port);
3668 addrlen = sizeof(addr4->sin_addr.s_addr);
3669 addrp = (char *)&addr4->sin_addr.s_addr;
3670 } else {
3671 addr6 = (struct sockaddr_in6 *)address;
3672 snum = ntohs(addr6->sin6_port);
3673 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3674 addrp = (char *)&addr6->sin6_addr.s6_addr;
3675 }
3676
3677 if (snum) {
3678 int low, high;
3679
3680 inet_get_local_port_range(&low, &high);
3681
3682 if (snum < max(PROT_SOCK, low) || snum > high) {
3683 err = sel_netport_sid(sk->sk_protocol,
3684 snum, &sid);
3685 if (err)
3686 goto out;
3687 AVC_AUDIT_DATA_INIT(&ad,NET);
3688 ad.u.net.sport = htons(snum);
3689 ad.u.net.family = family;
3690 err = avc_has_perm(isec->sid, sid,
3691 isec->sclass,
3692 SOCKET__NAME_BIND, &ad);
3693 if (err)
3694 goto out;
3695 }
3696 }
3697
3698 switch(isec->sclass) {
3699 case SECCLASS_TCP_SOCKET:
3700 node_perm = TCP_SOCKET__NODE_BIND;
3701 break;
3702
3703 case SECCLASS_UDP_SOCKET:
3704 node_perm = UDP_SOCKET__NODE_BIND;
3705 break;
3706
3707 case SECCLASS_DCCP_SOCKET:
3708 node_perm = DCCP_SOCKET__NODE_BIND;
3709 break;
3710
3711 default:
3712 node_perm = RAWIP_SOCKET__NODE_BIND;
3713 break;
3714 }
3715
3716 err = sel_netnode_sid(addrp, family, &sid);
3717 if (err)
3718 goto out;
3719
3720 AVC_AUDIT_DATA_INIT(&ad,NET);
3721 ad.u.net.sport = htons(snum);
3722 ad.u.net.family = family;
3723
3724 if (family == PF_INET)
3725 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3726 else
3727 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3728
3729 err = avc_has_perm(isec->sid, sid,
3730 isec->sclass, node_perm, &ad);
3731 if (err)
3732 goto out;
3733 }
3734 out:
3735 return err;
3736 }
3737
3738 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3739 {
3740 struct inode_security_struct *isec;
3741 int err;
3742
3743 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3744 if (err)
3745 return err;
3746
3747 /*
3748 * If a TCP or DCCP socket, check name_connect permission for the port.
3749 */
3750 isec = SOCK_INODE(sock)->i_security;
3751 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3752 isec->sclass == SECCLASS_DCCP_SOCKET) {
3753 struct sock *sk = sock->sk;
3754 struct avc_audit_data ad;
3755 struct sockaddr_in *addr4 = NULL;
3756 struct sockaddr_in6 *addr6 = NULL;
3757 unsigned short snum;
3758 u32 sid, perm;
3759
3760 if (sk->sk_family == PF_INET) {
3761 addr4 = (struct sockaddr_in *)address;
3762 if (addrlen < sizeof(struct sockaddr_in))
3763 return -EINVAL;
3764 snum = ntohs(addr4->sin_port);
3765 } else {
3766 addr6 = (struct sockaddr_in6 *)address;
3767 if (addrlen < SIN6_LEN_RFC2133)
3768 return -EINVAL;
3769 snum = ntohs(addr6->sin6_port);
3770 }
3771
3772 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3773 if (err)
3774 goto out;
3775
3776 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3777 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3778
3779 AVC_AUDIT_DATA_INIT(&ad,NET);
3780 ad.u.net.dport = htons(snum);
3781 ad.u.net.family = sk->sk_family;
3782 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3783 if (err)
3784 goto out;
3785 }
3786
3787 out:
3788 return err;
3789 }
3790
3791 static int selinux_socket_listen(struct socket *sock, int backlog)
3792 {
3793 return socket_has_perm(current, sock, SOCKET__LISTEN);
3794 }
3795
3796 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3797 {
3798 int err;
3799 struct inode_security_struct *isec;
3800 struct inode_security_struct *newisec;
3801
3802 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3803 if (err)
3804 return err;
3805
3806 newisec = SOCK_INODE(newsock)->i_security;
3807
3808 isec = SOCK_INODE(sock)->i_security;
3809 newisec->sclass = isec->sclass;
3810 newisec->sid = isec->sid;
3811 newisec->initialized = 1;
3812
3813 return 0;
3814 }
3815
3816 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3817 int size)
3818 {
3819 int rc;
3820
3821 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3822 if (rc)
3823 return rc;
3824
3825 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3826 }
3827
3828 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3829 int size, int flags)
3830 {
3831 return socket_has_perm(current, sock, SOCKET__READ);
3832 }
3833
3834 static int selinux_socket_getsockname(struct socket *sock)
3835 {
3836 return socket_has_perm(current, sock, SOCKET__GETATTR);
3837 }
3838
3839 static int selinux_socket_getpeername(struct socket *sock)
3840 {
3841 return socket_has_perm(current, sock, SOCKET__GETATTR);
3842 }
3843
3844 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3845 {
3846 int err;
3847
3848 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3849 if (err)
3850 return err;
3851
3852 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3853 }
3854
3855 static int selinux_socket_getsockopt(struct socket *sock, int level,
3856 int optname)
3857 {
3858 return socket_has_perm(current, sock, SOCKET__GETOPT);
3859 }
3860
3861 static int selinux_socket_shutdown(struct socket *sock, int how)
3862 {
3863 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3864 }
3865
3866 static int selinux_socket_unix_stream_connect(struct socket *sock,
3867 struct socket *other,
3868 struct sock *newsk)
3869 {
3870 struct sk_security_struct *ssec;
3871 struct inode_security_struct *isec;
3872 struct inode_security_struct *other_isec;
3873 struct avc_audit_data ad;
3874 int err;
3875
3876 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3877 if (err)
3878 return err;
3879
3880 isec = SOCK_INODE(sock)->i_security;
3881 other_isec = SOCK_INODE(other)->i_security;
3882
3883 AVC_AUDIT_DATA_INIT(&ad,NET);
3884 ad.u.net.sk = other->sk;
3885
3886 err = avc_has_perm(isec->sid, other_isec->sid,
3887 isec->sclass,
3888 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3889 if (err)
3890 return err;
3891
3892 /* connecting socket */
3893 ssec = sock->sk->sk_security;
3894 ssec->peer_sid = other_isec->sid;
3895
3896 /* server child socket */
3897 ssec = newsk->sk_security;
3898 ssec->peer_sid = isec->sid;
3899 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3900
3901 return err;
3902 }
3903
3904 static int selinux_socket_unix_may_send(struct socket *sock,
3905 struct socket *other)
3906 {
3907 struct inode_security_struct *isec;
3908 struct inode_security_struct *other_isec;
3909 struct avc_audit_data ad;
3910 int err;
3911
3912 isec = SOCK_INODE(sock)->i_security;
3913 other_isec = SOCK_INODE(other)->i_security;
3914
3915 AVC_AUDIT_DATA_INIT(&ad,NET);
3916 ad.u.net.sk = other->sk;
3917
3918 err = avc_has_perm(isec->sid, other_isec->sid,
3919 isec->sclass, SOCKET__SENDTO, &ad);
3920 if (err)
3921 return err;
3922
3923 return 0;
3924 }
3925
3926 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3927 u32 peer_sid,
3928 struct avc_audit_data *ad)
3929 {
3930 int err;
3931 u32 if_sid;
3932 u32 node_sid;
3933
3934 err = sel_netif_sid(ifindex, &if_sid);
3935 if (err)
3936 return err;
3937 err = avc_has_perm(peer_sid, if_sid,
3938 SECCLASS_NETIF, NETIF__INGRESS, ad);
3939 if (err)
3940 return err;
3941
3942 err = sel_netnode_sid(addrp, family, &node_sid);
3943 if (err)
3944 return err;
3945 return avc_has_perm(peer_sid, node_sid,
3946 SECCLASS_NODE, NODE__RECVFROM, ad);
3947 }
3948
3949 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3950 struct sk_buff *skb,
3951 struct avc_audit_data *ad,
3952 u16 family,
3953 char *addrp)
3954 {
3955 int err;
3956 struct sk_security_struct *sksec = sk->sk_security;
3957 u16 sk_class;
3958 u32 netif_perm, node_perm, recv_perm;
3959 u32 port_sid, node_sid, if_sid, sk_sid;
3960
3961 sk_sid = sksec->sid;
3962 sk_class = sksec->sclass;
3963
3964 switch (sk_class) {
3965 case SECCLASS_UDP_SOCKET:
3966 netif_perm = NETIF__UDP_RECV;
3967 node_perm = NODE__UDP_RECV;
3968 recv_perm = UDP_SOCKET__RECV_MSG;
3969 break;
3970 case SECCLASS_TCP_SOCKET:
3971 netif_perm = NETIF__TCP_RECV;
3972 node_perm = NODE__TCP_RECV;
3973 recv_perm = TCP_SOCKET__RECV_MSG;
3974 break;
3975 case SECCLASS_DCCP_SOCKET:
3976 netif_perm = NETIF__DCCP_RECV;
3977 node_perm = NODE__DCCP_RECV;
3978 recv_perm = DCCP_SOCKET__RECV_MSG;
3979 break;
3980 default:
3981 netif_perm = NETIF__RAWIP_RECV;
3982 node_perm = NODE__RAWIP_RECV;
3983 recv_perm = 0;
3984 break;
3985 }
3986
3987 err = sel_netif_sid(skb->iif, &if_sid);
3988 if (err)
3989 return err;
3990 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3991 if (err)
3992 return err;
3993
3994 err = sel_netnode_sid(addrp, family, &node_sid);
3995 if (err)
3996 return err;
3997 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3998 if (err)
3999 return err;
4000
4001 if (!recv_perm)
4002 return 0;
4003 err = sel_netport_sid(sk->sk_protocol,
4004 ntohs(ad->u.net.sport), &port_sid);
4005 if (unlikely(err)) {
4006 printk(KERN_WARNING
4007 "SELinux: failure in"
4008 " selinux_sock_rcv_skb_iptables_compat(),"
4009 " network port label not found\n");
4010 return err;
4011 }
4012 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4013 }
4014
4015 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4016 struct avc_audit_data *ad,
4017 u16 family, char *addrp)
4018 {
4019 int err;
4020 struct sk_security_struct *sksec = sk->sk_security;
4021 u32 peer_sid;
4022 u32 sk_sid = sksec->sid;
4023
4024 if (selinux_compat_net)
4025 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4026 family, addrp);
4027 else
4028 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4029 PACKET__RECV, ad);
4030 if (err)
4031 return err;
4032
4033 if (selinux_policycap_netpeer) {
4034 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4035 if (err)
4036 return err;
4037 err = avc_has_perm(sk_sid, peer_sid,
4038 SECCLASS_PEER, PEER__RECV, ad);
4039 } else {
4040 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4041 if (err)
4042 return err;
4043 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4044 }
4045
4046 return err;
4047 }
4048
4049 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4050 {
4051 int err;
4052 struct sk_security_struct *sksec = sk->sk_security;
4053 u16 family = sk->sk_family;
4054 u32 sk_sid = sksec->sid;
4055 struct avc_audit_data ad;
4056 char *addrp;
4057
4058 if (family != PF_INET && family != PF_INET6)
4059 return 0;
4060
4061 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4062 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4063 family = PF_INET;
4064
4065 AVC_AUDIT_DATA_INIT(&ad, NET);
4066 ad.u.net.netif = skb->iif;
4067 ad.u.net.family = family;
4068 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4069 if (err)
4070 return err;
4071
4072 /* If any sort of compatibility mode is enabled then handoff processing
4073 * to the selinux_sock_rcv_skb_compat() function to deal with the
4074 * special handling. We do this in an attempt to keep this function
4075 * as fast and as clean as possible. */
4076 if (selinux_compat_net || !selinux_policycap_netpeer)
4077 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4078 family, addrp);
4079
4080 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4081 u32 peer_sid;
4082
4083 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4084 if (err)
4085 return err;
4086 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4087 peer_sid, &ad);
4088 if (err)
4089 return err;
4090 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4091 PEER__RECV, &ad);
4092 }
4093
4094 if (selinux_secmark_enabled()) {
4095 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4096 PACKET__RECV, &ad);
4097 if (err)
4098 return err;
4099 }
4100
4101 return err;
4102 }
4103
4104 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4105 int __user *optlen, unsigned len)
4106 {
4107 int err = 0;
4108 char *scontext;
4109 u32 scontext_len;
4110 struct sk_security_struct *ssec;
4111 struct inode_security_struct *isec;
4112 u32 peer_sid = SECSID_NULL;
4113
4114 isec = SOCK_INODE(sock)->i_security;
4115
4116 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4117 isec->sclass == SECCLASS_TCP_SOCKET) {
4118 ssec = sock->sk->sk_security;
4119 peer_sid = ssec->peer_sid;
4120 }
4121 if (peer_sid == SECSID_NULL) {
4122 err = -ENOPROTOOPT;
4123 goto out;
4124 }
4125
4126 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4127
4128 if (err)
4129 goto out;
4130
4131 if (scontext_len > len) {
4132 err = -ERANGE;
4133 goto out_len;
4134 }
4135
4136 if (copy_to_user(optval, scontext, scontext_len))
4137 err = -EFAULT;
4138
4139 out_len:
4140 if (put_user(scontext_len, optlen))
4141 err = -EFAULT;
4142
4143 kfree(scontext);
4144 out:
4145 return err;
4146 }
4147
4148 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4149 {
4150 u32 peer_secid = SECSID_NULL;
4151 u16 family;
4152
4153 if (sock)
4154 family = sock->sk->sk_family;
4155 else if (skb && skb->sk)
4156 family = skb->sk->sk_family;
4157 else
4158 goto out;
4159
4160 if (sock && family == PF_UNIX)
4161 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4162 else if (skb)
4163 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4164
4165 out:
4166 *secid = peer_secid;
4167 if (peer_secid == SECSID_NULL)
4168 return -EINVAL;
4169 return 0;
4170 }
4171
4172 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4173 {
4174 return sk_alloc_security(sk, family, priority);
4175 }
4176
4177 static void selinux_sk_free_security(struct sock *sk)
4178 {
4179 sk_free_security(sk);
4180 }
4181
4182 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4183 {
4184 struct sk_security_struct *ssec = sk->sk_security;
4185 struct sk_security_struct *newssec = newsk->sk_security;
4186
4187 newssec->sid = ssec->sid;
4188 newssec->peer_sid = ssec->peer_sid;
4189 newssec->sclass = ssec->sclass;
4190
4191 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4192 }
4193
4194 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4195 {
4196 if (!sk)
4197 *secid = SECINITSID_ANY_SOCKET;
4198 else {
4199 struct sk_security_struct *sksec = sk->sk_security;
4200
4201 *secid = sksec->sid;
4202 }
4203 }
4204
4205 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4206 {
4207 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4208 struct sk_security_struct *sksec = sk->sk_security;
4209
4210 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4211 sk->sk_family == PF_UNIX)
4212 isec->sid = sksec->sid;
4213 sksec->sclass = isec->sclass;
4214
4215 selinux_netlbl_sock_graft(sk, parent);
4216 }
4217
4218 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4219 struct request_sock *req)
4220 {
4221 struct sk_security_struct *sksec = sk->sk_security;
4222 int err;
4223 u32 newsid;
4224 u32 peersid;
4225
4226 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4227 if (err)
4228 return err;
4229 if (peersid == SECSID_NULL) {
4230 req->secid = sksec->sid;
4231 req->peer_secid = SECSID_NULL;
4232 return 0;
4233 }
4234
4235 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4236 if (err)
4237 return err;
4238
4239 req->secid = newsid;
4240 req->peer_secid = peersid;
4241 return 0;
4242 }
4243
4244 static void selinux_inet_csk_clone(struct sock *newsk,
4245 const struct request_sock *req)
4246 {
4247 struct sk_security_struct *newsksec = newsk->sk_security;
4248
4249 newsksec->sid = req->secid;
4250 newsksec->peer_sid = req->peer_secid;
4251 /* NOTE: Ideally, we should also get the isec->sid for the
4252 new socket in sync, but we don't have the isec available yet.
4253 So we will wait until sock_graft to do it, by which
4254 time it will have been created and available. */
4255
4256 /* We don't need to take any sort of lock here as we are the only
4257 * thread with access to newsksec */
4258 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4259 }
4260
4261 static void selinux_inet_conn_established(struct sock *sk,
4262 struct sk_buff *skb)
4263 {
4264 struct sk_security_struct *sksec = sk->sk_security;
4265
4266 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4267 }
4268
4269 static void selinux_req_classify_flow(const struct request_sock *req,
4270 struct flowi *fl)
4271 {
4272 fl->secid = req->secid;
4273 }
4274
4275 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4276 {
4277 int err = 0;
4278 u32 perm;
4279 struct nlmsghdr *nlh;
4280 struct socket *sock = sk->sk_socket;
4281 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4282
4283 if (skb->len < NLMSG_SPACE(0)) {
4284 err = -EINVAL;
4285 goto out;
4286 }
4287 nlh = nlmsg_hdr(skb);
4288
4289 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4290 if (err) {
4291 if (err == -EINVAL) {
4292 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4293 "SELinux: unrecognized netlink message"
4294 " type=%hu for sclass=%hu\n",
4295 nlh->nlmsg_type, isec->sclass);
4296 if (!selinux_enforcing)
4297 err = 0;
4298 }
4299
4300 /* Ignore */
4301 if (err == -ENOENT)
4302 err = 0;
4303 goto out;
4304 }
4305
4306 err = socket_has_perm(current, sock, perm);
4307 out:
4308 return err;
4309 }
4310
4311 #ifdef CONFIG_NETFILTER
4312
4313 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4314 u16 family)
4315 {
4316 char *addrp;
4317 u32 peer_sid;
4318 struct avc_audit_data ad;
4319 u8 secmark_active;
4320 u8 peerlbl_active;
4321
4322 if (!selinux_policycap_netpeer)
4323 return NF_ACCEPT;
4324
4325 secmark_active = selinux_secmark_enabled();
4326 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4327 if (!secmark_active && !peerlbl_active)
4328 return NF_ACCEPT;
4329
4330 AVC_AUDIT_DATA_INIT(&ad, NET);
4331 ad.u.net.netif = ifindex;
4332 ad.u.net.family = family;
4333 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4334 return NF_DROP;
4335
4336 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4337 return NF_DROP;
4338
4339 if (peerlbl_active)
4340 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4341 peer_sid, &ad) != 0)
4342 return NF_DROP;
4343
4344 if (secmark_active)
4345 if (avc_has_perm(peer_sid, skb->secmark,
4346 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4347 return NF_DROP;
4348
4349 return NF_ACCEPT;
4350 }
4351
4352 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4353 struct sk_buff *skb,
4354 const struct net_device *in,
4355 const struct net_device *out,
4356 int (*okfn)(struct sk_buff *))
4357 {
4358 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4359 }
4360
4361 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4362 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4363 struct sk_buff *skb,
4364 const struct net_device *in,
4365 const struct net_device *out,
4366 int (*okfn)(struct sk_buff *))
4367 {
4368 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4369 }
4370 #endif /* IPV6 */
4371
4372 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4373 int ifindex,
4374 struct avc_audit_data *ad,
4375 u16 family, char *addrp)
4376 {
4377 int err;
4378 struct sk_security_struct *sksec = sk->sk_security;
4379 u16 sk_class;
4380 u32 netif_perm, node_perm, send_perm;
4381 u32 port_sid, node_sid, if_sid, sk_sid;
4382
4383 sk_sid = sksec->sid;
4384 sk_class = sksec->sclass;
4385
4386 switch (sk_class) {
4387 case SECCLASS_UDP_SOCKET:
4388 netif_perm = NETIF__UDP_SEND;
4389 node_perm = NODE__UDP_SEND;
4390 send_perm = UDP_SOCKET__SEND_MSG;
4391 break;
4392 case SECCLASS_TCP_SOCKET:
4393 netif_perm = NETIF__TCP_SEND;
4394 node_perm = NODE__TCP_SEND;
4395 send_perm = TCP_SOCKET__SEND_MSG;
4396 break;
4397 case SECCLASS_DCCP_SOCKET:
4398 netif_perm = NETIF__DCCP_SEND;
4399 node_perm = NODE__DCCP_SEND;
4400 send_perm = DCCP_SOCKET__SEND_MSG;
4401 break;
4402 default:
4403 netif_perm = NETIF__RAWIP_SEND;
4404 node_perm = NODE__RAWIP_SEND;
4405 send_perm = 0;
4406 break;
4407 }
4408
4409 err = sel_netif_sid(ifindex, &if_sid);
4410 if (err)
4411 return err;
4412 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4413 return err;
4414
4415 err = sel_netnode_sid(addrp, family, &node_sid);
4416 if (err)
4417 return err;
4418 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4419 if (err)
4420 return err;
4421
4422 if (send_perm != 0)
4423 return 0;
4424
4425 err = sel_netport_sid(sk->sk_protocol,
4426 ntohs(ad->u.net.dport), &port_sid);
4427 if (unlikely(err)) {
4428 printk(KERN_WARNING
4429 "SELinux: failure in"
4430 " selinux_ip_postroute_iptables_compat(),"
4431 " network port label not found\n");
4432 return err;
4433 }
4434 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4435 }
4436
4437 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4438 int ifindex,
4439 struct avc_audit_data *ad,
4440 u16 family,
4441 char *addrp,
4442 u8 proto)
4443 {
4444 struct sock *sk = skb->sk;
4445 struct sk_security_struct *sksec;
4446
4447 if (sk == NULL)
4448 return NF_ACCEPT;
4449 sksec = sk->sk_security;
4450
4451 if (selinux_compat_net) {
4452 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4453 ad, family, addrp))
4454 return NF_DROP;
4455 } else {
4456 if (avc_has_perm(sksec->sid, skb->secmark,
4457 SECCLASS_PACKET, PACKET__SEND, ad))
4458 return NF_DROP;
4459 }
4460
4461 if (selinux_policycap_netpeer)
4462 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4463 return NF_DROP;
4464
4465 return NF_ACCEPT;
4466 }
4467
4468 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4469 u16 family)
4470 {
4471 u32 secmark_perm;
4472 u32 peer_sid;
4473 struct sock *sk;
4474 struct avc_audit_data ad;
4475 char *addrp;
4476 u8 proto;
4477 u8 secmark_active;
4478 u8 peerlbl_active;
4479
4480 AVC_AUDIT_DATA_INIT(&ad, NET);
4481 ad.u.net.netif = ifindex;
4482 ad.u.net.family = family;
4483 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4484 return NF_DROP;
4485
4486 /* If any sort of compatibility mode is enabled then handoff processing
4487 * to the selinux_ip_postroute_compat() function to deal with the
4488 * special handling. We do this in an attempt to keep this function
4489 * as fast and as clean as possible. */
4490 if (selinux_compat_net || !selinux_policycap_netpeer)
4491 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4492 family, addrp, proto);
4493
4494 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4495 * packet transformation so allow the packet to pass without any checks
4496 * since we'll have another chance to perform access control checks
4497 * when the packet is on it's final way out.
4498 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4499 * is NULL, in this case go ahead and apply access control. */
4500 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4501 return NF_ACCEPT;
4502
4503 secmark_active = selinux_secmark_enabled();
4504 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4505 if (!secmark_active && !peerlbl_active)
4506 return NF_ACCEPT;
4507
4508 /* if the packet is locally generated (skb->sk != NULL) then use the
4509 * socket's label as the peer label, otherwise the packet is being
4510 * forwarded through this system and we need to fetch the peer label
4511 * directly from the packet */
4512 sk = skb->sk;
4513 if (sk) {
4514 struct sk_security_struct *sksec = sk->sk_security;
4515 peer_sid = sksec->sid;
4516 secmark_perm = PACKET__SEND;
4517 } else {
4518 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4519 return NF_DROP;
4520 secmark_perm = PACKET__FORWARD_OUT;
4521 }
4522
4523 if (secmark_active)
4524 if (avc_has_perm(peer_sid, skb->secmark,
4525 SECCLASS_PACKET, secmark_perm, &ad))
4526 return NF_DROP;
4527
4528 if (peerlbl_active) {
4529 u32 if_sid;
4530 u32 node_sid;
4531
4532 if (sel_netif_sid(ifindex, &if_sid))
4533 return NF_DROP;
4534 if (avc_has_perm(peer_sid, if_sid,
4535 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4536 return NF_DROP;
4537
4538 if (sel_netnode_sid(addrp, family, &node_sid))
4539 return NF_DROP;
4540 if (avc_has_perm(peer_sid, node_sid,
4541 SECCLASS_NODE, NODE__SENDTO, &ad))
4542 return NF_DROP;
4543 }
4544
4545 return NF_ACCEPT;
4546 }
4547
4548 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4549 struct sk_buff *skb,
4550 const struct net_device *in,
4551 const struct net_device *out,
4552 int (*okfn)(struct sk_buff *))
4553 {
4554 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4555 }
4556
4557 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4558 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4559 struct sk_buff *skb,
4560 const struct net_device *in,
4561 const struct net_device *out,
4562 int (*okfn)(struct sk_buff *))
4563 {
4564 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4565 }
4566 #endif /* IPV6 */
4567
4568 #endif /* CONFIG_NETFILTER */
4569
4570 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4571 {
4572 int err;
4573
4574 err = secondary_ops->netlink_send(sk, skb);
4575 if (err)
4576 return err;
4577
4578 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4579 err = selinux_nlmsg_perm(sk, skb);
4580
4581 return err;
4582 }
4583
4584 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4585 {
4586 int err;
4587 struct avc_audit_data ad;
4588
4589 err = secondary_ops->netlink_recv(skb, capability);
4590 if (err)
4591 return err;
4592
4593 AVC_AUDIT_DATA_INIT(&ad, CAP);
4594 ad.u.cap = capability;
4595
4596 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4597 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4598 }
4599
4600 static int ipc_alloc_security(struct task_struct *task,
4601 struct kern_ipc_perm *perm,
4602 u16 sclass)
4603 {
4604 struct task_security_struct *tsec = task->security;
4605 struct ipc_security_struct *isec;
4606
4607 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4608 if (!isec)
4609 return -ENOMEM;
4610
4611 isec->sclass = sclass;
4612 isec->sid = tsec->sid;
4613 perm->security = isec;
4614
4615 return 0;
4616 }
4617
4618 static void ipc_free_security(struct kern_ipc_perm *perm)
4619 {
4620 struct ipc_security_struct *isec = perm->security;
4621 perm->security = NULL;
4622 kfree(isec);
4623 }
4624
4625 static int msg_msg_alloc_security(struct msg_msg *msg)
4626 {
4627 struct msg_security_struct *msec;
4628
4629 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4630 if (!msec)
4631 return -ENOMEM;
4632
4633 msec->sid = SECINITSID_UNLABELED;
4634 msg->security = msec;
4635
4636 return 0;
4637 }
4638
4639 static void msg_msg_free_security(struct msg_msg *msg)
4640 {
4641 struct msg_security_struct *msec = msg->security;
4642
4643 msg->security = NULL;
4644 kfree(msec);
4645 }
4646
4647 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4648 u32 perms)
4649 {
4650 struct task_security_struct *tsec;
4651 struct ipc_security_struct *isec;
4652 struct avc_audit_data ad;
4653
4654 tsec = current->security;
4655 isec = ipc_perms->security;
4656
4657 AVC_AUDIT_DATA_INIT(&ad, IPC);
4658 ad.u.ipc_id = ipc_perms->key;
4659
4660 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4661 }
4662
4663 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4664 {
4665 return msg_msg_alloc_security(msg);
4666 }
4667
4668 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4669 {
4670 msg_msg_free_security(msg);
4671 }
4672
4673 /* message queue security operations */
4674 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4675 {
4676 struct task_security_struct *tsec;
4677 struct ipc_security_struct *isec;
4678 struct avc_audit_data ad;
4679 int rc;
4680
4681 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4682 if (rc)
4683 return rc;
4684
4685 tsec = current->security;
4686 isec = msq->q_perm.security;
4687
4688 AVC_AUDIT_DATA_INIT(&ad, IPC);
4689 ad.u.ipc_id = msq->q_perm.key;
4690
4691 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4692 MSGQ__CREATE, &ad);
4693 if (rc) {
4694 ipc_free_security(&msq->q_perm);
4695 return rc;
4696 }
4697 return 0;
4698 }
4699
4700 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4701 {
4702 ipc_free_security(&msq->q_perm);
4703 }
4704
4705 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4706 {
4707 struct task_security_struct *tsec;
4708 struct ipc_security_struct *isec;
4709 struct avc_audit_data ad;
4710
4711 tsec = current->security;
4712 isec = msq->q_perm.security;
4713
4714 AVC_AUDIT_DATA_INIT(&ad, IPC);
4715 ad.u.ipc_id = msq->q_perm.key;
4716
4717 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4718 MSGQ__ASSOCIATE, &ad);
4719 }
4720
4721 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4722 {
4723 int err;
4724 int perms;
4725
4726 switch(cmd) {
4727 case IPC_INFO:
4728 case MSG_INFO:
4729 /* No specific object, just general system-wide information. */
4730 return task_has_system(current, SYSTEM__IPC_INFO);
4731 case IPC_STAT:
4732 case MSG_STAT:
4733 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4734 break;
4735 case IPC_SET:
4736 perms = MSGQ__SETATTR;
4737 break;
4738 case IPC_RMID:
4739 perms = MSGQ__DESTROY;
4740 break;
4741 default:
4742 return 0;
4743 }
4744
4745 err = ipc_has_perm(&msq->q_perm, perms);
4746 return err;
4747 }
4748
4749 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4750 {
4751 struct task_security_struct *tsec;
4752 struct ipc_security_struct *isec;
4753 struct msg_security_struct *msec;
4754 struct avc_audit_data ad;
4755 int rc;
4756
4757 tsec = current->security;
4758 isec = msq->q_perm.security;
4759 msec = msg->security;
4760
4761 /*
4762 * First time through, need to assign label to the message
4763 */
4764 if (msec->sid == SECINITSID_UNLABELED) {
4765 /*
4766 * Compute new sid based on current process and
4767 * message queue this message will be stored in
4768 */
4769 rc = security_transition_sid(tsec->sid,
4770 isec->sid,
4771 SECCLASS_MSG,
4772 &msec->sid);
4773 if (rc)
4774 return rc;
4775 }
4776
4777 AVC_AUDIT_DATA_INIT(&ad, IPC);
4778 ad.u.ipc_id = msq->q_perm.key;
4779
4780 /* Can this process write to the queue? */
4781 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4782 MSGQ__WRITE, &ad);
4783 if (!rc)
4784 /* Can this process send the message */
4785 rc = avc_has_perm(tsec->sid, msec->sid,
4786 SECCLASS_MSG, MSG__SEND, &ad);
4787 if (!rc)
4788 /* Can the message be put in the queue? */
4789 rc = avc_has_perm(msec->sid, isec->sid,
4790 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4791
4792 return rc;
4793 }
4794
4795 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4796 struct task_struct *target,
4797 long type, int mode)
4798 {
4799 struct task_security_struct *tsec;
4800 struct ipc_security_struct *isec;
4801 struct msg_security_struct *msec;
4802 struct avc_audit_data ad;
4803 int rc;
4804
4805 tsec = target->security;
4806 isec = msq->q_perm.security;
4807 msec = msg->security;
4808
4809 AVC_AUDIT_DATA_INIT(&ad, IPC);
4810 ad.u.ipc_id = msq->q_perm.key;
4811
4812 rc = avc_has_perm(tsec->sid, isec->sid,
4813 SECCLASS_MSGQ, MSGQ__READ, &ad);
4814 if (!rc)
4815 rc = avc_has_perm(tsec->sid, msec->sid,
4816 SECCLASS_MSG, MSG__RECEIVE, &ad);
4817 return rc;
4818 }
4819
4820 /* Shared Memory security operations */
4821 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4822 {
4823 struct task_security_struct *tsec;
4824 struct ipc_security_struct *isec;
4825 struct avc_audit_data ad;
4826 int rc;
4827
4828 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4829 if (rc)
4830 return rc;
4831
4832 tsec = current->security;
4833 isec = shp->shm_perm.security;
4834
4835 AVC_AUDIT_DATA_INIT(&ad, IPC);
4836 ad.u.ipc_id = shp->shm_perm.key;
4837
4838 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4839 SHM__CREATE, &ad);
4840 if (rc) {
4841 ipc_free_security(&shp->shm_perm);
4842 return rc;
4843 }
4844 return 0;
4845 }
4846
4847 static void selinux_shm_free_security(struct shmid_kernel *shp)
4848 {
4849 ipc_free_security(&shp->shm_perm);
4850 }
4851
4852 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4853 {
4854 struct task_security_struct *tsec;
4855 struct ipc_security_struct *isec;
4856 struct avc_audit_data ad;
4857
4858 tsec = current->security;
4859 isec = shp->shm_perm.security;
4860
4861 AVC_AUDIT_DATA_INIT(&ad, IPC);
4862 ad.u.ipc_id = shp->shm_perm.key;
4863
4864 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4865 SHM__ASSOCIATE, &ad);
4866 }
4867
4868 /* Note, at this point, shp is locked down */
4869 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4870 {
4871 int perms;
4872 int err;
4873
4874 switch(cmd) {
4875 case IPC_INFO:
4876 case SHM_INFO:
4877 /* No specific object, just general system-wide information. */
4878 return task_has_system(current, SYSTEM__IPC_INFO);
4879 case IPC_STAT:
4880 case SHM_STAT:
4881 perms = SHM__GETATTR | SHM__ASSOCIATE;
4882 break;
4883 case IPC_SET:
4884 perms = SHM__SETATTR;
4885 break;
4886 case SHM_LOCK:
4887 case SHM_UNLOCK:
4888 perms = SHM__LOCK;
4889 break;
4890 case IPC_RMID:
4891 perms = SHM__DESTROY;
4892 break;
4893 default:
4894 return 0;
4895 }
4896
4897 err = ipc_has_perm(&shp->shm_perm, perms);
4898 return err;
4899 }
4900
4901 static int selinux_shm_shmat(struct shmid_kernel *shp,
4902 char __user *shmaddr, int shmflg)
4903 {
4904 u32 perms;
4905 int rc;
4906
4907 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4908 if (rc)
4909 return rc;
4910
4911 if (shmflg & SHM_RDONLY)
4912 perms = SHM__READ;
4913 else
4914 perms = SHM__READ | SHM__WRITE;
4915
4916 return ipc_has_perm(&shp->shm_perm, perms);
4917 }
4918
4919 /* Semaphore security operations */
4920 static int selinux_sem_alloc_security(struct sem_array *sma)
4921 {
4922 struct task_security_struct *tsec;
4923 struct ipc_security_struct *isec;
4924 struct avc_audit_data ad;
4925 int rc;
4926
4927 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4928 if (rc)
4929 return rc;
4930
4931 tsec = current->security;
4932 isec = sma->sem_perm.security;
4933
4934 AVC_AUDIT_DATA_INIT(&ad, IPC);
4935 ad.u.ipc_id = sma->sem_perm.key;
4936
4937 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4938 SEM__CREATE, &ad);
4939 if (rc) {
4940 ipc_free_security(&sma->sem_perm);
4941 return rc;
4942 }
4943 return 0;
4944 }
4945
4946 static void selinux_sem_free_security(struct sem_array *sma)
4947 {
4948 ipc_free_security(&sma->sem_perm);
4949 }
4950
4951 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4952 {
4953 struct task_security_struct *tsec;
4954 struct ipc_security_struct *isec;
4955 struct avc_audit_data ad;
4956
4957 tsec = current->security;
4958 isec = sma->sem_perm.security;
4959
4960 AVC_AUDIT_DATA_INIT(&ad, IPC);
4961 ad.u.ipc_id = sma->sem_perm.key;
4962
4963 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4964 SEM__ASSOCIATE, &ad);
4965 }
4966
4967 /* Note, at this point, sma is locked down */
4968 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4969 {
4970 int err;
4971 u32 perms;
4972
4973 switch(cmd) {
4974 case IPC_INFO:
4975 case SEM_INFO:
4976 /* No specific object, just general system-wide information. */
4977 return task_has_system(current, SYSTEM__IPC_INFO);
4978 case GETPID:
4979 case GETNCNT:
4980 case GETZCNT:
4981 perms = SEM__GETATTR;
4982 break;
4983 case GETVAL:
4984 case GETALL:
4985 perms = SEM__READ;
4986 break;
4987 case SETVAL:
4988 case SETALL:
4989 perms = SEM__WRITE;
4990 break;
4991 case IPC_RMID:
4992 perms = SEM__DESTROY;
4993 break;
4994 case IPC_SET:
4995 perms = SEM__SETATTR;
4996 break;
4997 case IPC_STAT:
4998 case SEM_STAT:
4999 perms = SEM__GETATTR | SEM__ASSOCIATE;
5000 break;
5001 default:
5002 return 0;
5003 }
5004
5005 err = ipc_has_perm(&sma->sem_perm, perms);
5006 return err;
5007 }
5008
5009 static int selinux_sem_semop(struct sem_array *sma,
5010 struct sembuf *sops, unsigned nsops, int alter)
5011 {
5012 u32 perms;
5013
5014 if (alter)
5015 perms = SEM__READ | SEM__WRITE;
5016 else
5017 perms = SEM__READ;
5018
5019 return ipc_has_perm(&sma->sem_perm, perms);
5020 }
5021
5022 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5023 {
5024 u32 av = 0;
5025
5026 av = 0;
5027 if (flag & S_IRUGO)
5028 av |= IPC__UNIX_READ;
5029 if (flag & S_IWUGO)
5030 av |= IPC__UNIX_WRITE;
5031
5032 if (av == 0)
5033 return 0;
5034
5035 return ipc_has_perm(ipcp, av);
5036 }
5037
5038 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5039 {
5040 struct ipc_security_struct *isec = ipcp->security;
5041 *secid = isec->sid;
5042 }
5043
5044 /* module stacking operations */
5045 static int selinux_register_security (const char *name, struct security_operations *ops)
5046 {
5047 if (secondary_ops != original_ops) {
5048 printk(KERN_ERR "%s: There is already a secondary security "
5049 "module registered.\n", __func__);
5050 return -EINVAL;
5051 }
5052
5053 secondary_ops = ops;
5054
5055 printk(KERN_INFO "%s: Registering secondary module %s\n",
5056 __func__,
5057 name);
5058
5059 return 0;
5060 }
5061
5062 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5063 {
5064 if (inode)
5065 inode_doinit_with_dentry(inode, dentry);
5066 }
5067
5068 static int selinux_getprocattr(struct task_struct *p,
5069 char *name, char **value)
5070 {
5071 struct task_security_struct *tsec;
5072 u32 sid;
5073 int error;
5074 unsigned len;
5075
5076 if (current != p) {
5077 error = task_has_perm(current, p, PROCESS__GETATTR);
5078 if (error)
5079 return error;
5080 }
5081
5082 tsec = p->security;
5083
5084 if (!strcmp(name, "current"))
5085 sid = tsec->sid;
5086 else if (!strcmp(name, "prev"))
5087 sid = tsec->osid;
5088 else if (!strcmp(name, "exec"))
5089 sid = tsec->exec_sid;
5090 else if (!strcmp(name, "fscreate"))
5091 sid = tsec->create_sid;
5092 else if (!strcmp(name, "keycreate"))
5093 sid = tsec->keycreate_sid;
5094 else if (!strcmp(name, "sockcreate"))
5095 sid = tsec->sockcreate_sid;
5096 else
5097 return -EINVAL;
5098
5099 if (!sid)
5100 return 0;
5101
5102 error = security_sid_to_context(sid, value, &len);
5103 if (error)
5104 return error;
5105 return len;
5106 }
5107
5108 static int selinux_setprocattr(struct task_struct *p,
5109 char *name, void *value, size_t size)
5110 {
5111 struct task_security_struct *tsec;
5112 struct task_struct *tracer;
5113 u32 sid = 0;
5114 int error;
5115 char *str = value;
5116
5117 if (current != p) {
5118 /* SELinux only allows a process to change its own
5119 security attributes. */
5120 return -EACCES;
5121 }
5122
5123 /*
5124 * Basic control over ability to set these attributes at all.
5125 * current == p, but we'll pass them separately in case the
5126 * above restriction is ever removed.
5127 */
5128 if (!strcmp(name, "exec"))
5129 error = task_has_perm(current, p, PROCESS__SETEXEC);
5130 else if (!strcmp(name, "fscreate"))
5131 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5132 else if (!strcmp(name, "keycreate"))
5133 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5134 else if (!strcmp(name, "sockcreate"))
5135 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5136 else if (!strcmp(name, "current"))
5137 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5138 else
5139 error = -EINVAL;
5140 if (error)
5141 return error;
5142
5143 /* Obtain a SID for the context, if one was specified. */
5144 if (size && str[1] && str[1] != '\n') {
5145 if (str[size-1] == '\n') {
5146 str[size-1] = 0;
5147 size--;
5148 }
5149 error = security_context_to_sid(value, size, &sid);
5150 if (error)
5151 return error;
5152 }
5153
5154 /* Permission checking based on the specified context is
5155 performed during the actual operation (execve,
5156 open/mkdir/...), when we know the full context of the
5157 operation. See selinux_bprm_set_security for the execve
5158 checks and may_create for the file creation checks. The
5159 operation will then fail if the context is not permitted. */
5160 tsec = p->security;
5161 if (!strcmp(name, "exec"))
5162 tsec->exec_sid = sid;
5163 else if (!strcmp(name, "fscreate"))
5164 tsec->create_sid = sid;
5165 else if (!strcmp(name, "keycreate")) {
5166 error = may_create_key(sid, p);
5167 if (error)
5168 return error;
5169 tsec->keycreate_sid = sid;
5170 } else if (!strcmp(name, "sockcreate"))
5171 tsec->sockcreate_sid = sid;
5172 else if (!strcmp(name, "current")) {
5173 struct av_decision avd;
5174
5175 if (sid == 0)
5176 return -EINVAL;
5177
5178 /* Only allow single threaded processes to change context */
5179 if (atomic_read(&p->mm->mm_users) != 1) {
5180 struct task_struct *g, *t;
5181 struct mm_struct *mm = p->mm;
5182 read_lock(&tasklist_lock);
5183 do_each_thread(g, t)
5184 if (t->mm == mm && t != p) {
5185 read_unlock(&tasklist_lock);
5186 return -EPERM;
5187 }
5188 while_each_thread(g, t);
5189 read_unlock(&tasklist_lock);
5190 }
5191
5192 /* Check permissions for the transition. */
5193 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5194 PROCESS__DYNTRANSITION, NULL);
5195 if (error)
5196 return error;
5197
5198 /* Check for ptracing, and update the task SID if ok.
5199 Otherwise, leave SID unchanged and fail. */
5200 task_lock(p);
5201 rcu_read_lock();
5202 tracer = task_tracer_task(p);
5203 if (tracer != NULL) {
5204 struct task_security_struct *ptsec = tracer->security;
5205 u32 ptsid = ptsec->sid;
5206 rcu_read_unlock();
5207 error = avc_has_perm_noaudit(ptsid, sid,
5208 SECCLASS_PROCESS,
5209 PROCESS__PTRACE, 0, &avd);
5210 if (!error)
5211 tsec->sid = sid;
5212 task_unlock(p);
5213 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5214 PROCESS__PTRACE, &avd, error, NULL);
5215 if (error)
5216 return error;
5217 } else {
5218 rcu_read_unlock();
5219 tsec->sid = sid;
5220 task_unlock(p);
5221 }
5222 }
5223 else
5224 return -EINVAL;
5225
5226 return size;
5227 }
5228
5229 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5230 {
5231 return security_sid_to_context(secid, secdata, seclen);
5232 }
5233
5234 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5235 {
5236 return security_context_to_sid(secdata, seclen, secid);
5237 }
5238
5239 static void selinux_release_secctx(char *secdata, u32 seclen)
5240 {
5241 kfree(secdata);
5242 }
5243
5244 #ifdef CONFIG_KEYS
5245
5246 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5247 unsigned long flags)
5248 {
5249 struct task_security_struct *tsec = tsk->security;
5250 struct key_security_struct *ksec;
5251
5252 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5253 if (!ksec)
5254 return -ENOMEM;
5255
5256 if (tsec->keycreate_sid)
5257 ksec->sid = tsec->keycreate_sid;
5258 else
5259 ksec->sid = tsec->sid;
5260 k->security = ksec;
5261
5262 return 0;
5263 }
5264
5265 static void selinux_key_free(struct key *k)
5266 {
5267 struct key_security_struct *ksec = k->security;
5268
5269 k->security = NULL;
5270 kfree(ksec);
5271 }
5272
5273 static int selinux_key_permission(key_ref_t key_ref,
5274 struct task_struct *ctx,
5275 key_perm_t perm)
5276 {
5277 struct key *key;
5278 struct task_security_struct *tsec;
5279 struct key_security_struct *ksec;
5280
5281 key = key_ref_to_ptr(key_ref);
5282
5283 tsec = ctx->security;
5284 ksec = key->security;
5285
5286 /* if no specific permissions are requested, we skip the
5287 permission check. No serious, additional covert channels
5288 appear to be created. */
5289 if (perm == 0)
5290 return 0;
5291
5292 return avc_has_perm(tsec->sid, ksec->sid,
5293 SECCLASS_KEY, perm, NULL);
5294 }
5295
5296 #endif
5297
5298 static struct security_operations selinux_ops = {
5299 .name = "selinux",
5300
5301 .ptrace = selinux_ptrace,
5302 .capget = selinux_capget,
5303 .capset_check = selinux_capset_check,
5304 .capset_set = selinux_capset_set,
5305 .sysctl = selinux_sysctl,
5306 .capable = selinux_capable,
5307 .quotactl = selinux_quotactl,
5308 .quota_on = selinux_quota_on,
5309 .syslog = selinux_syslog,
5310 .vm_enough_memory = selinux_vm_enough_memory,
5311
5312 .netlink_send = selinux_netlink_send,
5313 .netlink_recv = selinux_netlink_recv,
5314
5315 .bprm_alloc_security = selinux_bprm_alloc_security,
5316 .bprm_free_security = selinux_bprm_free_security,
5317 .bprm_apply_creds = selinux_bprm_apply_creds,
5318 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5319 .bprm_set_security = selinux_bprm_set_security,
5320 .bprm_check_security = selinux_bprm_check_security,
5321 .bprm_secureexec = selinux_bprm_secureexec,
5322
5323 .sb_alloc_security = selinux_sb_alloc_security,
5324 .sb_free_security = selinux_sb_free_security,
5325 .sb_copy_data = selinux_sb_copy_data,
5326 .sb_kern_mount = selinux_sb_kern_mount,
5327 .sb_statfs = selinux_sb_statfs,
5328 .sb_mount = selinux_mount,
5329 .sb_umount = selinux_umount,
5330 .sb_get_mnt_opts = selinux_get_mnt_opts,
5331 .sb_set_mnt_opts = selinux_set_mnt_opts,
5332 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5333 .sb_parse_opts_str = selinux_parse_opts_str,
5334
5335
5336 .inode_alloc_security = selinux_inode_alloc_security,
5337 .inode_free_security = selinux_inode_free_security,
5338 .inode_init_security = selinux_inode_init_security,
5339 .inode_create = selinux_inode_create,
5340 .inode_link = selinux_inode_link,
5341 .inode_unlink = selinux_inode_unlink,
5342 .inode_symlink = selinux_inode_symlink,
5343 .inode_mkdir = selinux_inode_mkdir,
5344 .inode_rmdir = selinux_inode_rmdir,
5345 .inode_mknod = selinux_inode_mknod,
5346 .inode_rename = selinux_inode_rename,
5347 .inode_readlink = selinux_inode_readlink,
5348 .inode_follow_link = selinux_inode_follow_link,
5349 .inode_permission = selinux_inode_permission,
5350 .inode_setattr = selinux_inode_setattr,
5351 .inode_getattr = selinux_inode_getattr,
5352 .inode_setxattr = selinux_inode_setxattr,
5353 .inode_post_setxattr = selinux_inode_post_setxattr,
5354 .inode_getxattr = selinux_inode_getxattr,
5355 .inode_listxattr = selinux_inode_listxattr,
5356 .inode_removexattr = selinux_inode_removexattr,
5357 .inode_getsecurity = selinux_inode_getsecurity,
5358 .inode_setsecurity = selinux_inode_setsecurity,
5359 .inode_listsecurity = selinux_inode_listsecurity,
5360 .inode_need_killpriv = selinux_inode_need_killpriv,
5361 .inode_killpriv = selinux_inode_killpriv,
5362 .inode_getsecid = selinux_inode_getsecid,
5363
5364 .file_permission = selinux_file_permission,
5365 .file_alloc_security = selinux_file_alloc_security,
5366 .file_free_security = selinux_file_free_security,
5367 .file_ioctl = selinux_file_ioctl,
5368 .file_mmap = selinux_file_mmap,
5369 .file_mprotect = selinux_file_mprotect,
5370 .file_lock = selinux_file_lock,
5371 .file_fcntl = selinux_file_fcntl,
5372 .file_set_fowner = selinux_file_set_fowner,
5373 .file_send_sigiotask = selinux_file_send_sigiotask,
5374 .file_receive = selinux_file_receive,
5375
5376 .dentry_open = selinux_dentry_open,
5377
5378 .task_create = selinux_task_create,
5379 .task_alloc_security = selinux_task_alloc_security,
5380 .task_free_security = selinux_task_free_security,
5381 .task_setuid = selinux_task_setuid,
5382 .task_post_setuid = selinux_task_post_setuid,
5383 .task_setgid = selinux_task_setgid,
5384 .task_setpgid = selinux_task_setpgid,
5385 .task_getpgid = selinux_task_getpgid,
5386 .task_getsid = selinux_task_getsid,
5387 .task_getsecid = selinux_task_getsecid,
5388 .task_setgroups = selinux_task_setgroups,
5389 .task_setnice = selinux_task_setnice,
5390 .task_setioprio = selinux_task_setioprio,
5391 .task_getioprio = selinux_task_getioprio,
5392 .task_setrlimit = selinux_task_setrlimit,
5393 .task_setscheduler = selinux_task_setscheduler,
5394 .task_getscheduler = selinux_task_getscheduler,
5395 .task_movememory = selinux_task_movememory,
5396 .task_kill = selinux_task_kill,
5397 .task_wait = selinux_task_wait,
5398 .task_prctl = selinux_task_prctl,
5399 .task_reparent_to_init = selinux_task_reparent_to_init,
5400 .task_to_inode = selinux_task_to_inode,
5401
5402 .ipc_permission = selinux_ipc_permission,
5403 .ipc_getsecid = selinux_ipc_getsecid,
5404
5405 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5406 .msg_msg_free_security = selinux_msg_msg_free_security,
5407
5408 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5409 .msg_queue_free_security = selinux_msg_queue_free_security,
5410 .msg_queue_associate = selinux_msg_queue_associate,
5411 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5412 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5413 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5414
5415 .shm_alloc_security = selinux_shm_alloc_security,
5416 .shm_free_security = selinux_shm_free_security,
5417 .shm_associate = selinux_shm_associate,
5418 .shm_shmctl = selinux_shm_shmctl,
5419 .shm_shmat = selinux_shm_shmat,
5420
5421 .sem_alloc_security = selinux_sem_alloc_security,
5422 .sem_free_security = selinux_sem_free_security,
5423 .sem_associate = selinux_sem_associate,
5424 .sem_semctl = selinux_sem_semctl,
5425 .sem_semop = selinux_sem_semop,
5426
5427 .register_security = selinux_register_security,
5428
5429 .d_instantiate = selinux_d_instantiate,
5430
5431 .getprocattr = selinux_getprocattr,
5432 .setprocattr = selinux_setprocattr,
5433
5434 .secid_to_secctx = selinux_secid_to_secctx,
5435 .secctx_to_secid = selinux_secctx_to_secid,
5436 .release_secctx = selinux_release_secctx,
5437
5438 .unix_stream_connect = selinux_socket_unix_stream_connect,
5439 .unix_may_send = selinux_socket_unix_may_send,
5440
5441 .socket_create = selinux_socket_create,
5442 .socket_post_create = selinux_socket_post_create,
5443 .socket_bind = selinux_socket_bind,
5444 .socket_connect = selinux_socket_connect,
5445 .socket_listen = selinux_socket_listen,
5446 .socket_accept = selinux_socket_accept,
5447 .socket_sendmsg = selinux_socket_sendmsg,
5448 .socket_recvmsg = selinux_socket_recvmsg,
5449 .socket_getsockname = selinux_socket_getsockname,
5450 .socket_getpeername = selinux_socket_getpeername,
5451 .socket_getsockopt = selinux_socket_getsockopt,
5452 .socket_setsockopt = selinux_socket_setsockopt,
5453 .socket_shutdown = selinux_socket_shutdown,
5454 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5455 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5456 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5457 .sk_alloc_security = selinux_sk_alloc_security,
5458 .sk_free_security = selinux_sk_free_security,
5459 .sk_clone_security = selinux_sk_clone_security,
5460 .sk_getsecid = selinux_sk_getsecid,
5461 .sock_graft = selinux_sock_graft,
5462 .inet_conn_request = selinux_inet_conn_request,
5463 .inet_csk_clone = selinux_inet_csk_clone,
5464 .inet_conn_established = selinux_inet_conn_established,
5465 .req_classify_flow = selinux_req_classify_flow,
5466
5467 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5468 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5469 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5470 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5471 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5472 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5473 .xfrm_state_free_security = selinux_xfrm_state_free,
5474 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5475 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5476 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5477 .xfrm_decode_session = selinux_xfrm_decode_session,
5478 #endif
5479
5480 #ifdef CONFIG_KEYS
5481 .key_alloc = selinux_key_alloc,
5482 .key_free = selinux_key_free,
5483 .key_permission = selinux_key_permission,
5484 #endif
5485
5486 #ifdef CONFIG_AUDIT
5487 .audit_rule_init = selinux_audit_rule_init,
5488 .audit_rule_known = selinux_audit_rule_known,
5489 .audit_rule_match = selinux_audit_rule_match,
5490 .audit_rule_free = selinux_audit_rule_free,
5491 #endif
5492 };
5493
5494 static __init int selinux_init(void)
5495 {
5496 struct task_security_struct *tsec;
5497
5498 if (!security_module_enable(&selinux_ops)) {
5499 selinux_enabled = 0;
5500 return 0;
5501 }
5502
5503 if (!selinux_enabled) {
5504 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5505 return 0;
5506 }
5507
5508 printk(KERN_INFO "SELinux: Initializing.\n");
5509
5510 /* Set the security state for the initial task. */
5511 if (task_alloc_security(current))
5512 panic("SELinux: Failed to initialize initial task.\n");
5513 tsec = current->security;
5514 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5515
5516 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5517 sizeof(struct inode_security_struct),
5518 0, SLAB_PANIC, NULL);
5519 avc_init();
5520
5521 original_ops = secondary_ops = security_ops;
5522 if (!secondary_ops)
5523 panic ("SELinux: No initial security operations\n");
5524 if (register_security (&selinux_ops))
5525 panic("SELinux: Unable to register with kernel.\n");
5526
5527 if (selinux_enforcing) {
5528 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5529 } else {
5530 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5531 }
5532
5533 #ifdef CONFIG_KEYS
5534 /* Add security information to initial keyrings */
5535 selinux_key_alloc(&root_user_keyring, current,
5536 KEY_ALLOC_NOT_IN_QUOTA);
5537 selinux_key_alloc(&root_session_keyring, current,
5538 KEY_ALLOC_NOT_IN_QUOTA);
5539 #endif
5540
5541 return 0;
5542 }
5543
5544 void selinux_complete_init(void)
5545 {
5546 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5547
5548 /* Set up any superblocks initialized prior to the policy load. */
5549 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5550 spin_lock(&sb_lock);
5551 spin_lock(&sb_security_lock);
5552 next_sb:
5553 if (!list_empty(&superblock_security_head)) {
5554 struct superblock_security_struct *sbsec =
5555 list_entry(superblock_security_head.next,
5556 struct superblock_security_struct,
5557 list);
5558 struct super_block *sb = sbsec->sb;
5559 sb->s_count++;
5560 spin_unlock(&sb_security_lock);
5561 spin_unlock(&sb_lock);
5562 down_read(&sb->s_umount);
5563 if (sb->s_root)
5564 superblock_doinit(sb, NULL);
5565 drop_super(sb);
5566 spin_lock(&sb_lock);
5567 spin_lock(&sb_security_lock);
5568 list_del_init(&sbsec->list);
5569 goto next_sb;
5570 }
5571 spin_unlock(&sb_security_lock);
5572 spin_unlock(&sb_lock);
5573 }
5574
5575 /* SELinux requires early initialization in order to label
5576 all processes and objects when they are created. */
5577 security_initcall(selinux_init);
5578
5579 #if defined(CONFIG_NETFILTER)
5580
5581 static struct nf_hook_ops selinux_ipv4_ops[] = {
5582 {
5583 .hook = selinux_ipv4_postroute,
5584 .owner = THIS_MODULE,
5585 .pf = PF_INET,
5586 .hooknum = NF_INET_POST_ROUTING,
5587 .priority = NF_IP_PRI_SELINUX_LAST,
5588 },
5589 {
5590 .hook = selinux_ipv4_forward,
5591 .owner = THIS_MODULE,
5592 .pf = PF_INET,
5593 .hooknum = NF_INET_FORWARD,
5594 .priority = NF_IP_PRI_SELINUX_FIRST,
5595 }
5596 };
5597
5598 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5599
5600 static struct nf_hook_ops selinux_ipv6_ops[] = {
5601 {
5602 .hook = selinux_ipv6_postroute,
5603 .owner = THIS_MODULE,
5604 .pf = PF_INET6,
5605 .hooknum = NF_INET_POST_ROUTING,
5606 .priority = NF_IP6_PRI_SELINUX_LAST,
5607 },
5608 {
5609 .hook = selinux_ipv6_forward,
5610 .owner = THIS_MODULE,
5611 .pf = PF_INET6,
5612 .hooknum = NF_INET_FORWARD,
5613 .priority = NF_IP6_PRI_SELINUX_FIRST,
5614 }
5615 };
5616
5617 #endif /* IPV6 */
5618
5619 static int __init selinux_nf_ip_init(void)
5620 {
5621 int err = 0;
5622 u32 iter;
5623
5624 if (!selinux_enabled)
5625 goto out;
5626
5627 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5628
5629 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5630 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5631 if (err)
5632 panic("SELinux: nf_register_hook for IPv4: error %d\n",
5633 err);
5634 }
5635
5636 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5637 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5638 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5639 if (err)
5640 panic("SELinux: nf_register_hook for IPv6: error %d\n",
5641 err);
5642 }
5643 #endif /* IPV6 */
5644
5645 out:
5646 return err;
5647 }
5648
5649 __initcall(selinux_nf_ip_init);
5650
5651 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5652 static void selinux_nf_ip_exit(void)
5653 {
5654 u32 iter;
5655
5656 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5657
5658 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5659 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5660 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5661 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5662 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5663 #endif /* IPV6 */
5664 }
5665 #endif
5666
5667 #else /* CONFIG_NETFILTER */
5668
5669 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5670 #define selinux_nf_ip_exit()
5671 #endif
5672
5673 #endif /* CONFIG_NETFILTER */
5674
5675 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5676 int selinux_disable(void)
5677 {
5678 extern void exit_sel_fs(void);
5679 static int selinux_disabled = 0;
5680
5681 if (ss_initialized) {
5682 /* Not permitted after initial policy load. */
5683 return -EINVAL;
5684 }
5685
5686 if (selinux_disabled) {
5687 /* Only do this once. */
5688 return -EINVAL;
5689 }
5690
5691 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5692
5693 selinux_disabled = 1;
5694 selinux_enabled = 0;
5695
5696 /* Reset security_ops to the secondary module, dummy or capability. */
5697 security_ops = secondary_ops;
5698
5699 /* Unregister netfilter hooks. */
5700 selinux_nf_ip_exit();
5701
5702 /* Unregister selinuxfs. */
5703 exit_sel_fs();
5704
5705 return 0;
5706 }
5707 #endif
AMDTP streaming driver for the Linux FireWire stack (Juju)