?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[ACPI] CONFIG_ACPI now depends on CONFIG_PM
[linux-2.6/kmemtrace.git] / security / selinux / hooks.c
blobaae1e794fe48326f696b766a80a13898c4e43a1b
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
19 */
20
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
32 #include <linux/mm.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
45 #include <linux/kd.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
49 #include <net/icmp.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
66 #include <net/ipv6.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71
72 #include "avc.h"
73 #include "objsec.h"
74 #include "netif.h"
75
76 #define XATTR_SELINUX_SUFFIX "selinux"
77 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
78
79 extern unsigned int policydb_loaded_version;
80 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
81
82 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
83 int selinux_enforcing = 0;
84
85 static int __init enforcing_setup(char *str)
86 {
87 selinux_enforcing = simple_strtol(str,NULL,0);
88 return 1;
89 }
90 __setup("enforcing=", enforcing_setup);
91 #endif
92
93 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
94 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
95
96 static int __init selinux_enabled_setup(char *str)
97 {
98 selinux_enabled = simple_strtol(str, NULL, 0);
99 return 1;
100 }
101 __setup("selinux=", selinux_enabled_setup);
102 #endif
103
104 /* Original (dummy) security module. */
105 static struct security_operations *original_ops = NULL;
106
107 /* Minimal support for a secondary security module,
108 just to allow the use of the dummy or capability modules.
109 The owlsm module can alternatively be used as a secondary
110 module as long as CONFIG_OWLSM_FD is not enabled. */
111 static struct security_operations *secondary_ops = NULL;
112
113 /* Lists of inode and superblock security structures initialized
114 before the policy was loaded. */
115 static LIST_HEAD(superblock_security_head);
116 static DEFINE_SPINLOCK(sb_security_lock);
117
118 /* Allocate and free functions for each kind of security blob. */
119
120 static int task_alloc_security(struct task_struct *task)
121 {
122 struct task_security_struct *tsec;
123
124 tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
125 if (!tsec)
126 return -ENOMEM;
127
128 memset(tsec, 0, sizeof(struct task_security_struct));
129 tsec->magic = SELINUX_MAGIC;
130 tsec->task = task;
131 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
132 task->security = tsec;
133
134 return 0;
135 }
136
137 static void task_free_security(struct task_struct *task)
138 {
139 struct task_security_struct *tsec = task->security;
140
141 if (!tsec || tsec->magic != SELINUX_MAGIC)
142 return;
143
144 task->security = NULL;
145 kfree(tsec);
146 }
147
148 static int inode_alloc_security(struct inode *inode)
149 {
150 struct task_security_struct *tsec = current->security;
151 struct inode_security_struct *isec;
152
153 isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
154 if (!isec)
155 return -ENOMEM;
156
157 memset(isec, 0, sizeof(struct inode_security_struct));
158 init_MUTEX(&isec->sem);
159 INIT_LIST_HEAD(&isec->list);
160 isec->magic = SELINUX_MAGIC;
161 isec->inode = inode;
162 isec->sid = SECINITSID_UNLABELED;
163 isec->sclass = SECCLASS_FILE;
164 if (tsec && tsec->magic == SELINUX_MAGIC)
165 isec->task_sid = tsec->sid;
166 else
167 isec->task_sid = SECINITSID_UNLABELED;
168 inode->i_security = isec;
169
170 return 0;
171 }
172
173 static void inode_free_security(struct inode *inode)
174 {
175 struct inode_security_struct *isec = inode->i_security;
176 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
177
178 if (!isec || isec->magic != SELINUX_MAGIC)
179 return;
180
181 spin_lock(&sbsec->isec_lock);
182 if (!list_empty(&isec->list))
183 list_del_init(&isec->list);
184 spin_unlock(&sbsec->isec_lock);
185
186 inode->i_security = NULL;
187 kfree(isec);
188 }
189
190 static int file_alloc_security(struct file *file)
191 {
192 struct task_security_struct *tsec = current->security;
193 struct file_security_struct *fsec;
194
195 fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
196 if (!fsec)
197 return -ENOMEM;
198
199 memset(fsec, 0, sizeof(struct file_security_struct));
200 fsec->magic = SELINUX_MAGIC;
201 fsec->file = file;
202 if (tsec && tsec->magic == SELINUX_MAGIC) {
203 fsec->sid = tsec->sid;
204 fsec->fown_sid = tsec->sid;
205 } else {
206 fsec->sid = SECINITSID_UNLABELED;
207 fsec->fown_sid = SECINITSID_UNLABELED;
208 }
209 file->f_security = fsec;
210
211 return 0;
212 }
213
214 static void file_free_security(struct file *file)
215 {
216 struct file_security_struct *fsec = file->f_security;
217
218 if (!fsec || fsec->magic != SELINUX_MAGIC)
219 return;
220
221 file->f_security = NULL;
222 kfree(fsec);
223 }
224
225 static int superblock_alloc_security(struct super_block *sb)
226 {
227 struct superblock_security_struct *sbsec;
228
229 sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
230 if (!sbsec)
231 return -ENOMEM;
232
233 memset(sbsec, 0, sizeof(struct superblock_security_struct));
234 init_MUTEX(&sbsec->sem);
235 INIT_LIST_HEAD(&sbsec->list);
236 INIT_LIST_HEAD(&sbsec->isec_head);
237 spin_lock_init(&sbsec->isec_lock);
238 sbsec->magic = SELINUX_MAGIC;
239 sbsec->sb = sb;
240 sbsec->sid = SECINITSID_UNLABELED;
241 sbsec->def_sid = SECINITSID_FILE;
242 sb->s_security = sbsec;
243
244 return 0;
245 }
246
247 static void superblock_free_security(struct super_block *sb)
248 {
249 struct superblock_security_struct *sbsec = sb->s_security;
250
251 if (!sbsec || sbsec->magic != SELINUX_MAGIC)
252 return;
253
254 spin_lock(&sb_security_lock);
255 if (!list_empty(&sbsec->list))
256 list_del_init(&sbsec->list);
257 spin_unlock(&sb_security_lock);
258
259 sb->s_security = NULL;
260 kfree(sbsec);
261 }
262
263 #ifdef CONFIG_SECURITY_NETWORK
264 static int sk_alloc_security(struct sock *sk, int family, int priority)
265 {
266 struct sk_security_struct *ssec;
267
268 if (family != PF_UNIX)
269 return 0;
270
271 ssec = kmalloc(sizeof(*ssec), priority);
272 if (!ssec)
273 return -ENOMEM;
274
275 memset(ssec, 0, sizeof(*ssec));
276 ssec->magic = SELINUX_MAGIC;
277 ssec->sk = sk;
278 ssec->peer_sid = SECINITSID_UNLABELED;
279 sk->sk_security = ssec;
280
281 return 0;
282 }
283
284 static void sk_free_security(struct sock *sk)
285 {
286 struct sk_security_struct *ssec = sk->sk_security;
287
288 if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
289 return;
290
291 sk->sk_security = NULL;
292 kfree(ssec);
293 }
294 #endif /* CONFIG_SECURITY_NETWORK */
295
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
299
300 /* The file system's label must be initialized prior to use. */
301
302 static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309 };
310
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313 static inline int inode_doinit(struct inode *inode)
314 {
315 return inode_doinit_with_dentry(inode, NULL);
316 }
317
318 enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
322 };
323
324 static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
328 };
329
330 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
331
332 static int try_context_mount(struct super_block *sb, void *data)
333 {
334 char *context = NULL, *defcontext = NULL;
335 const char *name;
336 u32 sid;
337 int alloc = 0, rc = 0, seen = 0;
338 struct task_security_struct *tsec = current->security;
339 struct superblock_security_struct *sbsec = sb->s_security;
340
341 if (!data)
342 goto out;
343
344 name = sb->s_type->name;
345
346 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
347
348 /* NFS we understand. */
349 if (!strcmp(name, "nfs")) {
350 struct nfs_mount_data *d = data;
351
352 if (d->version < NFS_MOUNT_VERSION)
353 goto out;
354
355 if (d->context[0]) {
356 context = d->context;
357 seen |= Opt_context;
358 }
359 } else
360 goto out;
361
362 } else {
363 /* Standard string-based options. */
364 char *p, *options = data;
365
366 while ((p = strsep(&options, ",")) != NULL) {
367 int token;
368 substring_t args[MAX_OPT_ARGS];
369
370 if (!*p)
371 continue;
372
373 token = match_token(p, tokens, args);
374
375 switch (token) {
376 case Opt_context:
377 if (seen) {
378 rc = -EINVAL;
379 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
380 goto out_free;
381 }
382 context = match_strdup(&args[0]);
383 if (!context) {
384 rc = -ENOMEM;
385 goto out_free;
386 }
387 if (!alloc)
388 alloc = 1;
389 seen |= Opt_context;
390 break;
391
392 case Opt_fscontext:
393 if (seen & (Opt_context|Opt_fscontext)) {
394 rc = -EINVAL;
395 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
396 goto out_free;
397 }
398 context = match_strdup(&args[0]);
399 if (!context) {
400 rc = -ENOMEM;
401 goto out_free;
402 }
403 if (!alloc)
404 alloc = 1;
405 seen |= Opt_fscontext;
406 break;
407
408 case Opt_defcontext:
409 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
410 rc = -EINVAL;
411 printk(KERN_WARNING "SELinux: "
412 "defcontext option is invalid "
413 "for this filesystem type\n");
414 goto out_free;
415 }
416 if (seen & (Opt_context|Opt_defcontext)) {
417 rc = -EINVAL;
418 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
419 goto out_free;
420 }
421 defcontext = match_strdup(&args[0]);
422 if (!defcontext) {
423 rc = -ENOMEM;
424 goto out_free;
425 }
426 if (!alloc)
427 alloc = 1;
428 seen |= Opt_defcontext;
429 break;
430
431 default:
432 rc = -EINVAL;
433 printk(KERN_WARNING "SELinux: unknown mount "
434 "option\n");
435 goto out_free;
436
437 }
438 }
439 }
440
441 if (!seen)
442 goto out;
443
444 if (context) {
445 rc = security_context_to_sid(context, strlen(context), &sid);
446 if (rc) {
447 printk(KERN_WARNING "SELinux: security_context_to_sid"
448 "(%s) failed for (dev %s, type %s) errno=%d\n",
449 context, sb->s_id, name, rc);
450 goto out_free;
451 }
452
453 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELFROM, NULL);
455 if (rc)
456 goto out_free;
457
458 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
459 FILESYSTEM__RELABELTO, NULL);
460 if (rc)
461 goto out_free;
462
463 sbsec->sid = sid;
464
465 if (seen & Opt_context)
466 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
467 }
468
469 if (defcontext) {
470 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
471 if (rc) {
472 printk(KERN_WARNING "SELinux: security_context_to_sid"
473 "(%s) failed for (dev %s, type %s) errno=%d\n",
474 defcontext, sb->s_id, name, rc);
475 goto out_free;
476 }
477
478 if (sid == sbsec->def_sid)
479 goto out_free;
480
481 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
482 FILESYSTEM__RELABELFROM, NULL);
483 if (rc)
484 goto out_free;
485
486 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__ASSOCIATE, NULL);
488 if (rc)
489 goto out_free;
490
491 sbsec->def_sid = sid;
492 }
493
494 out_free:
495 if (alloc) {
496 kfree(context);
497 kfree(defcontext);
498 }
499 out:
500 return rc;
501 }
502
503 static int superblock_doinit(struct super_block *sb, void *data)
504 {
505 struct superblock_security_struct *sbsec = sb->s_security;
506 struct dentry *root = sb->s_root;
507 struct inode *inode = root->d_inode;
508 int rc = 0;
509
510 down(&sbsec->sem);
511 if (sbsec->initialized)
512 goto out;
513
514 if (!ss_initialized) {
515 /* Defer initialization until selinux_complete_init,
516 after the initial policy is loaded and the security
517 server is ready to handle calls. */
518 spin_lock(&sb_security_lock);
519 if (list_empty(&sbsec->list))
520 list_add(&sbsec->list, &superblock_security_head);
521 spin_unlock(&sb_security_lock);
522 goto out;
523 }
524
525 /* Determine the labeling behavior to use for this filesystem type. */
526 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
527 if (rc) {
528 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
529 __FUNCTION__, sb->s_type->name, rc);
530 goto out;
531 }
532
533 rc = try_context_mount(sb, data);
534 if (rc)
535 goto out;
536
537 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
538 /* Make sure that the xattr handler exists and that no
539 error other than -ENODATA is returned by getxattr on
540 the root directory. -ENODATA is ok, as this may be
541 the first boot of the SELinux kernel before we have
542 assigned xattr values to the filesystem. */
543 if (!inode->i_op->getxattr) {
544 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
545 "xattr support\n", sb->s_id, sb->s_type->name);
546 rc = -EOPNOTSUPP;
547 goto out;
548 }
549 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
550 if (rc < 0 && rc != -ENODATA) {
551 if (rc == -EOPNOTSUPP)
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) has no security xattr handler\n",
554 sb->s_id, sb->s_type->name);
555 else
556 printk(KERN_WARNING "SELinux: (dev %s, type "
557 "%s) getxattr errno %d\n", sb->s_id,
558 sb->s_type->name, -rc);
559 goto out;
560 }
561 }
562
563 if (strcmp(sb->s_type->name, "proc") == 0)
564 sbsec->proc = 1;
565
566 sbsec->initialized = 1;
567
568 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
570 sb->s_id, sb->s_type->name);
571 }
572 else {
573 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
574 sb->s_id, sb->s_type->name,
575 labeling_behaviors[sbsec->behavior-1]);
576 }
577
578 /* Initialize the root inode. */
579 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
580
581 /* Initialize any other inodes associated with the superblock, e.g.
582 inodes created prior to initial policy load or inodes created
583 during get_sb by a pseudo filesystem that directly
584 populates itself. */
585 spin_lock(&sbsec->isec_lock);
586 next_inode:
587 if (!list_empty(&sbsec->isec_head)) {
588 struct inode_security_struct *isec =
589 list_entry(sbsec->isec_head.next,
590 struct inode_security_struct, list);
591 struct inode *inode = isec->inode;
592 spin_unlock(&sbsec->isec_lock);
593 inode = igrab(inode);
594 if (inode) {
595 if (!IS_PRIVATE (inode))
596 inode_doinit(inode);
597 iput(inode);
598 }
599 spin_lock(&sbsec->isec_lock);
600 list_del_init(&isec->list);
601 goto next_inode;
602 }
603 spin_unlock(&sbsec->isec_lock);
604 out:
605 up(&sbsec->sem);
606 return rc;
607 }
608
609 static inline u16 inode_mode_to_security_class(umode_t mode)
610 {
611 switch (mode & S_IFMT) {
612 case S_IFSOCK:
613 return SECCLASS_SOCK_FILE;
614 case S_IFLNK:
615 return SECCLASS_LNK_FILE;
616 case S_IFREG:
617 return SECCLASS_FILE;
618 case S_IFBLK:
619 return SECCLASS_BLK_FILE;
620 case S_IFDIR:
621 return SECCLASS_DIR;
622 case S_IFCHR:
623 return SECCLASS_CHR_FILE;
624 case S_IFIFO:
625 return SECCLASS_FIFO_FILE;
626
627 }
628
629 return SECCLASS_FILE;
630 }
631
632 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
633 {
634 switch (family) {
635 case PF_UNIX:
636 switch (type) {
637 case SOCK_STREAM:
638 case SOCK_SEQPACKET:
639 return SECCLASS_UNIX_STREAM_SOCKET;
640 case SOCK_DGRAM:
641 return SECCLASS_UNIX_DGRAM_SOCKET;
642 }
643 break;
644 case PF_INET:
645 case PF_INET6:
646 switch (type) {
647 case SOCK_STREAM:
648 return SECCLASS_TCP_SOCKET;
649 case SOCK_DGRAM:
650 return SECCLASS_UDP_SOCKET;
651 case SOCK_RAW:
652 return SECCLASS_RAWIP_SOCKET;
653 }
654 break;
655 case PF_NETLINK:
656 switch (protocol) {
657 case NETLINK_ROUTE:
658 return SECCLASS_NETLINK_ROUTE_SOCKET;
659 case NETLINK_FIREWALL:
660 return SECCLASS_NETLINK_FIREWALL_SOCKET;
661 case NETLINK_TCPDIAG:
662 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
663 case NETLINK_NFLOG:
664 return SECCLASS_NETLINK_NFLOG_SOCKET;
665 case NETLINK_XFRM:
666 return SECCLASS_NETLINK_XFRM_SOCKET;
667 case NETLINK_SELINUX:
668 return SECCLASS_NETLINK_SELINUX_SOCKET;
669 case NETLINK_AUDIT:
670 return SECCLASS_NETLINK_AUDIT_SOCKET;
671 case NETLINK_IP6_FW:
672 return SECCLASS_NETLINK_IP6FW_SOCKET;
673 case NETLINK_DNRTMSG:
674 return SECCLASS_NETLINK_DNRT_SOCKET;
675 case NETLINK_KOBJECT_UEVENT:
676 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
677 default:
678 return SECCLASS_NETLINK_SOCKET;
679 }
680 case PF_PACKET:
681 return SECCLASS_PACKET_SOCKET;
682 case PF_KEY:
683 return SECCLASS_KEY_SOCKET;
684 }
685
686 return SECCLASS_SOCKET;
687 }
688
689 #ifdef CONFIG_PROC_FS
690 static int selinux_proc_get_sid(struct proc_dir_entry *de,
691 u16 tclass,
692 u32 *sid)
693 {
694 int buflen, rc;
695 char *buffer, *path, *end;
696
697 buffer = (char*)__get_free_page(GFP_KERNEL);
698 if (!buffer)
699 return -ENOMEM;
700
701 buflen = PAGE_SIZE;
702 end = buffer+buflen;
703 *--end = '\0';
704 buflen--;
705 path = end-1;
706 *path = '/';
707 while (de && de != de->parent) {
708 buflen -= de->namelen + 1;
709 if (buflen < 0)
710 break;
711 end -= de->namelen;
712 memcpy(end, de->name, de->namelen);
713 *--end = '/';
714 path = end;
715 de = de->parent;
716 }
717 rc = security_genfs_sid("proc", path, tclass, sid);
718 free_page((unsigned long)buffer);
719 return rc;
720 }
721 #else
722 static int selinux_proc_get_sid(struct proc_dir_entry *de,
723 u16 tclass,
724 u32 *sid)
725 {
726 return -EINVAL;
727 }
728 #endif
729
730 /* The inode's security attributes must be initialized before first use. */
731 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
732 {
733 struct superblock_security_struct *sbsec = NULL;
734 struct inode_security_struct *isec = inode->i_security;
735 u32 sid;
736 struct dentry *dentry;
737 #define INITCONTEXTLEN 255
738 char *context = NULL;
739 unsigned len = 0;
740 int rc = 0;
741 int hold_sem = 0;
742
743 if (isec->initialized)
744 goto out;
745
746 down(&isec->sem);
747 hold_sem = 1;
748 if (isec->initialized)
749 goto out;
750
751 sbsec = inode->i_sb->s_security;
752 if (!sbsec->initialized) {
753 /* Defer initialization until selinux_complete_init,
754 after the initial policy is loaded and the security
755 server is ready to handle calls. */
756 spin_lock(&sbsec->isec_lock);
757 if (list_empty(&isec->list))
758 list_add(&isec->list, &sbsec->isec_head);
759 spin_unlock(&sbsec->isec_lock);
760 goto out;
761 }
762
763 switch (sbsec->behavior) {
764 case SECURITY_FS_USE_XATTR:
765 if (!inode->i_op->getxattr) {
766 isec->sid = sbsec->def_sid;
767 break;
768 }
769
770 /* Need a dentry, since the xattr API requires one.
771 Life would be simpler if we could just pass the inode. */
772 if (opt_dentry) {
773 /* Called from d_instantiate or d_splice_alias. */
774 dentry = dget(opt_dentry);
775 } else {
776 /* Called from selinux_complete_init, try to find a dentry. */
777 dentry = d_find_alias(inode);
778 }
779 if (!dentry) {
780 printk(KERN_WARNING "%s: no dentry for dev=%s "
781 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
782 inode->i_ino);
783 goto out;
784 }
785
786 len = INITCONTEXTLEN;
787 context = kmalloc(len, GFP_KERNEL);
788 if (!context) {
789 rc = -ENOMEM;
790 dput(dentry);
791 goto out;
792 }
793 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
794 context, len);
795 if (rc == -ERANGE) {
796 /* Need a larger buffer. Query for the right size. */
797 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
798 NULL, 0);
799 if (rc < 0) {
800 dput(dentry);
801 goto out;
802 }
803 kfree(context);
804 len = rc;
805 context = kmalloc(len, GFP_KERNEL);
806 if (!context) {
807 rc = -ENOMEM;
808 dput(dentry);
809 goto out;
810 }
811 rc = inode->i_op->getxattr(dentry,
812 XATTR_NAME_SELINUX,
813 context, len);
814 }
815 dput(dentry);
816 if (rc < 0) {
817 if (rc != -ENODATA) {
818 printk(KERN_WARNING "%s: getxattr returned "
819 "%d for dev=%s ino=%ld\n", __FUNCTION__,
820 -rc, inode->i_sb->s_id, inode->i_ino);
821 kfree(context);
822 goto out;
823 }
824 /* Map ENODATA to the default file SID */
825 sid = sbsec->def_sid;
826 rc = 0;
827 } else {
828 rc = security_context_to_sid(context, rc, &sid);
829 if (rc) {
830 printk(KERN_WARNING "%s: context_to_sid(%s) "
831 "returned %d for dev=%s ino=%ld\n",
832 __FUNCTION__, context, -rc,
833 inode->i_sb->s_id, inode->i_ino);
834 kfree(context);
835 /* Leave with the unlabeled SID */
836 rc = 0;
837 break;
838 }
839 }
840 kfree(context);
841 isec->sid = sid;
842 break;
843 case SECURITY_FS_USE_TASK:
844 isec->sid = isec->task_sid;
845 break;
846 case SECURITY_FS_USE_TRANS:
847 /* Default to the fs SID. */
848 isec->sid = sbsec->sid;
849
850 /* Try to obtain a transition SID. */
851 isec->sclass = inode_mode_to_security_class(inode->i_mode);
852 rc = security_transition_sid(isec->task_sid,
853 sbsec->sid,
854 isec->sclass,
855 &sid);
856 if (rc)
857 goto out;
858 isec->sid = sid;
859 break;
860 default:
861 /* Default to the fs SID. */
862 isec->sid = sbsec->sid;
863
864 if (sbsec->proc) {
865 struct proc_inode *proci = PROC_I(inode);
866 if (proci->pde) {
867 isec->sclass = inode_mode_to_security_class(inode->i_mode);
868 rc = selinux_proc_get_sid(proci->pde,
869 isec->sclass,
870 &sid);
871 if (rc)
872 goto out;
873 isec->sid = sid;
874 }
875 }
876 break;
877 }
878
879 isec->initialized = 1;
880
881 out:
882 if (isec->sclass == SECCLASS_FILE)
883 isec->sclass = inode_mode_to_security_class(inode->i_mode);
884
885 if (hold_sem)
886 up(&isec->sem);
887 return rc;
888 }
889
890 /* Convert a Linux signal to an access vector. */
891 static inline u32 signal_to_av(int sig)
892 {
893 u32 perm = 0;
894
895 switch (sig) {
896 case SIGCHLD:
897 /* Commonly granted from child to parent. */
898 perm = PROCESS__SIGCHLD;
899 break;
900 case SIGKILL:
901 /* Cannot be caught or ignored */
902 perm = PROCESS__SIGKILL;
903 break;
904 case SIGSTOP:
905 /* Cannot be caught or ignored */
906 perm = PROCESS__SIGSTOP;
907 break;
908 default:
909 /* All other signals. */
910 perm = PROCESS__SIGNAL;
911 break;
912 }
913
914 return perm;
915 }
916
917 /* Check permission betweeen a pair of tasks, e.g. signal checks,
918 fork check, ptrace check, etc. */
919 static int task_has_perm(struct task_struct *tsk1,
920 struct task_struct *tsk2,
921 u32 perms)
922 {
923 struct task_security_struct *tsec1, *tsec2;
924
925 tsec1 = tsk1->security;
926 tsec2 = tsk2->security;
927 return avc_has_perm(tsec1->sid, tsec2->sid,
928 SECCLASS_PROCESS, perms, NULL);
929 }
930
931 /* Check whether a task is allowed to use a capability. */
932 static int task_has_capability(struct task_struct *tsk,
933 int cap)
934 {
935 struct task_security_struct *tsec;
936 struct avc_audit_data ad;
937
938 tsec = tsk->security;
939
940 AVC_AUDIT_DATA_INIT(&ad,CAP);
941 ad.tsk = tsk;
942 ad.u.cap = cap;
943
944 return avc_has_perm(tsec->sid, tsec->sid,
945 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
946 }
947
948 /* Check whether a task is allowed to use a system operation. */
949 static int task_has_system(struct task_struct *tsk,
950 u32 perms)
951 {
952 struct task_security_struct *tsec;
953
954 tsec = tsk->security;
955
956 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
957 SECCLASS_SYSTEM, perms, NULL);
958 }
959
960 /* Check whether a task has a particular permission to an inode.
961 The 'adp' parameter is optional and allows other audit
962 data to be passed (e.g. the dentry). */
963 static int inode_has_perm(struct task_struct *tsk,
964 struct inode *inode,
965 u32 perms,
966 struct avc_audit_data *adp)
967 {
968 struct task_security_struct *tsec;
969 struct inode_security_struct *isec;
970 struct avc_audit_data ad;
971
972 tsec = tsk->security;
973 isec = inode->i_security;
974
975 if (!adp) {
976 adp = &ad;
977 AVC_AUDIT_DATA_INIT(&ad, FS);
978 ad.u.fs.inode = inode;
979 }
980
981 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
982 }
983
984 /* Same as inode_has_perm, but pass explicit audit data containing
985 the dentry to help the auditing code to more easily generate the
986 pathname if needed. */
987 static inline int dentry_has_perm(struct task_struct *tsk,
988 struct vfsmount *mnt,
989 struct dentry *dentry,
990 u32 av)
991 {
992 struct inode *inode = dentry->d_inode;
993 struct avc_audit_data ad;
994 AVC_AUDIT_DATA_INIT(&ad,FS);
995 ad.u.fs.mnt = mnt;
996 ad.u.fs.dentry = dentry;
997 return inode_has_perm(tsk, inode, av, &ad);
998 }
999
1000 /* Check whether a task can use an open file descriptor to
1001 access an inode in a given way. Check access to the
1002 descriptor itself, and then use dentry_has_perm to
1003 check a particular permission to the file.
1004 Access to the descriptor is implicitly granted if it
1005 has the same SID as the process. If av is zero, then
1006 access to the file is not checked, e.g. for cases
1007 where only the descriptor is affected like seek. */
1008 static inline int file_has_perm(struct task_struct *tsk,
1009 struct file *file,
1010 u32 av)
1011 {
1012 struct task_security_struct *tsec = tsk->security;
1013 struct file_security_struct *fsec = file->f_security;
1014 struct vfsmount *mnt = file->f_vfsmnt;
1015 struct dentry *dentry = file->f_dentry;
1016 struct inode *inode = dentry->d_inode;
1017 struct avc_audit_data ad;
1018 int rc;
1019
1020 AVC_AUDIT_DATA_INIT(&ad, FS);
1021 ad.u.fs.mnt = mnt;
1022 ad.u.fs.dentry = dentry;
1023
1024 if (tsec->sid != fsec->sid) {
1025 rc = avc_has_perm(tsec->sid, fsec->sid,
1026 SECCLASS_FD,
1027 FD__USE,
1028 &ad);
1029 if (rc)
1030 return rc;
1031 }
1032
1033 /* av is zero if only checking access to the descriptor. */
1034 if (av)
1035 return inode_has_perm(tsk, inode, av, &ad);
1036
1037 return 0;
1038 }
1039
1040 /* Check whether a task can create a file. */
1041 static int may_create(struct inode *dir,
1042 struct dentry *dentry,
1043 u16 tclass)
1044 {
1045 struct task_security_struct *tsec;
1046 struct inode_security_struct *dsec;
1047 struct superblock_security_struct *sbsec;
1048 u32 newsid;
1049 struct avc_audit_data ad;
1050 int rc;
1051
1052 tsec = current->security;
1053 dsec = dir->i_security;
1054 sbsec = dir->i_sb->s_security;
1055
1056 AVC_AUDIT_DATA_INIT(&ad, FS);
1057 ad.u.fs.dentry = dentry;
1058
1059 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1060 DIR__ADD_NAME | DIR__SEARCH,
1061 &ad);
1062 if (rc)
1063 return rc;
1064
1065 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1066 newsid = tsec->create_sid;
1067 } else {
1068 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1069 &newsid);
1070 if (rc)
1071 return rc;
1072 }
1073
1074 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1075 if (rc)
1076 return rc;
1077
1078 return avc_has_perm(newsid, sbsec->sid,
1079 SECCLASS_FILESYSTEM,
1080 FILESYSTEM__ASSOCIATE, &ad);
1081 }
1082
1083 #define MAY_LINK 0
1084 #define MAY_UNLINK 1
1085 #define MAY_RMDIR 2
1086
1087 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1088 static int may_link(struct inode *dir,
1089 struct dentry *dentry,
1090 int kind)
1091
1092 {
1093 struct task_security_struct *tsec;
1094 struct inode_security_struct *dsec, *isec;
1095 struct avc_audit_data ad;
1096 u32 av;
1097 int rc;
1098
1099 tsec = current->security;
1100 dsec = dir->i_security;
1101 isec = dentry->d_inode->i_security;
1102
1103 AVC_AUDIT_DATA_INIT(&ad, FS);
1104 ad.u.fs.dentry = dentry;
1105
1106 av = DIR__SEARCH;
1107 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1108 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1109 if (rc)
1110 return rc;
1111
1112 switch (kind) {
1113 case MAY_LINK:
1114 av = FILE__LINK;
1115 break;
1116 case MAY_UNLINK:
1117 av = FILE__UNLINK;
1118 break;
1119 case MAY_RMDIR:
1120 av = DIR__RMDIR;
1121 break;
1122 default:
1123 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1124 return 0;
1125 }
1126
1127 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1128 return rc;
1129 }
1130
1131 static inline int may_rename(struct inode *old_dir,
1132 struct dentry *old_dentry,
1133 struct inode *new_dir,
1134 struct dentry *new_dentry)
1135 {
1136 struct task_security_struct *tsec;
1137 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1138 struct avc_audit_data ad;
1139 u32 av;
1140 int old_is_dir, new_is_dir;
1141 int rc;
1142
1143 tsec = current->security;
1144 old_dsec = old_dir->i_security;
1145 old_isec = old_dentry->d_inode->i_security;
1146 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1147 new_dsec = new_dir->i_security;
1148
1149 AVC_AUDIT_DATA_INIT(&ad, FS);
1150
1151 ad.u.fs.dentry = old_dentry;
1152 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1153 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1154 if (rc)
1155 return rc;
1156 rc = avc_has_perm(tsec->sid, old_isec->sid,
1157 old_isec->sclass, FILE__RENAME, &ad);
1158 if (rc)
1159 return rc;
1160 if (old_is_dir && new_dir != old_dir) {
1161 rc = avc_has_perm(tsec->sid, old_isec->sid,
1162 old_isec->sclass, DIR__REPARENT, &ad);
1163 if (rc)
1164 return rc;
1165 }
1166
1167 ad.u.fs.dentry = new_dentry;
1168 av = DIR__ADD_NAME | DIR__SEARCH;
1169 if (new_dentry->d_inode)
1170 av |= DIR__REMOVE_NAME;
1171 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1172 if (rc)
1173 return rc;
1174 if (new_dentry->d_inode) {
1175 new_isec = new_dentry->d_inode->i_security;
1176 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1177 rc = avc_has_perm(tsec->sid, new_isec->sid,
1178 new_isec->sclass,
1179 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1180 if (rc)
1181 return rc;
1182 }
1183
1184 return 0;
1185 }
1186
1187 /* Check whether a task can perform a filesystem operation. */
1188 static int superblock_has_perm(struct task_struct *tsk,
1189 struct super_block *sb,
1190 u32 perms,
1191 struct avc_audit_data *ad)
1192 {
1193 struct task_security_struct *tsec;
1194 struct superblock_security_struct *sbsec;
1195
1196 tsec = tsk->security;
1197 sbsec = sb->s_security;
1198 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1199 perms, ad);
1200 }
1201
1202 /* Convert a Linux mode and permission mask to an access vector. */
1203 static inline u32 file_mask_to_av(int mode, int mask)
1204 {
1205 u32 av = 0;
1206
1207 if ((mode & S_IFMT) != S_IFDIR) {
1208 if (mask & MAY_EXEC)
1209 av |= FILE__EXECUTE;
1210 if (mask & MAY_READ)
1211 av |= FILE__READ;
1212
1213 if (mask & MAY_APPEND)
1214 av |= FILE__APPEND;
1215 else if (mask & MAY_WRITE)
1216 av |= FILE__WRITE;
1217
1218 } else {
1219 if (mask & MAY_EXEC)
1220 av |= DIR__SEARCH;
1221 if (mask & MAY_WRITE)
1222 av |= DIR__WRITE;
1223 if (mask & MAY_READ)
1224 av |= DIR__READ;
1225 }
1226
1227 return av;
1228 }
1229
1230 /* Convert a Linux file to an access vector. */
1231 static inline u32 file_to_av(struct file *file)
1232 {
1233 u32 av = 0;
1234
1235 if (file->f_mode & FMODE_READ)
1236 av |= FILE__READ;
1237 if (file->f_mode & FMODE_WRITE) {
1238 if (file->f_flags & O_APPEND)
1239 av |= FILE__APPEND;
1240 else
1241 av |= FILE__WRITE;
1242 }
1243
1244 return av;
1245 }
1246
1247 /* Set an inode's SID to a specified value. */
1248 static int inode_security_set_sid(struct inode *inode, u32 sid)
1249 {
1250 struct inode_security_struct *isec = inode->i_security;
1251 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1252
1253 if (!sbsec->initialized) {
1254 /* Defer initialization to selinux_complete_init. */
1255 return 0;
1256 }
1257
1258 down(&isec->sem);
1259 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1260 isec->sid = sid;
1261 isec->initialized = 1;
1262 up(&isec->sem);
1263 return 0;
1264 }
1265
1266 /* Set the security attributes on a newly created file. */
1267 static int post_create(struct inode *dir,
1268 struct dentry *dentry)
1269 {
1270
1271 struct task_security_struct *tsec;
1272 struct inode *inode;
1273 struct inode_security_struct *dsec;
1274 struct superblock_security_struct *sbsec;
1275 u32 newsid;
1276 char *context;
1277 unsigned int len;
1278 int rc;
1279
1280 tsec = current->security;
1281 dsec = dir->i_security;
1282 sbsec = dir->i_sb->s_security;
1283
1284 inode = dentry->d_inode;
1285 if (!inode) {
1286 /* Some file system types (e.g. NFS) may not instantiate
1287 a dentry for all create operations (e.g. symlink),
1288 so we have to check to see if the inode is non-NULL. */
1289 printk(KERN_WARNING "post_create: no inode, dir (dev=%s, "
1290 "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1291 return 0;
1292 }
1293
1294 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1295 newsid = tsec->create_sid;
1296 } else {
1297 rc = security_transition_sid(tsec->sid, dsec->sid,
1298 inode_mode_to_security_class(inode->i_mode),
1299 &newsid);
1300 if (rc) {
1301 printk(KERN_WARNING "post_create: "
1302 "security_transition_sid failed, rc=%d (dev=%s "
1303 "ino=%ld)\n",
1304 -rc, inode->i_sb->s_id, inode->i_ino);
1305 return rc;
1306 }
1307 }
1308
1309 rc = inode_security_set_sid(inode, newsid);
1310 if (rc) {
1311 printk(KERN_WARNING "post_create: inode_security_set_sid "
1312 "failed, rc=%d (dev=%s ino=%ld)\n",
1313 -rc, inode->i_sb->s_id, inode->i_ino);
1314 return rc;
1315 }
1316
1317 if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1318 inode->i_op->setxattr) {
1319 /* Use extended attributes. */
1320 rc = security_sid_to_context(newsid, &context, &len);
1321 if (rc) {
1322 printk(KERN_WARNING "post_create: sid_to_context "
1323 "failed, rc=%d (dev=%s ino=%ld)\n",
1324 -rc, inode->i_sb->s_id, inode->i_ino);
1325 return rc;
1326 }
1327 down(&inode->i_sem);
1328 rc = inode->i_op->setxattr(dentry,
1329 XATTR_NAME_SELINUX,
1330 context, len, 0);
1331 up(&inode->i_sem);
1332 kfree(context);
1333 if (rc < 0) {
1334 printk(KERN_WARNING "post_create: setxattr failed, "
1335 "rc=%d (dev=%s ino=%ld)\n",
1336 -rc, inode->i_sb->s_id, inode->i_ino);
1337 return rc;
1338 }
1339 }
1340
1341 return 0;
1342 }
1343
1344
1345 /* Hook functions begin here. */
1346
1347 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1348 {
1349 struct task_security_struct *psec = parent->security;
1350 struct task_security_struct *csec = child->security;
1351 int rc;
1352
1353 rc = secondary_ops->ptrace(parent,child);
1354 if (rc)
1355 return rc;
1356
1357 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1358 /* Save the SID of the tracing process for later use in apply_creds. */
1359 if (!rc)
1360 csec->ptrace_sid = psec->sid;
1361 return rc;
1362 }
1363
1364 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1365 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1366 {
1367 int error;
1368
1369 error = task_has_perm(current, target, PROCESS__GETCAP);
1370 if (error)
1371 return error;
1372
1373 return secondary_ops->capget(target, effective, inheritable, permitted);
1374 }
1375
1376 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1377 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1378 {
1379 int error;
1380
1381 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1382 if (error)
1383 return error;
1384
1385 return task_has_perm(current, target, PROCESS__SETCAP);
1386 }
1387
1388 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1389 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390 {
1391 secondary_ops->capset_set(target, effective, inheritable, permitted);
1392 }
1393
1394 static int selinux_capable(struct task_struct *tsk, int cap)
1395 {
1396 int rc;
1397
1398 rc = secondary_ops->capable(tsk, cap);
1399 if (rc)
1400 return rc;
1401
1402 return task_has_capability(tsk,cap);
1403 }
1404
1405 static int selinux_sysctl(ctl_table *table, int op)
1406 {
1407 int error = 0;
1408 u32 av;
1409 struct task_security_struct *tsec;
1410 u32 tsid;
1411 int rc;
1412
1413 rc = secondary_ops->sysctl(table, op);
1414 if (rc)
1415 return rc;
1416
1417 tsec = current->security;
1418
1419 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1420 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1421 if (rc) {
1422 /* Default to the well-defined sysctl SID. */
1423 tsid = SECINITSID_SYSCTL;
1424 }
1425
1426 /* The op values are "defined" in sysctl.c, thereby creating
1427 * a bad coupling between this module and sysctl.c */
1428 if(op == 001) {
1429 error = avc_has_perm(tsec->sid, tsid,
1430 SECCLASS_DIR, DIR__SEARCH, NULL);
1431 } else {
1432 av = 0;
1433 if (op & 004)
1434 av |= FILE__READ;
1435 if (op & 002)
1436 av |= FILE__WRITE;
1437 if (av)
1438 error = avc_has_perm(tsec->sid, tsid,
1439 SECCLASS_FILE, av, NULL);
1440 }
1441
1442 return error;
1443 }
1444
1445 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1446 {
1447 int rc = 0;
1448
1449 if (!sb)
1450 return 0;
1451
1452 switch (cmds) {
1453 case Q_SYNC:
1454 case Q_QUOTAON:
1455 case Q_QUOTAOFF:
1456 case Q_SETINFO:
1457 case Q_SETQUOTA:
1458 rc = superblock_has_perm(current,
1459 sb,
1460 FILESYSTEM__QUOTAMOD, NULL);
1461 break;
1462 case Q_GETFMT:
1463 case Q_GETINFO:
1464 case Q_GETQUOTA:
1465 rc = superblock_has_perm(current,
1466 sb,
1467 FILESYSTEM__QUOTAGET, NULL);
1468 break;
1469 default:
1470 rc = 0; /* let the kernel handle invalid cmds */
1471 break;
1472 }
1473 return rc;
1474 }
1475
1476 static int selinux_quota_on(struct dentry *dentry)
1477 {
1478 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1479 }
1480
1481 static int selinux_syslog(int type)
1482 {
1483 int rc;
1484
1485 rc = secondary_ops->syslog(type);
1486 if (rc)
1487 return rc;
1488
1489 switch (type) {
1490 case 3: /* Read last kernel messages */
1491 case 10: /* Return size of the log buffer */
1492 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1493 break;
1494 case 6: /* Disable logging to console */
1495 case 7: /* Enable logging to console */
1496 case 8: /* Set level of messages printed to console */
1497 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1498 break;
1499 case 0: /* Close log */
1500 case 1: /* Open log */
1501 case 2: /* Read from log */
1502 case 4: /* Read/clear last kernel messages */
1503 case 5: /* Clear ring buffer */
1504 default:
1505 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1506 break;
1507 }
1508 return rc;
1509 }
1510
1511 /*
1512 * Check that a process has enough memory to allocate a new virtual
1513 * mapping. 0 means there is enough memory for the allocation to
1514 * succeed and -ENOMEM implies there is not.
1515 *
1516 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1517 * if the capability is granted, but __vm_enough_memory requires 1 if
1518 * the capability is granted.
1519 *
1520 * Do not audit the selinux permission check, as this is applied to all
1521 * processes that allocate mappings.
1522 */
1523 static int selinux_vm_enough_memory(long pages)
1524 {
1525 int rc, cap_sys_admin = 0;
1526 struct task_security_struct *tsec = current->security;
1527
1528 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1529 if (rc == 0)
1530 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1531 SECCLASS_CAPABILITY,
1532 CAP_TO_MASK(CAP_SYS_ADMIN),
1533 NULL);
1534
1535 if (rc == 0)
1536 cap_sys_admin = 1;
1537
1538 return __vm_enough_memory(pages, cap_sys_admin);
1539 }
1540
1541 /* binprm security operations */
1542
1543 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1544 {
1545 struct bprm_security_struct *bsec;
1546
1547 bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1548 if (!bsec)
1549 return -ENOMEM;
1550
1551 memset(bsec, 0, sizeof *bsec);
1552 bsec->magic = SELINUX_MAGIC;
1553 bsec->bprm = bprm;
1554 bsec->sid = SECINITSID_UNLABELED;
1555 bsec->set = 0;
1556
1557 bprm->security = bsec;
1558 return 0;
1559 }
1560
1561 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1562 {
1563 struct task_security_struct *tsec;
1564 struct inode *inode = bprm->file->f_dentry->d_inode;
1565 struct inode_security_struct *isec;
1566 struct bprm_security_struct *bsec;
1567 u32 newsid;
1568 struct avc_audit_data ad;
1569 int rc;
1570
1571 rc = secondary_ops->bprm_set_security(bprm);
1572 if (rc)
1573 return rc;
1574
1575 bsec = bprm->security;
1576
1577 if (bsec->set)
1578 return 0;
1579
1580 tsec = current->security;
1581 isec = inode->i_security;
1582
1583 /* Default to the current task SID. */
1584 bsec->sid = tsec->sid;
1585
1586 /* Reset create SID on execve. */
1587 tsec->create_sid = 0;
1588
1589 if (tsec->exec_sid) {
1590 newsid = tsec->exec_sid;
1591 /* Reset exec SID on execve. */
1592 tsec->exec_sid = 0;
1593 } else {
1594 /* Check for a default transition on this program. */
1595 rc = security_transition_sid(tsec->sid, isec->sid,
1596 SECCLASS_PROCESS, &newsid);
1597 if (rc)
1598 return rc;
1599 }
1600
1601 AVC_AUDIT_DATA_INIT(&ad, FS);
1602 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1603 ad.u.fs.dentry = bprm->file->f_dentry;
1604
1605 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1606 newsid = tsec->sid;
1607
1608 if (tsec->sid == newsid) {
1609 rc = avc_has_perm(tsec->sid, isec->sid,
1610 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1611 if (rc)
1612 return rc;
1613 } else {
1614 /* Check permissions for the transition. */
1615 rc = avc_has_perm(tsec->sid, newsid,
1616 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1617 if (rc)
1618 return rc;
1619
1620 rc = avc_has_perm(newsid, isec->sid,
1621 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1622 if (rc)
1623 return rc;
1624
1625 /* Clear any possibly unsafe personality bits on exec: */
1626 current->personality &= ~PER_CLEAR_ON_SETID;
1627
1628 /* Set the security field to the new SID. */
1629 bsec->sid = newsid;
1630 }
1631
1632 bsec->set = 1;
1633 return 0;
1634 }
1635
1636 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1637 {
1638 return secondary_ops->bprm_check_security(bprm);
1639 }
1640
1641
1642 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1643 {
1644 struct task_security_struct *tsec = current->security;
1645 int atsecure = 0;
1646
1647 if (tsec->osid != tsec->sid) {
1648 /* Enable secure mode for SIDs transitions unless
1649 the noatsecure permission is granted between
1650 the two SIDs, i.e. ahp returns 0. */
1651 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1652 SECCLASS_PROCESS,
1653 PROCESS__NOATSECURE, NULL);
1654 }
1655
1656 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1657 }
1658
1659 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1660 {
1661 struct bprm_security_struct *bsec = bprm->security;
1662 bprm->security = NULL;
1663 kfree(bsec);
1664 }
1665
1666 extern struct vfsmount *selinuxfs_mount;
1667 extern struct dentry *selinux_null;
1668
1669 /* Derived from fs/exec.c:flush_old_files. */
1670 static inline void flush_unauthorized_files(struct files_struct * files)
1671 {
1672 struct avc_audit_data ad;
1673 struct file *file, *devnull = NULL;
1674 struct tty_struct *tty = current->signal->tty;
1675 long j = -1;
1676
1677 if (tty) {
1678 file_list_lock();
1679 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1680 if (file) {
1681 /* Revalidate access to controlling tty.
1682 Use inode_has_perm on the tty inode directly rather
1683 than using file_has_perm, as this particular open
1684 file may belong to another process and we are only
1685 interested in the inode-based check here. */
1686 struct inode *inode = file->f_dentry->d_inode;
1687 if (inode_has_perm(current, inode,
1688 FILE__READ | FILE__WRITE, NULL)) {
1689 /* Reset controlling tty. */
1690 current->signal->tty = NULL;
1691 current->signal->tty_old_pgrp = 0;
1692 }
1693 }
1694 file_list_unlock();
1695 }
1696
1697 /* Revalidate access to inherited open files. */
1698
1699 AVC_AUDIT_DATA_INIT(&ad,FS);
1700
1701 spin_lock(&files->file_lock);
1702 for (;;) {
1703 unsigned long set, i;
1704 int fd;
1705
1706 j++;
1707 i = j * __NFDBITS;
1708 if (i >= files->max_fds || i >= files->max_fdset)
1709 break;
1710 set = files->open_fds->fds_bits[j];
1711 if (!set)
1712 continue;
1713 spin_unlock(&files->file_lock);
1714 for ( ; set ; i++,set >>= 1) {
1715 if (set & 1) {
1716 file = fget(i);
1717 if (!file)
1718 continue;
1719 if (file_has_perm(current,
1720 file,
1721 file_to_av(file))) {
1722 sys_close(i);
1723 fd = get_unused_fd();
1724 if (fd != i) {
1725 if (fd >= 0)
1726 put_unused_fd(fd);
1727 fput(file);
1728 continue;
1729 }
1730 if (devnull) {
1731 atomic_inc(&devnull->f_count);
1732 } else {
1733 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1734 if (!devnull) {
1735 put_unused_fd(fd);
1736 fput(file);
1737 continue;
1738 }
1739 }
1740 fd_install(fd, devnull);
1741 }
1742 fput(file);
1743 }
1744 }
1745 spin_lock(&files->file_lock);
1746
1747 }
1748 spin_unlock(&files->file_lock);
1749 }
1750
1751 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1752 {
1753 struct task_security_struct *tsec;
1754 struct bprm_security_struct *bsec;
1755 u32 sid;
1756 int rc;
1757
1758 secondary_ops->bprm_apply_creds(bprm, unsafe);
1759
1760 tsec = current->security;
1761
1762 bsec = bprm->security;
1763 sid = bsec->sid;
1764
1765 tsec->osid = tsec->sid;
1766 bsec->unsafe = 0;
1767 if (tsec->sid != sid) {
1768 /* Check for shared state. If not ok, leave SID
1769 unchanged and kill. */
1770 if (unsafe & LSM_UNSAFE_SHARE) {
1771 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1772 PROCESS__SHARE, NULL);
1773 if (rc) {
1774 bsec->unsafe = 1;
1775 return;
1776 }
1777 }
1778
1779 /* Check for ptracing, and update the task SID if ok.
1780 Otherwise, leave SID unchanged and kill. */
1781 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1782 rc = avc_has_perm(tsec->ptrace_sid, sid,
1783 SECCLASS_PROCESS, PROCESS__PTRACE,
1784 NULL);
1785 if (rc) {
1786 bsec->unsafe = 1;
1787 return;
1788 }
1789 }
1790 tsec->sid = sid;
1791 }
1792 }
1793
1794 /*
1795 * called after apply_creds without the task lock held
1796 */
1797 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1798 {
1799 struct task_security_struct *tsec;
1800 struct rlimit *rlim, *initrlim;
1801 struct itimerval itimer;
1802 struct bprm_security_struct *bsec;
1803 int rc, i;
1804
1805 tsec = current->security;
1806 bsec = bprm->security;
1807
1808 if (bsec->unsafe) {
1809 force_sig_specific(SIGKILL, current);
1810 return;
1811 }
1812 if (tsec->osid == tsec->sid)
1813 return;
1814
1815 /* Close files for which the new task SID is not authorized. */
1816 flush_unauthorized_files(current->files);
1817
1818 /* Check whether the new SID can inherit signal state
1819 from the old SID. If not, clear itimers to avoid
1820 subsequent signal generation and flush and unblock
1821 signals. This must occur _after_ the task SID has
1822 been updated so that any kill done after the flush
1823 will be checked against the new SID. */
1824 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1825 PROCESS__SIGINH, NULL);
1826 if (rc) {
1827 memset(&itimer, 0, sizeof itimer);
1828 for (i = 0; i < 3; i++)
1829 do_setitimer(i, &itimer, NULL);
1830 flush_signals(current);
1831 spin_lock_irq(&current->sighand->siglock);
1832 flush_signal_handlers(current, 1);
1833 sigemptyset(&current->blocked);
1834 recalc_sigpending();
1835 spin_unlock_irq(&current->sighand->siglock);
1836 }
1837
1838 /* Check whether the new SID can inherit resource limits
1839 from the old SID. If not, reset all soft limits to
1840 the lower of the current task's hard limit and the init
1841 task's soft limit. Note that the setting of hard limits
1842 (even to lower them) can be controlled by the setrlimit
1843 check. The inclusion of the init task's soft limit into
1844 the computation is to avoid resetting soft limits higher
1845 than the default soft limit for cases where the default
1846 is lower than the hard limit, e.g. RLIMIT_CORE or
1847 RLIMIT_STACK.*/
1848 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1849 PROCESS__RLIMITINH, NULL);
1850 if (rc) {
1851 for (i = 0; i < RLIM_NLIMITS; i++) {
1852 rlim = current->signal->rlim + i;
1853 initrlim = init_task.signal->rlim+i;
1854 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1855 }
1856 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1857 /*
1858 * This will cause RLIMIT_CPU calculations
1859 * to be refigured.
1860 */
1861 current->it_prof_expires = jiffies_to_cputime(1);
1862 }
1863 }
1864
1865 /* Wake up the parent if it is waiting so that it can
1866 recheck wait permission to the new task SID. */
1867 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1868 }
1869
1870 /* superblock security operations */
1871
1872 static int selinux_sb_alloc_security(struct super_block *sb)
1873 {
1874 return superblock_alloc_security(sb);
1875 }
1876
1877 static void selinux_sb_free_security(struct super_block *sb)
1878 {
1879 superblock_free_security(sb);
1880 }
1881
1882 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1883 {
1884 if (plen > olen)
1885 return 0;
1886
1887 return !memcmp(prefix, option, plen);
1888 }
1889
1890 static inline int selinux_option(char *option, int len)
1891 {
1892 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1893 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1894 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1895 }
1896
1897 static inline void take_option(char **to, char *from, int *first, int len)
1898 {
1899 if (!*first) {
1900 **to = ',';
1901 *to += 1;
1902 }
1903 else
1904 *first = 0;
1905 memcpy(*to, from, len);
1906 *to += len;
1907 }
1908
1909 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1910 {
1911 int fnosec, fsec, rc = 0;
1912 char *in_save, *in_curr, *in_end;
1913 char *sec_curr, *nosec_save, *nosec;
1914
1915 in_curr = orig;
1916 sec_curr = copy;
1917
1918 /* Binary mount data: just copy */
1919 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1920 copy_page(sec_curr, in_curr);
1921 goto out;
1922 }
1923
1924 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1925 if (!nosec) {
1926 rc = -ENOMEM;
1927 goto out;
1928 }
1929
1930 nosec_save = nosec;
1931 fnosec = fsec = 1;
1932 in_save = in_end = orig;
1933
1934 do {
1935 if (*in_end == ',' || *in_end == '\0') {
1936 int len = in_end - in_curr;
1937
1938 if (selinux_option(in_curr, len))
1939 take_option(&sec_curr, in_curr, &fsec, len);
1940 else
1941 take_option(&nosec, in_curr, &fnosec, len);
1942
1943 in_curr = in_end + 1;
1944 }
1945 } while (*in_end++);
1946
1947 copy_page(in_save, nosec_save);
1948 out:
1949 return rc;
1950 }
1951
1952 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1953 {
1954 struct avc_audit_data ad;
1955 int rc;
1956
1957 rc = superblock_doinit(sb, data);
1958 if (rc)
1959 return rc;
1960
1961 AVC_AUDIT_DATA_INIT(&ad,FS);
1962 ad.u.fs.dentry = sb->s_root;
1963 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1964 }
1965
1966 static int selinux_sb_statfs(struct super_block *sb)
1967 {
1968 struct avc_audit_data ad;
1969
1970 AVC_AUDIT_DATA_INIT(&ad,FS);
1971 ad.u.fs.dentry = sb->s_root;
1972 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1973 }
1974
1975 static int selinux_mount(char * dev_name,
1976 struct nameidata *nd,
1977 char * type,
1978 unsigned long flags,
1979 void * data)
1980 {
1981 int rc;
1982
1983 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1984 if (rc)
1985 return rc;
1986
1987 if (flags & MS_REMOUNT)
1988 return superblock_has_perm(current, nd->mnt->mnt_sb,
1989 FILESYSTEM__REMOUNT, NULL);
1990 else
1991 return dentry_has_perm(current, nd->mnt, nd->dentry,
1992 FILE__MOUNTON);
1993 }
1994
1995 static int selinux_umount(struct vfsmount *mnt, int flags)
1996 {
1997 int rc;
1998
1999 rc = secondary_ops->sb_umount(mnt, flags);
2000 if (rc)
2001 return rc;
2002
2003 return superblock_has_perm(current,mnt->mnt_sb,
2004 FILESYSTEM__UNMOUNT,NULL);
2005 }
2006
2007 /* inode security operations */
2008
2009 static int selinux_inode_alloc_security(struct inode *inode)
2010 {
2011 return inode_alloc_security(inode);
2012 }
2013
2014 static void selinux_inode_free_security(struct inode *inode)
2015 {
2016 inode_free_security(inode);
2017 }
2018
2019 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2020 {
2021 return may_create(dir, dentry, SECCLASS_FILE);
2022 }
2023
2024 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2025 {
2026 post_create(dir, dentry);
2027 }
2028
2029 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2030 {
2031 int rc;
2032
2033 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2034 if (rc)
2035 return rc;
2036 return may_link(dir, old_dentry, MAY_LINK);
2037 }
2038
2039 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2040 {
2041 return;
2042 }
2043
2044 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2045 {
2046 int rc;
2047
2048 rc = secondary_ops->inode_unlink(dir, dentry);
2049 if (rc)
2050 return rc;
2051 return may_link(dir, dentry, MAY_UNLINK);
2052 }
2053
2054 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2055 {
2056 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2057 }
2058
2059 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2060 {
2061 post_create(dir, dentry);
2062 }
2063
2064 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2065 {
2066 return may_create(dir, dentry, SECCLASS_DIR);
2067 }
2068
2069 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2070 {
2071 post_create(dir, dentry);
2072 }
2073
2074 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2075 {
2076 return may_link(dir, dentry, MAY_RMDIR);
2077 }
2078
2079 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2080 {
2081 int rc;
2082
2083 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2084 if (rc)
2085 return rc;
2086
2087 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2088 }
2089
2090 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2091 {
2092 post_create(dir, dentry);
2093 }
2094
2095 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2096 struct inode *new_inode, struct dentry *new_dentry)
2097 {
2098 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2099 }
2100
2101 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2102 struct inode *new_inode, struct dentry *new_dentry)
2103 {
2104 return;
2105 }
2106
2107 static int selinux_inode_readlink(struct dentry *dentry)
2108 {
2109 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2110 }
2111
2112 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2113 {
2114 int rc;
2115
2116 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2117 if (rc)
2118 return rc;
2119 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2120 }
2121
2122 static int selinux_inode_permission(struct inode *inode, int mask,
2123 struct nameidata *nd)
2124 {
2125 int rc;
2126
2127 rc = secondary_ops->inode_permission(inode, mask, nd);
2128 if (rc)
2129 return rc;
2130
2131 if (!mask) {
2132 /* No permission to check. Existence test. */
2133 return 0;
2134 }
2135
2136 return inode_has_perm(current, inode,
2137 file_mask_to_av(inode->i_mode, mask), NULL);
2138 }
2139
2140 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2141 {
2142 int rc;
2143
2144 rc = secondary_ops->inode_setattr(dentry, iattr);
2145 if (rc)
2146 return rc;
2147
2148 if (iattr->ia_valid & ATTR_FORCE)
2149 return 0;
2150
2151 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2152 ATTR_ATIME_SET | ATTR_MTIME_SET))
2153 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2154
2155 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2156 }
2157
2158 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2159 {
2160 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2161 }
2162
2163 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2164 {
2165 struct task_security_struct *tsec = current->security;
2166 struct inode *inode = dentry->d_inode;
2167 struct inode_security_struct *isec = inode->i_security;
2168 struct superblock_security_struct *sbsec;
2169 struct avc_audit_data ad;
2170 u32 newsid;
2171 int rc = 0;
2172
2173 if (strcmp(name, XATTR_NAME_SELINUX)) {
2174 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2175 sizeof XATTR_SECURITY_PREFIX - 1) &&
2176 !capable(CAP_SYS_ADMIN)) {
2177 /* A different attribute in the security namespace.
2178 Restrict to administrator. */
2179 return -EPERM;
2180 }
2181
2182 /* Not an attribute we recognize, so just check the
2183 ordinary setattr permission. */
2184 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2185 }
2186
2187 sbsec = inode->i_sb->s_security;
2188 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2189 return -EOPNOTSUPP;
2190
2191 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2192 return -EPERM;
2193
2194 AVC_AUDIT_DATA_INIT(&ad,FS);
2195 ad.u.fs.dentry = dentry;
2196
2197 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2198 FILE__RELABELFROM, &ad);
2199 if (rc)
2200 return rc;
2201
2202 rc = security_context_to_sid(value, size, &newsid);
2203 if (rc)
2204 return rc;
2205
2206 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2207 FILE__RELABELTO, &ad);
2208 if (rc)
2209 return rc;
2210
2211 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2212 isec->sclass);
2213 if (rc)
2214 return rc;
2215
2216 return avc_has_perm(newsid,
2217 sbsec->sid,
2218 SECCLASS_FILESYSTEM,
2219 FILESYSTEM__ASSOCIATE,
2220 &ad);
2221 }
2222
2223 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2224 void *value, size_t size, int flags)
2225 {
2226 struct inode *inode = dentry->d_inode;
2227 struct inode_security_struct *isec = inode->i_security;
2228 u32 newsid;
2229 int rc;
2230
2231 if (strcmp(name, XATTR_NAME_SELINUX)) {
2232 /* Not an attribute we recognize, so nothing to do. */
2233 return;
2234 }
2235
2236 rc = security_context_to_sid(value, size, &newsid);
2237 if (rc) {
2238 printk(KERN_WARNING "%s: unable to obtain SID for context "
2239 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2240 return;
2241 }
2242
2243 isec->sid = newsid;
2244 return;
2245 }
2246
2247 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2248 {
2249 struct inode *inode = dentry->d_inode;
2250 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2251
2252 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2253 return -EOPNOTSUPP;
2254
2255 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2256 }
2257
2258 static int selinux_inode_listxattr (struct dentry *dentry)
2259 {
2260 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2261 }
2262
2263 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2264 {
2265 if (strcmp(name, XATTR_NAME_SELINUX)) {
2266 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2267 sizeof XATTR_SECURITY_PREFIX - 1) &&
2268 !capable(CAP_SYS_ADMIN)) {
2269 /* A different attribute in the security namespace.
2270 Restrict to administrator. */
2271 return -EPERM;
2272 }
2273
2274 /* Not an attribute we recognize, so just check the
2275 ordinary setattr permission. Might want a separate
2276 permission for removexattr. */
2277 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2278 }
2279
2280 /* No one is allowed to remove a SELinux security label.
2281 You can change the label, but all data must be labeled. */
2282 return -EACCES;
2283 }
2284
2285 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2286 {
2287 struct inode_security_struct *isec = inode->i_security;
2288 char *context;
2289 unsigned len;
2290 int rc;
2291
2292 /* Permission check handled by selinux_inode_getxattr hook.*/
2293
2294 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2295 return -EOPNOTSUPP;
2296
2297 rc = security_sid_to_context(isec->sid, &context, &len);
2298 if (rc)
2299 return rc;
2300
2301 if (!buffer || !size) {
2302 kfree(context);
2303 return len;
2304 }
2305 if (size < len) {
2306 kfree(context);
2307 return -ERANGE;
2308 }
2309 memcpy(buffer, context, len);
2310 kfree(context);
2311 return len;
2312 }
2313
2314 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2315 const void *value, size_t size, int flags)
2316 {
2317 struct inode_security_struct *isec = inode->i_security;
2318 u32 newsid;
2319 int rc;
2320
2321 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2322 return -EOPNOTSUPP;
2323
2324 if (!value || !size)
2325 return -EACCES;
2326
2327 rc = security_context_to_sid((void*)value, size, &newsid);
2328 if (rc)
2329 return rc;
2330
2331 isec->sid = newsid;
2332 return 0;
2333 }
2334
2335 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2336 {
2337 const int len = sizeof(XATTR_NAME_SELINUX);
2338 if (buffer && len <= buffer_size)
2339 memcpy(buffer, XATTR_NAME_SELINUX, len);
2340 return len;
2341 }
2342
2343 /* file security operations */
2344
2345 static int selinux_file_permission(struct file *file, int mask)
2346 {
2347 struct inode *inode = file->f_dentry->d_inode;
2348
2349 if (!mask) {
2350 /* No permission to check. Existence test. */
2351 return 0;
2352 }
2353
2354 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2355 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2356 mask |= MAY_APPEND;
2357
2358 return file_has_perm(current, file,
2359 file_mask_to_av(inode->i_mode, mask));
2360 }
2361
2362 static int selinux_file_alloc_security(struct file *file)
2363 {
2364 return file_alloc_security(file);
2365 }
2366
2367 static void selinux_file_free_security(struct file *file)
2368 {
2369 file_free_security(file);
2370 }
2371
2372 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2373 unsigned long arg)
2374 {
2375 int error = 0;
2376
2377 switch (cmd) {
2378 case FIONREAD:
2379 /* fall through */
2380 case FIBMAP:
2381 /* fall through */
2382 case FIGETBSZ:
2383 /* fall through */
2384 case EXT2_IOC_GETFLAGS:
2385 /* fall through */
2386 case EXT2_IOC_GETVERSION:
2387 error = file_has_perm(current, file, FILE__GETATTR);
2388 break;
2389
2390 case EXT2_IOC_SETFLAGS:
2391 /* fall through */
2392 case EXT2_IOC_SETVERSION:
2393 error = file_has_perm(current, file, FILE__SETATTR);
2394 break;
2395
2396 /* sys_ioctl() checks */
2397 case FIONBIO:
2398 /* fall through */
2399 case FIOASYNC:
2400 error = file_has_perm(current, file, 0);
2401 break;
2402
2403 case KDSKBENT:
2404 case KDSKBSENT:
2405 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2406 break;
2407
2408 /* default case assumes that the command will go
2409 * to the file's ioctl() function.
2410 */
2411 default:
2412 error = file_has_perm(current, file, FILE__IOCTL);
2413
2414 }
2415 return error;
2416 }
2417
2418 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2419 {
2420 #ifndef CONFIG_PPC32
2421 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2422 /*
2423 * We are making executable an anonymous mapping or a
2424 * private file mapping that will also be writable.
2425 * This has an additional check.
2426 */
2427 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2428 if (rc)
2429 return rc;
2430 }
2431 #endif
2432
2433 if (file) {
2434 /* read access is always possible with a mapping */
2435 u32 av = FILE__READ;
2436
2437 /* write access only matters if the mapping is shared */
2438 if (shared && (prot & PROT_WRITE))
2439 av |= FILE__WRITE;
2440
2441 if (prot & PROT_EXEC)
2442 av |= FILE__EXECUTE;
2443
2444 return file_has_perm(current, file, av);
2445 }
2446 return 0;
2447 }
2448
2449 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2450 unsigned long prot, unsigned long flags)
2451 {
2452 int rc;
2453
2454 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2455 if (rc)
2456 return rc;
2457
2458 if (selinux_checkreqprot)
2459 prot = reqprot;
2460
2461 return file_map_prot_check(file, prot,
2462 (flags & MAP_TYPE) == MAP_SHARED);
2463 }
2464
2465 static int selinux_file_mprotect(struct vm_area_struct *vma,
2466 unsigned long reqprot,
2467 unsigned long prot)
2468 {
2469 int rc;
2470
2471 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2472 if (rc)
2473 return rc;
2474
2475 if (selinux_checkreqprot)
2476 prot = reqprot;
2477
2478 #ifndef CONFIG_PPC32
2479 if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2480 /*
2481 * We are making executable a file mapping that has
2482 * had some COW done. Since pages might have been written,
2483 * check ability to execute the possibly modified content.
2484 * This typically should only occur for text relocations.
2485 */
2486 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2487 if (rc)
2488 return rc;
2489 }
2490 #endif
2491
2492 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2493 }
2494
2495 static int selinux_file_lock(struct file *file, unsigned int cmd)
2496 {
2497 return file_has_perm(current, file, FILE__LOCK);
2498 }
2499
2500 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2501 unsigned long arg)
2502 {
2503 int err = 0;
2504
2505 switch (cmd) {
2506 case F_SETFL:
2507 if (!file->f_dentry || !file->f_dentry->d_inode) {
2508 err = -EINVAL;
2509 break;
2510 }
2511
2512 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2513 err = file_has_perm(current, file,FILE__WRITE);
2514 break;
2515 }
2516 /* fall through */
2517 case F_SETOWN:
2518 case F_SETSIG:
2519 case F_GETFL:
2520 case F_GETOWN:
2521 case F_GETSIG:
2522 /* Just check FD__USE permission */
2523 err = file_has_perm(current, file, 0);
2524 break;
2525 case F_GETLK:
2526 case F_SETLK:
2527 case F_SETLKW:
2528 #if BITS_PER_LONG == 32
2529 case F_GETLK64:
2530 case F_SETLK64:
2531 case F_SETLKW64:
2532 #endif
2533 if (!file->f_dentry || !file->f_dentry->d_inode) {
2534 err = -EINVAL;
2535 break;
2536 }
2537 err = file_has_perm(current, file, FILE__LOCK);
2538 break;
2539 }
2540
2541 return err;
2542 }
2543
2544 static int selinux_file_set_fowner(struct file *file)
2545 {
2546 struct task_security_struct *tsec;
2547 struct file_security_struct *fsec;
2548
2549 tsec = current->security;
2550 fsec = file->f_security;
2551 fsec->fown_sid = tsec->sid;
2552
2553 return 0;
2554 }
2555
2556 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2557 struct fown_struct *fown, int signum)
2558 {
2559 struct file *file;
2560 u32 perm;
2561 struct task_security_struct *tsec;
2562 struct file_security_struct *fsec;
2563
2564 /* struct fown_struct is never outside the context of a struct file */
2565 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2566
2567 tsec = tsk->security;
2568 fsec = file->f_security;
2569
2570 if (!signum)
2571 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2572 else
2573 perm = signal_to_av(signum);
2574
2575 return avc_has_perm(fsec->fown_sid, tsec->sid,
2576 SECCLASS_PROCESS, perm, NULL);
2577 }
2578
2579 static int selinux_file_receive(struct file *file)
2580 {
2581 return file_has_perm(current, file, file_to_av(file));
2582 }
2583
2584 /* task security operations */
2585
2586 static int selinux_task_create(unsigned long clone_flags)
2587 {
2588 int rc;
2589
2590 rc = secondary_ops->task_create(clone_flags);
2591 if (rc)
2592 return rc;
2593
2594 return task_has_perm(current, current, PROCESS__FORK);
2595 }
2596
2597 static int selinux_task_alloc_security(struct task_struct *tsk)
2598 {
2599 struct task_security_struct *tsec1, *tsec2;
2600 int rc;
2601
2602 tsec1 = current->security;
2603
2604 rc = task_alloc_security(tsk);
2605 if (rc)
2606 return rc;
2607 tsec2 = tsk->security;
2608
2609 tsec2->osid = tsec1->osid;
2610 tsec2->sid = tsec1->sid;
2611
2612 /* Retain the exec and create SIDs across fork */
2613 tsec2->exec_sid = tsec1->exec_sid;
2614 tsec2->create_sid = tsec1->create_sid;
2615
2616 /* Retain ptracer SID across fork, if any.
2617 This will be reset by the ptrace hook upon any
2618 subsequent ptrace_attach operations. */
2619 tsec2->ptrace_sid = tsec1->ptrace_sid;
2620
2621 return 0;
2622 }
2623
2624 static void selinux_task_free_security(struct task_struct *tsk)
2625 {
2626 task_free_security(tsk);
2627 }
2628
2629 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2630 {
2631 /* Since setuid only affects the current process, and
2632 since the SELinux controls are not based on the Linux
2633 identity attributes, SELinux does not need to control
2634 this operation. However, SELinux does control the use
2635 of the CAP_SETUID and CAP_SETGID capabilities using the
2636 capable hook. */
2637 return 0;
2638 }
2639
2640 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2641 {
2642 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2643 }
2644
2645 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2646 {
2647 /* See the comment for setuid above. */
2648 return 0;
2649 }
2650
2651 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2652 {
2653 return task_has_perm(current, p, PROCESS__SETPGID);
2654 }
2655
2656 static int selinux_task_getpgid(struct task_struct *p)
2657 {
2658 return task_has_perm(current, p, PROCESS__GETPGID);
2659 }
2660
2661 static int selinux_task_getsid(struct task_struct *p)
2662 {
2663 return task_has_perm(current, p, PROCESS__GETSESSION);
2664 }
2665
2666 static int selinux_task_setgroups(struct group_info *group_info)
2667 {
2668 /* See the comment for setuid above. */
2669 return 0;
2670 }
2671
2672 static int selinux_task_setnice(struct task_struct *p, int nice)
2673 {
2674 int rc;
2675
2676 rc = secondary_ops->task_setnice(p, nice);
2677 if (rc)
2678 return rc;
2679
2680 return task_has_perm(current,p, PROCESS__SETSCHED);
2681 }
2682
2683 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2684 {
2685 struct rlimit *old_rlim = current->signal->rlim + resource;
2686 int rc;
2687
2688 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2689 if (rc)
2690 return rc;
2691
2692 /* Control the ability to change the hard limit (whether
2693 lowering or raising it), so that the hard limit can
2694 later be used as a safe reset point for the soft limit
2695 upon context transitions. See selinux_bprm_apply_creds. */
2696 if (old_rlim->rlim_max != new_rlim->rlim_max)
2697 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2698
2699 return 0;
2700 }
2701
2702 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2703 {
2704 return task_has_perm(current, p, PROCESS__SETSCHED);
2705 }
2706
2707 static int selinux_task_getscheduler(struct task_struct *p)
2708 {
2709 return task_has_perm(current, p, PROCESS__GETSCHED);
2710 }
2711
2712 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2713 {
2714 u32 perm;
2715 int rc;
2716
2717 rc = secondary_ops->task_kill(p, info, sig);
2718 if (rc)
2719 return rc;
2720
2721 if (info && ((unsigned long)info == 1 ||
2722 (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2723 return 0;
2724
2725 if (!sig)
2726 perm = PROCESS__SIGNULL; /* null signal; existence test */
2727 else
2728 perm = signal_to_av(sig);
2729
2730 return task_has_perm(current, p, perm);
2731 }
2732
2733 static int selinux_task_prctl(int option,
2734 unsigned long arg2,
2735 unsigned long arg3,
2736 unsigned long arg4,
2737 unsigned long arg5)
2738 {
2739 /* The current prctl operations do not appear to require
2740 any SELinux controls since they merely observe or modify
2741 the state of the current process. */
2742 return 0;
2743 }
2744
2745 static int selinux_task_wait(struct task_struct *p)
2746 {
2747 u32 perm;
2748
2749 perm = signal_to_av(p->exit_signal);
2750
2751 return task_has_perm(p, current, perm);
2752 }
2753
2754 static void selinux_task_reparent_to_init(struct task_struct *p)
2755 {
2756 struct task_security_struct *tsec;
2757
2758 secondary_ops->task_reparent_to_init(p);
2759
2760 tsec = p->security;
2761 tsec->osid = tsec->sid;
2762 tsec->sid = SECINITSID_KERNEL;
2763 return;
2764 }
2765
2766 static void selinux_task_to_inode(struct task_struct *p,
2767 struct inode *inode)
2768 {
2769 struct task_security_struct *tsec = p->security;
2770 struct inode_security_struct *isec = inode->i_security;
2771
2772 isec->sid = tsec->sid;
2773 isec->initialized = 1;
2774 return;
2775 }
2776
2777 #ifdef CONFIG_SECURITY_NETWORK
2778
2779 /* Returns error only if unable to parse addresses */
2780 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2781 {
2782 int offset, ihlen, ret = -EINVAL;
2783 struct iphdr _iph, *ih;
2784
2785 offset = skb->nh.raw - skb->data;
2786 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2787 if (ih == NULL)
2788 goto out;
2789
2790 ihlen = ih->ihl * 4;
2791 if (ihlen < sizeof(_iph))
2792 goto out;
2793
2794 ad->u.net.v4info.saddr = ih->saddr;
2795 ad->u.net.v4info.daddr = ih->daddr;
2796 ret = 0;
2797
2798 switch (ih->protocol) {
2799 case IPPROTO_TCP: {
2800 struct tcphdr _tcph, *th;
2801
2802 if (ntohs(ih->frag_off) & IP_OFFSET)
2803 break;
2804
2805 offset += ihlen;
2806 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2807 if (th == NULL)
2808 break;
2809
2810 ad->u.net.sport = th->source;
2811 ad->u.net.dport = th->dest;
2812 break;
2813 }
2814
2815 case IPPROTO_UDP: {
2816 struct udphdr _udph, *uh;
2817
2818 if (ntohs(ih->frag_off) & IP_OFFSET)
2819 break;
2820
2821 offset += ihlen;
2822 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2823 if (uh == NULL)
2824 break;
2825
2826 ad->u.net.sport = uh->source;
2827 ad->u.net.dport = uh->dest;
2828 break;
2829 }
2830
2831 default:
2832 break;
2833 }
2834 out:
2835 return ret;
2836 }
2837
2838 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2839
2840 /* Returns error only if unable to parse addresses */
2841 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2842 {
2843 u8 nexthdr;
2844 int ret = -EINVAL, offset;
2845 struct ipv6hdr _ipv6h, *ip6;
2846
2847 offset = skb->nh.raw - skb->data;
2848 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2849 if (ip6 == NULL)
2850 goto out;
2851
2852 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2853 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2854 ret = 0;
2855
2856 nexthdr = ip6->nexthdr;
2857 offset += sizeof(_ipv6h);
2858 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2859 if (offset < 0)
2860 goto out;
2861
2862 switch (nexthdr) {
2863 case IPPROTO_TCP: {
2864 struct tcphdr _tcph, *th;
2865
2866 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2867 if (th == NULL)
2868 break;
2869
2870 ad->u.net.sport = th->source;
2871 ad->u.net.dport = th->dest;
2872 break;
2873 }
2874
2875 case IPPROTO_UDP: {
2876 struct udphdr _udph, *uh;
2877
2878 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2879 if (uh == NULL)
2880 break;
2881
2882 ad->u.net.sport = uh->source;
2883 ad->u.net.dport = uh->dest;
2884 break;
2885 }
2886
2887 /* includes fragments */
2888 default:
2889 break;
2890 }
2891 out:
2892 return ret;
2893 }
2894
2895 #endif /* IPV6 */
2896
2897 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2898 char **addrp, int *len, int src)
2899 {
2900 int ret = 0;
2901
2902 switch (ad->u.net.family) {
2903 case PF_INET:
2904 ret = selinux_parse_skb_ipv4(skb, ad);
2905 if (ret || !addrp)
2906 break;
2907 *len = 4;
2908 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2909 &ad->u.net.v4info.daddr);
2910 break;
2911
2912 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2913 case PF_INET6:
2914 ret = selinux_parse_skb_ipv6(skb, ad);
2915 if (ret || !addrp)
2916 break;
2917 *len = 16;
2918 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2919 &ad->u.net.v6info.daddr);
2920 break;
2921 #endif /* IPV6 */
2922 default:
2923 break;
2924 }
2925
2926 return ret;
2927 }
2928
2929 /* socket security operations */
2930 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2931 u32 perms)
2932 {
2933 struct inode_security_struct *isec;
2934 struct task_security_struct *tsec;
2935 struct avc_audit_data ad;
2936 int err = 0;
2937
2938 tsec = task->security;
2939 isec = SOCK_INODE(sock)->i_security;
2940
2941 if (isec->sid == SECINITSID_KERNEL)
2942 goto out;
2943
2944 AVC_AUDIT_DATA_INIT(&ad,NET);
2945 ad.u.net.sk = sock->sk;
2946 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2947
2948 out:
2949 return err;
2950 }
2951
2952 static int selinux_socket_create(int family, int type,
2953 int protocol, int kern)
2954 {
2955 int err = 0;
2956 struct task_security_struct *tsec;
2957
2958 if (kern)
2959 goto out;
2960
2961 tsec = current->security;
2962 err = avc_has_perm(tsec->sid, tsec->sid,
2963 socket_type_to_security_class(family, type,
2964 protocol), SOCKET__CREATE, NULL);
2965
2966 out:
2967 return err;
2968 }
2969
2970 static void selinux_socket_post_create(struct socket *sock, int family,
2971 int type, int protocol, int kern)
2972 {
2973 struct inode_security_struct *isec;
2974 struct task_security_struct *tsec;
2975
2976 isec = SOCK_INODE(sock)->i_security;
2977
2978 tsec = current->security;
2979 isec->sclass = socket_type_to_security_class(family, type, protocol);
2980 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2981 isec->initialized = 1;
2982
2983 return;
2984 }
2985
2986 /* Range of port numbers used to automatically bind.
2987 Need to determine whether we should perform a name_bind
2988 permission check between the socket and the port number. */
2989 #define ip_local_port_range_0 sysctl_local_port_range[0]
2990 #define ip_local_port_range_1 sysctl_local_port_range[1]
2991
2992 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2993 {
2994 u16 family;
2995 int err;
2996
2997 err = socket_has_perm(current, sock, SOCKET__BIND);
2998 if (err)
2999 goto out;
3000
3001 /*
3002 * If PF_INET or PF_INET6, check name_bind permission for the port.
3003 */
3004 family = sock->sk->sk_family;
3005 if (family == PF_INET || family == PF_INET6) {
3006 char *addrp;
3007 struct inode_security_struct *isec;
3008 struct task_security_struct *tsec;
3009 struct avc_audit_data ad;
3010 struct sockaddr_in *addr4 = NULL;
3011 struct sockaddr_in6 *addr6 = NULL;
3012 unsigned short snum;
3013 struct sock *sk = sock->sk;
3014 u32 sid, node_perm, addrlen;
3015
3016 tsec = current->security;
3017 isec = SOCK_INODE(sock)->i_security;
3018
3019 if (family == PF_INET) {
3020 addr4 = (struct sockaddr_in *)address;
3021 snum = ntohs(addr4->sin_port);
3022 addrlen = sizeof(addr4->sin_addr.s_addr);
3023 addrp = (char *)&addr4->sin_addr.s_addr;
3024 } else {
3025 addr6 = (struct sockaddr_in6 *)address;
3026 snum = ntohs(addr6->sin6_port);
3027 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3028 addrp = (char *)&addr6->sin6_addr.s6_addr;
3029 }
3030
3031 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3032 snum > ip_local_port_range_1)) {
3033 err = security_port_sid(sk->sk_family, sk->sk_type,
3034 sk->sk_protocol, snum, &sid);
3035 if (err)
3036 goto out;
3037 AVC_AUDIT_DATA_INIT(&ad,NET);
3038 ad.u.net.sport = htons(snum);
3039 ad.u.net.family = family;
3040 err = avc_has_perm(isec->sid, sid,
3041 isec->sclass,
3042 SOCKET__NAME_BIND, &ad);
3043 if (err)
3044 goto out;
3045 }
3046
3047 switch(sk->sk_protocol) {
3048 case IPPROTO_TCP:
3049 node_perm = TCP_SOCKET__NODE_BIND;
3050 break;
3051
3052 case IPPROTO_UDP:
3053 node_perm = UDP_SOCKET__NODE_BIND;
3054 break;
3055
3056 default:
3057 node_perm = RAWIP_SOCKET__NODE_BIND;
3058 break;
3059 }
3060
3061 err = security_node_sid(family, addrp, addrlen, &sid);
3062 if (err)
3063 goto out;
3064
3065 AVC_AUDIT_DATA_INIT(&ad,NET);
3066 ad.u.net.sport = htons(snum);
3067 ad.u.net.family = family;
3068
3069 if (family == PF_INET)
3070 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3071 else
3072 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3073
3074 err = avc_has_perm(isec->sid, sid,
3075 isec->sclass, node_perm, &ad);
3076 if (err)
3077 goto out;
3078 }
3079 out:
3080 return err;
3081 }
3082
3083 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3084 {
3085 struct inode_security_struct *isec;
3086 int err;
3087
3088 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3089 if (err)
3090 return err;
3091
3092 /*
3093 * If a TCP socket, check name_connect permission for the port.
3094 */
3095 isec = SOCK_INODE(sock)->i_security;
3096 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3097 struct sock *sk = sock->sk;
3098 struct avc_audit_data ad;
3099 struct sockaddr_in *addr4 = NULL;
3100 struct sockaddr_in6 *addr6 = NULL;
3101 unsigned short snum;
3102 u32 sid;
3103
3104 if (sk->sk_family == PF_INET) {
3105 addr4 = (struct sockaddr_in *)address;
3106 if (addrlen != sizeof(struct sockaddr_in))
3107 return -EINVAL;
3108 snum = ntohs(addr4->sin_port);
3109 } else {
3110 addr6 = (struct sockaddr_in6 *)address;
3111 if (addrlen != sizeof(struct sockaddr_in6))
3112 return -EINVAL;
3113 snum = ntohs(addr6->sin6_port);
3114 }
3115
3116 err = security_port_sid(sk->sk_family, sk->sk_type,
3117 sk->sk_protocol, snum, &sid);
3118 if (err)
3119 goto out;
3120
3121 AVC_AUDIT_DATA_INIT(&ad,NET);
3122 ad.u.net.dport = htons(snum);
3123 ad.u.net.family = sk->sk_family;
3124 err = avc_has_perm(isec->sid, sid, isec->sclass,
3125 TCP_SOCKET__NAME_CONNECT, &ad);
3126 if (err)
3127 goto out;
3128 }
3129
3130 out:
3131 return err;
3132 }
3133
3134 static int selinux_socket_listen(struct socket *sock, int backlog)
3135 {
3136 return socket_has_perm(current, sock, SOCKET__LISTEN);
3137 }
3138
3139 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3140 {
3141 int err;
3142 struct inode_security_struct *isec;
3143 struct inode_security_struct *newisec;
3144
3145 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3146 if (err)
3147 return err;
3148
3149 newisec = SOCK_INODE(newsock)->i_security;
3150
3151 isec = SOCK_INODE(sock)->i_security;
3152 newisec->sclass = isec->sclass;
3153 newisec->sid = isec->sid;
3154 newisec->initialized = 1;
3155
3156 return 0;
3157 }
3158
3159 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3160 int size)
3161 {
3162 return socket_has_perm(current, sock, SOCKET__WRITE);
3163 }
3164
3165 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3166 int size, int flags)
3167 {
3168 return socket_has_perm(current, sock, SOCKET__READ);
3169 }
3170
3171 static int selinux_socket_getsockname(struct socket *sock)
3172 {
3173 return socket_has_perm(current, sock, SOCKET__GETATTR);
3174 }
3175
3176 static int selinux_socket_getpeername(struct socket *sock)
3177 {
3178 return socket_has_perm(current, sock, SOCKET__GETATTR);
3179 }
3180
3181 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3182 {
3183 return socket_has_perm(current, sock, SOCKET__SETOPT);
3184 }
3185
3186 static int selinux_socket_getsockopt(struct socket *sock, int level,
3187 int optname)
3188 {
3189 return socket_has_perm(current, sock, SOCKET__GETOPT);
3190 }
3191
3192 static int selinux_socket_shutdown(struct socket *sock, int how)
3193 {
3194 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3195 }
3196
3197 static int selinux_socket_unix_stream_connect(struct socket *sock,
3198 struct socket *other,
3199 struct sock *newsk)
3200 {
3201 struct sk_security_struct *ssec;
3202 struct inode_security_struct *isec;
3203 struct inode_security_struct *other_isec;
3204 struct avc_audit_data ad;
3205 int err;
3206
3207 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3208 if (err)
3209 return err;
3210
3211 isec = SOCK_INODE(sock)->i_security;
3212 other_isec = SOCK_INODE(other)->i_security;
3213
3214 AVC_AUDIT_DATA_INIT(&ad,NET);
3215 ad.u.net.sk = other->sk;
3216
3217 err = avc_has_perm(isec->sid, other_isec->sid,
3218 isec->sclass,
3219 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3220 if (err)
3221 return err;
3222
3223 /* connecting socket */
3224 ssec = sock->sk->sk_security;
3225 ssec->peer_sid = other_isec->sid;
3226
3227 /* server child socket */
3228 ssec = newsk->sk_security;
3229 ssec->peer_sid = isec->sid;
3230
3231 return 0;
3232 }
3233
3234 static int selinux_socket_unix_may_send(struct socket *sock,
3235 struct socket *other)
3236 {
3237 struct inode_security_struct *isec;
3238 struct inode_security_struct *other_isec;
3239 struct avc_audit_data ad;
3240 int err;
3241
3242 isec = SOCK_INODE(sock)->i_security;
3243 other_isec = SOCK_INODE(other)->i_security;
3244
3245 AVC_AUDIT_DATA_INIT(&ad,NET);
3246 ad.u.net.sk = other->sk;
3247
3248 err = avc_has_perm(isec->sid, other_isec->sid,
3249 isec->sclass, SOCKET__SENDTO, &ad);
3250 if (err)
3251 return err;
3252
3253 return 0;
3254 }
3255
3256 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3257 {
3258 u16 family;
3259 char *addrp;
3260 int len, err = 0;
3261 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3262 u32 sock_sid = 0;
3263 u16 sock_class = 0;
3264 struct socket *sock;
3265 struct net_device *dev;
3266 struct avc_audit_data ad;
3267
3268 family = sk->sk_family;
3269 if (family != PF_INET && family != PF_INET6)
3270 goto out;
3271
3272 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3273 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3274 family = PF_INET;
3275
3276 read_lock_bh(&sk->sk_callback_lock);
3277 sock = sk->sk_socket;
3278 if (sock) {
3279 struct inode *inode;
3280 inode = SOCK_INODE(sock);
3281 if (inode) {
3282 struct inode_security_struct *isec;
3283 isec = inode->i_security;
3284 sock_sid = isec->sid;
3285 sock_class = isec->sclass;
3286 }
3287 }
3288 read_unlock_bh(&sk->sk_callback_lock);
3289 if (!sock_sid)
3290 goto out;
3291
3292 dev = skb->dev;
3293 if (!dev)
3294 goto out;
3295
3296 err = sel_netif_sids(dev, &if_sid, NULL);
3297 if (err)
3298 goto out;
3299
3300 switch (sock_class) {
3301 case SECCLASS_UDP_SOCKET:
3302 netif_perm = NETIF__UDP_RECV;
3303 node_perm = NODE__UDP_RECV;
3304 recv_perm = UDP_SOCKET__RECV_MSG;
3305 break;
3306
3307 case SECCLASS_TCP_SOCKET:
3308 netif_perm = NETIF__TCP_RECV;
3309 node_perm = NODE__TCP_RECV;
3310 recv_perm = TCP_SOCKET__RECV_MSG;
3311 break;
3312
3313 default:
3314 netif_perm = NETIF__RAWIP_RECV;
3315 node_perm = NODE__RAWIP_RECV;
3316 break;
3317 }
3318
3319 AVC_AUDIT_DATA_INIT(&ad, NET);
3320 ad.u.net.netif = dev->name;
3321 ad.u.net.family = family;
3322
3323 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3324 if (err)
3325 goto out;
3326
3327 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3328 if (err)
3329 goto out;
3330
3331 /* Fixme: this lookup is inefficient */
3332 err = security_node_sid(family, addrp, len, &node_sid);
3333 if (err)
3334 goto out;
3335
3336 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3337 if (err)
3338 goto out;
3339
3340 if (recv_perm) {
3341 u32 port_sid;
3342
3343 /* Fixme: make this more efficient */
3344 err = security_port_sid(sk->sk_family, sk->sk_type,
3345 sk->sk_protocol, ntohs(ad.u.net.sport),
3346 &port_sid);
3347 if (err)
3348 goto out;
3349
3350 err = avc_has_perm(sock_sid, port_sid,
3351 sock_class, recv_perm, &ad);
3352 }
3353 out:
3354 return err;
3355 }
3356
3357 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3358 int __user *optlen, unsigned len)
3359 {
3360 int err = 0;
3361 char *scontext;
3362 u32 scontext_len;
3363 struct sk_security_struct *ssec;
3364 struct inode_security_struct *isec;
3365
3366 isec = SOCK_INODE(sock)->i_security;
3367 if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3368 err = -ENOPROTOOPT;
3369 goto out;
3370 }
3371
3372 ssec = sock->sk->sk_security;
3373
3374 err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3375 if (err)
3376 goto out;
3377
3378 if (scontext_len > len) {
3379 err = -ERANGE;
3380 goto out_len;
3381 }
3382
3383 if (copy_to_user(optval, scontext, scontext_len))
3384 err = -EFAULT;
3385
3386 out_len:
3387 if (put_user(scontext_len, optlen))
3388 err = -EFAULT;
3389
3390 kfree(scontext);
3391 out:
3392 return err;
3393 }
3394
3395 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3396 {
3397 return sk_alloc_security(sk, family, priority);
3398 }
3399
3400 static void selinux_sk_free_security(struct sock *sk)
3401 {
3402 sk_free_security(sk);
3403 }
3404
3405 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3406 {
3407 int err = 0;
3408 u32 perm;
3409 struct nlmsghdr *nlh;
3410 struct socket *sock = sk->sk_socket;
3411 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3412
3413 if (skb->len < NLMSG_SPACE(0)) {
3414 err = -EINVAL;
3415 goto out;
3416 }
3417 nlh = (struct nlmsghdr *)skb->data;
3418
3419 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3420 if (err) {
3421 if (err == -EINVAL) {
3422 audit_log(current->audit_context,
3423 "SELinux: unrecognized netlink message"
3424 " type=%hu for sclass=%hu\n",
3425 nlh->nlmsg_type, isec->sclass);
3426 if (!selinux_enforcing)
3427 err = 0;
3428 }
3429
3430 /* Ignore */
3431 if (err == -ENOENT)
3432 err = 0;
3433 goto out;
3434 }
3435
3436 err = socket_has_perm(current, sock, perm);
3437 out:
3438 return err;
3439 }
3440
3441 #ifdef CONFIG_NETFILTER
3442
3443 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3444 struct sk_buff **pskb,
3445 const struct net_device *in,
3446 const struct net_device *out,
3447 int (*okfn)(struct sk_buff *),
3448 u16 family)
3449 {
3450 char *addrp;
3451 int len, err = NF_ACCEPT;
3452 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3453 struct sock *sk;
3454 struct socket *sock;
3455 struct inode *inode;
3456 struct sk_buff *skb = *pskb;
3457 struct inode_security_struct *isec;
3458 struct avc_audit_data ad;
3459 struct net_device *dev = (struct net_device *)out;
3460
3461 sk = skb->sk;
3462 if (!sk)
3463 goto out;
3464
3465 sock = sk->sk_socket;
3466 if (!sock)
3467 goto out;
3468
3469 inode = SOCK_INODE(sock);
3470 if (!inode)
3471 goto out;
3472
3473 err = sel_netif_sids(dev, &if_sid, NULL);
3474 if (err)
3475 goto out;
3476
3477 isec = inode->i_security;
3478
3479 switch (isec->sclass) {
3480 case SECCLASS_UDP_SOCKET:
3481 netif_perm = NETIF__UDP_SEND;
3482 node_perm = NODE__UDP_SEND;
3483 send_perm = UDP_SOCKET__SEND_MSG;
3484 break;
3485
3486 case SECCLASS_TCP_SOCKET:
3487 netif_perm = NETIF__TCP_SEND;
3488 node_perm = NODE__TCP_SEND;
3489 send_perm = TCP_SOCKET__SEND_MSG;
3490 break;
3491
3492 default:
3493 netif_perm = NETIF__RAWIP_SEND;
3494 node_perm = NODE__RAWIP_SEND;
3495 break;
3496 }
3497
3498
3499 AVC_AUDIT_DATA_INIT(&ad, NET);
3500 ad.u.net.netif = dev->name;
3501 ad.u.net.family = family;
3502
3503 err = selinux_parse_skb(skb, &ad, &addrp,
3504 &len, 0) ? NF_DROP : NF_ACCEPT;
3505 if (err != NF_ACCEPT)
3506 goto out;
3507
3508 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3509 netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3510 if (err != NF_ACCEPT)
3511 goto out;
3512
3513 /* Fixme: this lookup is inefficient */
3514 err = security_node_sid(family, addrp, len,
3515 &node_sid) ? NF_DROP : NF_ACCEPT;
3516 if (err != NF_ACCEPT)
3517 goto out;
3518
3519 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3520 node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3521 if (err != NF_ACCEPT)
3522 goto out;
3523
3524 if (send_perm) {
3525 u32 port_sid;
3526
3527 /* Fixme: make this more efficient */
3528 err = security_port_sid(sk->sk_family,
3529 sk->sk_type,
3530 sk->sk_protocol,
3531 ntohs(ad.u.net.dport),
3532 &port_sid) ? NF_DROP : NF_ACCEPT;
3533 if (err != NF_ACCEPT)
3534 goto out;
3535
3536 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3537 send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3538 }
3539
3540 out:
3541 return err;
3542 }
3543
3544 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3545 struct sk_buff **pskb,
3546 const struct net_device *in,
3547 const struct net_device *out,
3548 int (*okfn)(struct sk_buff *))
3549 {
3550 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3551 }
3552
3553 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3554
3555 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3556 struct sk_buff **pskb,
3557 const struct net_device *in,
3558 const struct net_device *out,
3559 int (*okfn)(struct sk_buff *))
3560 {
3561 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3562 }
3563
3564 #endif /* IPV6 */
3565
3566 #endif /* CONFIG_NETFILTER */
3567
3568 #else
3569
3570 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3571 {
3572 return 0;
3573 }
3574
3575 #endif /* CONFIG_SECURITY_NETWORK */
3576
3577 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3578 {
3579 struct task_security_struct *tsec;
3580 struct av_decision avd;
3581 int err;
3582
3583 err = secondary_ops->netlink_send(sk, skb);
3584 if (err)
3585 return err;
3586
3587 tsec = current->security;
3588
3589 avd.allowed = 0;
3590 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3591 SECCLASS_CAPABILITY, ~0, &avd);
3592 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3593
3594 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3595 err = selinux_nlmsg_perm(sk, skb);
3596
3597 return err;
3598 }
3599
3600 static int selinux_netlink_recv(struct sk_buff *skb)
3601 {
3602 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3603 return -EPERM;
3604 return 0;
3605 }
3606
3607 static int ipc_alloc_security(struct task_struct *task,
3608 struct kern_ipc_perm *perm,
3609 u16 sclass)
3610 {
3611 struct task_security_struct *tsec = task->security;
3612 struct ipc_security_struct *isec;
3613
3614 isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3615 if (!isec)
3616 return -ENOMEM;
3617
3618 memset(isec, 0, sizeof(struct ipc_security_struct));
3619 isec->magic = SELINUX_MAGIC;
3620 isec->sclass = sclass;
3621 isec->ipc_perm = perm;
3622 if (tsec) {
3623 isec->sid = tsec->sid;
3624 } else {
3625 isec->sid = SECINITSID_UNLABELED;
3626 }
3627 perm->security = isec;
3628
3629 return 0;
3630 }
3631
3632 static void ipc_free_security(struct kern_ipc_perm *perm)
3633 {
3634 struct ipc_security_struct *isec = perm->security;
3635 if (!isec || isec->magic != SELINUX_MAGIC)
3636 return;
3637
3638 perm->security = NULL;
3639 kfree(isec);
3640 }
3641
3642 static int msg_msg_alloc_security(struct msg_msg *msg)
3643 {
3644 struct msg_security_struct *msec;
3645
3646 msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3647 if (!msec)
3648 return -ENOMEM;
3649
3650 memset(msec, 0, sizeof(struct msg_security_struct));
3651 msec->magic = SELINUX_MAGIC;
3652 msec->msg = msg;
3653 msec->sid = SECINITSID_UNLABELED;
3654 msg->security = msec;
3655
3656 return 0;
3657 }
3658
3659 static void msg_msg_free_security(struct msg_msg *msg)
3660 {
3661 struct msg_security_struct *msec = msg->security;
3662 if (!msec || msec->magic != SELINUX_MAGIC)
3663 return;
3664
3665 msg->security = NULL;
3666 kfree(msec);
3667 }
3668
3669 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3670 u32 perms)
3671 {
3672 struct task_security_struct *tsec;
3673 struct ipc_security_struct *isec;
3674 struct avc_audit_data ad;
3675
3676 tsec = current->security;
3677 isec = ipc_perms->security;
3678
3679 AVC_AUDIT_DATA_INIT(&ad, IPC);
3680 ad.u.ipc_id = ipc_perms->key;
3681
3682 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3683 }
3684
3685 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3686 {
3687 return msg_msg_alloc_security(msg);
3688 }
3689
3690 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3691 {
3692 msg_msg_free_security(msg);
3693 }
3694
3695 /* message queue security operations */
3696 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3697 {
3698 struct task_security_struct *tsec;
3699 struct ipc_security_struct *isec;
3700 struct avc_audit_data ad;
3701 int rc;
3702
3703 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3704 if (rc)
3705 return rc;
3706
3707 tsec = current->security;
3708 isec = msq->q_perm.security;
3709
3710 AVC_AUDIT_DATA_INIT(&ad, IPC);
3711 ad.u.ipc_id = msq->q_perm.key;
3712
3713 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3714 MSGQ__CREATE, &ad);
3715 if (rc) {
3716 ipc_free_security(&msq->q_perm);
3717 return rc;
3718 }
3719 return 0;
3720 }
3721
3722 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3723 {
3724 ipc_free_security(&msq->q_perm);
3725 }
3726
3727 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3728 {
3729 struct task_security_struct *tsec;
3730 struct ipc_security_struct *isec;
3731 struct avc_audit_data ad;
3732
3733 tsec = current->security;
3734 isec = msq->q_perm.security;
3735
3736 AVC_AUDIT_DATA_INIT(&ad, IPC);
3737 ad.u.ipc_id = msq->q_perm.key;
3738
3739 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3740 MSGQ__ASSOCIATE, &ad);
3741 }
3742
3743 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3744 {
3745 int err;
3746 int perms;
3747
3748 switch(cmd) {
3749 case IPC_INFO:
3750 case MSG_INFO:
3751 /* No specific object, just general system-wide information. */
3752 return task_has_system(current, SYSTEM__IPC_INFO);
3753 case IPC_STAT:
3754 case MSG_STAT:
3755 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3756 break;
3757 case IPC_SET:
3758 perms = MSGQ__SETATTR;
3759 break;
3760 case IPC_RMID:
3761 perms = MSGQ__DESTROY;
3762 break;
3763 default:
3764 return 0;
3765 }
3766
3767 err = ipc_has_perm(&msq->q_perm, perms);
3768 return err;
3769 }
3770
3771 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3772 {
3773 struct task_security_struct *tsec;
3774 struct ipc_security_struct *isec;
3775 struct msg_security_struct *msec;
3776 struct avc_audit_data ad;
3777 int rc;
3778
3779 tsec = current->security;
3780 isec = msq->q_perm.security;
3781 msec = msg->security;
3782
3783 /*
3784 * First time through, need to assign label to the message
3785 */
3786 if (msec->sid == SECINITSID_UNLABELED) {
3787 /*
3788 * Compute new sid based on current process and
3789 * message queue this message will be stored in
3790 */
3791 rc = security_transition_sid(tsec->sid,
3792 isec->sid,
3793 SECCLASS_MSG,
3794 &msec->sid);
3795 if (rc)
3796 return rc;
3797 }
3798
3799 AVC_AUDIT_DATA_INIT(&ad, IPC);
3800 ad.u.ipc_id = msq->q_perm.key;
3801
3802 /* Can this process write to the queue? */
3803 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3804 MSGQ__WRITE, &ad);
3805 if (!rc)
3806 /* Can this process send the message */
3807 rc = avc_has_perm(tsec->sid, msec->sid,
3808 SECCLASS_MSG, MSG__SEND, &ad);
3809 if (!rc)
3810 /* Can the message be put in the queue? */
3811 rc = avc_has_perm(msec->sid, isec->sid,
3812 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3813
3814 return rc;
3815 }
3816
3817 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3818 struct task_struct *target,
3819 long type, int mode)
3820 {
3821 struct task_security_struct *tsec;
3822 struct ipc_security_struct *isec;
3823 struct msg_security_struct *msec;
3824 struct avc_audit_data ad;
3825 int rc;
3826
3827 tsec = target->security;
3828 isec = msq->q_perm.security;
3829 msec = msg->security;
3830
3831 AVC_AUDIT_DATA_INIT(&ad, IPC);
3832 ad.u.ipc_id = msq->q_perm.key;
3833
3834 rc = avc_has_perm(tsec->sid, isec->sid,
3835 SECCLASS_MSGQ, MSGQ__READ, &ad);
3836 if (!rc)
3837 rc = avc_has_perm(tsec->sid, msec->sid,
3838 SECCLASS_MSG, MSG__RECEIVE, &ad);
3839 return rc;
3840 }
3841
3842 /* Shared Memory security operations */
3843 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3844 {
3845 struct task_security_struct *tsec;
3846 struct ipc_security_struct *isec;
3847 struct avc_audit_data ad;
3848 int rc;
3849
3850 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3851 if (rc)
3852 return rc;
3853
3854 tsec = current->security;
3855 isec = shp->shm_perm.security;
3856
3857 AVC_AUDIT_DATA_INIT(&ad, IPC);
3858 ad.u.ipc_id = shp->shm_perm.key;
3859
3860 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3861 SHM__CREATE, &ad);
3862 if (rc) {
3863 ipc_free_security(&shp->shm_perm);
3864 return rc;
3865 }
3866 return 0;
3867 }
3868
3869 static void selinux_shm_free_security(struct shmid_kernel *shp)
3870 {
3871 ipc_free_security(&shp->shm_perm);
3872 }
3873
3874 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3875 {
3876 struct task_security_struct *tsec;
3877 struct ipc_security_struct *isec;
3878 struct avc_audit_data ad;
3879
3880 tsec = current->security;
3881 isec = shp->shm_perm.security;
3882
3883 AVC_AUDIT_DATA_INIT(&ad, IPC);
3884 ad.u.ipc_id = shp->shm_perm.key;
3885
3886 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3887 SHM__ASSOCIATE, &ad);
3888 }
3889
3890 /* Note, at this point, shp is locked down */
3891 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3892 {
3893 int perms;
3894 int err;
3895
3896 switch(cmd) {
3897 case IPC_INFO:
3898 case SHM_INFO:
3899 /* No specific object, just general system-wide information. */
3900 return task_has_system(current, SYSTEM__IPC_INFO);
3901 case IPC_STAT:
3902 case SHM_STAT:
3903 perms = SHM__GETATTR | SHM__ASSOCIATE;
3904 break;
3905 case IPC_SET:
3906 perms = SHM__SETATTR;
3907 break;
3908 case SHM_LOCK:
3909 case SHM_UNLOCK:
3910 perms = SHM__LOCK;
3911 break;
3912 case IPC_RMID:
3913 perms = SHM__DESTROY;
3914 break;
3915 default:
3916 return 0;
3917 }
3918
3919 err = ipc_has_perm(&shp->shm_perm, perms);
3920 return err;
3921 }
3922
3923 static int selinux_shm_shmat(struct shmid_kernel *shp,
3924 char __user *shmaddr, int shmflg)
3925 {
3926 u32 perms;
3927 int rc;
3928
3929 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3930 if (rc)
3931 return rc;
3932
3933 if (shmflg & SHM_RDONLY)
3934 perms = SHM__READ;
3935 else
3936 perms = SHM__READ | SHM__WRITE;
3937
3938 return ipc_has_perm(&shp->shm_perm, perms);
3939 }
3940
3941 /* Semaphore security operations */
3942 static int selinux_sem_alloc_security(struct sem_array *sma)
3943 {
3944 struct task_security_struct *tsec;
3945 struct ipc_security_struct *isec;
3946 struct avc_audit_data ad;
3947 int rc;
3948
3949 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3950 if (rc)
3951 return rc;
3952
3953 tsec = current->security;
3954 isec = sma->sem_perm.security;
3955
3956 AVC_AUDIT_DATA_INIT(&ad, IPC);
3957 ad.u.ipc_id = sma->sem_perm.key;
3958
3959 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3960 SEM__CREATE, &ad);
3961 if (rc) {
3962 ipc_free_security(&sma->sem_perm);
3963 return rc;
3964 }
3965 return 0;
3966 }
3967
3968 static void selinux_sem_free_security(struct sem_array *sma)
3969 {
3970 ipc_free_security(&sma->sem_perm);
3971 }
3972
3973 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3974 {
3975 struct task_security_struct *tsec;
3976 struct ipc_security_struct *isec;
3977 struct avc_audit_data ad;
3978
3979 tsec = current->security;
3980 isec = sma->sem_perm.security;
3981
3982 AVC_AUDIT_DATA_INIT(&ad, IPC);
3983 ad.u.ipc_id = sma->sem_perm.key;
3984
3985 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3986 SEM__ASSOCIATE, &ad);
3987 }
3988
3989 /* Note, at this point, sma is locked down */
3990 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3991 {
3992 int err;
3993 u32 perms;
3994
3995 switch(cmd) {
3996 case IPC_INFO:
3997 case SEM_INFO:
3998 /* No specific object, just general system-wide information. */
3999 return task_has_system(current, SYSTEM__IPC_INFO);
4000 case GETPID:
4001 case GETNCNT:
4002 case GETZCNT:
4003 perms = SEM__GETATTR;
4004 break;
4005 case GETVAL:
4006 case GETALL:
4007 perms = SEM__READ;
4008 break;
4009 case SETVAL:
4010 case SETALL:
4011 perms = SEM__WRITE;
4012 break;
4013 case IPC_RMID:
4014 perms = SEM__DESTROY;
4015 break;
4016 case IPC_SET:
4017 perms = SEM__SETATTR;
4018 break;
4019 case IPC_STAT:
4020 case SEM_STAT:
4021 perms = SEM__GETATTR | SEM__ASSOCIATE;
4022 break;
4023 default:
4024 return 0;
4025 }
4026
4027 err = ipc_has_perm(&sma->sem_perm, perms);
4028 return err;
4029 }
4030
4031 static int selinux_sem_semop(struct sem_array *sma,
4032 struct sembuf *sops, unsigned nsops, int alter)
4033 {
4034 u32 perms;
4035
4036 if (alter)
4037 perms = SEM__READ | SEM__WRITE;
4038 else
4039 perms = SEM__READ;
4040
4041 return ipc_has_perm(&sma->sem_perm, perms);
4042 }
4043
4044 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4045 {
4046 u32 av = 0;
4047
4048 av = 0;
4049 if (flag & S_IRUGO)
4050 av |= IPC__UNIX_READ;
4051 if (flag & S_IWUGO)
4052 av |= IPC__UNIX_WRITE;
4053
4054 if (av == 0)
4055 return 0;
4056
4057 return ipc_has_perm(ipcp, av);
4058 }
4059
4060 /* module stacking operations */
4061 static int selinux_register_security (const char *name, struct security_operations *ops)
4062 {
4063 if (secondary_ops != original_ops) {
4064 printk(KERN_INFO "%s: There is already a secondary security "
4065 "module registered.\n", __FUNCTION__);
4066 return -EINVAL;
4067 }
4068
4069 secondary_ops = ops;
4070
4071 printk(KERN_INFO "%s: Registering secondary module %s\n",
4072 __FUNCTION__,
4073 name);
4074
4075 return 0;
4076 }
4077
4078 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4079 {
4080 if (ops != secondary_ops) {
4081 printk (KERN_INFO "%s: trying to unregister a security module "
4082 "that is not registered.\n", __FUNCTION__);
4083 return -EINVAL;
4084 }
4085
4086 secondary_ops = original_ops;
4087
4088 return 0;
4089 }
4090
4091 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4092 {
4093 if (inode)
4094 inode_doinit_with_dentry(inode, dentry);
4095 }
4096
4097 static int selinux_getprocattr(struct task_struct *p,
4098 char *name, void *value, size_t size)
4099 {
4100 struct task_security_struct *tsec;
4101 u32 sid, len;
4102 char *context;
4103 int error;
4104
4105 if (current != p) {
4106 error = task_has_perm(current, p, PROCESS__GETATTR);
4107 if (error)
4108 return error;
4109 }
4110
4111 if (!size)
4112 return -ERANGE;
4113
4114 tsec = p->security;
4115
4116 if (!strcmp(name, "current"))
4117 sid = tsec->sid;
4118 else if (!strcmp(name, "prev"))
4119 sid = tsec->osid;
4120 else if (!strcmp(name, "exec"))
4121 sid = tsec->exec_sid;
4122 else if (!strcmp(name, "fscreate"))
4123 sid = tsec->create_sid;
4124 else
4125 return -EINVAL;
4126
4127 if (!sid)
4128 return 0;
4129
4130 error = security_sid_to_context(sid, &context, &len);
4131 if (error)
4132 return error;
4133 if (len > size) {
4134 kfree(context);
4135 return -ERANGE;
4136 }
4137 memcpy(value, context, len);
4138 kfree(context);
4139 return len;
4140 }
4141
4142 static int selinux_setprocattr(struct task_struct *p,
4143 char *name, void *value, size_t size)
4144 {
4145 struct task_security_struct *tsec;
4146 u32 sid = 0;
4147 int error;
4148 char *str = value;
4149
4150 if (current != p) {
4151 /* SELinux only allows a process to change its own
4152 security attributes. */
4153 return -EACCES;
4154 }
4155
4156 /*
4157 * Basic control over ability to set these attributes at all.
4158 * current == p, but we'll pass them separately in case the
4159 * above restriction is ever removed.
4160 */
4161 if (!strcmp(name, "exec"))
4162 error = task_has_perm(current, p, PROCESS__SETEXEC);
4163 else if (!strcmp(name, "fscreate"))
4164 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4165 else if (!strcmp(name, "current"))
4166 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4167 else
4168 error = -EINVAL;
4169 if (error)
4170 return error;
4171
4172 /* Obtain a SID for the context, if one was specified. */
4173 if (size && str[1] && str[1] != '\n') {
4174 if (str[size-1] == '\n') {
4175 str[size-1] = 0;
4176 size--;
4177 }
4178 error = security_context_to_sid(value, size, &sid);
4179 if (error)
4180 return error;
4181 }
4182
4183 /* Permission checking based on the specified context is
4184 performed during the actual operation (execve,
4185 open/mkdir/...), when we know the full context of the
4186 operation. See selinux_bprm_set_security for the execve
4187 checks and may_create for the file creation checks. The
4188 operation will then fail if the context is not permitted. */
4189 tsec = p->security;
4190 if (!strcmp(name, "exec"))
4191 tsec->exec_sid = sid;
4192 else if (!strcmp(name, "fscreate"))
4193 tsec->create_sid = sid;
4194 else if (!strcmp(name, "current")) {
4195 struct av_decision avd;
4196
4197 if (sid == 0)
4198 return -EINVAL;
4199
4200 /* Only allow single threaded processes to change context */
4201 if (atomic_read(&p->mm->mm_users) != 1) {
4202 struct task_struct *g, *t;
4203 struct mm_struct *mm = p->mm;
4204 read_lock(&tasklist_lock);
4205 do_each_thread(g, t)
4206 if (t->mm == mm && t != p) {
4207 read_unlock(&tasklist_lock);
4208 return -EPERM;
4209 }
4210 while_each_thread(g, t);
4211 read_unlock(&tasklist_lock);
4212 }
4213
4214 /* Check permissions for the transition. */
4215 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4216 PROCESS__DYNTRANSITION, NULL);
4217 if (error)
4218 return error;
4219
4220 /* Check for ptracing, and update the task SID if ok.
4221 Otherwise, leave SID unchanged and fail. */
4222 task_lock(p);
4223 if (p->ptrace & PT_PTRACED) {
4224 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4225 SECCLASS_PROCESS,
4226 PROCESS__PTRACE, &avd);
4227 if (!error)
4228 tsec->sid = sid;
4229 task_unlock(p);
4230 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4231 PROCESS__PTRACE, &avd, error, NULL);
4232 if (error)
4233 return error;
4234 } else {
4235 tsec->sid = sid;
4236 task_unlock(p);
4237 }
4238 }
4239 else
4240 return -EINVAL;
4241
4242 return size;
4243 }
4244
4245 static struct security_operations selinux_ops = {
4246 .ptrace = selinux_ptrace,
4247 .capget = selinux_capget,
4248 .capset_check = selinux_capset_check,
4249 .capset_set = selinux_capset_set,
4250 .sysctl = selinux_sysctl,
4251 .capable = selinux_capable,
4252 .quotactl = selinux_quotactl,
4253 .quota_on = selinux_quota_on,
4254 .syslog = selinux_syslog,
4255 .vm_enough_memory = selinux_vm_enough_memory,
4256
4257 .netlink_send = selinux_netlink_send,
4258 .netlink_recv = selinux_netlink_recv,
4259
4260 .bprm_alloc_security = selinux_bprm_alloc_security,
4261 .bprm_free_security = selinux_bprm_free_security,
4262 .bprm_apply_creds = selinux_bprm_apply_creds,
4263 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4264 .bprm_set_security = selinux_bprm_set_security,
4265 .bprm_check_security = selinux_bprm_check_security,
4266 .bprm_secureexec = selinux_bprm_secureexec,
4267
4268 .sb_alloc_security = selinux_sb_alloc_security,
4269 .sb_free_security = selinux_sb_free_security,
4270 .sb_copy_data = selinux_sb_copy_data,
4271 .sb_kern_mount = selinux_sb_kern_mount,
4272 .sb_statfs = selinux_sb_statfs,
4273 .sb_mount = selinux_mount,
4274 .sb_umount = selinux_umount,
4275
4276 .inode_alloc_security = selinux_inode_alloc_security,
4277 .inode_free_security = selinux_inode_free_security,
4278 .inode_create = selinux_inode_create,
4279 .inode_post_create = selinux_inode_post_create,
4280 .inode_link = selinux_inode_link,
4281 .inode_post_link = selinux_inode_post_link,
4282 .inode_unlink = selinux_inode_unlink,
4283 .inode_symlink = selinux_inode_symlink,
4284 .inode_post_symlink = selinux_inode_post_symlink,
4285 .inode_mkdir = selinux_inode_mkdir,
4286 .inode_post_mkdir = selinux_inode_post_mkdir,
4287 .inode_rmdir = selinux_inode_rmdir,
4288 .inode_mknod = selinux_inode_mknod,
4289 .inode_post_mknod = selinux_inode_post_mknod,
4290 .inode_rename = selinux_inode_rename,
4291 .inode_post_rename = selinux_inode_post_rename,
4292 .inode_readlink = selinux_inode_readlink,
4293 .inode_follow_link = selinux_inode_follow_link,
4294 .inode_permission = selinux_inode_permission,
4295 .inode_setattr = selinux_inode_setattr,
4296 .inode_getattr = selinux_inode_getattr,
4297 .inode_setxattr = selinux_inode_setxattr,
4298 .inode_post_setxattr = selinux_inode_post_setxattr,
4299 .inode_getxattr = selinux_inode_getxattr,
4300 .inode_listxattr = selinux_inode_listxattr,
4301 .inode_removexattr = selinux_inode_removexattr,
4302 .inode_getsecurity = selinux_inode_getsecurity,
4303 .inode_setsecurity = selinux_inode_setsecurity,
4304 .inode_listsecurity = selinux_inode_listsecurity,
4305
4306 .file_permission = selinux_file_permission,
4307 .file_alloc_security = selinux_file_alloc_security,
4308 .file_free_security = selinux_file_free_security,
4309 .file_ioctl = selinux_file_ioctl,
4310 .file_mmap = selinux_file_mmap,
4311 .file_mprotect = selinux_file_mprotect,
4312 .file_lock = selinux_file_lock,
4313 .file_fcntl = selinux_file_fcntl,
4314 .file_set_fowner = selinux_file_set_fowner,
4315 .file_send_sigiotask = selinux_file_send_sigiotask,
4316 .file_receive = selinux_file_receive,
4317
4318 .task_create = selinux_task_create,
4319 .task_alloc_security = selinux_task_alloc_security,
4320 .task_free_security = selinux_task_free_security,
4321 .task_setuid = selinux_task_setuid,
4322 .task_post_setuid = selinux_task_post_setuid,
4323 .task_setgid = selinux_task_setgid,
4324 .task_setpgid = selinux_task_setpgid,
4325 .task_getpgid = selinux_task_getpgid,
4326 .task_getsid = selinux_task_getsid,
4327 .task_setgroups = selinux_task_setgroups,
4328 .task_setnice = selinux_task_setnice,
4329 .task_setrlimit = selinux_task_setrlimit,
4330 .task_setscheduler = selinux_task_setscheduler,
4331 .task_getscheduler = selinux_task_getscheduler,
4332 .task_kill = selinux_task_kill,
4333 .task_wait = selinux_task_wait,
4334 .task_prctl = selinux_task_prctl,
4335 .task_reparent_to_init = selinux_task_reparent_to_init,
4336 .task_to_inode = selinux_task_to_inode,
4337
4338 .ipc_permission = selinux_ipc_permission,
4339
4340 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4341 .msg_msg_free_security = selinux_msg_msg_free_security,
4342
4343 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4344 .msg_queue_free_security = selinux_msg_queue_free_security,
4345 .msg_queue_associate = selinux_msg_queue_associate,
4346 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4347 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4348 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4349
4350 .shm_alloc_security = selinux_shm_alloc_security,
4351 .shm_free_security = selinux_shm_free_security,
4352 .shm_associate = selinux_shm_associate,
4353 .shm_shmctl = selinux_shm_shmctl,
4354 .shm_shmat = selinux_shm_shmat,
4355
4356 .sem_alloc_security = selinux_sem_alloc_security,
4357 .sem_free_security = selinux_sem_free_security,
4358 .sem_associate = selinux_sem_associate,
4359 .sem_semctl = selinux_sem_semctl,
4360 .sem_semop = selinux_sem_semop,
4361
4362 .register_security = selinux_register_security,
4363 .unregister_security = selinux_unregister_security,
4364
4365 .d_instantiate = selinux_d_instantiate,
4366
4367 .getprocattr = selinux_getprocattr,
4368 .setprocattr = selinux_setprocattr,
4369
4370 #ifdef CONFIG_SECURITY_NETWORK
4371 .unix_stream_connect = selinux_socket_unix_stream_connect,
4372 .unix_may_send = selinux_socket_unix_may_send,
4373
4374 .socket_create = selinux_socket_create,
4375 .socket_post_create = selinux_socket_post_create,
4376 .socket_bind = selinux_socket_bind,
4377 .socket_connect = selinux_socket_connect,
4378 .socket_listen = selinux_socket_listen,
4379 .socket_accept = selinux_socket_accept,
4380 .socket_sendmsg = selinux_socket_sendmsg,
4381 .socket_recvmsg = selinux_socket_recvmsg,
4382 .socket_getsockname = selinux_socket_getsockname,
4383 .socket_getpeername = selinux_socket_getpeername,
4384 .socket_getsockopt = selinux_socket_getsockopt,
4385 .socket_setsockopt = selinux_socket_setsockopt,
4386 .socket_shutdown = selinux_socket_shutdown,
4387 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4388 .socket_getpeersec = selinux_socket_getpeersec,
4389 .sk_alloc_security = selinux_sk_alloc_security,
4390 .sk_free_security = selinux_sk_free_security,
4391 #endif
4392 };
4393
4394 static __init int selinux_init(void)
4395 {
4396 struct task_security_struct *tsec;
4397
4398 if (!selinux_enabled) {
4399 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4400 return 0;
4401 }
4402
4403 printk(KERN_INFO "SELinux: Initializing.\n");
4404
4405 /* Set the security state for the initial task. */
4406 if (task_alloc_security(current))
4407 panic("SELinux: Failed to initialize initial task.\n");
4408 tsec = current->security;
4409 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4410
4411 avc_init();
4412
4413 original_ops = secondary_ops = security_ops;
4414 if (!secondary_ops)
4415 panic ("SELinux: No initial security operations\n");
4416 if (register_security (&selinux_ops))
4417 panic("SELinux: Unable to register with kernel.\n");
4418
4419 if (selinux_enforcing) {
4420 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4421 } else {
4422 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4423 }
4424 return 0;
4425 }
4426
4427 void selinux_complete_init(void)
4428 {
4429 printk(KERN_INFO "SELinux: Completing initialization.\n");
4430
4431 /* Set up any superblocks initialized prior to the policy load. */
4432 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4433 spin_lock(&sb_security_lock);
4434 next_sb:
4435 if (!list_empty(&superblock_security_head)) {
4436 struct superblock_security_struct *sbsec =
4437 list_entry(superblock_security_head.next,
4438 struct superblock_security_struct,
4439 list);
4440 struct super_block *sb = sbsec->sb;
4441 spin_lock(&sb_lock);
4442 sb->s_count++;
4443 spin_unlock(&sb_lock);
4444 spin_unlock(&sb_security_lock);
4445 down_read(&sb->s_umount);
4446 if (sb->s_root)
4447 superblock_doinit(sb, NULL);
4448 drop_super(sb);
4449 spin_lock(&sb_security_lock);
4450 list_del_init(&sbsec->list);
4451 goto next_sb;
4452 }
4453 spin_unlock(&sb_security_lock);
4454 }
4455
4456 /* SELinux requires early initialization in order to label
4457 all processes and objects when they are created. */
4458 security_initcall(selinux_init);
4459
4460 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4461
4462 static struct nf_hook_ops selinux_ipv4_op = {
4463 .hook = selinux_ipv4_postroute_last,
4464 .owner = THIS_MODULE,
4465 .pf = PF_INET,
4466 .hooknum = NF_IP_POST_ROUTING,
4467 .priority = NF_IP_PRI_SELINUX_LAST,
4468 };
4469
4470 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4471
4472 static struct nf_hook_ops selinux_ipv6_op = {
4473 .hook = selinux_ipv6_postroute_last,
4474 .owner = THIS_MODULE,
4475 .pf = PF_INET6,
4476 .hooknum = NF_IP6_POST_ROUTING,
4477 .priority = NF_IP6_PRI_SELINUX_LAST,
4478 };
4479
4480 #endif /* IPV6 */
4481
4482 static int __init selinux_nf_ip_init(void)
4483 {
4484 int err = 0;
4485
4486 if (!selinux_enabled)
4487 goto out;
4488
4489 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4490
4491 err = nf_register_hook(&selinux_ipv4_op);
4492 if (err)
4493 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4494
4495 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4496
4497 err = nf_register_hook(&selinux_ipv6_op);
4498 if (err)
4499 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4500
4501 #endif /* IPV6 */
4502 out:
4503 return err;
4504 }
4505
4506 __initcall(selinux_nf_ip_init);
4507
4508 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4509 static void selinux_nf_ip_exit(void)
4510 {
4511 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4512
4513 nf_unregister_hook(&selinux_ipv4_op);
4514 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4515 nf_unregister_hook(&selinux_ipv6_op);
4516 #endif /* IPV6 */
4517 }
4518 #endif
4519
4520 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4521
4522 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4523 #define selinux_nf_ip_exit()
4524 #endif
4525
4526 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4527
4528 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4529 int selinux_disable(void)
4530 {
4531 extern void exit_sel_fs(void);
4532 static int selinux_disabled = 0;
4533
4534 if (ss_initialized) {
4535 /* Not permitted after initial policy load. */
4536 return -EINVAL;
4537 }
4538
4539 if (selinux_disabled) {
4540 /* Only do this once. */
4541 return -EINVAL;
4542 }
4543
4544 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4545
4546 selinux_disabled = 1;
4547
4548 /* Reset security_ops to the secondary module, dummy or capability. */
4549 security_ops = secondary_ops;
4550
4551 /* Unregister netfilter hooks. */
4552 selinux_nf_ip_exit();
4553
4554 /* Unregister selinuxfs. */
4555 exit_sel_fs();
4556
4557 return 0;
4558 }
4559 #endif
4560
4561
kmemtrace - Kernel memory tracer