?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tty: introduce no_tty and use it in selinux
[linux-2.6.22.y-op.git] / security / selinux / hooks.c
blobfa9dbb6b110d7278ab2f95b072b5e1823e983ec7
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
33 #include <linux/mm.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/smp_lock.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for sysctl_local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <asm/uaccess.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/dccp.h>
62 #include <linux/quota.h>
63 #include <linux/un.h> /* for Unix socket types */
64 #include <net/af_unix.h> /* for Unix socket types */
65 #include <linux/parser.h>
66 #include <linux/nfs_mount.h>
67 #include <net/ipv6.h>
68 #include <linux/hugetlb.h>
69 #include <linux/personality.h>
70 #include <linux/sysctl.h>
71 #include <linux/audit.h>
72 #include <linux/string.h>
73 #include <linux/selinux.h>
74 #include <linux/mutex.h>
75
76 #include "avc.h"
77 #include "objsec.h"
78 #include "netif.h"
79 #include "xfrm.h"
80 #include "netlabel.h"
81
82 #define XATTR_SELINUX_SUFFIX "selinux"
83 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84
85 extern unsigned int policydb_loaded_version;
86 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
87 extern int selinux_compat_net;
88
89 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
90 int selinux_enforcing = 0;
91
92 static int __init enforcing_setup(char *str)
93 {
94 selinux_enforcing = simple_strtol(str,NULL,0);
95 return 1;
96 }
97 __setup("enforcing=", enforcing_setup);
98 #endif
99
100 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
101 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
102
103 static int __init selinux_enabled_setup(char *str)
104 {
105 selinux_enabled = simple_strtol(str, NULL, 0);
106 return 1;
107 }
108 __setup("selinux=", selinux_enabled_setup);
109 #else
110 int selinux_enabled = 1;
111 #endif
112
113 /* Original (dummy) security module. */
114 static struct security_operations *original_ops = NULL;
115
116 /* Minimal support for a secondary security module,
117 just to allow the use of the dummy or capability modules.
118 The owlsm module can alternatively be used as a secondary
119 module as long as CONFIG_OWLSM_FD is not enabled. */
120 static struct security_operations *secondary_ops = NULL;
121
122 /* Lists of inode and superblock security structures initialized
123 before the policy was loaded. */
124 static LIST_HEAD(superblock_security_head);
125 static DEFINE_SPINLOCK(sb_security_lock);
126
127 static struct kmem_cache *sel_inode_cache;
128
129 /* Return security context for a given sid or just the context
130 length if the buffer is null or length is 0 */
131 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
132 {
133 char *context;
134 unsigned len;
135 int rc;
136
137 rc = security_sid_to_context(sid, &context, &len);
138 if (rc)
139 return rc;
140
141 if (!buffer || !size)
142 goto getsecurity_exit;
143
144 if (size < len) {
145 len = -ERANGE;
146 goto getsecurity_exit;
147 }
148 memcpy(buffer, context, len);
149
150 getsecurity_exit:
151 kfree(context);
152 return len;
153 }
154
155 /* Allocate and free functions for each kind of security blob. */
156
157 static int task_alloc_security(struct task_struct *task)
158 {
159 struct task_security_struct *tsec;
160
161 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 if (!tsec)
163 return -ENOMEM;
164
165 tsec->task = task;
166 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
167 task->security = tsec;
168
169 return 0;
170 }
171
172 static void task_free_security(struct task_struct *task)
173 {
174 struct task_security_struct *tsec = task->security;
175 task->security = NULL;
176 kfree(tsec);
177 }
178
179 static int inode_alloc_security(struct inode *inode)
180 {
181 struct task_security_struct *tsec = current->security;
182 struct inode_security_struct *isec;
183
184 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
185 if (!isec)
186 return -ENOMEM;
187
188 mutex_init(&isec->lock);
189 INIT_LIST_HEAD(&isec->list);
190 isec->inode = inode;
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
193 isec->task_sid = tsec->sid;
194 inode->i_security = isec;
195
196 return 0;
197 }
198
199 static void inode_free_security(struct inode *inode)
200 {
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
203
204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
208
209 inode->i_security = NULL;
210 kmem_cache_free(sel_inode_cache, isec);
211 }
212
213 static int file_alloc_security(struct file *file)
214 {
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
217
218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219 if (!fsec)
220 return -ENOMEM;
221
222 fsec->file = file;
223 fsec->sid = tsec->sid;
224 fsec->fown_sid = tsec->sid;
225 file->f_security = fsec;
226
227 return 0;
228 }
229
230 static void file_free_security(struct file *file)
231 {
232 struct file_security_struct *fsec = file->f_security;
233 file->f_security = NULL;
234 kfree(fsec);
235 }
236
237 static int superblock_alloc_security(struct super_block *sb)
238 {
239 struct superblock_security_struct *sbsec;
240
241 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 if (!sbsec)
243 return -ENOMEM;
244
245 mutex_init(&sbsec->lock);
246 INIT_LIST_HEAD(&sbsec->list);
247 INIT_LIST_HEAD(&sbsec->isec_head);
248 spin_lock_init(&sbsec->isec_lock);
249 sbsec->sb = sb;
250 sbsec->sid = SECINITSID_UNLABELED;
251 sbsec->def_sid = SECINITSID_FILE;
252 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
253 sb->s_security = sbsec;
254
255 return 0;
256 }
257
258 static void superblock_free_security(struct super_block *sb)
259 {
260 struct superblock_security_struct *sbsec = sb->s_security;
261
262 spin_lock(&sb_security_lock);
263 if (!list_empty(&sbsec->list))
264 list_del_init(&sbsec->list);
265 spin_unlock(&sb_security_lock);
266
267 sb->s_security = NULL;
268 kfree(sbsec);
269 }
270
271 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
272 {
273 struct sk_security_struct *ssec;
274
275 ssec = kzalloc(sizeof(*ssec), priority);
276 if (!ssec)
277 return -ENOMEM;
278
279 ssec->sk = sk;
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 ssec->sid = SECINITSID_UNLABELED;
282 sk->sk_security = ssec;
283
284 selinux_netlbl_sk_security_init(ssec, family);
285
286 return 0;
287 }
288
289 static void sk_free_security(struct sock *sk)
290 {
291 struct sk_security_struct *ssec = sk->sk_security;
292
293 sk->sk_security = NULL;
294 kfree(ssec);
295 }
296
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316 return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 4,
323 Opt_rootcontext = 8,
324 };
325
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
331 };
332
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
334
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
338 {
339 int rc;
340
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
343 if (rc)
344 return rc;
345
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
348 return rc;
349 }
350
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
354 {
355 int rc;
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
358 if (rc)
359 return rc;
360
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
363 return rc;
364 }
365
366 static int try_context_mount(struct super_block *sb, void *data)
367 {
368 char *context = NULL, *defcontext = NULL;
369 char *fscontext = NULL, *rootcontext = NULL;
370 const char *name;
371 u32 sid;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
375
376 if (!data)
377 goto out;
378
379 name = sb->s_type->name;
380
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
382
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
386
387 if (d->version < NFS_MOUNT_VERSION)
388 goto out;
389
390 if (d->context[0]) {
391 context = d->context;
392 seen |= Opt_context;
393 }
394 } else
395 goto out;
396
397 } else {
398 /* Standard string-based options. */
399 char *p, *options = data;
400
401 while ((p = strsep(&options, "|")) != NULL) {
402 int token;
403 substring_t args[MAX_OPT_ARGS];
404
405 if (!*p)
406 continue;
407
408 token = match_token(p, tokens, args);
409
410 switch (token) {
411 case Opt_context:
412 if (seen & (Opt_context|Opt_defcontext)) {
413 rc = -EINVAL;
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
415 goto out_free;
416 }
417 context = match_strdup(&args[0]);
418 if (!context) {
419 rc = -ENOMEM;
420 goto out_free;
421 }
422 if (!alloc)
423 alloc = 1;
424 seen |= Opt_context;
425 break;
426
427 case Opt_fscontext:
428 if (seen & Opt_fscontext) {
429 rc = -EINVAL;
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
431 goto out_free;
432 }
433 fscontext = match_strdup(&args[0]);
434 if (!fscontext) {
435 rc = -ENOMEM;
436 goto out_free;
437 }
438 if (!alloc)
439 alloc = 1;
440 seen |= Opt_fscontext;
441 break;
442
443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
445 rc = -EINVAL;
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
447 goto out_free;
448 }
449 rootcontext = match_strdup(&args[0]);
450 if (!rootcontext) {
451 rc = -ENOMEM;
452 goto out_free;
453 }
454 if (!alloc)
455 alloc = 1;
456 seen |= Opt_rootcontext;
457 break;
458
459 case Opt_defcontext:
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
461 rc = -EINVAL;
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
465 goto out_free;
466 }
467 if (seen & (Opt_context|Opt_defcontext)) {
468 rc = -EINVAL;
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
470 goto out_free;
471 }
472 defcontext = match_strdup(&args[0]);
473 if (!defcontext) {
474 rc = -ENOMEM;
475 goto out_free;
476 }
477 if (!alloc)
478 alloc = 1;
479 seen |= Opt_defcontext;
480 break;
481
482 default:
483 rc = -EINVAL;
484 printk(KERN_WARNING "SELinux: unknown mount "
485 "option\n");
486 goto out_free;
487
488 }
489 }
490 }
491
492 if (!seen)
493 goto out;
494
495 /* sets the context of the superblock for the fs being mounted. */
496 if (fscontext) {
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
498 if (rc) {
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
501 fscontext, sb->s_id, name, rc);
502 goto out_free;
503 }
504
505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
506 if (rc)
507 goto out_free;
508
509 sbsec->sid = sid;
510 }
511
512 /*
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
516 */
517 if (context) {
518 rc = security_context_to_sid(context, strlen(context), &sid);
519 if (rc) {
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
523 goto out_free;
524 }
525
526 if (!fscontext) {
527 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
528 if (rc)
529 goto out_free;
530 sbsec->sid = sid;
531 } else {
532 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
533 if (rc)
534 goto out_free;
535 }
536 sbsec->mntpoint_sid = sid;
537
538 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
539 }
540
541 if (rootcontext) {
542 struct inode *inode = sb->s_root->d_inode;
543 struct inode_security_struct *isec = inode->i_security;
544 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
545 if (rc) {
546 printk(KERN_WARNING "SELinux: security_context_to_sid"
547 "(%s) failed for (dev %s, type %s) errno=%d\n",
548 rootcontext, sb->s_id, name, rc);
549 goto out_free;
550 }
551
552 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
553 if (rc)
554 goto out_free;
555
556 isec->sid = sid;
557 isec->initialized = 1;
558 }
559
560 if (defcontext) {
561 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
562 if (rc) {
563 printk(KERN_WARNING "SELinux: security_context_to_sid"
564 "(%s) failed for (dev %s, type %s) errno=%d\n",
565 defcontext, sb->s_id, name, rc);
566 goto out_free;
567 }
568
569 if (sid == sbsec->def_sid)
570 goto out_free;
571
572 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
573 if (rc)
574 goto out_free;
575
576 sbsec->def_sid = sid;
577 }
578
579 out_free:
580 if (alloc) {
581 kfree(context);
582 kfree(defcontext);
583 kfree(fscontext);
584 kfree(rootcontext);
585 }
586 out:
587 return rc;
588 }
589
590 static int superblock_doinit(struct super_block *sb, void *data)
591 {
592 struct superblock_security_struct *sbsec = sb->s_security;
593 struct dentry *root = sb->s_root;
594 struct inode *inode = root->d_inode;
595 int rc = 0;
596
597 mutex_lock(&sbsec->lock);
598 if (sbsec->initialized)
599 goto out;
600
601 if (!ss_initialized) {
602 /* Defer initialization until selinux_complete_init,
603 after the initial policy is loaded and the security
604 server is ready to handle calls. */
605 spin_lock(&sb_security_lock);
606 if (list_empty(&sbsec->list))
607 list_add(&sbsec->list, &superblock_security_head);
608 spin_unlock(&sb_security_lock);
609 goto out;
610 }
611
612 /* Determine the labeling behavior to use for this filesystem type. */
613 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
614 if (rc) {
615 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
616 __FUNCTION__, sb->s_type->name, rc);
617 goto out;
618 }
619
620 rc = try_context_mount(sb, data);
621 if (rc)
622 goto out;
623
624 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625 /* Make sure that the xattr handler exists and that no
626 error other than -ENODATA is returned by getxattr on
627 the root directory. -ENODATA is ok, as this may be
628 the first boot of the SELinux kernel before we have
629 assigned xattr values to the filesystem. */
630 if (!inode->i_op->getxattr) {
631 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632 "xattr support\n", sb->s_id, sb->s_type->name);
633 rc = -EOPNOTSUPP;
634 goto out;
635 }
636 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637 if (rc < 0 && rc != -ENODATA) {
638 if (rc == -EOPNOTSUPP)
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) has no security xattr handler\n",
641 sb->s_id, sb->s_type->name);
642 else
643 printk(KERN_WARNING "SELinux: (dev %s, type "
644 "%s) getxattr errno %d\n", sb->s_id,
645 sb->s_type->name, -rc);
646 goto out;
647 }
648 }
649
650 if (strcmp(sb->s_type->name, "proc") == 0)
651 sbsec->proc = 1;
652
653 sbsec->initialized = 1;
654
655 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657 sb->s_id, sb->s_type->name);
658 }
659 else {
660 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
661 sb->s_id, sb->s_type->name,
662 labeling_behaviors[sbsec->behavior-1]);
663 }
664
665 /* Initialize the root inode. */
666 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
667
668 /* Initialize any other inodes associated with the superblock, e.g.
669 inodes created prior to initial policy load or inodes created
670 during get_sb by a pseudo filesystem that directly
671 populates itself. */
672 spin_lock(&sbsec->isec_lock);
673 next_inode:
674 if (!list_empty(&sbsec->isec_head)) {
675 struct inode_security_struct *isec =
676 list_entry(sbsec->isec_head.next,
677 struct inode_security_struct, list);
678 struct inode *inode = isec->inode;
679 spin_unlock(&sbsec->isec_lock);
680 inode = igrab(inode);
681 if (inode) {
682 if (!IS_PRIVATE (inode))
683 inode_doinit(inode);
684 iput(inode);
685 }
686 spin_lock(&sbsec->isec_lock);
687 list_del_init(&isec->list);
688 goto next_inode;
689 }
690 spin_unlock(&sbsec->isec_lock);
691 out:
692 mutex_unlock(&sbsec->lock);
693 return rc;
694 }
695
696 static inline u16 inode_mode_to_security_class(umode_t mode)
697 {
698 switch (mode & S_IFMT) {
699 case S_IFSOCK:
700 return SECCLASS_SOCK_FILE;
701 case S_IFLNK:
702 return SECCLASS_LNK_FILE;
703 case S_IFREG:
704 return SECCLASS_FILE;
705 case S_IFBLK:
706 return SECCLASS_BLK_FILE;
707 case S_IFDIR:
708 return SECCLASS_DIR;
709 case S_IFCHR:
710 return SECCLASS_CHR_FILE;
711 case S_IFIFO:
712 return SECCLASS_FIFO_FILE;
713
714 }
715
716 return SECCLASS_FILE;
717 }
718
719 static inline int default_protocol_stream(int protocol)
720 {
721 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
722 }
723
724 static inline int default_protocol_dgram(int protocol)
725 {
726 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
727 }
728
729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
730 {
731 switch (family) {
732 case PF_UNIX:
733 switch (type) {
734 case SOCK_STREAM:
735 case SOCK_SEQPACKET:
736 return SECCLASS_UNIX_STREAM_SOCKET;
737 case SOCK_DGRAM:
738 return SECCLASS_UNIX_DGRAM_SOCKET;
739 }
740 break;
741 case PF_INET:
742 case PF_INET6:
743 switch (type) {
744 case SOCK_STREAM:
745 if (default_protocol_stream(protocol))
746 return SECCLASS_TCP_SOCKET;
747 else
748 return SECCLASS_RAWIP_SOCKET;
749 case SOCK_DGRAM:
750 if (default_protocol_dgram(protocol))
751 return SECCLASS_UDP_SOCKET;
752 else
753 return SECCLASS_RAWIP_SOCKET;
754 case SOCK_DCCP:
755 return SECCLASS_DCCP_SOCKET;
756 default:
757 return SECCLASS_RAWIP_SOCKET;
758 }
759 break;
760 case PF_NETLINK:
761 switch (protocol) {
762 case NETLINK_ROUTE:
763 return SECCLASS_NETLINK_ROUTE_SOCKET;
764 case NETLINK_FIREWALL:
765 return SECCLASS_NETLINK_FIREWALL_SOCKET;
766 case NETLINK_INET_DIAG:
767 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
768 case NETLINK_NFLOG:
769 return SECCLASS_NETLINK_NFLOG_SOCKET;
770 case NETLINK_XFRM:
771 return SECCLASS_NETLINK_XFRM_SOCKET;
772 case NETLINK_SELINUX:
773 return SECCLASS_NETLINK_SELINUX_SOCKET;
774 case NETLINK_AUDIT:
775 return SECCLASS_NETLINK_AUDIT_SOCKET;
776 case NETLINK_IP6_FW:
777 return SECCLASS_NETLINK_IP6FW_SOCKET;
778 case NETLINK_DNRTMSG:
779 return SECCLASS_NETLINK_DNRT_SOCKET;
780 case NETLINK_KOBJECT_UEVENT:
781 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
782 default:
783 return SECCLASS_NETLINK_SOCKET;
784 }
785 case PF_PACKET:
786 return SECCLASS_PACKET_SOCKET;
787 case PF_KEY:
788 return SECCLASS_KEY_SOCKET;
789 case PF_APPLETALK:
790 return SECCLASS_APPLETALK_SOCKET;
791 }
792
793 return SECCLASS_SOCKET;
794 }
795
796 #ifdef CONFIG_PROC_FS
797 static int selinux_proc_get_sid(struct proc_dir_entry *de,
798 u16 tclass,
799 u32 *sid)
800 {
801 int buflen, rc;
802 char *buffer, *path, *end;
803
804 buffer = (char*)__get_free_page(GFP_KERNEL);
805 if (!buffer)
806 return -ENOMEM;
807
808 buflen = PAGE_SIZE;
809 end = buffer+buflen;
810 *--end = '\0';
811 buflen--;
812 path = end-1;
813 *path = '/';
814 while (de && de != de->parent) {
815 buflen -= de->namelen + 1;
816 if (buflen < 0)
817 break;
818 end -= de->namelen;
819 memcpy(end, de->name, de->namelen);
820 *--end = '/';
821 path = end;
822 de = de->parent;
823 }
824 rc = security_genfs_sid("proc", path, tclass, sid);
825 free_page((unsigned long)buffer);
826 return rc;
827 }
828 #else
829 static int selinux_proc_get_sid(struct proc_dir_entry *de,
830 u16 tclass,
831 u32 *sid)
832 {
833 return -EINVAL;
834 }
835 #endif
836
837 /* The inode's security attributes must be initialized before first use. */
838 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
839 {
840 struct superblock_security_struct *sbsec = NULL;
841 struct inode_security_struct *isec = inode->i_security;
842 u32 sid;
843 struct dentry *dentry;
844 #define INITCONTEXTLEN 255
845 char *context = NULL;
846 unsigned len = 0;
847 int rc = 0;
848
849 if (isec->initialized)
850 goto out;
851
852 mutex_lock(&isec->lock);
853 if (isec->initialized)
854 goto out_unlock;
855
856 sbsec = inode->i_sb->s_security;
857 if (!sbsec->initialized) {
858 /* Defer initialization until selinux_complete_init,
859 after the initial policy is loaded and the security
860 server is ready to handle calls. */
861 spin_lock(&sbsec->isec_lock);
862 if (list_empty(&isec->list))
863 list_add(&isec->list, &sbsec->isec_head);
864 spin_unlock(&sbsec->isec_lock);
865 goto out_unlock;
866 }
867
868 switch (sbsec->behavior) {
869 case SECURITY_FS_USE_XATTR:
870 if (!inode->i_op->getxattr) {
871 isec->sid = sbsec->def_sid;
872 break;
873 }
874
875 /* Need a dentry, since the xattr API requires one.
876 Life would be simpler if we could just pass the inode. */
877 if (opt_dentry) {
878 /* Called from d_instantiate or d_splice_alias. */
879 dentry = dget(opt_dentry);
880 } else {
881 /* Called from selinux_complete_init, try to find a dentry. */
882 dentry = d_find_alias(inode);
883 }
884 if (!dentry) {
885 printk(KERN_WARNING "%s: no dentry for dev=%s "
886 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
887 inode->i_ino);
888 goto out_unlock;
889 }
890
891 len = INITCONTEXTLEN;
892 context = kmalloc(len, GFP_KERNEL);
893 if (!context) {
894 rc = -ENOMEM;
895 dput(dentry);
896 goto out_unlock;
897 }
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
899 context, len);
900 if (rc == -ERANGE) {
901 /* Need a larger buffer. Query for the right size. */
902 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
903 NULL, 0);
904 if (rc < 0) {
905 dput(dentry);
906 goto out_unlock;
907 }
908 kfree(context);
909 len = rc;
910 context = kmalloc(len, GFP_KERNEL);
911 if (!context) {
912 rc = -ENOMEM;
913 dput(dentry);
914 goto out_unlock;
915 }
916 rc = inode->i_op->getxattr(dentry,
917 XATTR_NAME_SELINUX,
918 context, len);
919 }
920 dput(dentry);
921 if (rc < 0) {
922 if (rc != -ENODATA) {
923 printk(KERN_WARNING "%s: getxattr returned "
924 "%d for dev=%s ino=%ld\n", __FUNCTION__,
925 -rc, inode->i_sb->s_id, inode->i_ino);
926 kfree(context);
927 goto out_unlock;
928 }
929 /* Map ENODATA to the default file SID */
930 sid = sbsec->def_sid;
931 rc = 0;
932 } else {
933 rc = security_context_to_sid_default(context, rc, &sid,
934 sbsec->def_sid);
935 if (rc) {
936 printk(KERN_WARNING "%s: context_to_sid(%s) "
937 "returned %d for dev=%s ino=%ld\n",
938 __FUNCTION__, context, -rc,
939 inode->i_sb->s_id, inode->i_ino);
940 kfree(context);
941 /* Leave with the unlabeled SID */
942 rc = 0;
943 break;
944 }
945 }
946 kfree(context);
947 isec->sid = sid;
948 break;
949 case SECURITY_FS_USE_TASK:
950 isec->sid = isec->task_sid;
951 break;
952 case SECURITY_FS_USE_TRANS:
953 /* Default to the fs SID. */
954 isec->sid = sbsec->sid;
955
956 /* Try to obtain a transition SID. */
957 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958 rc = security_transition_sid(isec->task_sid,
959 sbsec->sid,
960 isec->sclass,
961 &sid);
962 if (rc)
963 goto out_unlock;
964 isec->sid = sid;
965 break;
966 case SECURITY_FS_USE_MNTPOINT:
967 isec->sid = sbsec->mntpoint_sid;
968 break;
969 default:
970 /* Default to the fs superblock SID. */
971 isec->sid = sbsec->sid;
972
973 if (sbsec->proc) {
974 struct proc_inode *proci = PROC_I(inode);
975 if (proci->pde) {
976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977 rc = selinux_proc_get_sid(proci->pde,
978 isec->sclass,
979 &sid);
980 if (rc)
981 goto out_unlock;
982 isec->sid = sid;
983 }
984 }
985 break;
986 }
987
988 isec->initialized = 1;
989
990 out_unlock:
991 mutex_unlock(&isec->lock);
992 out:
993 if (isec->sclass == SECCLASS_FILE)
994 isec->sclass = inode_mode_to_security_class(inode->i_mode);
995 return rc;
996 }
997
998 /* Convert a Linux signal to an access vector. */
999 static inline u32 signal_to_av(int sig)
1000 {
1001 u32 perm = 0;
1002
1003 switch (sig) {
1004 case SIGCHLD:
1005 /* Commonly granted from child to parent. */
1006 perm = PROCESS__SIGCHLD;
1007 break;
1008 case SIGKILL:
1009 /* Cannot be caught or ignored */
1010 perm = PROCESS__SIGKILL;
1011 break;
1012 case SIGSTOP:
1013 /* Cannot be caught or ignored */
1014 perm = PROCESS__SIGSTOP;
1015 break;
1016 default:
1017 /* All other signals. */
1018 perm = PROCESS__SIGNAL;
1019 break;
1020 }
1021
1022 return perm;
1023 }
1024
1025 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1026 fork check, ptrace check, etc. */
1027 static int task_has_perm(struct task_struct *tsk1,
1028 struct task_struct *tsk2,
1029 u32 perms)
1030 {
1031 struct task_security_struct *tsec1, *tsec2;
1032
1033 tsec1 = tsk1->security;
1034 tsec2 = tsk2->security;
1035 return avc_has_perm(tsec1->sid, tsec2->sid,
1036 SECCLASS_PROCESS, perms, NULL);
1037 }
1038
1039 /* Check whether a task is allowed to use a capability. */
1040 static int task_has_capability(struct task_struct *tsk,
1041 int cap)
1042 {
1043 struct task_security_struct *tsec;
1044 struct avc_audit_data ad;
1045
1046 tsec = tsk->security;
1047
1048 AVC_AUDIT_DATA_INIT(&ad,CAP);
1049 ad.tsk = tsk;
1050 ad.u.cap = cap;
1051
1052 return avc_has_perm(tsec->sid, tsec->sid,
1053 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1054 }
1055
1056 /* Check whether a task is allowed to use a system operation. */
1057 static int task_has_system(struct task_struct *tsk,
1058 u32 perms)
1059 {
1060 struct task_security_struct *tsec;
1061
1062 tsec = tsk->security;
1063
1064 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1065 SECCLASS_SYSTEM, perms, NULL);
1066 }
1067
1068 /* Check whether a task has a particular permission to an inode.
1069 The 'adp' parameter is optional and allows other audit
1070 data to be passed (e.g. the dentry). */
1071 static int inode_has_perm(struct task_struct *tsk,
1072 struct inode *inode,
1073 u32 perms,
1074 struct avc_audit_data *adp)
1075 {
1076 struct task_security_struct *tsec;
1077 struct inode_security_struct *isec;
1078 struct avc_audit_data ad;
1079
1080 if (unlikely (IS_PRIVATE (inode)))
1081 return 0;
1082
1083 tsec = tsk->security;
1084 isec = inode->i_security;
1085
1086 if (!adp) {
1087 adp = &ad;
1088 AVC_AUDIT_DATA_INIT(&ad, FS);
1089 ad.u.fs.inode = inode;
1090 }
1091
1092 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1093 }
1094
1095 /* Same as inode_has_perm, but pass explicit audit data containing
1096 the dentry to help the auditing code to more easily generate the
1097 pathname if needed. */
1098 static inline int dentry_has_perm(struct task_struct *tsk,
1099 struct vfsmount *mnt,
1100 struct dentry *dentry,
1101 u32 av)
1102 {
1103 struct inode *inode = dentry->d_inode;
1104 struct avc_audit_data ad;
1105 AVC_AUDIT_DATA_INIT(&ad,FS);
1106 ad.u.fs.mnt = mnt;
1107 ad.u.fs.dentry = dentry;
1108 return inode_has_perm(tsk, inode, av, &ad);
1109 }
1110
1111 /* Check whether a task can use an open file descriptor to
1112 access an inode in a given way. Check access to the
1113 descriptor itself, and then use dentry_has_perm to
1114 check a particular permission to the file.
1115 Access to the descriptor is implicitly granted if it
1116 has the same SID as the process. If av is zero, then
1117 access to the file is not checked, e.g. for cases
1118 where only the descriptor is affected like seek. */
1119 static int file_has_perm(struct task_struct *tsk,
1120 struct file *file,
1121 u32 av)
1122 {
1123 struct task_security_struct *tsec = tsk->security;
1124 struct file_security_struct *fsec = file->f_security;
1125 struct vfsmount *mnt = file->f_path.mnt;
1126 struct dentry *dentry = file->f_path.dentry;
1127 struct inode *inode = dentry->d_inode;
1128 struct avc_audit_data ad;
1129 int rc;
1130
1131 AVC_AUDIT_DATA_INIT(&ad, FS);
1132 ad.u.fs.mnt = mnt;
1133 ad.u.fs.dentry = dentry;
1134
1135 if (tsec->sid != fsec->sid) {
1136 rc = avc_has_perm(tsec->sid, fsec->sid,
1137 SECCLASS_FD,
1138 FD__USE,
1139 &ad);
1140 if (rc)
1141 return rc;
1142 }
1143
1144 /* av is zero if only checking access to the descriptor. */
1145 if (av)
1146 return inode_has_perm(tsk, inode, av, &ad);
1147
1148 return 0;
1149 }
1150
1151 /* Check whether a task can create a file. */
1152 static int may_create(struct inode *dir,
1153 struct dentry *dentry,
1154 u16 tclass)
1155 {
1156 struct task_security_struct *tsec;
1157 struct inode_security_struct *dsec;
1158 struct superblock_security_struct *sbsec;
1159 u32 newsid;
1160 struct avc_audit_data ad;
1161 int rc;
1162
1163 tsec = current->security;
1164 dsec = dir->i_security;
1165 sbsec = dir->i_sb->s_security;
1166
1167 AVC_AUDIT_DATA_INIT(&ad, FS);
1168 ad.u.fs.dentry = dentry;
1169
1170 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1171 DIR__ADD_NAME | DIR__SEARCH,
1172 &ad);
1173 if (rc)
1174 return rc;
1175
1176 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1177 newsid = tsec->create_sid;
1178 } else {
1179 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1180 &newsid);
1181 if (rc)
1182 return rc;
1183 }
1184
1185 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1186 if (rc)
1187 return rc;
1188
1189 return avc_has_perm(newsid, sbsec->sid,
1190 SECCLASS_FILESYSTEM,
1191 FILESYSTEM__ASSOCIATE, &ad);
1192 }
1193
1194 /* Check whether a task can create a key. */
1195 static int may_create_key(u32 ksid,
1196 struct task_struct *ctx)
1197 {
1198 struct task_security_struct *tsec;
1199
1200 tsec = ctx->security;
1201
1202 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1203 }
1204
1205 #define MAY_LINK 0
1206 #define MAY_UNLINK 1
1207 #define MAY_RMDIR 2
1208
1209 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1210 static int may_link(struct inode *dir,
1211 struct dentry *dentry,
1212 int kind)
1213
1214 {
1215 struct task_security_struct *tsec;
1216 struct inode_security_struct *dsec, *isec;
1217 struct avc_audit_data ad;
1218 u32 av;
1219 int rc;
1220
1221 tsec = current->security;
1222 dsec = dir->i_security;
1223 isec = dentry->d_inode->i_security;
1224
1225 AVC_AUDIT_DATA_INIT(&ad, FS);
1226 ad.u.fs.dentry = dentry;
1227
1228 av = DIR__SEARCH;
1229 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1230 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1231 if (rc)
1232 return rc;
1233
1234 switch (kind) {
1235 case MAY_LINK:
1236 av = FILE__LINK;
1237 break;
1238 case MAY_UNLINK:
1239 av = FILE__UNLINK;
1240 break;
1241 case MAY_RMDIR:
1242 av = DIR__RMDIR;
1243 break;
1244 default:
1245 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1246 return 0;
1247 }
1248
1249 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1250 return rc;
1251 }
1252
1253 static inline int may_rename(struct inode *old_dir,
1254 struct dentry *old_dentry,
1255 struct inode *new_dir,
1256 struct dentry *new_dentry)
1257 {
1258 struct task_security_struct *tsec;
1259 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1260 struct avc_audit_data ad;
1261 u32 av;
1262 int old_is_dir, new_is_dir;
1263 int rc;
1264
1265 tsec = current->security;
1266 old_dsec = old_dir->i_security;
1267 old_isec = old_dentry->d_inode->i_security;
1268 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1269 new_dsec = new_dir->i_security;
1270
1271 AVC_AUDIT_DATA_INIT(&ad, FS);
1272
1273 ad.u.fs.dentry = old_dentry;
1274 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1275 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1276 if (rc)
1277 return rc;
1278 rc = avc_has_perm(tsec->sid, old_isec->sid,
1279 old_isec->sclass, FILE__RENAME, &ad);
1280 if (rc)
1281 return rc;
1282 if (old_is_dir && new_dir != old_dir) {
1283 rc = avc_has_perm(tsec->sid, old_isec->sid,
1284 old_isec->sclass, DIR__REPARENT, &ad);
1285 if (rc)
1286 return rc;
1287 }
1288
1289 ad.u.fs.dentry = new_dentry;
1290 av = DIR__ADD_NAME | DIR__SEARCH;
1291 if (new_dentry->d_inode)
1292 av |= DIR__REMOVE_NAME;
1293 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1294 if (rc)
1295 return rc;
1296 if (new_dentry->d_inode) {
1297 new_isec = new_dentry->d_inode->i_security;
1298 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1299 rc = avc_has_perm(tsec->sid, new_isec->sid,
1300 new_isec->sclass,
1301 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1302 if (rc)
1303 return rc;
1304 }
1305
1306 return 0;
1307 }
1308
1309 /* Check whether a task can perform a filesystem operation. */
1310 static int superblock_has_perm(struct task_struct *tsk,
1311 struct super_block *sb,
1312 u32 perms,
1313 struct avc_audit_data *ad)
1314 {
1315 struct task_security_struct *tsec;
1316 struct superblock_security_struct *sbsec;
1317
1318 tsec = tsk->security;
1319 sbsec = sb->s_security;
1320 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1321 perms, ad);
1322 }
1323
1324 /* Convert a Linux mode and permission mask to an access vector. */
1325 static inline u32 file_mask_to_av(int mode, int mask)
1326 {
1327 u32 av = 0;
1328
1329 if ((mode & S_IFMT) != S_IFDIR) {
1330 if (mask & MAY_EXEC)
1331 av |= FILE__EXECUTE;
1332 if (mask & MAY_READ)
1333 av |= FILE__READ;
1334
1335 if (mask & MAY_APPEND)
1336 av |= FILE__APPEND;
1337 else if (mask & MAY_WRITE)
1338 av |= FILE__WRITE;
1339
1340 } else {
1341 if (mask & MAY_EXEC)
1342 av |= DIR__SEARCH;
1343 if (mask & MAY_WRITE)
1344 av |= DIR__WRITE;
1345 if (mask & MAY_READ)
1346 av |= DIR__READ;
1347 }
1348
1349 return av;
1350 }
1351
1352 /* Convert a Linux file to an access vector. */
1353 static inline u32 file_to_av(struct file *file)
1354 {
1355 u32 av = 0;
1356
1357 if (file->f_mode & FMODE_READ)
1358 av |= FILE__READ;
1359 if (file->f_mode & FMODE_WRITE) {
1360 if (file->f_flags & O_APPEND)
1361 av |= FILE__APPEND;
1362 else
1363 av |= FILE__WRITE;
1364 }
1365
1366 return av;
1367 }
1368
1369 /* Hook functions begin here. */
1370
1371 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1372 {
1373 struct task_security_struct *psec = parent->security;
1374 struct task_security_struct *csec = child->security;
1375 int rc;
1376
1377 rc = secondary_ops->ptrace(parent,child);
1378 if (rc)
1379 return rc;
1380
1381 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1382 /* Save the SID of the tracing process for later use in apply_creds. */
1383 if (!(child->ptrace & PT_PTRACED) && !rc)
1384 csec->ptrace_sid = psec->sid;
1385 return rc;
1386 }
1387
1388 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1389 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390 {
1391 int error;
1392
1393 error = task_has_perm(current, target, PROCESS__GETCAP);
1394 if (error)
1395 return error;
1396
1397 return secondary_ops->capget(target, effective, inheritable, permitted);
1398 }
1399
1400 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1401 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1402 {
1403 int error;
1404
1405 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1406 if (error)
1407 return error;
1408
1409 return task_has_perm(current, target, PROCESS__SETCAP);
1410 }
1411
1412 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1413 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1414 {
1415 secondary_ops->capset_set(target, effective, inheritable, permitted);
1416 }
1417
1418 static int selinux_capable(struct task_struct *tsk, int cap)
1419 {
1420 int rc;
1421
1422 rc = secondary_ops->capable(tsk, cap);
1423 if (rc)
1424 return rc;
1425
1426 return task_has_capability(tsk,cap);
1427 }
1428
1429 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1430 {
1431 int buflen, rc;
1432 char *buffer, *path, *end;
1433
1434 rc = -ENOMEM;
1435 buffer = (char*)__get_free_page(GFP_KERNEL);
1436 if (!buffer)
1437 goto out;
1438
1439 buflen = PAGE_SIZE;
1440 end = buffer+buflen;
1441 *--end = '\0';
1442 buflen--;
1443 path = end-1;
1444 *path = '/';
1445 while (table) {
1446 const char *name = table->procname;
1447 size_t namelen = strlen(name);
1448 buflen -= namelen + 1;
1449 if (buflen < 0)
1450 goto out_free;
1451 end -= namelen;
1452 memcpy(end, name, namelen);
1453 *--end = '/';
1454 path = end;
1455 table = table->parent;
1456 }
1457 buflen -= 4;
1458 if (buflen < 0)
1459 goto out_free;
1460 end -= 4;
1461 memcpy(end, "/sys", 4);
1462 path = end;
1463 rc = security_genfs_sid("proc", path, tclass, sid);
1464 out_free:
1465 free_page((unsigned long)buffer);
1466 out:
1467 return rc;
1468 }
1469
1470 static int selinux_sysctl(ctl_table *table, int op)
1471 {
1472 int error = 0;
1473 u32 av;
1474 struct task_security_struct *tsec;
1475 u32 tsid;
1476 int rc;
1477
1478 rc = secondary_ops->sysctl(table, op);
1479 if (rc)
1480 return rc;
1481
1482 tsec = current->security;
1483
1484 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1485 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1486 if (rc) {
1487 /* Default to the well-defined sysctl SID. */
1488 tsid = SECINITSID_SYSCTL;
1489 }
1490
1491 /* The op values are "defined" in sysctl.c, thereby creating
1492 * a bad coupling between this module and sysctl.c */
1493 if(op == 001) {
1494 error = avc_has_perm(tsec->sid, tsid,
1495 SECCLASS_DIR, DIR__SEARCH, NULL);
1496 } else {
1497 av = 0;
1498 if (op & 004)
1499 av |= FILE__READ;
1500 if (op & 002)
1501 av |= FILE__WRITE;
1502 if (av)
1503 error = avc_has_perm(tsec->sid, tsid,
1504 SECCLASS_FILE, av, NULL);
1505 }
1506
1507 return error;
1508 }
1509
1510 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1511 {
1512 int rc = 0;
1513
1514 if (!sb)
1515 return 0;
1516
1517 switch (cmds) {
1518 case Q_SYNC:
1519 case Q_QUOTAON:
1520 case Q_QUOTAOFF:
1521 case Q_SETINFO:
1522 case Q_SETQUOTA:
1523 rc = superblock_has_perm(current,
1524 sb,
1525 FILESYSTEM__QUOTAMOD, NULL);
1526 break;
1527 case Q_GETFMT:
1528 case Q_GETINFO:
1529 case Q_GETQUOTA:
1530 rc = superblock_has_perm(current,
1531 sb,
1532 FILESYSTEM__QUOTAGET, NULL);
1533 break;
1534 default:
1535 rc = 0; /* let the kernel handle invalid cmds */
1536 break;
1537 }
1538 return rc;
1539 }
1540
1541 static int selinux_quota_on(struct dentry *dentry)
1542 {
1543 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1544 }
1545
1546 static int selinux_syslog(int type)
1547 {
1548 int rc;
1549
1550 rc = secondary_ops->syslog(type);
1551 if (rc)
1552 return rc;
1553
1554 switch (type) {
1555 case 3: /* Read last kernel messages */
1556 case 10: /* Return size of the log buffer */
1557 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1558 break;
1559 case 6: /* Disable logging to console */
1560 case 7: /* Enable logging to console */
1561 case 8: /* Set level of messages printed to console */
1562 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1563 break;
1564 case 0: /* Close log */
1565 case 1: /* Open log */
1566 case 2: /* Read from log */
1567 case 4: /* Read/clear last kernel messages */
1568 case 5: /* Clear ring buffer */
1569 default:
1570 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1571 break;
1572 }
1573 return rc;
1574 }
1575
1576 /*
1577 * Check that a process has enough memory to allocate a new virtual
1578 * mapping. 0 means there is enough memory for the allocation to
1579 * succeed and -ENOMEM implies there is not.
1580 *
1581 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1582 * if the capability is granted, but __vm_enough_memory requires 1 if
1583 * the capability is granted.
1584 *
1585 * Do not audit the selinux permission check, as this is applied to all
1586 * processes that allocate mappings.
1587 */
1588 static int selinux_vm_enough_memory(long pages)
1589 {
1590 int rc, cap_sys_admin = 0;
1591 struct task_security_struct *tsec = current->security;
1592
1593 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1594 if (rc == 0)
1595 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1596 SECCLASS_CAPABILITY,
1597 CAP_TO_MASK(CAP_SYS_ADMIN),
1598 NULL);
1599
1600 if (rc == 0)
1601 cap_sys_admin = 1;
1602
1603 return __vm_enough_memory(pages, cap_sys_admin);
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610 struct bprm_security_struct *bsec;
1611
1612 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613 if (!bsec)
1614 return -ENOMEM;
1615
1616 bsec->bprm = bprm;
1617 bsec->sid = SECINITSID_UNLABELED;
1618 bsec->set = 0;
1619
1620 bprm->security = bsec;
1621 return 0;
1622 }
1623
1624 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625 {
1626 struct task_security_struct *tsec;
1627 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1628 struct inode_security_struct *isec;
1629 struct bprm_security_struct *bsec;
1630 u32 newsid;
1631 struct avc_audit_data ad;
1632 int rc;
1633
1634 rc = secondary_ops->bprm_set_security(bprm);
1635 if (rc)
1636 return rc;
1637
1638 bsec = bprm->security;
1639
1640 if (bsec->set)
1641 return 0;
1642
1643 tsec = current->security;
1644 isec = inode->i_security;
1645
1646 /* Default to the current task SID. */
1647 bsec->sid = tsec->sid;
1648
1649 /* Reset fs, key, and sock SIDs on execve. */
1650 tsec->create_sid = 0;
1651 tsec->keycreate_sid = 0;
1652 tsec->sockcreate_sid = 0;
1653
1654 if (tsec->exec_sid) {
1655 newsid = tsec->exec_sid;
1656 /* Reset exec SID on execve. */
1657 tsec->exec_sid = 0;
1658 } else {
1659 /* Check for a default transition on this program. */
1660 rc = security_transition_sid(tsec->sid, isec->sid,
1661 SECCLASS_PROCESS, &newsid);
1662 if (rc)
1663 return rc;
1664 }
1665
1666 AVC_AUDIT_DATA_INIT(&ad, FS);
1667 ad.u.fs.mnt = bprm->file->f_path.mnt;
1668 ad.u.fs.dentry = bprm->file->f_path.dentry;
1669
1670 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1671 newsid = tsec->sid;
1672
1673 if (tsec->sid == newsid) {
1674 rc = avc_has_perm(tsec->sid, isec->sid,
1675 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676 if (rc)
1677 return rc;
1678 } else {
1679 /* Check permissions for the transition. */
1680 rc = avc_has_perm(tsec->sid, newsid,
1681 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682 if (rc)
1683 return rc;
1684
1685 rc = avc_has_perm(newsid, isec->sid,
1686 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687 if (rc)
1688 return rc;
1689
1690 /* Clear any possibly unsafe personality bits on exec: */
1691 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693 /* Set the security field to the new SID. */
1694 bsec->sid = newsid;
1695 }
1696
1697 bsec->set = 1;
1698 return 0;
1699 }
1700
1701 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702 {
1703 return secondary_ops->bprm_check_security(bprm);
1704 }
1705
1706
1707 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708 {
1709 struct task_security_struct *tsec = current->security;
1710 int atsecure = 0;
1711
1712 if (tsec->osid != tsec->sid) {
1713 /* Enable secure mode for SIDs transitions unless
1714 the noatsecure permission is granted between
1715 the two SIDs, i.e. ahp returns 0. */
1716 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717 SECCLASS_PROCESS,
1718 PROCESS__NOATSECURE, NULL);
1719 }
1720
1721 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722 }
1723
1724 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725 {
1726 kfree(bprm->security);
1727 bprm->security = NULL;
1728 }
1729
1730 extern struct vfsmount *selinuxfs_mount;
1731 extern struct dentry *selinux_null;
1732
1733 /* Derived from fs/exec.c:flush_old_files. */
1734 static inline void flush_unauthorized_files(struct files_struct * files)
1735 {
1736 struct avc_audit_data ad;
1737 struct file *file, *devnull = NULL;
1738 struct tty_struct *tty;
1739 struct fdtable *fdt;
1740 long j = -1;
1741 int drop_tty = 0;
1742
1743 mutex_lock(&tty_mutex);
1744 tty = get_current_tty();
1745 if (tty) {
1746 file_list_lock();
1747 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1748 if (file) {
1749 /* Revalidate access to controlling tty.
1750 Use inode_has_perm on the tty inode directly rather
1751 than using file_has_perm, as this particular open
1752 file may belong to another process and we are only
1753 interested in the inode-based check here. */
1754 struct inode *inode = file->f_path.dentry->d_inode;
1755 if (inode_has_perm(current, inode,
1756 FILE__READ | FILE__WRITE, NULL)) {
1757 drop_tty = 1;
1758 }
1759 }
1760 file_list_unlock();
1761 }
1762 mutex_unlock(&tty_mutex);
1763 /* Reset controlling tty. */
1764 if (drop_tty)
1765 no_tty();
1766
1767 /* Revalidate access to inherited open files. */
1768
1769 AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771 spin_lock(&files->file_lock);
1772 for (;;) {
1773 unsigned long set, i;
1774 int fd;
1775
1776 j++;
1777 i = j * __NFDBITS;
1778 fdt = files_fdtable(files);
1779 if (i >= fdt->max_fds)
1780 break;
1781 set = fdt->open_fds->fds_bits[j];
1782 if (!set)
1783 continue;
1784 spin_unlock(&files->file_lock);
1785 for ( ; set ; i++,set >>= 1) {
1786 if (set & 1) {
1787 file = fget(i);
1788 if (!file)
1789 continue;
1790 if (file_has_perm(current,
1791 file,
1792 file_to_av(file))) {
1793 sys_close(i);
1794 fd = get_unused_fd();
1795 if (fd != i) {
1796 if (fd >= 0)
1797 put_unused_fd(fd);
1798 fput(file);
1799 continue;
1800 }
1801 if (devnull) {
1802 get_file(devnull);
1803 } else {
1804 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1805 if (IS_ERR(devnull)) {
1806 devnull = NULL;
1807 put_unused_fd(fd);
1808 fput(file);
1809 continue;
1810 }
1811 }
1812 fd_install(fd, devnull);
1813 }
1814 fput(file);
1815 }
1816 }
1817 spin_lock(&files->file_lock);
1818
1819 }
1820 spin_unlock(&files->file_lock);
1821 }
1822
1823 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1824 {
1825 struct task_security_struct *tsec;
1826 struct bprm_security_struct *bsec;
1827 u32 sid;
1828 int rc;
1829
1830 secondary_ops->bprm_apply_creds(bprm, unsafe);
1831
1832 tsec = current->security;
1833
1834 bsec = bprm->security;
1835 sid = bsec->sid;
1836
1837 tsec->osid = tsec->sid;
1838 bsec->unsafe = 0;
1839 if (tsec->sid != sid) {
1840 /* Check for shared state. If not ok, leave SID
1841 unchanged and kill. */
1842 if (unsafe & LSM_UNSAFE_SHARE) {
1843 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1844 PROCESS__SHARE, NULL);
1845 if (rc) {
1846 bsec->unsafe = 1;
1847 return;
1848 }
1849 }
1850
1851 /* Check for ptracing, and update the task SID if ok.
1852 Otherwise, leave SID unchanged and kill. */
1853 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1854 rc = avc_has_perm(tsec->ptrace_sid, sid,
1855 SECCLASS_PROCESS, PROCESS__PTRACE,
1856 NULL);
1857 if (rc) {
1858 bsec->unsafe = 1;
1859 return;
1860 }
1861 }
1862 tsec->sid = sid;
1863 }
1864 }
1865
1866 /*
1867 * called after apply_creds without the task lock held
1868 */
1869 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1870 {
1871 struct task_security_struct *tsec;
1872 struct rlimit *rlim, *initrlim;
1873 struct itimerval itimer;
1874 struct bprm_security_struct *bsec;
1875 int rc, i;
1876
1877 tsec = current->security;
1878 bsec = bprm->security;
1879
1880 if (bsec->unsafe) {
1881 force_sig_specific(SIGKILL, current);
1882 return;
1883 }
1884 if (tsec->osid == tsec->sid)
1885 return;
1886
1887 /* Close files for which the new task SID is not authorized. */
1888 flush_unauthorized_files(current->files);
1889
1890 /* Check whether the new SID can inherit signal state
1891 from the old SID. If not, clear itimers to avoid
1892 subsequent signal generation and flush and unblock
1893 signals. This must occur _after_ the task SID has
1894 been updated so that any kill done after the flush
1895 will be checked against the new SID. */
1896 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897 PROCESS__SIGINH, NULL);
1898 if (rc) {
1899 memset(&itimer, 0, sizeof itimer);
1900 for (i = 0; i < 3; i++)
1901 do_setitimer(i, &itimer, NULL);
1902 flush_signals(current);
1903 spin_lock_irq(&current->sighand->siglock);
1904 flush_signal_handlers(current, 1);
1905 sigemptyset(&current->blocked);
1906 recalc_sigpending();
1907 spin_unlock_irq(&current->sighand->siglock);
1908 }
1909
1910 /* Check whether the new SID can inherit resource limits
1911 from the old SID. If not, reset all soft limits to
1912 the lower of the current task's hard limit and the init
1913 task's soft limit. Note that the setting of hard limits
1914 (even to lower them) can be controlled by the setrlimit
1915 check. The inclusion of the init task's soft limit into
1916 the computation is to avoid resetting soft limits higher
1917 than the default soft limit for cases where the default
1918 is lower than the hard limit, e.g. RLIMIT_CORE or
1919 RLIMIT_STACK.*/
1920 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1921 PROCESS__RLIMITINH, NULL);
1922 if (rc) {
1923 for (i = 0; i < RLIM_NLIMITS; i++) {
1924 rlim = current->signal->rlim + i;
1925 initrlim = init_task.signal->rlim+i;
1926 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1927 }
1928 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1929 /*
1930 * This will cause RLIMIT_CPU calculations
1931 * to be refigured.
1932 */
1933 current->it_prof_expires = jiffies_to_cputime(1);
1934 }
1935 }
1936
1937 /* Wake up the parent if it is waiting so that it can
1938 recheck wait permission to the new task SID. */
1939 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1940 }
1941
1942 /* superblock security operations */
1943
1944 static int selinux_sb_alloc_security(struct super_block *sb)
1945 {
1946 return superblock_alloc_security(sb);
1947 }
1948
1949 static void selinux_sb_free_security(struct super_block *sb)
1950 {
1951 superblock_free_security(sb);
1952 }
1953
1954 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1955 {
1956 if (plen > olen)
1957 return 0;
1958
1959 return !memcmp(prefix, option, plen);
1960 }
1961
1962 static inline int selinux_option(char *option, int len)
1963 {
1964 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1965 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1966 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1967 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1968 }
1969
1970 static inline void take_option(char **to, char *from, int *first, int len)
1971 {
1972 if (!*first) {
1973 **to = ',';
1974 *to += 1;
1975 } else
1976 *first = 0;
1977 memcpy(*to, from, len);
1978 *to += len;
1979 }
1980
1981 static inline void take_selinux_option(char **to, char *from, int *first,
1982 int len)
1983 {
1984 int current_size = 0;
1985
1986 if (!*first) {
1987 **to = '|';
1988 *to += 1;
1989 }
1990 else
1991 *first = 0;
1992
1993 while (current_size < len) {
1994 if (*from != '"') {
1995 **to = *from;
1996 *to += 1;
1997 }
1998 from += 1;
1999 current_size += 1;
2000 }
2001 }
2002
2003 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2004 {
2005 int fnosec, fsec, rc = 0;
2006 char *in_save, *in_curr, *in_end;
2007 char *sec_curr, *nosec_save, *nosec;
2008 int open_quote = 0;
2009
2010 in_curr = orig;
2011 sec_curr = copy;
2012
2013 /* Binary mount data: just copy */
2014 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2015 copy_page(sec_curr, in_curr);
2016 goto out;
2017 }
2018
2019 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2020 if (!nosec) {
2021 rc = -ENOMEM;
2022 goto out;
2023 }
2024
2025 nosec_save = nosec;
2026 fnosec = fsec = 1;
2027 in_save = in_end = orig;
2028
2029 do {
2030 if (*in_end == '"')
2031 open_quote = !open_quote;
2032 if ((*in_end == ',' && open_quote == 0) ||
2033 *in_end == '\0') {
2034 int len = in_end - in_curr;
2035
2036 if (selinux_option(in_curr, len))
2037 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2038 else
2039 take_option(&nosec, in_curr, &fnosec, len);
2040
2041 in_curr = in_end + 1;
2042 }
2043 } while (*in_end++);
2044
2045 strcpy(in_save, nosec_save);
2046 free_page((unsigned long)nosec_save);
2047 out:
2048 return rc;
2049 }
2050
2051 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2052 {
2053 struct avc_audit_data ad;
2054 int rc;
2055
2056 rc = superblock_doinit(sb, data);
2057 if (rc)
2058 return rc;
2059
2060 AVC_AUDIT_DATA_INIT(&ad,FS);
2061 ad.u.fs.dentry = sb->s_root;
2062 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2063 }
2064
2065 static int selinux_sb_statfs(struct dentry *dentry)
2066 {
2067 struct avc_audit_data ad;
2068
2069 AVC_AUDIT_DATA_INIT(&ad,FS);
2070 ad.u.fs.dentry = dentry->d_sb->s_root;
2071 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2072 }
2073
2074 static int selinux_mount(char * dev_name,
2075 struct nameidata *nd,
2076 char * type,
2077 unsigned long flags,
2078 void * data)
2079 {
2080 int rc;
2081
2082 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2083 if (rc)
2084 return rc;
2085
2086 if (flags & MS_REMOUNT)
2087 return superblock_has_perm(current, nd->mnt->mnt_sb,
2088 FILESYSTEM__REMOUNT, NULL);
2089 else
2090 return dentry_has_perm(current, nd->mnt, nd->dentry,
2091 FILE__MOUNTON);
2092 }
2093
2094 static int selinux_umount(struct vfsmount *mnt, int flags)
2095 {
2096 int rc;
2097
2098 rc = secondary_ops->sb_umount(mnt, flags);
2099 if (rc)
2100 return rc;
2101
2102 return superblock_has_perm(current,mnt->mnt_sb,
2103 FILESYSTEM__UNMOUNT,NULL);
2104 }
2105
2106 /* inode security operations */
2107
2108 static int selinux_inode_alloc_security(struct inode *inode)
2109 {
2110 return inode_alloc_security(inode);
2111 }
2112
2113 static void selinux_inode_free_security(struct inode *inode)
2114 {
2115 inode_free_security(inode);
2116 }
2117
2118 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2119 char **name, void **value,
2120 size_t *len)
2121 {
2122 struct task_security_struct *tsec;
2123 struct inode_security_struct *dsec;
2124 struct superblock_security_struct *sbsec;
2125 u32 newsid, clen;
2126 int rc;
2127 char *namep = NULL, *context;
2128
2129 tsec = current->security;
2130 dsec = dir->i_security;
2131 sbsec = dir->i_sb->s_security;
2132
2133 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2134 newsid = tsec->create_sid;
2135 } else {
2136 rc = security_transition_sid(tsec->sid, dsec->sid,
2137 inode_mode_to_security_class(inode->i_mode),
2138 &newsid);
2139 if (rc) {
2140 printk(KERN_WARNING "%s: "
2141 "security_transition_sid failed, rc=%d (dev=%s "
2142 "ino=%ld)\n",
2143 __FUNCTION__,
2144 -rc, inode->i_sb->s_id, inode->i_ino);
2145 return rc;
2146 }
2147 }
2148
2149 /* Possibly defer initialization to selinux_complete_init. */
2150 if (sbsec->initialized) {
2151 struct inode_security_struct *isec = inode->i_security;
2152 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2153 isec->sid = newsid;
2154 isec->initialized = 1;
2155 }
2156
2157 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2158 return -EOPNOTSUPP;
2159
2160 if (name) {
2161 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2162 if (!namep)
2163 return -ENOMEM;
2164 *name = namep;
2165 }
2166
2167 if (value && len) {
2168 rc = security_sid_to_context(newsid, &context, &clen);
2169 if (rc) {
2170 kfree(namep);
2171 return rc;
2172 }
2173 *value = context;
2174 *len = clen;
2175 }
2176
2177 return 0;
2178 }
2179
2180 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2181 {
2182 return may_create(dir, dentry, SECCLASS_FILE);
2183 }
2184
2185 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2186 {
2187 int rc;
2188
2189 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2190 if (rc)
2191 return rc;
2192 return may_link(dir, old_dentry, MAY_LINK);
2193 }
2194
2195 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2196 {
2197 int rc;
2198
2199 rc = secondary_ops->inode_unlink(dir, dentry);
2200 if (rc)
2201 return rc;
2202 return may_link(dir, dentry, MAY_UNLINK);
2203 }
2204
2205 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2206 {
2207 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2208 }
2209
2210 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2211 {
2212 return may_create(dir, dentry, SECCLASS_DIR);
2213 }
2214
2215 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2216 {
2217 return may_link(dir, dentry, MAY_RMDIR);
2218 }
2219
2220 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2221 {
2222 int rc;
2223
2224 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2225 if (rc)
2226 return rc;
2227
2228 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2229 }
2230
2231 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2232 struct inode *new_inode, struct dentry *new_dentry)
2233 {
2234 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2235 }
2236
2237 static int selinux_inode_readlink(struct dentry *dentry)
2238 {
2239 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2240 }
2241
2242 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2243 {
2244 int rc;
2245
2246 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2247 if (rc)
2248 return rc;
2249 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2250 }
2251
2252 static int selinux_inode_permission(struct inode *inode, int mask,
2253 struct nameidata *nd)
2254 {
2255 int rc;
2256
2257 rc = secondary_ops->inode_permission(inode, mask, nd);
2258 if (rc)
2259 return rc;
2260
2261 if (!mask) {
2262 /* No permission to check. Existence test. */
2263 return 0;
2264 }
2265
2266 return inode_has_perm(current, inode,
2267 file_mask_to_av(inode->i_mode, mask), NULL);
2268 }
2269
2270 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2271 {
2272 int rc;
2273
2274 rc = secondary_ops->inode_setattr(dentry, iattr);
2275 if (rc)
2276 return rc;
2277
2278 if (iattr->ia_valid & ATTR_FORCE)
2279 return 0;
2280
2281 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2282 ATTR_ATIME_SET | ATTR_MTIME_SET))
2283 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2284
2285 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2286 }
2287
2288 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2289 {
2290 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2291 }
2292
2293 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2294 {
2295 struct task_security_struct *tsec = current->security;
2296 struct inode *inode = dentry->d_inode;
2297 struct inode_security_struct *isec = inode->i_security;
2298 struct superblock_security_struct *sbsec;
2299 struct avc_audit_data ad;
2300 u32 newsid;
2301 int rc = 0;
2302
2303 if (strcmp(name, XATTR_NAME_SELINUX)) {
2304 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2305 sizeof XATTR_SECURITY_PREFIX - 1) &&
2306 !capable(CAP_SYS_ADMIN)) {
2307 /* A different attribute in the security namespace.
2308 Restrict to administrator. */
2309 return -EPERM;
2310 }
2311
2312 /* Not an attribute we recognize, so just check the
2313 ordinary setattr permission. */
2314 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2315 }
2316
2317 sbsec = inode->i_sb->s_security;
2318 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2319 return -EOPNOTSUPP;
2320
2321 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2322 return -EPERM;
2323
2324 AVC_AUDIT_DATA_INIT(&ad,FS);
2325 ad.u.fs.dentry = dentry;
2326
2327 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2328 FILE__RELABELFROM, &ad);
2329 if (rc)
2330 return rc;
2331
2332 rc = security_context_to_sid(value, size, &newsid);
2333 if (rc)
2334 return rc;
2335
2336 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2337 FILE__RELABELTO, &ad);
2338 if (rc)
2339 return rc;
2340
2341 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2342 isec->sclass);
2343 if (rc)
2344 return rc;
2345
2346 return avc_has_perm(newsid,
2347 sbsec->sid,
2348 SECCLASS_FILESYSTEM,
2349 FILESYSTEM__ASSOCIATE,
2350 &ad);
2351 }
2352
2353 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2354 void *value, size_t size, int flags)
2355 {
2356 struct inode *inode = dentry->d_inode;
2357 struct inode_security_struct *isec = inode->i_security;
2358 u32 newsid;
2359 int rc;
2360
2361 if (strcmp(name, XATTR_NAME_SELINUX)) {
2362 /* Not an attribute we recognize, so nothing to do. */
2363 return;
2364 }
2365
2366 rc = security_context_to_sid(value, size, &newsid);
2367 if (rc) {
2368 printk(KERN_WARNING "%s: unable to obtain SID for context "
2369 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2370 return;
2371 }
2372
2373 isec->sid = newsid;
2374 return;
2375 }
2376
2377 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2378 {
2379 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2380 }
2381
2382 static int selinux_inode_listxattr (struct dentry *dentry)
2383 {
2384 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2385 }
2386
2387 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2388 {
2389 if (strcmp(name, XATTR_NAME_SELINUX)) {
2390 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2391 sizeof XATTR_SECURITY_PREFIX - 1) &&
2392 !capable(CAP_SYS_ADMIN)) {
2393 /* A different attribute in the security namespace.
2394 Restrict to administrator. */
2395 return -EPERM;
2396 }
2397
2398 /* Not an attribute we recognize, so just check the
2399 ordinary setattr permission. Might want a separate
2400 permission for removexattr. */
2401 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2402 }
2403
2404 /* No one is allowed to remove a SELinux security label.
2405 You can change the label, but all data must be labeled. */
2406 return -EACCES;
2407 }
2408
2409 static const char *selinux_inode_xattr_getsuffix(void)
2410 {
2411 return XATTR_SELINUX_SUFFIX;
2412 }
2413
2414 /*
2415 * Copy the in-core inode security context value to the user. If the
2416 * getxattr() prior to this succeeded, check to see if we need to
2417 * canonicalize the value to be finally returned to the user.
2418 *
2419 * Permission check is handled by selinux_inode_getxattr hook.
2420 */
2421 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2422 {
2423 struct inode_security_struct *isec = inode->i_security;
2424
2425 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2426 return -EOPNOTSUPP;
2427
2428 return selinux_getsecurity(isec->sid, buffer, size);
2429 }
2430
2431 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2432 const void *value, size_t size, int flags)
2433 {
2434 struct inode_security_struct *isec = inode->i_security;
2435 u32 newsid;
2436 int rc;
2437
2438 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2439 return -EOPNOTSUPP;
2440
2441 if (!value || !size)
2442 return -EACCES;
2443
2444 rc = security_context_to_sid((void*)value, size, &newsid);
2445 if (rc)
2446 return rc;
2447
2448 isec->sid = newsid;
2449 return 0;
2450 }
2451
2452 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2453 {
2454 const int len = sizeof(XATTR_NAME_SELINUX);
2455 if (buffer && len <= buffer_size)
2456 memcpy(buffer, XATTR_NAME_SELINUX, len);
2457 return len;
2458 }
2459
2460 /* file security operations */
2461
2462 static int selinux_file_permission(struct file *file, int mask)
2463 {
2464 int rc;
2465 struct inode *inode = file->f_path.dentry->d_inode;
2466
2467 if (!mask) {
2468 /* No permission to check. Existence test. */
2469 return 0;
2470 }
2471
2472 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2473 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2474 mask |= MAY_APPEND;
2475
2476 rc = file_has_perm(current, file,
2477 file_mask_to_av(inode->i_mode, mask));
2478 if (rc)
2479 return rc;
2480
2481 return selinux_netlbl_inode_permission(inode, mask);
2482 }
2483
2484 static int selinux_file_alloc_security(struct file *file)
2485 {
2486 return file_alloc_security(file);
2487 }
2488
2489 static void selinux_file_free_security(struct file *file)
2490 {
2491 file_free_security(file);
2492 }
2493
2494 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2495 unsigned long arg)
2496 {
2497 int error = 0;
2498
2499 switch (cmd) {
2500 case FIONREAD:
2501 /* fall through */
2502 case FIBMAP:
2503 /* fall through */
2504 case FIGETBSZ:
2505 /* fall through */
2506 case EXT2_IOC_GETFLAGS:
2507 /* fall through */
2508 case EXT2_IOC_GETVERSION:
2509 error = file_has_perm(current, file, FILE__GETATTR);
2510 break;
2511
2512 case EXT2_IOC_SETFLAGS:
2513 /* fall through */
2514 case EXT2_IOC_SETVERSION:
2515 error = file_has_perm(current, file, FILE__SETATTR);
2516 break;
2517
2518 /* sys_ioctl() checks */
2519 case FIONBIO:
2520 /* fall through */
2521 case FIOASYNC:
2522 error = file_has_perm(current, file, 0);
2523 break;
2524
2525 case KDSKBENT:
2526 case KDSKBSENT:
2527 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2528 break;
2529
2530 /* default case assumes that the command will go
2531 * to the file's ioctl() function.
2532 */
2533 default:
2534 error = file_has_perm(current, file, FILE__IOCTL);
2535
2536 }
2537 return error;
2538 }
2539
2540 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2541 {
2542 #ifndef CONFIG_PPC32
2543 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2544 /*
2545 * We are making executable an anonymous mapping or a
2546 * private file mapping that will also be writable.
2547 * This has an additional check.
2548 */
2549 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2550 if (rc)
2551 return rc;
2552 }
2553 #endif
2554
2555 if (file) {
2556 /* read access is always possible with a mapping */
2557 u32 av = FILE__READ;
2558
2559 /* write access only matters if the mapping is shared */
2560 if (shared && (prot & PROT_WRITE))
2561 av |= FILE__WRITE;
2562
2563 if (prot & PROT_EXEC)
2564 av |= FILE__EXECUTE;
2565
2566 return file_has_perm(current, file, av);
2567 }
2568 return 0;
2569 }
2570
2571 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2572 unsigned long prot, unsigned long flags)
2573 {
2574 int rc;
2575
2576 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2577 if (rc)
2578 return rc;
2579
2580 if (selinux_checkreqprot)
2581 prot = reqprot;
2582
2583 return file_map_prot_check(file, prot,
2584 (flags & MAP_TYPE) == MAP_SHARED);
2585 }
2586
2587 static int selinux_file_mprotect(struct vm_area_struct *vma,
2588 unsigned long reqprot,
2589 unsigned long prot)
2590 {
2591 int rc;
2592
2593 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2594 if (rc)
2595 return rc;
2596
2597 if (selinux_checkreqprot)
2598 prot = reqprot;
2599
2600 #ifndef CONFIG_PPC32
2601 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2602 rc = 0;
2603 if (vma->vm_start >= vma->vm_mm->start_brk &&
2604 vma->vm_end <= vma->vm_mm->brk) {
2605 rc = task_has_perm(current, current,
2606 PROCESS__EXECHEAP);
2607 } else if (!vma->vm_file &&
2608 vma->vm_start <= vma->vm_mm->start_stack &&
2609 vma->vm_end >= vma->vm_mm->start_stack) {
2610 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2611 } else if (vma->vm_file && vma->anon_vma) {
2612 /*
2613 * We are making executable a file mapping that has
2614 * had some COW done. Since pages might have been
2615 * written, check ability to execute the possibly
2616 * modified content. This typically should only
2617 * occur for text relocations.
2618 */
2619 rc = file_has_perm(current, vma->vm_file,
2620 FILE__EXECMOD);
2621 }
2622 if (rc)
2623 return rc;
2624 }
2625 #endif
2626
2627 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2628 }
2629
2630 static int selinux_file_lock(struct file *file, unsigned int cmd)
2631 {
2632 return file_has_perm(current, file, FILE__LOCK);
2633 }
2634
2635 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2636 unsigned long arg)
2637 {
2638 int err = 0;
2639
2640 switch (cmd) {
2641 case F_SETFL:
2642 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2643 err = -EINVAL;
2644 break;
2645 }
2646
2647 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2648 err = file_has_perm(current, file,FILE__WRITE);
2649 break;
2650 }
2651 /* fall through */
2652 case F_SETOWN:
2653 case F_SETSIG:
2654 case F_GETFL:
2655 case F_GETOWN:
2656 case F_GETSIG:
2657 /* Just check FD__USE permission */
2658 err = file_has_perm(current, file, 0);
2659 break;
2660 case F_GETLK:
2661 case F_SETLK:
2662 case F_SETLKW:
2663 #if BITS_PER_LONG == 32
2664 case F_GETLK64:
2665 case F_SETLK64:
2666 case F_SETLKW64:
2667 #endif
2668 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2669 err = -EINVAL;
2670 break;
2671 }
2672 err = file_has_perm(current, file, FILE__LOCK);
2673 break;
2674 }
2675
2676 return err;
2677 }
2678
2679 static int selinux_file_set_fowner(struct file *file)
2680 {
2681 struct task_security_struct *tsec;
2682 struct file_security_struct *fsec;
2683
2684 tsec = current->security;
2685 fsec = file->f_security;
2686 fsec->fown_sid = tsec->sid;
2687
2688 return 0;
2689 }
2690
2691 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2692 struct fown_struct *fown, int signum)
2693 {
2694 struct file *file;
2695 u32 perm;
2696 struct task_security_struct *tsec;
2697 struct file_security_struct *fsec;
2698
2699 /* struct fown_struct is never outside the context of a struct file */
2700 file = container_of(fown, struct file, f_owner);
2701
2702 tsec = tsk->security;
2703 fsec = file->f_security;
2704
2705 if (!signum)
2706 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2707 else
2708 perm = signal_to_av(signum);
2709
2710 return avc_has_perm(fsec->fown_sid, tsec->sid,
2711 SECCLASS_PROCESS, perm, NULL);
2712 }
2713
2714 static int selinux_file_receive(struct file *file)
2715 {
2716 return file_has_perm(current, file, file_to_av(file));
2717 }
2718
2719 /* task security operations */
2720
2721 static int selinux_task_create(unsigned long clone_flags)
2722 {
2723 int rc;
2724
2725 rc = secondary_ops->task_create(clone_flags);
2726 if (rc)
2727 return rc;
2728
2729 return task_has_perm(current, current, PROCESS__FORK);
2730 }
2731
2732 static int selinux_task_alloc_security(struct task_struct *tsk)
2733 {
2734 struct task_security_struct *tsec1, *tsec2;
2735 int rc;
2736
2737 tsec1 = current->security;
2738
2739 rc = task_alloc_security(tsk);
2740 if (rc)
2741 return rc;
2742 tsec2 = tsk->security;
2743
2744 tsec2->osid = tsec1->osid;
2745 tsec2->sid = tsec1->sid;
2746
2747 /* Retain the exec, fs, key, and sock SIDs across fork */
2748 tsec2->exec_sid = tsec1->exec_sid;
2749 tsec2->create_sid = tsec1->create_sid;
2750 tsec2->keycreate_sid = tsec1->keycreate_sid;
2751 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2752
2753 /* Retain ptracer SID across fork, if any.
2754 This will be reset by the ptrace hook upon any
2755 subsequent ptrace_attach operations. */
2756 tsec2->ptrace_sid = tsec1->ptrace_sid;
2757
2758 return 0;
2759 }
2760
2761 static void selinux_task_free_security(struct task_struct *tsk)
2762 {
2763 task_free_security(tsk);
2764 }
2765
2766 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2767 {
2768 /* Since setuid only affects the current process, and
2769 since the SELinux controls are not based on the Linux
2770 identity attributes, SELinux does not need to control
2771 this operation. However, SELinux does control the use
2772 of the CAP_SETUID and CAP_SETGID capabilities using the
2773 capable hook. */
2774 return 0;
2775 }
2776
2777 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2778 {
2779 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2780 }
2781
2782 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2783 {
2784 /* See the comment for setuid above. */
2785 return 0;
2786 }
2787
2788 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2789 {
2790 return task_has_perm(current, p, PROCESS__SETPGID);
2791 }
2792
2793 static int selinux_task_getpgid(struct task_struct *p)
2794 {
2795 return task_has_perm(current, p, PROCESS__GETPGID);
2796 }
2797
2798 static int selinux_task_getsid(struct task_struct *p)
2799 {
2800 return task_has_perm(current, p, PROCESS__GETSESSION);
2801 }
2802
2803 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2804 {
2805 selinux_get_task_sid(p, secid);
2806 }
2807
2808 static int selinux_task_setgroups(struct group_info *group_info)
2809 {
2810 /* See the comment for setuid above. */
2811 return 0;
2812 }
2813
2814 static int selinux_task_setnice(struct task_struct *p, int nice)
2815 {
2816 int rc;
2817
2818 rc = secondary_ops->task_setnice(p, nice);
2819 if (rc)
2820 return rc;
2821
2822 return task_has_perm(current,p, PROCESS__SETSCHED);
2823 }
2824
2825 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2826 {
2827 return task_has_perm(current, p, PROCESS__SETSCHED);
2828 }
2829
2830 static int selinux_task_getioprio(struct task_struct *p)
2831 {
2832 return task_has_perm(current, p, PROCESS__GETSCHED);
2833 }
2834
2835 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2836 {
2837 struct rlimit *old_rlim = current->signal->rlim + resource;
2838 int rc;
2839
2840 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2841 if (rc)
2842 return rc;
2843
2844 /* Control the ability to change the hard limit (whether
2845 lowering or raising it), so that the hard limit can
2846 later be used as a safe reset point for the soft limit
2847 upon context transitions. See selinux_bprm_apply_creds. */
2848 if (old_rlim->rlim_max != new_rlim->rlim_max)
2849 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2850
2851 return 0;
2852 }
2853
2854 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2855 {
2856 return task_has_perm(current, p, PROCESS__SETSCHED);
2857 }
2858
2859 static int selinux_task_getscheduler(struct task_struct *p)
2860 {
2861 return task_has_perm(current, p, PROCESS__GETSCHED);
2862 }
2863
2864 static int selinux_task_movememory(struct task_struct *p)
2865 {
2866 return task_has_perm(current, p, PROCESS__SETSCHED);
2867 }
2868
2869 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2870 int sig, u32 secid)
2871 {
2872 u32 perm;
2873 int rc;
2874 struct task_security_struct *tsec;
2875
2876 rc = secondary_ops->task_kill(p, info, sig, secid);
2877 if (rc)
2878 return rc;
2879
2880 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2881 return 0;
2882
2883 if (!sig)
2884 perm = PROCESS__SIGNULL; /* null signal; existence test */
2885 else
2886 perm = signal_to_av(sig);
2887 tsec = p->security;
2888 if (secid)
2889 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2890 else
2891 rc = task_has_perm(current, p, perm);
2892 return rc;
2893 }
2894
2895 static int selinux_task_prctl(int option,
2896 unsigned long arg2,
2897 unsigned long arg3,
2898 unsigned long arg4,
2899 unsigned long arg5)
2900 {
2901 /* The current prctl operations do not appear to require
2902 any SELinux controls since they merely observe or modify
2903 the state of the current process. */
2904 return 0;
2905 }
2906
2907 static int selinux_task_wait(struct task_struct *p)
2908 {
2909 u32 perm;
2910
2911 perm = signal_to_av(p->exit_signal);
2912
2913 return task_has_perm(p, current, perm);
2914 }
2915
2916 static void selinux_task_reparent_to_init(struct task_struct *p)
2917 {
2918 struct task_security_struct *tsec;
2919
2920 secondary_ops->task_reparent_to_init(p);
2921
2922 tsec = p->security;
2923 tsec->osid = tsec->sid;
2924 tsec->sid = SECINITSID_KERNEL;
2925 return;
2926 }
2927
2928 static void selinux_task_to_inode(struct task_struct *p,
2929 struct inode *inode)
2930 {
2931 struct task_security_struct *tsec = p->security;
2932 struct inode_security_struct *isec = inode->i_security;
2933
2934 isec->sid = tsec->sid;
2935 isec->initialized = 1;
2936 return;
2937 }
2938
2939 /* Returns error only if unable to parse addresses */
2940 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2941 struct avc_audit_data *ad, u8 *proto)
2942 {
2943 int offset, ihlen, ret = -EINVAL;
2944 struct iphdr _iph, *ih;
2945
2946 offset = skb_network_offset(skb);
2947 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2948 if (ih == NULL)
2949 goto out;
2950
2951 ihlen = ih->ihl * 4;
2952 if (ihlen < sizeof(_iph))
2953 goto out;
2954
2955 ad->u.net.v4info.saddr = ih->saddr;
2956 ad->u.net.v4info.daddr = ih->daddr;
2957 ret = 0;
2958
2959 if (proto)
2960 *proto = ih->protocol;
2961
2962 switch (ih->protocol) {
2963 case IPPROTO_TCP: {
2964 struct tcphdr _tcph, *th;
2965
2966 if (ntohs(ih->frag_off) & IP_OFFSET)
2967 break;
2968
2969 offset += ihlen;
2970 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2971 if (th == NULL)
2972 break;
2973
2974 ad->u.net.sport = th->source;
2975 ad->u.net.dport = th->dest;
2976 break;
2977 }
2978
2979 case IPPROTO_UDP: {
2980 struct udphdr _udph, *uh;
2981
2982 if (ntohs(ih->frag_off) & IP_OFFSET)
2983 break;
2984
2985 offset += ihlen;
2986 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2987 if (uh == NULL)
2988 break;
2989
2990 ad->u.net.sport = uh->source;
2991 ad->u.net.dport = uh->dest;
2992 break;
2993 }
2994
2995 case IPPROTO_DCCP: {
2996 struct dccp_hdr _dccph, *dh;
2997
2998 if (ntohs(ih->frag_off) & IP_OFFSET)
2999 break;
3000
3001 offset += ihlen;
3002 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3003 if (dh == NULL)
3004 break;
3005
3006 ad->u.net.sport = dh->dccph_sport;
3007 ad->u.net.dport = dh->dccph_dport;
3008 break;
3009 }
3010
3011 default:
3012 break;
3013 }
3014 out:
3015 return ret;
3016 }
3017
3018 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3019
3020 /* Returns error only if unable to parse addresses */
3021 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3022 struct avc_audit_data *ad, u8 *proto)
3023 {
3024 u8 nexthdr;
3025 int ret = -EINVAL, offset;
3026 struct ipv6hdr _ipv6h, *ip6;
3027
3028 offset = skb_network_offset(skb);
3029 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3030 if (ip6 == NULL)
3031 goto out;
3032
3033 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3034 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3035 ret = 0;
3036
3037 nexthdr = ip6->nexthdr;
3038 offset += sizeof(_ipv6h);
3039 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3040 if (offset < 0)
3041 goto out;
3042
3043 if (proto)
3044 *proto = nexthdr;
3045
3046 switch (nexthdr) {
3047 case IPPROTO_TCP: {
3048 struct tcphdr _tcph, *th;
3049
3050 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3051 if (th == NULL)
3052 break;
3053
3054 ad->u.net.sport = th->source;
3055 ad->u.net.dport = th->dest;
3056 break;
3057 }
3058
3059 case IPPROTO_UDP: {
3060 struct udphdr _udph, *uh;
3061
3062 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3063 if (uh == NULL)
3064 break;
3065
3066 ad->u.net.sport = uh->source;
3067 ad->u.net.dport = uh->dest;
3068 break;
3069 }
3070
3071 case IPPROTO_DCCP: {
3072 struct dccp_hdr _dccph, *dh;
3073
3074 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3075 if (dh == NULL)
3076 break;
3077
3078 ad->u.net.sport = dh->dccph_sport;
3079 ad->u.net.dport = dh->dccph_dport;
3080 break;
3081 }
3082
3083 /* includes fragments */
3084 default:
3085 break;
3086 }
3087 out:
3088 return ret;
3089 }
3090
3091 #endif /* IPV6 */
3092
3093 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3094 char **addrp, int *len, int src, u8 *proto)
3095 {
3096 int ret = 0;
3097
3098 switch (ad->u.net.family) {
3099 case PF_INET:
3100 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3101 if (ret || !addrp)
3102 break;
3103 *len = 4;
3104 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3105 &ad->u.net.v4info.daddr);
3106 break;
3107
3108 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3109 case PF_INET6:
3110 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3111 if (ret || !addrp)
3112 break;
3113 *len = 16;
3114 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3115 &ad->u.net.v6info.daddr);
3116 break;
3117 #endif /* IPV6 */
3118 default:
3119 break;
3120 }
3121
3122 return ret;
3123 }
3124
3125 /**
3126 * selinux_skb_extlbl_sid - Determine the external label of a packet
3127 * @skb: the packet
3128 * @base_sid: the SELinux SID to use as a context for MLS only external labels
3129 * @sid: the packet's SID
3130 *
3131 * Description:
3132 * Check the various different forms of external packet labeling and determine
3133 * the external SID for the packet.
3134 *
3135 */
3136 static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3137 u32 base_sid,
3138 u32 *sid)
3139 {
3140 u32 xfrm_sid;
3141 u32 nlbl_sid;
3142
3143 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3144 if (selinux_netlbl_skbuff_getsid(skb,
3145 (xfrm_sid == SECSID_NULL ?
3146 base_sid : xfrm_sid),
3147 &nlbl_sid) != 0)
3148 nlbl_sid = SECSID_NULL;
3149
3150 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3151 }
3152
3153 /* socket security operations */
3154 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3155 u32 perms)
3156 {
3157 struct inode_security_struct *isec;
3158 struct task_security_struct *tsec;
3159 struct avc_audit_data ad;
3160 int err = 0;
3161
3162 tsec = task->security;
3163 isec = SOCK_INODE(sock)->i_security;
3164
3165 if (isec->sid == SECINITSID_KERNEL)
3166 goto out;
3167
3168 AVC_AUDIT_DATA_INIT(&ad,NET);
3169 ad.u.net.sk = sock->sk;
3170 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3171
3172 out:
3173 return err;
3174 }
3175
3176 static int selinux_socket_create(int family, int type,
3177 int protocol, int kern)
3178 {
3179 int err = 0;
3180 struct task_security_struct *tsec;
3181 u32 newsid;
3182
3183 if (kern)
3184 goto out;
3185
3186 tsec = current->security;
3187 newsid = tsec->sockcreate_sid ? : tsec->sid;
3188 err = avc_has_perm(tsec->sid, newsid,
3189 socket_type_to_security_class(family, type,
3190 protocol), SOCKET__CREATE, NULL);
3191
3192 out:
3193 return err;
3194 }
3195
3196 static int selinux_socket_post_create(struct socket *sock, int family,
3197 int type, int protocol, int kern)
3198 {
3199 int err = 0;
3200 struct inode_security_struct *isec;
3201 struct task_security_struct *tsec;
3202 struct sk_security_struct *sksec;
3203 u32 newsid;
3204
3205 isec = SOCK_INODE(sock)->i_security;
3206
3207 tsec = current->security;
3208 newsid = tsec->sockcreate_sid ? : tsec->sid;
3209 isec->sclass = socket_type_to_security_class(family, type, protocol);
3210 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3211 isec->initialized = 1;
3212
3213 if (sock->sk) {
3214 sksec = sock->sk->sk_security;
3215 sksec->sid = isec->sid;
3216 err = selinux_netlbl_socket_post_create(sock);
3217 }
3218
3219 return err;
3220 }
3221
3222 /* Range of port numbers used to automatically bind.
3223 Need to determine whether we should perform a name_bind
3224 permission check between the socket and the port number. */
3225 #define ip_local_port_range_0 sysctl_local_port_range[0]
3226 #define ip_local_port_range_1 sysctl_local_port_range[1]
3227
3228 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3229 {
3230 u16 family;
3231 int err;
3232
3233 err = socket_has_perm(current, sock, SOCKET__BIND);
3234 if (err)
3235 goto out;
3236
3237 /*
3238 * If PF_INET or PF_INET6, check name_bind permission for the port.
3239 * Multiple address binding for SCTP is not supported yet: we just
3240 * check the first address now.
3241 */
3242 family = sock->sk->sk_family;
3243 if (family == PF_INET || family == PF_INET6) {
3244 char *addrp;
3245 struct inode_security_struct *isec;
3246 struct task_security_struct *tsec;
3247 struct avc_audit_data ad;
3248 struct sockaddr_in *addr4 = NULL;
3249 struct sockaddr_in6 *addr6 = NULL;
3250 unsigned short snum;
3251 struct sock *sk = sock->sk;
3252 u32 sid, node_perm, addrlen;
3253
3254 tsec = current->security;
3255 isec = SOCK_INODE(sock)->i_security;
3256
3257 if (family == PF_INET) {
3258 addr4 = (struct sockaddr_in *)address;
3259 snum = ntohs(addr4->sin_port);
3260 addrlen = sizeof(addr4->sin_addr.s_addr);
3261 addrp = (char *)&addr4->sin_addr.s_addr;
3262 } else {
3263 addr6 = (struct sockaddr_in6 *)address;
3264 snum = ntohs(addr6->sin6_port);
3265 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3266 addrp = (char *)&addr6->sin6_addr.s6_addr;
3267 }
3268
3269 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3270 snum > ip_local_port_range_1)) {
3271 err = security_port_sid(sk->sk_family, sk->sk_type,
3272 sk->sk_protocol, snum, &sid);
3273 if (err)
3274 goto out;
3275 AVC_AUDIT_DATA_INIT(&ad,NET);
3276 ad.u.net.sport = htons(snum);
3277 ad.u.net.family = family;
3278 err = avc_has_perm(isec->sid, sid,
3279 isec->sclass,
3280 SOCKET__NAME_BIND, &ad);
3281 if (err)
3282 goto out;
3283 }
3284
3285 switch(isec->sclass) {
3286 case SECCLASS_TCP_SOCKET:
3287 node_perm = TCP_SOCKET__NODE_BIND;
3288 break;
3289
3290 case SECCLASS_UDP_SOCKET:
3291 node_perm = UDP_SOCKET__NODE_BIND;
3292 break;
3293
3294 case SECCLASS_DCCP_SOCKET:
3295 node_perm = DCCP_SOCKET__NODE_BIND;
3296 break;
3297
3298 default:
3299 node_perm = RAWIP_SOCKET__NODE_BIND;
3300 break;
3301 }
3302
3303 err = security_node_sid(family, addrp, addrlen, &sid);
3304 if (err)
3305 goto out;
3306
3307 AVC_AUDIT_DATA_INIT(&ad,NET);
3308 ad.u.net.sport = htons(snum);
3309 ad.u.net.family = family;
3310
3311 if (family == PF_INET)
3312 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3313 else
3314 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3315
3316 err = avc_has_perm(isec->sid, sid,
3317 isec->sclass, node_perm, &ad);
3318 if (err)
3319 goto out;
3320 }
3321 out:
3322 return err;
3323 }
3324
3325 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3326 {
3327 struct inode_security_struct *isec;
3328 int err;
3329
3330 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3331 if (err)
3332 return err;
3333
3334 /*
3335 * If a TCP or DCCP socket, check name_connect permission for the port.
3336 */
3337 isec = SOCK_INODE(sock)->i_security;
3338 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3339 isec->sclass == SECCLASS_DCCP_SOCKET) {
3340 struct sock *sk = sock->sk;
3341 struct avc_audit_data ad;
3342 struct sockaddr_in *addr4 = NULL;
3343 struct sockaddr_in6 *addr6 = NULL;
3344 unsigned short snum;
3345 u32 sid, perm;
3346
3347 if (sk->sk_family == PF_INET) {
3348 addr4 = (struct sockaddr_in *)address;
3349 if (addrlen < sizeof(struct sockaddr_in))
3350 return -EINVAL;
3351 snum = ntohs(addr4->sin_port);
3352 } else {
3353 addr6 = (struct sockaddr_in6 *)address;
3354 if (addrlen < SIN6_LEN_RFC2133)
3355 return -EINVAL;
3356 snum = ntohs(addr6->sin6_port);
3357 }
3358
3359 err = security_port_sid(sk->sk_family, sk->sk_type,
3360 sk->sk_protocol, snum, &sid);
3361 if (err)
3362 goto out;
3363
3364 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3365 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3366
3367 AVC_AUDIT_DATA_INIT(&ad,NET);
3368 ad.u.net.dport = htons(snum);
3369 ad.u.net.family = sk->sk_family;
3370 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3371 if (err)
3372 goto out;
3373 }
3374
3375 out:
3376 return err;
3377 }
3378
3379 static int selinux_socket_listen(struct socket *sock, int backlog)
3380 {
3381 return socket_has_perm(current, sock, SOCKET__LISTEN);
3382 }
3383
3384 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3385 {
3386 int err;
3387 struct inode_security_struct *isec;
3388 struct inode_security_struct *newisec;
3389
3390 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3391 if (err)
3392 return err;
3393
3394 newisec = SOCK_INODE(newsock)->i_security;
3395
3396 isec = SOCK_INODE(sock)->i_security;
3397 newisec->sclass = isec->sclass;
3398 newisec->sid = isec->sid;
3399 newisec->initialized = 1;
3400
3401 return 0;
3402 }
3403
3404 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3405 int size)
3406 {
3407 int rc;
3408
3409 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3410 if (rc)
3411 return rc;
3412
3413 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3414 }
3415
3416 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3417 int size, int flags)
3418 {
3419 return socket_has_perm(current, sock, SOCKET__READ);
3420 }
3421
3422 static int selinux_socket_getsockname(struct socket *sock)
3423 {
3424 return socket_has_perm(current, sock, SOCKET__GETATTR);
3425 }
3426
3427 static int selinux_socket_getpeername(struct socket *sock)
3428 {
3429 return socket_has_perm(current, sock, SOCKET__GETATTR);
3430 }
3431
3432 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3433 {
3434 int err;
3435
3436 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3437 if (err)
3438 return err;
3439
3440 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3441 }
3442
3443 static int selinux_socket_getsockopt(struct socket *sock, int level,
3444 int optname)
3445 {
3446 return socket_has_perm(current, sock, SOCKET__GETOPT);
3447 }
3448
3449 static int selinux_socket_shutdown(struct socket *sock, int how)
3450 {
3451 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3452 }
3453
3454 static int selinux_socket_unix_stream_connect(struct socket *sock,
3455 struct socket *other,
3456 struct sock *newsk)
3457 {
3458 struct sk_security_struct *ssec;
3459 struct inode_security_struct *isec;
3460 struct inode_security_struct *other_isec;
3461 struct avc_audit_data ad;
3462 int err;
3463
3464 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3465 if (err)
3466 return err;
3467
3468 isec = SOCK_INODE(sock)->i_security;
3469 other_isec = SOCK_INODE(other)->i_security;
3470
3471 AVC_AUDIT_DATA_INIT(&ad,NET);
3472 ad.u.net.sk = other->sk;
3473
3474 err = avc_has_perm(isec->sid, other_isec->sid,
3475 isec->sclass,
3476 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3477 if (err)
3478 return err;
3479
3480 /* connecting socket */
3481 ssec = sock->sk->sk_security;
3482 ssec->peer_sid = other_isec->sid;
3483
3484 /* server child socket */
3485 ssec = newsk->sk_security;
3486 ssec->peer_sid = isec->sid;
3487 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3488
3489 return err;
3490 }
3491
3492 static int selinux_socket_unix_may_send(struct socket *sock,
3493 struct socket *other)
3494 {
3495 struct inode_security_struct *isec;
3496 struct inode_security_struct *other_isec;
3497 struct avc_audit_data ad;
3498 int err;
3499
3500 isec = SOCK_INODE(sock)->i_security;
3501 other_isec = SOCK_INODE(other)->i_security;
3502
3503 AVC_AUDIT_DATA_INIT(&ad,NET);
3504 ad.u.net.sk = other->sk;
3505
3506 err = avc_has_perm(isec->sid, other_isec->sid,
3507 isec->sclass, SOCKET__SENDTO, &ad);
3508 if (err)
3509 return err;
3510
3511 return 0;
3512 }
3513
3514 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3515 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3516 {
3517 int err = 0;
3518 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3519 struct socket *sock;
3520 u16 sock_class = 0;
3521 u32 sock_sid = 0;
3522
3523 read_lock_bh(&sk->sk_callback_lock);
3524 sock = sk->sk_socket;
3525 if (sock) {
3526 struct inode *inode;
3527 inode = SOCK_INODE(sock);
3528 if (inode) {
3529 struct inode_security_struct *isec;
3530 isec = inode->i_security;
3531 sock_sid = isec->sid;
3532 sock_class = isec->sclass;
3533 }
3534 }
3535 read_unlock_bh(&sk->sk_callback_lock);
3536 if (!sock_sid)
3537 goto out;
3538
3539 if (!skb->dev)
3540 goto out;
3541
3542 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3543 if (err)
3544 goto out;
3545
3546 switch (sock_class) {
3547 case SECCLASS_UDP_SOCKET:
3548 netif_perm = NETIF__UDP_RECV;
3549 node_perm = NODE__UDP_RECV;
3550 recv_perm = UDP_SOCKET__RECV_MSG;
3551 break;
3552
3553 case SECCLASS_TCP_SOCKET:
3554 netif_perm = NETIF__TCP_RECV;
3555 node_perm = NODE__TCP_RECV;
3556 recv_perm = TCP_SOCKET__RECV_MSG;
3557 break;
3558
3559 case SECCLASS_DCCP_SOCKET:
3560 netif_perm = NETIF__DCCP_RECV;
3561 node_perm = NODE__DCCP_RECV;
3562 recv_perm = DCCP_SOCKET__RECV_MSG;
3563 break;
3564
3565 default:
3566 netif_perm = NETIF__RAWIP_RECV;
3567 node_perm = NODE__RAWIP_RECV;
3568 break;
3569 }
3570
3571 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3572 if (err)
3573 goto out;
3574
3575 err = security_node_sid(family, addrp, len, &node_sid);
3576 if (err)
3577 goto out;
3578
3579 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3580 if (err)
3581 goto out;
3582
3583 if (recv_perm) {
3584 u32 port_sid;
3585
3586 err = security_port_sid(sk->sk_family, sk->sk_type,
3587 sk->sk_protocol, ntohs(ad->u.net.sport),
3588 &port_sid);
3589 if (err)
3590 goto out;
3591
3592 err = avc_has_perm(sock_sid, port_sid,
3593 sock_class, recv_perm, ad);
3594 }
3595
3596 out:
3597 return err;
3598 }
3599
3600 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3601 {
3602 u16 family;
3603 char *addrp;
3604 int len, err = 0;
3605 struct avc_audit_data ad;
3606 struct sk_security_struct *sksec = sk->sk_security;
3607
3608 family = sk->sk_family;
3609 if (family != PF_INET && family != PF_INET6)
3610 goto out;
3611
3612 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3613 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3614 family = PF_INET;
3615
3616 AVC_AUDIT_DATA_INIT(&ad, NET);
3617 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3618 ad.u.net.family = family;
3619
3620 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3621 if (err)
3622 goto out;
3623
3624 if (selinux_compat_net)
3625 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3626 addrp, len);
3627 else
3628 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3629 PACKET__RECV, &ad);
3630 if (err)
3631 goto out;
3632
3633 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3634 if (err)
3635 goto out;
3636
3637 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3638 out:
3639 return err;
3640 }
3641
3642 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3643 int __user *optlen, unsigned len)
3644 {
3645 int err = 0;
3646 char *scontext;
3647 u32 scontext_len;
3648 struct sk_security_struct *ssec;
3649 struct inode_security_struct *isec;
3650 u32 peer_sid = SECSID_NULL;
3651
3652 isec = SOCK_INODE(sock)->i_security;
3653
3654 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3655 isec->sclass == SECCLASS_TCP_SOCKET) {
3656 ssec = sock->sk->sk_security;
3657 peer_sid = ssec->peer_sid;
3658 }
3659 if (peer_sid == SECSID_NULL) {
3660 err = -ENOPROTOOPT;
3661 goto out;
3662 }
3663
3664 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3665
3666 if (err)
3667 goto out;
3668
3669 if (scontext_len > len) {
3670 err = -ERANGE;
3671 goto out_len;
3672 }
3673
3674 if (copy_to_user(optval, scontext, scontext_len))
3675 err = -EFAULT;
3676
3677 out_len:
3678 if (put_user(scontext_len, optlen))
3679 err = -EFAULT;
3680
3681 kfree(scontext);
3682 out:
3683 return err;
3684 }
3685
3686 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3687 {
3688 u32 peer_secid = SECSID_NULL;
3689 int err = 0;
3690
3691 if (sock && sock->sk->sk_family == PF_UNIX)
3692 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3693 else if (skb)
3694 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
3695
3696 if (peer_secid == SECSID_NULL)
3697 err = -EINVAL;
3698 *secid = peer_secid;
3699
3700 return err;
3701 }
3702
3703 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3704 {
3705 return sk_alloc_security(sk, family, priority);
3706 }
3707
3708 static void selinux_sk_free_security(struct sock *sk)
3709 {
3710 sk_free_security(sk);
3711 }
3712
3713 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3714 {
3715 struct sk_security_struct *ssec = sk->sk_security;
3716 struct sk_security_struct *newssec = newsk->sk_security;
3717
3718 newssec->sid = ssec->sid;
3719 newssec->peer_sid = ssec->peer_sid;
3720
3721 selinux_netlbl_sk_security_clone(ssec, newssec);
3722 }
3723
3724 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3725 {
3726 if (!sk)
3727 *secid = SECINITSID_ANY_SOCKET;
3728 else {
3729 struct sk_security_struct *sksec = sk->sk_security;
3730
3731 *secid = sksec->sid;
3732 }
3733 }
3734
3735 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3736 {
3737 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3738 struct sk_security_struct *sksec = sk->sk_security;
3739
3740 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3741 sk->sk_family == PF_UNIX)
3742 isec->sid = sksec->sid;
3743
3744 selinux_netlbl_sock_graft(sk, parent);
3745 }
3746
3747 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3748 struct request_sock *req)
3749 {
3750 struct sk_security_struct *sksec = sk->sk_security;
3751 int err;
3752 u32 newsid;
3753 u32 peersid;
3754
3755 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
3756 if (peersid == SECSID_NULL) {
3757 req->secid = sksec->sid;
3758 req->peer_secid = SECSID_NULL;
3759 return 0;
3760 }
3761
3762 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3763 if (err)
3764 return err;
3765
3766 req->secid = newsid;
3767 req->peer_secid = peersid;
3768 return 0;
3769 }
3770
3771 static void selinux_inet_csk_clone(struct sock *newsk,
3772 const struct request_sock *req)
3773 {
3774 struct sk_security_struct *newsksec = newsk->sk_security;
3775
3776 newsksec->sid = req->secid;
3777 newsksec->peer_sid = req->peer_secid;
3778 /* NOTE: Ideally, we should also get the isec->sid for the
3779 new socket in sync, but we don't have the isec available yet.
3780 So we will wait until sock_graft to do it, by which
3781 time it will have been created and available. */
3782
3783 /* We don't need to take any sort of lock here as we are the only
3784 * thread with access to newsksec */
3785 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3786 }
3787
3788 static void selinux_inet_conn_established(struct sock *sk,
3789 struct sk_buff *skb)
3790 {
3791 struct sk_security_struct *sksec = sk->sk_security;
3792
3793 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
3794 }
3795
3796 static void selinux_req_classify_flow(const struct request_sock *req,
3797 struct flowi *fl)
3798 {
3799 fl->secid = req->secid;
3800 }
3801
3802 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3803 {
3804 int err = 0;
3805 u32 perm;
3806 struct nlmsghdr *nlh;
3807 struct socket *sock = sk->sk_socket;
3808 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3809
3810 if (skb->len < NLMSG_SPACE(0)) {
3811 err = -EINVAL;
3812 goto out;
3813 }
3814 nlh = nlmsg_hdr(skb);
3815
3816 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3817 if (err) {
3818 if (err == -EINVAL) {
3819 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3820 "SELinux: unrecognized netlink message"
3821 " type=%hu for sclass=%hu\n",
3822 nlh->nlmsg_type, isec->sclass);
3823 if (!selinux_enforcing)
3824 err = 0;
3825 }
3826
3827 /* Ignore */
3828 if (err == -ENOENT)
3829 err = 0;
3830 goto out;
3831 }
3832
3833 err = socket_has_perm(current, sock, perm);
3834 out:
3835 return err;
3836 }
3837
3838 #ifdef CONFIG_NETFILTER
3839
3840 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3841 struct avc_audit_data *ad,
3842 u16 family, char *addrp, int len)
3843 {
3844 int err = 0;
3845 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3846 struct socket *sock;
3847 struct inode *inode;
3848 struct inode_security_struct *isec;
3849
3850 sock = sk->sk_socket;
3851 if (!sock)
3852 goto out;
3853
3854 inode = SOCK_INODE(sock);
3855 if (!inode)
3856 goto out;
3857
3858 isec = inode->i_security;
3859
3860 err = sel_netif_sids(dev, &if_sid, NULL);
3861 if (err)
3862 goto out;
3863
3864 switch (isec->sclass) {
3865 case SECCLASS_UDP_SOCKET:
3866 netif_perm = NETIF__UDP_SEND;
3867 node_perm = NODE__UDP_SEND;
3868 send_perm = UDP_SOCKET__SEND_MSG;
3869 break;
3870
3871 case SECCLASS_TCP_SOCKET:
3872 netif_perm = NETIF__TCP_SEND;
3873 node_perm = NODE__TCP_SEND;
3874 send_perm = TCP_SOCKET__SEND_MSG;
3875 break;
3876
3877 case SECCLASS_DCCP_SOCKET:
3878 netif_perm = NETIF__DCCP_SEND;
3879 node_perm = NODE__DCCP_SEND;
3880 send_perm = DCCP_SOCKET__SEND_MSG;
3881 break;
3882
3883 default:
3884 netif_perm = NETIF__RAWIP_SEND;
3885 node_perm = NODE__RAWIP_SEND;
3886 break;
3887 }
3888
3889 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3890 if (err)
3891 goto out;
3892
3893 err = security_node_sid(family, addrp, len, &node_sid);
3894 if (err)
3895 goto out;
3896
3897 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3898 if (err)
3899 goto out;
3900
3901 if (send_perm) {
3902 u32 port_sid;
3903
3904 err = security_port_sid(sk->sk_family,
3905 sk->sk_type,
3906 sk->sk_protocol,
3907 ntohs(ad->u.net.dport),
3908 &port_sid);
3909 if (err)
3910 goto out;
3911
3912 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3913 send_perm, ad);
3914 }
3915 out:
3916 return err;
3917 }
3918
3919 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3920 struct sk_buff **pskb,
3921 const struct net_device *in,
3922 const struct net_device *out,
3923 int (*okfn)(struct sk_buff *),
3924 u16 family)
3925 {
3926 char *addrp;
3927 int len, err = 0;
3928 struct sock *sk;
3929 struct sk_buff *skb = *pskb;
3930 struct avc_audit_data ad;
3931 struct net_device *dev = (struct net_device *)out;
3932 struct sk_security_struct *sksec;
3933 u8 proto;
3934
3935 sk = skb->sk;
3936 if (!sk)
3937 goto out;
3938
3939 sksec = sk->sk_security;
3940
3941 AVC_AUDIT_DATA_INIT(&ad, NET);
3942 ad.u.net.netif = dev->name;
3943 ad.u.net.family = family;
3944
3945 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3946 if (err)
3947 goto out;
3948
3949 if (selinux_compat_net)
3950 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3951 family, addrp, len);
3952 else
3953 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3954 PACKET__SEND, &ad);
3955
3956 if (err)
3957 goto out;
3958
3959 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3960 out:
3961 return err ? NF_DROP : NF_ACCEPT;
3962 }
3963
3964 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3965 struct sk_buff **pskb,
3966 const struct net_device *in,
3967 const struct net_device *out,
3968 int (*okfn)(struct sk_buff *))
3969 {
3970 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3971 }
3972
3973 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3974
3975 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3976 struct sk_buff **pskb,
3977 const struct net_device *in,
3978 const struct net_device *out,
3979 int (*okfn)(struct sk_buff *))
3980 {
3981 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3982 }
3983
3984 #endif /* IPV6 */
3985
3986 #endif /* CONFIG_NETFILTER */
3987
3988 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3989 {
3990 int err;
3991
3992 err = secondary_ops->netlink_send(sk, skb);
3993 if (err)
3994 return err;
3995
3996 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3997 err = selinux_nlmsg_perm(sk, skb);
3998
3999 return err;
4000 }
4001
4002 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4003 {
4004 int err;
4005 struct avc_audit_data ad;
4006
4007 err = secondary_ops->netlink_recv(skb, capability);
4008 if (err)
4009 return err;
4010
4011 AVC_AUDIT_DATA_INIT(&ad, CAP);
4012 ad.u.cap = capability;
4013
4014 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4015 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4016 }
4017
4018 static int ipc_alloc_security(struct task_struct *task,
4019 struct kern_ipc_perm *perm,
4020 u16 sclass)
4021 {
4022 struct task_security_struct *tsec = task->security;
4023 struct ipc_security_struct *isec;
4024
4025 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4026 if (!isec)
4027 return -ENOMEM;
4028
4029 isec->sclass = sclass;
4030 isec->ipc_perm = perm;
4031 isec->sid = tsec->sid;
4032 perm->security = isec;
4033
4034 return 0;
4035 }
4036
4037 static void ipc_free_security(struct kern_ipc_perm *perm)
4038 {
4039 struct ipc_security_struct *isec = perm->security;
4040 perm->security = NULL;
4041 kfree(isec);
4042 }
4043
4044 static int msg_msg_alloc_security(struct msg_msg *msg)
4045 {
4046 struct msg_security_struct *msec;
4047
4048 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4049 if (!msec)
4050 return -ENOMEM;
4051
4052 msec->msg = msg;
4053 msec->sid = SECINITSID_UNLABELED;
4054 msg->security = msec;
4055
4056 return 0;
4057 }
4058
4059 static void msg_msg_free_security(struct msg_msg *msg)
4060 {
4061 struct msg_security_struct *msec = msg->security;
4062
4063 msg->security = NULL;
4064 kfree(msec);
4065 }
4066
4067 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4068 u32 perms)
4069 {
4070 struct task_security_struct *tsec;
4071 struct ipc_security_struct *isec;
4072 struct avc_audit_data ad;
4073
4074 tsec = current->security;
4075 isec = ipc_perms->security;
4076
4077 AVC_AUDIT_DATA_INIT(&ad, IPC);
4078 ad.u.ipc_id = ipc_perms->key;
4079
4080 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4081 }
4082
4083 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4084 {
4085 return msg_msg_alloc_security(msg);
4086 }
4087
4088 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4089 {
4090 msg_msg_free_security(msg);
4091 }
4092
4093 /* message queue security operations */
4094 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4095 {
4096 struct task_security_struct *tsec;
4097 struct ipc_security_struct *isec;
4098 struct avc_audit_data ad;
4099 int rc;
4100
4101 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4102 if (rc)
4103 return rc;
4104
4105 tsec = current->security;
4106 isec = msq->q_perm.security;
4107
4108 AVC_AUDIT_DATA_INIT(&ad, IPC);
4109 ad.u.ipc_id = msq->q_perm.key;
4110
4111 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4112 MSGQ__CREATE, &ad);
4113 if (rc) {
4114 ipc_free_security(&msq->q_perm);
4115 return rc;
4116 }
4117 return 0;
4118 }
4119
4120 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4121 {
4122 ipc_free_security(&msq->q_perm);
4123 }
4124
4125 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4126 {
4127 struct task_security_struct *tsec;
4128 struct ipc_security_struct *isec;
4129 struct avc_audit_data ad;
4130
4131 tsec = current->security;
4132 isec = msq->q_perm.security;
4133
4134 AVC_AUDIT_DATA_INIT(&ad, IPC);
4135 ad.u.ipc_id = msq->q_perm.key;
4136
4137 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4138 MSGQ__ASSOCIATE, &ad);
4139 }
4140
4141 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4142 {
4143 int err;
4144 int perms;
4145
4146 switch(cmd) {
4147 case IPC_INFO:
4148 case MSG_INFO:
4149 /* No specific object, just general system-wide information. */
4150 return task_has_system(current, SYSTEM__IPC_INFO);
4151 case IPC_STAT:
4152 case MSG_STAT:
4153 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4154 break;
4155 case IPC_SET:
4156 perms = MSGQ__SETATTR;
4157 break;
4158 case IPC_RMID:
4159 perms = MSGQ__DESTROY;
4160 break;
4161 default:
4162 return 0;
4163 }
4164
4165 err = ipc_has_perm(&msq->q_perm, perms);
4166 return err;
4167 }
4168
4169 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4170 {
4171 struct task_security_struct *tsec;
4172 struct ipc_security_struct *isec;
4173 struct msg_security_struct *msec;
4174 struct avc_audit_data ad;
4175 int rc;
4176
4177 tsec = current->security;
4178 isec = msq->q_perm.security;
4179 msec = msg->security;
4180
4181 /*
4182 * First time through, need to assign label to the message
4183 */
4184 if (msec->sid == SECINITSID_UNLABELED) {
4185 /*
4186 * Compute new sid based on current process and
4187 * message queue this message will be stored in
4188 */
4189 rc = security_transition_sid(tsec->sid,
4190 isec->sid,
4191 SECCLASS_MSG,
4192 &msec->sid);
4193 if (rc)
4194 return rc;
4195 }
4196
4197 AVC_AUDIT_DATA_INIT(&ad, IPC);
4198 ad.u.ipc_id = msq->q_perm.key;
4199
4200 /* Can this process write to the queue? */
4201 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4202 MSGQ__WRITE, &ad);
4203 if (!rc)
4204 /* Can this process send the message */
4205 rc = avc_has_perm(tsec->sid, msec->sid,
4206 SECCLASS_MSG, MSG__SEND, &ad);
4207 if (!rc)
4208 /* Can the message be put in the queue? */
4209 rc = avc_has_perm(msec->sid, isec->sid,
4210 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4211
4212 return rc;
4213 }
4214
4215 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4216 struct task_struct *target,
4217 long type, int mode)
4218 {
4219 struct task_security_struct *tsec;
4220 struct ipc_security_struct *isec;
4221 struct msg_security_struct *msec;
4222 struct avc_audit_data ad;
4223 int rc;
4224
4225 tsec = target->security;
4226 isec = msq->q_perm.security;
4227 msec = msg->security;
4228
4229 AVC_AUDIT_DATA_INIT(&ad, IPC);
4230 ad.u.ipc_id = msq->q_perm.key;
4231
4232 rc = avc_has_perm(tsec->sid, isec->sid,
4233 SECCLASS_MSGQ, MSGQ__READ, &ad);
4234 if (!rc)
4235 rc = avc_has_perm(tsec->sid, msec->sid,
4236 SECCLASS_MSG, MSG__RECEIVE, &ad);
4237 return rc;
4238 }
4239
4240 /* Shared Memory security operations */
4241 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4242 {
4243 struct task_security_struct *tsec;
4244 struct ipc_security_struct *isec;
4245 struct avc_audit_data ad;
4246 int rc;
4247
4248 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4249 if (rc)
4250 return rc;
4251
4252 tsec = current->security;
4253 isec = shp->shm_perm.security;
4254
4255 AVC_AUDIT_DATA_INIT(&ad, IPC);
4256 ad.u.ipc_id = shp->shm_perm.key;
4257
4258 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4259 SHM__CREATE, &ad);
4260 if (rc) {
4261 ipc_free_security(&shp->shm_perm);
4262 return rc;
4263 }
4264 return 0;
4265 }
4266
4267 static void selinux_shm_free_security(struct shmid_kernel *shp)
4268 {
4269 ipc_free_security(&shp->shm_perm);
4270 }
4271
4272 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4273 {
4274 struct task_security_struct *tsec;
4275 struct ipc_security_struct *isec;
4276 struct avc_audit_data ad;
4277
4278 tsec = current->security;
4279 isec = shp->shm_perm.security;
4280
4281 AVC_AUDIT_DATA_INIT(&ad, IPC);
4282 ad.u.ipc_id = shp->shm_perm.key;
4283
4284 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4285 SHM__ASSOCIATE, &ad);
4286 }
4287
4288 /* Note, at this point, shp is locked down */
4289 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4290 {
4291 int perms;
4292 int err;
4293
4294 switch(cmd) {
4295 case IPC_INFO:
4296 case SHM_INFO:
4297 /* No specific object, just general system-wide information. */
4298 return task_has_system(current, SYSTEM__IPC_INFO);
4299 case IPC_STAT:
4300 case SHM_STAT:
4301 perms = SHM__GETATTR | SHM__ASSOCIATE;
4302 break;
4303 case IPC_SET:
4304 perms = SHM__SETATTR;
4305 break;
4306 case SHM_LOCK:
4307 case SHM_UNLOCK:
4308 perms = SHM__LOCK;
4309 break;
4310 case IPC_RMID:
4311 perms = SHM__DESTROY;
4312 break;
4313 default:
4314 return 0;
4315 }
4316
4317 err = ipc_has_perm(&shp->shm_perm, perms);
4318 return err;
4319 }
4320
4321 static int selinux_shm_shmat(struct shmid_kernel *shp,
4322 char __user *shmaddr, int shmflg)
4323 {
4324 u32 perms;
4325 int rc;
4326
4327 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4328 if (rc)
4329 return rc;
4330
4331 if (shmflg & SHM_RDONLY)
4332 perms = SHM__READ;
4333 else
4334 perms = SHM__READ | SHM__WRITE;
4335
4336 return ipc_has_perm(&shp->shm_perm, perms);
4337 }
4338
4339 /* Semaphore security operations */
4340 static int selinux_sem_alloc_security(struct sem_array *sma)
4341 {
4342 struct task_security_struct *tsec;
4343 struct ipc_security_struct *isec;
4344 struct avc_audit_data ad;
4345 int rc;
4346
4347 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4348 if (rc)
4349 return rc;
4350
4351 tsec = current->security;
4352 isec = sma->sem_perm.security;
4353
4354 AVC_AUDIT_DATA_INIT(&ad, IPC);
4355 ad.u.ipc_id = sma->sem_perm.key;
4356
4357 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4358 SEM__CREATE, &ad);
4359 if (rc) {
4360 ipc_free_security(&sma->sem_perm);
4361 return rc;
4362 }
4363 return 0;
4364 }
4365
4366 static void selinux_sem_free_security(struct sem_array *sma)
4367 {
4368 ipc_free_security(&sma->sem_perm);
4369 }
4370
4371 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4372 {
4373 struct task_security_struct *tsec;
4374 struct ipc_security_struct *isec;
4375 struct avc_audit_data ad;
4376
4377 tsec = current->security;
4378 isec = sma->sem_perm.security;
4379
4380 AVC_AUDIT_DATA_INIT(&ad, IPC);
4381 ad.u.ipc_id = sma->sem_perm.key;
4382
4383 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4384 SEM__ASSOCIATE, &ad);
4385 }
4386
4387 /* Note, at this point, sma is locked down */
4388 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4389 {
4390 int err;
4391 u32 perms;
4392
4393 switch(cmd) {
4394 case IPC_INFO:
4395 case SEM_INFO:
4396 /* No specific object, just general system-wide information. */
4397 return task_has_system(current, SYSTEM__IPC_INFO);
4398 case GETPID:
4399 case GETNCNT:
4400 case GETZCNT:
4401 perms = SEM__GETATTR;
4402 break;
4403 case GETVAL:
4404 case GETALL:
4405 perms = SEM__READ;
4406 break;
4407 case SETVAL:
4408 case SETALL:
4409 perms = SEM__WRITE;
4410 break;
4411 case IPC_RMID:
4412 perms = SEM__DESTROY;
4413 break;
4414 case IPC_SET:
4415 perms = SEM__SETATTR;
4416 break;
4417 case IPC_STAT:
4418 case SEM_STAT:
4419 perms = SEM__GETATTR | SEM__ASSOCIATE;
4420 break;
4421 default:
4422 return 0;
4423 }
4424
4425 err = ipc_has_perm(&sma->sem_perm, perms);
4426 return err;
4427 }
4428
4429 static int selinux_sem_semop(struct sem_array *sma,
4430 struct sembuf *sops, unsigned nsops, int alter)
4431 {
4432 u32 perms;
4433
4434 if (alter)
4435 perms = SEM__READ | SEM__WRITE;
4436 else
4437 perms = SEM__READ;
4438
4439 return ipc_has_perm(&sma->sem_perm, perms);
4440 }
4441
4442 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4443 {
4444 u32 av = 0;
4445
4446 av = 0;
4447 if (flag & S_IRUGO)
4448 av |= IPC__UNIX_READ;
4449 if (flag & S_IWUGO)
4450 av |= IPC__UNIX_WRITE;
4451
4452 if (av == 0)
4453 return 0;
4454
4455 return ipc_has_perm(ipcp, av);
4456 }
4457
4458 /* module stacking operations */
4459 static int selinux_register_security (const char *name, struct security_operations *ops)
4460 {
4461 if (secondary_ops != original_ops) {
4462 printk(KERN_ERR "%s: There is already a secondary security "
4463 "module registered.\n", __FUNCTION__);
4464 return -EINVAL;
4465 }
4466
4467 secondary_ops = ops;
4468
4469 printk(KERN_INFO "%s: Registering secondary module %s\n",
4470 __FUNCTION__,
4471 name);
4472
4473 return 0;
4474 }
4475
4476 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4477 {
4478 if (ops != secondary_ops) {
4479 printk(KERN_ERR "%s: trying to unregister a security module "
4480 "that is not registered.\n", __FUNCTION__);
4481 return -EINVAL;
4482 }
4483
4484 secondary_ops = original_ops;
4485
4486 return 0;
4487 }
4488
4489 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4490 {
4491 if (inode)
4492 inode_doinit_with_dentry(inode, dentry);
4493 }
4494
4495 static int selinux_getprocattr(struct task_struct *p,
4496 char *name, char **value)
4497 {
4498 struct task_security_struct *tsec;
4499 u32 sid;
4500 int error;
4501 unsigned len;
4502
4503 if (current != p) {
4504 error = task_has_perm(current, p, PROCESS__GETATTR);
4505 if (error)
4506 return error;
4507 }
4508
4509 tsec = p->security;
4510
4511 if (!strcmp(name, "current"))
4512 sid = tsec->sid;
4513 else if (!strcmp(name, "prev"))
4514 sid = tsec->osid;
4515 else if (!strcmp(name, "exec"))
4516 sid = tsec->exec_sid;
4517 else if (!strcmp(name, "fscreate"))
4518 sid = tsec->create_sid;
4519 else if (!strcmp(name, "keycreate"))
4520 sid = tsec->keycreate_sid;
4521 else if (!strcmp(name, "sockcreate"))
4522 sid = tsec->sockcreate_sid;
4523 else
4524 return -EINVAL;
4525
4526 if (!sid)
4527 return 0;
4528
4529 error = security_sid_to_context(sid, value, &len);
4530 if (error)
4531 return error;
4532 return len;
4533 }
4534
4535 static int selinux_setprocattr(struct task_struct *p,
4536 char *name, void *value, size_t size)
4537 {
4538 struct task_security_struct *tsec;
4539 u32 sid = 0;
4540 int error;
4541 char *str = value;
4542
4543 if (current != p) {
4544 /* SELinux only allows a process to change its own
4545 security attributes. */
4546 return -EACCES;
4547 }
4548
4549 /*
4550 * Basic control over ability to set these attributes at all.
4551 * current == p, but we'll pass them separately in case the
4552 * above restriction is ever removed.
4553 */
4554 if (!strcmp(name, "exec"))
4555 error = task_has_perm(current, p, PROCESS__SETEXEC);
4556 else if (!strcmp(name, "fscreate"))
4557 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4558 else if (!strcmp(name, "keycreate"))
4559 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4560 else if (!strcmp(name, "sockcreate"))
4561 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4562 else if (!strcmp(name, "current"))
4563 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4564 else
4565 error = -EINVAL;
4566 if (error)
4567 return error;
4568
4569 /* Obtain a SID for the context, if one was specified. */
4570 if (size && str[1] && str[1] != '\n') {
4571 if (str[size-1] == '\n') {
4572 str[size-1] = 0;
4573 size--;
4574 }
4575 error = security_context_to_sid(value, size, &sid);
4576 if (error)
4577 return error;
4578 }
4579
4580 /* Permission checking based on the specified context is
4581 performed during the actual operation (execve,
4582 open/mkdir/...), when we know the full context of the
4583 operation. See selinux_bprm_set_security for the execve
4584 checks and may_create for the file creation checks. The
4585 operation will then fail if the context is not permitted. */
4586 tsec = p->security;
4587 if (!strcmp(name, "exec"))
4588 tsec->exec_sid = sid;
4589 else if (!strcmp(name, "fscreate"))
4590 tsec->create_sid = sid;
4591 else if (!strcmp(name, "keycreate")) {
4592 error = may_create_key(sid, p);
4593 if (error)
4594 return error;
4595 tsec->keycreate_sid = sid;
4596 } else if (!strcmp(name, "sockcreate"))
4597 tsec->sockcreate_sid = sid;
4598 else if (!strcmp(name, "current")) {
4599 struct av_decision avd;
4600
4601 if (sid == 0)
4602 return -EINVAL;
4603
4604 /* Only allow single threaded processes to change context */
4605 if (atomic_read(&p->mm->mm_users) != 1) {
4606 struct task_struct *g, *t;
4607 struct mm_struct *mm = p->mm;
4608 read_lock(&tasklist_lock);
4609 do_each_thread(g, t)
4610 if (t->mm == mm && t != p) {
4611 read_unlock(&tasklist_lock);
4612 return -EPERM;
4613 }
4614 while_each_thread(g, t);
4615 read_unlock(&tasklist_lock);
4616 }
4617
4618 /* Check permissions for the transition. */
4619 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4620 PROCESS__DYNTRANSITION, NULL);
4621 if (error)
4622 return error;
4623
4624 /* Check for ptracing, and update the task SID if ok.
4625 Otherwise, leave SID unchanged and fail. */
4626 task_lock(p);
4627 if (p->ptrace & PT_PTRACED) {
4628 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4629 SECCLASS_PROCESS,
4630 PROCESS__PTRACE, &avd);
4631 if (!error)
4632 tsec->sid = sid;
4633 task_unlock(p);
4634 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4635 PROCESS__PTRACE, &avd, error, NULL);
4636 if (error)
4637 return error;
4638 } else {
4639 tsec->sid = sid;
4640 task_unlock(p);
4641 }
4642 }
4643 else
4644 return -EINVAL;
4645
4646 return size;
4647 }
4648
4649 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4650 {
4651 return security_sid_to_context(secid, secdata, seclen);
4652 }
4653
4654 static void selinux_release_secctx(char *secdata, u32 seclen)
4655 {
4656 if (secdata)
4657 kfree(secdata);
4658 }
4659
4660 #ifdef CONFIG_KEYS
4661
4662 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4663 unsigned long flags)
4664 {
4665 struct task_security_struct *tsec = tsk->security;
4666 struct key_security_struct *ksec;
4667
4668 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4669 if (!ksec)
4670 return -ENOMEM;
4671
4672 ksec->obj = k;
4673 if (tsec->keycreate_sid)
4674 ksec->sid = tsec->keycreate_sid;
4675 else
4676 ksec->sid = tsec->sid;
4677 k->security = ksec;
4678
4679 return 0;
4680 }
4681
4682 static void selinux_key_free(struct key *k)
4683 {
4684 struct key_security_struct *ksec = k->security;
4685
4686 k->security = NULL;
4687 kfree(ksec);
4688 }
4689
4690 static int selinux_key_permission(key_ref_t key_ref,
4691 struct task_struct *ctx,
4692 key_perm_t perm)
4693 {
4694 struct key *key;
4695 struct task_security_struct *tsec;
4696 struct key_security_struct *ksec;
4697
4698 key = key_ref_to_ptr(key_ref);
4699
4700 tsec = ctx->security;
4701 ksec = key->security;
4702
4703 /* if no specific permissions are requested, we skip the
4704 permission check. No serious, additional covert channels
4705 appear to be created. */
4706 if (perm == 0)
4707 return 0;
4708
4709 return avc_has_perm(tsec->sid, ksec->sid,
4710 SECCLASS_KEY, perm, NULL);
4711 }
4712
4713 #endif
4714
4715 static struct security_operations selinux_ops = {
4716 .ptrace = selinux_ptrace,
4717 .capget = selinux_capget,
4718 .capset_check = selinux_capset_check,
4719 .capset_set = selinux_capset_set,
4720 .sysctl = selinux_sysctl,
4721 .capable = selinux_capable,
4722 .quotactl = selinux_quotactl,
4723 .quota_on = selinux_quota_on,
4724 .syslog = selinux_syslog,
4725 .vm_enough_memory = selinux_vm_enough_memory,
4726
4727 .netlink_send = selinux_netlink_send,
4728 .netlink_recv = selinux_netlink_recv,
4729
4730 .bprm_alloc_security = selinux_bprm_alloc_security,
4731 .bprm_free_security = selinux_bprm_free_security,
4732 .bprm_apply_creds = selinux_bprm_apply_creds,
4733 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4734 .bprm_set_security = selinux_bprm_set_security,
4735 .bprm_check_security = selinux_bprm_check_security,
4736 .bprm_secureexec = selinux_bprm_secureexec,
4737
4738 .sb_alloc_security = selinux_sb_alloc_security,
4739 .sb_free_security = selinux_sb_free_security,
4740 .sb_copy_data = selinux_sb_copy_data,
4741 .sb_kern_mount = selinux_sb_kern_mount,
4742 .sb_statfs = selinux_sb_statfs,
4743 .sb_mount = selinux_mount,
4744 .sb_umount = selinux_umount,
4745
4746 .inode_alloc_security = selinux_inode_alloc_security,
4747 .inode_free_security = selinux_inode_free_security,
4748 .inode_init_security = selinux_inode_init_security,
4749 .inode_create = selinux_inode_create,
4750 .inode_link = selinux_inode_link,
4751 .inode_unlink = selinux_inode_unlink,
4752 .inode_symlink = selinux_inode_symlink,
4753 .inode_mkdir = selinux_inode_mkdir,
4754 .inode_rmdir = selinux_inode_rmdir,
4755 .inode_mknod = selinux_inode_mknod,
4756 .inode_rename = selinux_inode_rename,
4757 .inode_readlink = selinux_inode_readlink,
4758 .inode_follow_link = selinux_inode_follow_link,
4759 .inode_permission = selinux_inode_permission,
4760 .inode_setattr = selinux_inode_setattr,
4761 .inode_getattr = selinux_inode_getattr,
4762 .inode_setxattr = selinux_inode_setxattr,
4763 .inode_post_setxattr = selinux_inode_post_setxattr,
4764 .inode_getxattr = selinux_inode_getxattr,
4765 .inode_listxattr = selinux_inode_listxattr,
4766 .inode_removexattr = selinux_inode_removexattr,
4767 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4768 .inode_getsecurity = selinux_inode_getsecurity,
4769 .inode_setsecurity = selinux_inode_setsecurity,
4770 .inode_listsecurity = selinux_inode_listsecurity,
4771
4772 .file_permission = selinux_file_permission,
4773 .file_alloc_security = selinux_file_alloc_security,
4774 .file_free_security = selinux_file_free_security,
4775 .file_ioctl = selinux_file_ioctl,
4776 .file_mmap = selinux_file_mmap,
4777 .file_mprotect = selinux_file_mprotect,
4778 .file_lock = selinux_file_lock,
4779 .file_fcntl = selinux_file_fcntl,
4780 .file_set_fowner = selinux_file_set_fowner,
4781 .file_send_sigiotask = selinux_file_send_sigiotask,
4782 .file_receive = selinux_file_receive,
4783
4784 .task_create = selinux_task_create,
4785 .task_alloc_security = selinux_task_alloc_security,
4786 .task_free_security = selinux_task_free_security,
4787 .task_setuid = selinux_task_setuid,
4788 .task_post_setuid = selinux_task_post_setuid,
4789 .task_setgid = selinux_task_setgid,
4790 .task_setpgid = selinux_task_setpgid,
4791 .task_getpgid = selinux_task_getpgid,
4792 .task_getsid = selinux_task_getsid,
4793 .task_getsecid = selinux_task_getsecid,
4794 .task_setgroups = selinux_task_setgroups,
4795 .task_setnice = selinux_task_setnice,
4796 .task_setioprio = selinux_task_setioprio,
4797 .task_getioprio = selinux_task_getioprio,
4798 .task_setrlimit = selinux_task_setrlimit,
4799 .task_setscheduler = selinux_task_setscheduler,
4800 .task_getscheduler = selinux_task_getscheduler,
4801 .task_movememory = selinux_task_movememory,
4802 .task_kill = selinux_task_kill,
4803 .task_wait = selinux_task_wait,
4804 .task_prctl = selinux_task_prctl,
4805 .task_reparent_to_init = selinux_task_reparent_to_init,
4806 .task_to_inode = selinux_task_to_inode,
4807
4808 .ipc_permission = selinux_ipc_permission,
4809
4810 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4811 .msg_msg_free_security = selinux_msg_msg_free_security,
4812
4813 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4814 .msg_queue_free_security = selinux_msg_queue_free_security,
4815 .msg_queue_associate = selinux_msg_queue_associate,
4816 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4817 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4818 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4819
4820 .shm_alloc_security = selinux_shm_alloc_security,
4821 .shm_free_security = selinux_shm_free_security,
4822 .shm_associate = selinux_shm_associate,
4823 .shm_shmctl = selinux_shm_shmctl,
4824 .shm_shmat = selinux_shm_shmat,
4825
4826 .sem_alloc_security = selinux_sem_alloc_security,
4827 .sem_free_security = selinux_sem_free_security,
4828 .sem_associate = selinux_sem_associate,
4829 .sem_semctl = selinux_sem_semctl,
4830 .sem_semop = selinux_sem_semop,
4831
4832 .register_security = selinux_register_security,
4833 .unregister_security = selinux_unregister_security,
4834
4835 .d_instantiate = selinux_d_instantiate,
4836
4837 .getprocattr = selinux_getprocattr,
4838 .setprocattr = selinux_setprocattr,
4839
4840 .secid_to_secctx = selinux_secid_to_secctx,
4841 .release_secctx = selinux_release_secctx,
4842
4843 .unix_stream_connect = selinux_socket_unix_stream_connect,
4844 .unix_may_send = selinux_socket_unix_may_send,
4845
4846 .socket_create = selinux_socket_create,
4847 .socket_post_create = selinux_socket_post_create,
4848 .socket_bind = selinux_socket_bind,
4849 .socket_connect = selinux_socket_connect,
4850 .socket_listen = selinux_socket_listen,
4851 .socket_accept = selinux_socket_accept,
4852 .socket_sendmsg = selinux_socket_sendmsg,
4853 .socket_recvmsg = selinux_socket_recvmsg,
4854 .socket_getsockname = selinux_socket_getsockname,
4855 .socket_getpeername = selinux_socket_getpeername,
4856 .socket_getsockopt = selinux_socket_getsockopt,
4857 .socket_setsockopt = selinux_socket_setsockopt,
4858 .socket_shutdown = selinux_socket_shutdown,
4859 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4860 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4861 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4862 .sk_alloc_security = selinux_sk_alloc_security,
4863 .sk_free_security = selinux_sk_free_security,
4864 .sk_clone_security = selinux_sk_clone_security,
4865 .sk_getsecid = selinux_sk_getsecid,
4866 .sock_graft = selinux_sock_graft,
4867 .inet_conn_request = selinux_inet_conn_request,
4868 .inet_csk_clone = selinux_inet_csk_clone,
4869 .inet_conn_established = selinux_inet_conn_established,
4870 .req_classify_flow = selinux_req_classify_flow,
4871
4872 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4873 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4874 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4875 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4876 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4877 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4878 .xfrm_state_free_security = selinux_xfrm_state_free,
4879 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4880 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4881 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
4882 .xfrm_decode_session = selinux_xfrm_decode_session,
4883 #endif
4884
4885 #ifdef CONFIG_KEYS
4886 .key_alloc = selinux_key_alloc,
4887 .key_free = selinux_key_free,
4888 .key_permission = selinux_key_permission,
4889 #endif
4890 };
4891
4892 static __init int selinux_init(void)
4893 {
4894 struct task_security_struct *tsec;
4895
4896 if (!selinux_enabled) {
4897 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4898 return 0;
4899 }
4900
4901 printk(KERN_INFO "SELinux: Initializing.\n");
4902
4903 /* Set the security state for the initial task. */
4904 if (task_alloc_security(current))
4905 panic("SELinux: Failed to initialize initial task.\n");
4906 tsec = current->security;
4907 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4908
4909 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4910 sizeof(struct inode_security_struct),
4911 0, SLAB_PANIC, NULL, NULL);
4912 avc_init();
4913
4914 original_ops = secondary_ops = security_ops;
4915 if (!secondary_ops)
4916 panic ("SELinux: No initial security operations\n");
4917 if (register_security (&selinux_ops))
4918 panic("SELinux: Unable to register with kernel.\n");
4919
4920 if (selinux_enforcing) {
4921 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
4922 } else {
4923 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
4924 }
4925
4926 #ifdef CONFIG_KEYS
4927 /* Add security information to initial keyrings */
4928 selinux_key_alloc(&root_user_keyring, current,
4929 KEY_ALLOC_NOT_IN_QUOTA);
4930 selinux_key_alloc(&root_session_keyring, current,
4931 KEY_ALLOC_NOT_IN_QUOTA);
4932 #endif
4933
4934 return 0;
4935 }
4936
4937 void selinux_complete_init(void)
4938 {
4939 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
4940
4941 /* Set up any superblocks initialized prior to the policy load. */
4942 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
4943 spin_lock(&sb_lock);
4944 spin_lock(&sb_security_lock);
4945 next_sb:
4946 if (!list_empty(&superblock_security_head)) {
4947 struct superblock_security_struct *sbsec =
4948 list_entry(superblock_security_head.next,
4949 struct superblock_security_struct,
4950 list);
4951 struct super_block *sb = sbsec->sb;
4952 sb->s_count++;
4953 spin_unlock(&sb_security_lock);
4954 spin_unlock(&sb_lock);
4955 down_read(&sb->s_umount);
4956 if (sb->s_root)
4957 superblock_doinit(sb, NULL);
4958 drop_super(sb);
4959 spin_lock(&sb_lock);
4960 spin_lock(&sb_security_lock);
4961 list_del_init(&sbsec->list);
4962 goto next_sb;
4963 }
4964 spin_unlock(&sb_security_lock);
4965 spin_unlock(&sb_lock);
4966 }
4967
4968 /* SELinux requires early initialization in order to label
4969 all processes and objects when they are created. */
4970 security_initcall(selinux_init);
4971
4972 #if defined(CONFIG_NETFILTER)
4973
4974 static struct nf_hook_ops selinux_ipv4_op = {
4975 .hook = selinux_ipv4_postroute_last,
4976 .owner = THIS_MODULE,
4977 .pf = PF_INET,
4978 .hooknum = NF_IP_POST_ROUTING,
4979 .priority = NF_IP_PRI_SELINUX_LAST,
4980 };
4981
4982 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4983
4984 static struct nf_hook_ops selinux_ipv6_op = {
4985 .hook = selinux_ipv6_postroute_last,
4986 .owner = THIS_MODULE,
4987 .pf = PF_INET6,
4988 .hooknum = NF_IP6_POST_ROUTING,
4989 .priority = NF_IP6_PRI_SELINUX_LAST,
4990 };
4991
4992 #endif /* IPV6 */
4993
4994 static int __init selinux_nf_ip_init(void)
4995 {
4996 int err = 0;
4997
4998 if (!selinux_enabled)
4999 goto out;
5000
5001 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5002
5003 err = nf_register_hook(&selinux_ipv4_op);
5004 if (err)
5005 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5006
5007 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5008
5009 err = nf_register_hook(&selinux_ipv6_op);
5010 if (err)
5011 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5012
5013 #endif /* IPV6 */
5014
5015 out:
5016 return err;
5017 }
5018
5019 __initcall(selinux_nf_ip_init);
5020
5021 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5022 static void selinux_nf_ip_exit(void)
5023 {
5024 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5025
5026 nf_unregister_hook(&selinux_ipv4_op);
5027 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5028 nf_unregister_hook(&selinux_ipv6_op);
5029 #endif /* IPV6 */
5030 }
5031 #endif
5032
5033 #else /* CONFIG_NETFILTER */
5034
5035 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5036 #define selinux_nf_ip_exit()
5037 #endif
5038
5039 #endif /* CONFIG_NETFILTER */
5040
5041 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5042 int selinux_disable(void)
5043 {
5044 extern void exit_sel_fs(void);
5045 static int selinux_disabled = 0;
5046
5047 if (ss_initialized) {
5048 /* Not permitted after initial policy load. */
5049 return -EINVAL;
5050 }
5051
5052 if (selinux_disabled) {
5053 /* Only do this once. */
5054 return -EINVAL;
5055 }
5056
5057 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5058
5059 selinux_disabled = 1;
5060 selinux_enabled = 0;
5061
5062 /* Reset security_ops to the secondary module, dummy or capability. */
5063 security_ops = secondary_ops;
5064
5065 /* Unregister netfilter hooks. */
5066 selinux_nf_ip_exit();
5067
5068 /* Unregister selinuxfs. */
5069 exit_sel_fs();
5070
5071 return 0;
5072 }
5073 #endif
5074
5075
linux v2.6.22.y-op