?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh...
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / security / selinux / hooks.c
blob3e3fde7c1d2bf2a48af6d19d72e47f3adc95514b
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kernel.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched.h>
31 #include <linux/security.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/swap.h>
40 #include <linux/spinlock.h>
41 #include <linux/syscalls.h>
42 #include <linux/file.h>
43 #include <linux/fdtable.h>
44 #include <linux/namei.h>
45 #include <linux/mount.h>
46 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <linux/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78 #include <linux/posix-timers.h>
79
80 #include "avc.h"
81 #include "objsec.h"
82 #include "netif.h"
83 #include "netnode.h"
84 #include "netport.h"
85 #include "xfrm.h"
86 #include "netlabel.h"
87 #include "audit.h"
88
89 #define XATTR_SELINUX_SUFFIX "selinux"
90 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
91
92 #define NUM_SEL_MNT_OPTS 4
93
94 extern unsigned int policydb_loaded_version;
95 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
96 extern int selinux_compat_net;
97 extern struct security_operations *security_ops;
98
99 /* SECMARK reference count */
100 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101
102 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
103 int selinux_enforcing;
104
105 static int __init enforcing_setup(char *str)
106 {
107 unsigned long enforcing;
108 if (!strict_strtoul(str, 0, &enforcing))
109 selinux_enforcing = enforcing ? 1 : 0;
110 return 1;
111 }
112 __setup("enforcing=", enforcing_setup);
113 #endif
114
115 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
116 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117
118 static int __init selinux_enabled_setup(char *str)
119 {
120 unsigned long enabled;
121 if (!strict_strtoul(str, 0, &enabled))
122 selinux_enabled = enabled ? 1 : 0;
123 return 1;
124 }
125 __setup("selinux=", selinux_enabled_setup);
126 #else
127 int selinux_enabled = 1;
128 #endif
129
130
131 /*
132 * Minimal support for a secondary security module,
133 * just to allow the use of the capability module.
134 */
135 static struct security_operations *secondary_ops;
136
137 /* Lists of inode and superblock security structures initialized
138 before the policy was loaded. */
139 static LIST_HEAD(superblock_security_head);
140 static DEFINE_SPINLOCK(sb_security_lock);
141
142 static struct kmem_cache *sel_inode_cache;
143
144 /**
145 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
146 *
147 * Description:
148 * This function checks the SECMARK reference counter to see if any SECMARK
149 * targets are currently configured, if the reference counter is greater than
150 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
151 * enabled, false (0) if SECMARK is disabled.
152 *
153 */
154 static int selinux_secmark_enabled(void)
155 {
156 return (atomic_read(&selinux_secmark_refcount) > 0);
157 }
158
159 /* Allocate and free functions for each kind of security blob. */
160
161 static int task_alloc_security(struct task_struct *task)
162 {
163 struct task_security_struct *tsec;
164
165 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
166 if (!tsec)
167 return -ENOMEM;
168
169 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
170 task->security = tsec;
171
172 return 0;
173 }
174
175 static void task_free_security(struct task_struct *task)
176 {
177 struct task_security_struct *tsec = task->security;
178 task->security = NULL;
179 kfree(tsec);
180 }
181
182 static int inode_alloc_security(struct inode *inode)
183 {
184 struct task_security_struct *tsec = current->security;
185 struct inode_security_struct *isec;
186
187 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
188 if (!isec)
189 return -ENOMEM;
190
191 mutex_init(&isec->lock);
192 INIT_LIST_HEAD(&isec->list);
193 isec->inode = inode;
194 isec->sid = SECINITSID_UNLABELED;
195 isec->sclass = SECCLASS_FILE;
196 isec->task_sid = tsec->sid;
197 inode->i_security = isec;
198
199 return 0;
200 }
201
202 static void inode_free_security(struct inode *inode)
203 {
204 struct inode_security_struct *isec = inode->i_security;
205 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
206
207 spin_lock(&sbsec->isec_lock);
208 if (!list_empty(&isec->list))
209 list_del_init(&isec->list);
210 spin_unlock(&sbsec->isec_lock);
211
212 inode->i_security = NULL;
213 kmem_cache_free(sel_inode_cache, isec);
214 }
215
216 static int file_alloc_security(struct file *file)
217 {
218 struct task_security_struct *tsec = current->security;
219 struct file_security_struct *fsec;
220
221 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
222 if (!fsec)
223 return -ENOMEM;
224
225 fsec->sid = tsec->sid;
226 fsec->fown_sid = tsec->sid;
227 file->f_security = fsec;
228
229 return 0;
230 }
231
232 static void file_free_security(struct file *file)
233 {
234 struct file_security_struct *fsec = file->f_security;
235 file->f_security = NULL;
236 kfree(fsec);
237 }
238
239 static int superblock_alloc_security(struct super_block *sb)
240 {
241 struct superblock_security_struct *sbsec;
242
243 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
244 if (!sbsec)
245 return -ENOMEM;
246
247 mutex_init(&sbsec->lock);
248 INIT_LIST_HEAD(&sbsec->list);
249 INIT_LIST_HEAD(&sbsec->isec_head);
250 spin_lock_init(&sbsec->isec_lock);
251 sbsec->sb = sb;
252 sbsec->sid = SECINITSID_UNLABELED;
253 sbsec->def_sid = SECINITSID_FILE;
254 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
255 sb->s_security = sbsec;
256
257 return 0;
258 }
259
260 static void superblock_free_security(struct super_block *sb)
261 {
262 struct superblock_security_struct *sbsec = sb->s_security;
263
264 spin_lock(&sb_security_lock);
265 if (!list_empty(&sbsec->list))
266 list_del_init(&sbsec->list);
267 spin_unlock(&sb_security_lock);
268
269 sb->s_security = NULL;
270 kfree(sbsec);
271 }
272
273 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
274 {
275 struct sk_security_struct *ssec;
276
277 ssec = kzalloc(sizeof(*ssec), priority);
278 if (!ssec)
279 return -ENOMEM;
280
281 ssec->peer_sid = SECINITSID_UNLABELED;
282 ssec->sid = SECINITSID_UNLABELED;
283 sk->sk_security = ssec;
284
285 selinux_netlbl_sk_security_reset(ssec, family);
286
287 return 0;
288 }
289
290 static void sk_free_security(struct sock *sk)
291 {
292 struct sk_security_struct *ssec = sk->sk_security;
293
294 sk->sk_security = NULL;
295 selinux_netlbl_sk_security_free(ssec);
296 kfree(ssec);
297 }
298
299 /* The security server must be initialized before
300 any labeling or access decisions can be provided. */
301 extern int ss_initialized;
302
303 /* The file system's label must be initialized prior to use. */
304
305 static char *labeling_behaviors[6] = {
306 "uses xattr",
307 "uses transition SIDs",
308 "uses task SIDs",
309 "uses genfs_contexts",
310 "not configured for labeling",
311 "uses mountpoint labeling",
312 };
313
314 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
315
316 static inline int inode_doinit(struct inode *inode)
317 {
318 return inode_doinit_with_dentry(inode, NULL);
319 }
320
321 enum {
322 Opt_error = -1,
323 Opt_context = 1,
324 Opt_fscontext = 2,
325 Opt_defcontext = 3,
326 Opt_rootcontext = 4,
327 };
328
329 static const match_table_t tokens = {
330 {Opt_context, CONTEXT_STR "%s"},
331 {Opt_fscontext, FSCONTEXT_STR "%s"},
332 {Opt_defcontext, DEFCONTEXT_STR "%s"},
333 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
334 {Opt_error, NULL},
335 };
336
337 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
338
339 static int may_context_mount_sb_relabel(u32 sid,
340 struct superblock_security_struct *sbsec,
341 struct task_security_struct *tsec)
342 {
343 int rc;
344
345 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELFROM, NULL);
347 if (rc)
348 return rc;
349
350 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
351 FILESYSTEM__RELABELTO, NULL);
352 return rc;
353 }
354
355 static int may_context_mount_inode_relabel(u32 sid,
356 struct superblock_security_struct *sbsec,
357 struct task_security_struct *tsec)
358 {
359 int rc;
360 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
361 FILESYSTEM__RELABELFROM, NULL);
362 if (rc)
363 return rc;
364
365 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
366 FILESYSTEM__ASSOCIATE, NULL);
367 return rc;
368 }
369
370 static int sb_finish_set_opts(struct super_block *sb)
371 {
372 struct superblock_security_struct *sbsec = sb->s_security;
373 struct dentry *root = sb->s_root;
374 struct inode *root_inode = root->d_inode;
375 int rc = 0;
376
377 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
378 /* Make sure that the xattr handler exists and that no
379 error other than -ENODATA is returned by getxattr on
380 the root directory. -ENODATA is ok, as this may be
381 the first boot of the SELinux kernel before we have
382 assigned xattr values to the filesystem. */
383 if (!root_inode->i_op->getxattr) {
384 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
385 "xattr support\n", sb->s_id, sb->s_type->name);
386 rc = -EOPNOTSUPP;
387 goto out;
388 }
389 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
390 if (rc < 0 && rc != -ENODATA) {
391 if (rc == -EOPNOTSUPP)
392 printk(KERN_WARNING "SELinux: (dev %s, type "
393 "%s) has no security xattr handler\n",
394 sb->s_id, sb->s_type->name);
395 else
396 printk(KERN_WARNING "SELinux: (dev %s, type "
397 "%s) getxattr errno %d\n", sb->s_id,
398 sb->s_type->name, -rc);
399 goto out;
400 }
401 }
402
403 sbsec->initialized = 1;
404
405 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
406 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
407 sb->s_id, sb->s_type->name);
408 else
409 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
410 sb->s_id, sb->s_type->name,
411 labeling_behaviors[sbsec->behavior-1]);
412
413 /* Initialize the root inode. */
414 rc = inode_doinit_with_dentry(root_inode, root);
415
416 /* Initialize any other inodes associated with the superblock, e.g.
417 inodes created prior to initial policy load or inodes created
418 during get_sb by a pseudo filesystem that directly
419 populates itself. */
420 spin_lock(&sbsec->isec_lock);
421 next_inode:
422 if (!list_empty(&sbsec->isec_head)) {
423 struct inode_security_struct *isec =
424 list_entry(sbsec->isec_head.next,
425 struct inode_security_struct, list);
426 struct inode *inode = isec->inode;
427 spin_unlock(&sbsec->isec_lock);
428 inode = igrab(inode);
429 if (inode) {
430 if (!IS_PRIVATE(inode))
431 inode_doinit(inode);
432 iput(inode);
433 }
434 spin_lock(&sbsec->isec_lock);
435 list_del_init(&isec->list);
436 goto next_inode;
437 }
438 spin_unlock(&sbsec->isec_lock);
439 out:
440 return rc;
441 }
442
443 /*
444 * This function should allow an FS to ask what it's mount security
445 * options were so it can use those later for submounts, displaying
446 * mount options, or whatever.
447 */
448 static int selinux_get_mnt_opts(const struct super_block *sb,
449 struct security_mnt_opts *opts)
450 {
451 int rc = 0, i;
452 struct superblock_security_struct *sbsec = sb->s_security;
453 char *context = NULL;
454 u32 len;
455 char tmp;
456
457 security_init_mnt_opts(opts);
458
459 if (!sbsec->initialized)
460 return -EINVAL;
461
462 if (!ss_initialized)
463 return -EINVAL;
464
465 /*
466 * if we ever use sbsec flags for anything other than tracking mount
467 * settings this is going to need a mask
468 */
469 tmp = sbsec->flags;
470 /* count the number of mount options for this sb */
471 for (i = 0; i < 8; i++) {
472 if (tmp & 0x01)
473 opts->num_mnt_opts++;
474 tmp >>= 1;
475 }
476
477 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
478 if (!opts->mnt_opts) {
479 rc = -ENOMEM;
480 goto out_free;
481 }
482
483 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
484 if (!opts->mnt_opts_flags) {
485 rc = -ENOMEM;
486 goto out_free;
487 }
488
489 i = 0;
490 if (sbsec->flags & FSCONTEXT_MNT) {
491 rc = security_sid_to_context(sbsec->sid, &context, &len);
492 if (rc)
493 goto out_free;
494 opts->mnt_opts[i] = context;
495 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
496 }
497 if (sbsec->flags & CONTEXT_MNT) {
498 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
499 if (rc)
500 goto out_free;
501 opts->mnt_opts[i] = context;
502 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
503 }
504 if (sbsec->flags & DEFCONTEXT_MNT) {
505 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
506 if (rc)
507 goto out_free;
508 opts->mnt_opts[i] = context;
509 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
510 }
511 if (sbsec->flags & ROOTCONTEXT_MNT) {
512 struct inode *root = sbsec->sb->s_root->d_inode;
513 struct inode_security_struct *isec = root->i_security;
514
515 rc = security_sid_to_context(isec->sid, &context, &len);
516 if (rc)
517 goto out_free;
518 opts->mnt_opts[i] = context;
519 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
520 }
521
522 BUG_ON(i != opts->num_mnt_opts);
523
524 return 0;
525
526 out_free:
527 security_free_mnt_opts(opts);
528 return rc;
529 }
530
531 static int bad_option(struct superblock_security_struct *sbsec, char flag,
532 u32 old_sid, u32 new_sid)
533 {
534 /* check if the old mount command had the same options */
535 if (sbsec->initialized)
536 if (!(sbsec->flags & flag) ||
537 (old_sid != new_sid))
538 return 1;
539
540 /* check if we were passed the same options twice,
541 * aka someone passed context=a,context=b
542 */
543 if (!sbsec->initialized)
544 if (sbsec->flags & flag)
545 return 1;
546 return 0;
547 }
548
549 /*
550 * Allow filesystems with binary mount data to explicitly set mount point
551 * labeling information.
552 */
553 static int selinux_set_mnt_opts(struct super_block *sb,
554 struct security_mnt_opts *opts)
555 {
556 int rc = 0, i;
557 struct task_security_struct *tsec = current->security;
558 struct superblock_security_struct *sbsec = sb->s_security;
559 const char *name = sb->s_type->name;
560 struct inode *inode = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *root_isec = inode->i_security;
562 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
563 u32 defcontext_sid = 0;
564 char **mount_options = opts->mnt_opts;
565 int *flags = opts->mnt_opts_flags;
566 int num_opts = opts->num_mnt_opts;
567
568 mutex_lock(&sbsec->lock);
569
570 if (!ss_initialized) {
571 if (!num_opts) {
572 /* Defer initialization until selinux_complete_init,
573 after the initial policy is loaded and the security
574 server is ready to handle calls. */
575 spin_lock(&sb_security_lock);
576 if (list_empty(&sbsec->list))
577 list_add(&sbsec->list, &superblock_security_head);
578 spin_unlock(&sb_security_lock);
579 goto out;
580 }
581 rc = -EINVAL;
582 printk(KERN_WARNING "SELinux: Unable to set superblock options "
583 "before the security server is initialized\n");
584 goto out;
585 }
586
587 /*
588 * Binary mount data FS will come through this function twice. Once
589 * from an explicit call and once from the generic calls from the vfs.
590 * Since the generic VFS calls will not contain any security mount data
591 * we need to skip the double mount verification.
592 *
593 * This does open a hole in which we will not notice if the first
594 * mount using this sb set explict options and a second mount using
595 * this sb does not set any security options. (The first options
596 * will be used for both mounts)
597 */
598 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
599 && (num_opts == 0))
600 goto out;
601
602 /*
603 * parse the mount options, check if they are valid sids.
604 * also check if someone is trying to mount the same sb more
605 * than once with different security options.
606 */
607 for (i = 0; i < num_opts; i++) {
608 u32 sid;
609 rc = security_context_to_sid(mount_options[i],
610 strlen(mount_options[i]), &sid);
611 if (rc) {
612 printk(KERN_WARNING "SELinux: security_context_to_sid"
613 "(%s) failed for (dev %s, type %s) errno=%d\n",
614 mount_options[i], sb->s_id, name, rc);
615 goto out;
616 }
617 switch (flags[i]) {
618 case FSCONTEXT_MNT:
619 fscontext_sid = sid;
620
621 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
622 fscontext_sid))
623 goto out_double_mount;
624
625 sbsec->flags |= FSCONTEXT_MNT;
626 break;
627 case CONTEXT_MNT:
628 context_sid = sid;
629
630 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
631 context_sid))
632 goto out_double_mount;
633
634 sbsec->flags |= CONTEXT_MNT;
635 break;
636 case ROOTCONTEXT_MNT:
637 rootcontext_sid = sid;
638
639 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
640 rootcontext_sid))
641 goto out_double_mount;
642
643 sbsec->flags |= ROOTCONTEXT_MNT;
644
645 break;
646 case DEFCONTEXT_MNT:
647 defcontext_sid = sid;
648
649 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
650 defcontext_sid))
651 goto out_double_mount;
652
653 sbsec->flags |= DEFCONTEXT_MNT;
654
655 break;
656 default:
657 rc = -EINVAL;
658 goto out;
659 }
660 }
661
662 if (sbsec->initialized) {
663 /* previously mounted with options, but not on this attempt? */
664 if (sbsec->flags && !num_opts)
665 goto out_double_mount;
666 rc = 0;
667 goto out;
668 }
669
670 if (strcmp(sb->s_type->name, "proc") == 0)
671 sbsec->proc = 1;
672
673 /* Determine the labeling behavior to use for this filesystem type. */
674 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
675 if (rc) {
676 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
677 __func__, sb->s_type->name, rc);
678 goto out;
679 }
680
681 /* sets the context of the superblock for the fs being mounted. */
682 if (fscontext_sid) {
683
684 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
685 if (rc)
686 goto out;
687
688 sbsec->sid = fscontext_sid;
689 }
690
691 /*
692 * Switch to using mount point labeling behavior.
693 * sets the label used on all file below the mountpoint, and will set
694 * the superblock context if not already set.
695 */
696 if (context_sid) {
697 if (!fscontext_sid) {
698 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
699 if (rc)
700 goto out;
701 sbsec->sid = context_sid;
702 } else {
703 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
704 if (rc)
705 goto out;
706 }
707 if (!rootcontext_sid)
708 rootcontext_sid = context_sid;
709
710 sbsec->mntpoint_sid = context_sid;
711 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
712 }
713
714 if (rootcontext_sid) {
715 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
716 if (rc)
717 goto out;
718
719 root_isec->sid = rootcontext_sid;
720 root_isec->initialized = 1;
721 }
722
723 if (defcontext_sid) {
724 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
725 rc = -EINVAL;
726 printk(KERN_WARNING "SELinux: defcontext option is "
727 "invalid for this filesystem type\n");
728 goto out;
729 }
730
731 if (defcontext_sid != sbsec->def_sid) {
732 rc = may_context_mount_inode_relabel(defcontext_sid,
733 sbsec, tsec);
734 if (rc)
735 goto out;
736 }
737
738 sbsec->def_sid = defcontext_sid;
739 }
740
741 rc = sb_finish_set_opts(sb);
742 out:
743 mutex_unlock(&sbsec->lock);
744 return rc;
745 out_double_mount:
746 rc = -EINVAL;
747 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
748 "security settings for (dev %s, type %s)\n", sb->s_id, name);
749 goto out;
750 }
751
752 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
753 struct super_block *newsb)
754 {
755 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
756 struct superblock_security_struct *newsbsec = newsb->s_security;
757
758 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
759 int set_context = (oldsbsec->flags & CONTEXT_MNT);
760 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
761
762 /*
763 * if the parent was able to be mounted it clearly had no special lsm
764 * mount options. thus we can safely put this sb on the list and deal
765 * with it later
766 */
767 if (!ss_initialized) {
768 spin_lock(&sb_security_lock);
769 if (list_empty(&newsbsec->list))
770 list_add(&newsbsec->list, &superblock_security_head);
771 spin_unlock(&sb_security_lock);
772 return;
773 }
774
775 /* how can we clone if the old one wasn't set up?? */
776 BUG_ON(!oldsbsec->initialized);
777
778 /* if fs is reusing a sb, just let its options stand... */
779 if (newsbsec->initialized)
780 return;
781
782 mutex_lock(&newsbsec->lock);
783
784 newsbsec->flags = oldsbsec->flags;
785
786 newsbsec->sid = oldsbsec->sid;
787 newsbsec->def_sid = oldsbsec->def_sid;
788 newsbsec->behavior = oldsbsec->behavior;
789
790 if (set_context) {
791 u32 sid = oldsbsec->mntpoint_sid;
792
793 if (!set_fscontext)
794 newsbsec->sid = sid;
795 if (!set_rootcontext) {
796 struct inode *newinode = newsb->s_root->d_inode;
797 struct inode_security_struct *newisec = newinode->i_security;
798 newisec->sid = sid;
799 }
800 newsbsec->mntpoint_sid = sid;
801 }
802 if (set_rootcontext) {
803 const struct inode *oldinode = oldsb->s_root->d_inode;
804 const struct inode_security_struct *oldisec = oldinode->i_security;
805 struct inode *newinode = newsb->s_root->d_inode;
806 struct inode_security_struct *newisec = newinode->i_security;
807
808 newisec->sid = oldisec->sid;
809 }
810
811 sb_finish_set_opts(newsb);
812 mutex_unlock(&newsbsec->lock);
813 }
814
815 static int selinux_parse_opts_str(char *options,
816 struct security_mnt_opts *opts)
817 {
818 char *p;
819 char *context = NULL, *defcontext = NULL;
820 char *fscontext = NULL, *rootcontext = NULL;
821 int rc, num_mnt_opts = 0;
822
823 opts->num_mnt_opts = 0;
824
825 /* Standard string-based options. */
826 while ((p = strsep(&options, "|")) != NULL) {
827 int token;
828 substring_t args[MAX_OPT_ARGS];
829
830 if (!*p)
831 continue;
832
833 token = match_token(p, tokens, args);
834
835 switch (token) {
836 case Opt_context:
837 if (context || defcontext) {
838 rc = -EINVAL;
839 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
840 goto out_err;
841 }
842 context = match_strdup(&args[0]);
843 if (!context) {
844 rc = -ENOMEM;
845 goto out_err;
846 }
847 break;
848
849 case Opt_fscontext:
850 if (fscontext) {
851 rc = -EINVAL;
852 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
853 goto out_err;
854 }
855 fscontext = match_strdup(&args[0]);
856 if (!fscontext) {
857 rc = -ENOMEM;
858 goto out_err;
859 }
860 break;
861
862 case Opt_rootcontext:
863 if (rootcontext) {
864 rc = -EINVAL;
865 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
866 goto out_err;
867 }
868 rootcontext = match_strdup(&args[0]);
869 if (!rootcontext) {
870 rc = -ENOMEM;
871 goto out_err;
872 }
873 break;
874
875 case Opt_defcontext:
876 if (context || defcontext) {
877 rc = -EINVAL;
878 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
879 goto out_err;
880 }
881 defcontext = match_strdup(&args[0]);
882 if (!defcontext) {
883 rc = -ENOMEM;
884 goto out_err;
885 }
886 break;
887
888 default:
889 rc = -EINVAL;
890 printk(KERN_WARNING "SELinux: unknown mount option\n");
891 goto out_err;
892
893 }
894 }
895
896 rc = -ENOMEM;
897 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
898 if (!opts->mnt_opts)
899 goto out_err;
900
901 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
902 if (!opts->mnt_opts_flags) {
903 kfree(opts->mnt_opts);
904 goto out_err;
905 }
906
907 if (fscontext) {
908 opts->mnt_opts[num_mnt_opts] = fscontext;
909 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
910 }
911 if (context) {
912 opts->mnt_opts[num_mnt_opts] = context;
913 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
914 }
915 if (rootcontext) {
916 opts->mnt_opts[num_mnt_opts] = rootcontext;
917 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
918 }
919 if (defcontext) {
920 opts->mnt_opts[num_mnt_opts] = defcontext;
921 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
922 }
923
924 opts->num_mnt_opts = num_mnt_opts;
925 return 0;
926
927 out_err:
928 kfree(context);
929 kfree(defcontext);
930 kfree(fscontext);
931 kfree(rootcontext);
932 return rc;
933 }
934 /*
935 * string mount options parsing and call set the sbsec
936 */
937 static int superblock_doinit(struct super_block *sb, void *data)
938 {
939 int rc = 0;
940 char *options = data;
941 struct security_mnt_opts opts;
942
943 security_init_mnt_opts(&opts);
944
945 if (!data)
946 goto out;
947
948 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
949
950 rc = selinux_parse_opts_str(options, &opts);
951 if (rc)
952 goto out_err;
953
954 out:
955 rc = selinux_set_mnt_opts(sb, &opts);
956
957 out_err:
958 security_free_mnt_opts(&opts);
959 return rc;
960 }
961
962 static void selinux_write_opts(struct seq_file *m,
963 struct security_mnt_opts *opts)
964 {
965 int i;
966 char *prefix;
967
968 for (i = 0; i < opts->num_mnt_opts; i++) {
969 char *has_comma = strchr(opts->mnt_opts[i], ',');
970
971 switch (opts->mnt_opts_flags[i]) {
972 case CONTEXT_MNT:
973 prefix = CONTEXT_STR;
974 break;
975 case FSCONTEXT_MNT:
976 prefix = FSCONTEXT_STR;
977 break;
978 case ROOTCONTEXT_MNT:
979 prefix = ROOTCONTEXT_STR;
980 break;
981 case DEFCONTEXT_MNT:
982 prefix = DEFCONTEXT_STR;
983 break;
984 default:
985 BUG();
986 };
987 /* we need a comma before each option */
988 seq_putc(m, ',');
989 seq_puts(m, prefix);
990 if (has_comma)
991 seq_putc(m, '\"');
992 seq_puts(m, opts->mnt_opts[i]);
993 if (has_comma)
994 seq_putc(m, '\"');
995 }
996 }
997
998 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
999 {
1000 struct security_mnt_opts opts;
1001 int rc;
1002
1003 rc = selinux_get_mnt_opts(sb, &opts);
1004 if (rc) {
1005 /* before policy load we may get EINVAL, don't show anything */
1006 if (rc == -EINVAL)
1007 rc = 0;
1008 return rc;
1009 }
1010
1011 selinux_write_opts(m, &opts);
1012
1013 security_free_mnt_opts(&opts);
1014
1015 return rc;
1016 }
1017
1018 static inline u16 inode_mode_to_security_class(umode_t mode)
1019 {
1020 switch (mode & S_IFMT) {
1021 case S_IFSOCK:
1022 return SECCLASS_SOCK_FILE;
1023 case S_IFLNK:
1024 return SECCLASS_LNK_FILE;
1025 case S_IFREG:
1026 return SECCLASS_FILE;
1027 case S_IFBLK:
1028 return SECCLASS_BLK_FILE;
1029 case S_IFDIR:
1030 return SECCLASS_DIR;
1031 case S_IFCHR:
1032 return SECCLASS_CHR_FILE;
1033 case S_IFIFO:
1034 return SECCLASS_FIFO_FILE;
1035
1036 }
1037
1038 return SECCLASS_FILE;
1039 }
1040
1041 static inline int default_protocol_stream(int protocol)
1042 {
1043 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1044 }
1045
1046 static inline int default_protocol_dgram(int protocol)
1047 {
1048 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1049 }
1050
1051 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1052 {
1053 switch (family) {
1054 case PF_UNIX:
1055 switch (type) {
1056 case SOCK_STREAM:
1057 case SOCK_SEQPACKET:
1058 return SECCLASS_UNIX_STREAM_SOCKET;
1059 case SOCK_DGRAM:
1060 return SECCLASS_UNIX_DGRAM_SOCKET;
1061 }
1062 break;
1063 case PF_INET:
1064 case PF_INET6:
1065 switch (type) {
1066 case SOCK_STREAM:
1067 if (default_protocol_stream(protocol))
1068 return SECCLASS_TCP_SOCKET;
1069 else
1070 return SECCLASS_RAWIP_SOCKET;
1071 case SOCK_DGRAM:
1072 if (default_protocol_dgram(protocol))
1073 return SECCLASS_UDP_SOCKET;
1074 else
1075 return SECCLASS_RAWIP_SOCKET;
1076 case SOCK_DCCP:
1077 return SECCLASS_DCCP_SOCKET;
1078 default:
1079 return SECCLASS_RAWIP_SOCKET;
1080 }
1081 break;
1082 case PF_NETLINK:
1083 switch (protocol) {
1084 case NETLINK_ROUTE:
1085 return SECCLASS_NETLINK_ROUTE_SOCKET;
1086 case NETLINK_FIREWALL:
1087 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1088 case NETLINK_INET_DIAG:
1089 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1090 case NETLINK_NFLOG:
1091 return SECCLASS_NETLINK_NFLOG_SOCKET;
1092 case NETLINK_XFRM:
1093 return SECCLASS_NETLINK_XFRM_SOCKET;
1094 case NETLINK_SELINUX:
1095 return SECCLASS_NETLINK_SELINUX_SOCKET;
1096 case NETLINK_AUDIT:
1097 return SECCLASS_NETLINK_AUDIT_SOCKET;
1098 case NETLINK_IP6_FW:
1099 return SECCLASS_NETLINK_IP6FW_SOCKET;
1100 case NETLINK_DNRTMSG:
1101 return SECCLASS_NETLINK_DNRT_SOCKET;
1102 case NETLINK_KOBJECT_UEVENT:
1103 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1104 default:
1105 return SECCLASS_NETLINK_SOCKET;
1106 }
1107 case PF_PACKET:
1108 return SECCLASS_PACKET_SOCKET;
1109 case PF_KEY:
1110 return SECCLASS_KEY_SOCKET;
1111 case PF_APPLETALK:
1112 return SECCLASS_APPLETALK_SOCKET;
1113 }
1114
1115 return SECCLASS_SOCKET;
1116 }
1117
1118 #ifdef CONFIG_PROC_FS
1119 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1120 u16 tclass,
1121 u32 *sid)
1122 {
1123 int buflen, rc;
1124 char *buffer, *path, *end;
1125
1126 buffer = (char *)__get_free_page(GFP_KERNEL);
1127 if (!buffer)
1128 return -ENOMEM;
1129
1130 buflen = PAGE_SIZE;
1131 end = buffer+buflen;
1132 *--end = '\0';
1133 buflen--;
1134 path = end-1;
1135 *path = '/';
1136 while (de && de != de->parent) {
1137 buflen -= de->namelen + 1;
1138 if (buflen < 0)
1139 break;
1140 end -= de->namelen;
1141 memcpy(end, de->name, de->namelen);
1142 *--end = '/';
1143 path = end;
1144 de = de->parent;
1145 }
1146 rc = security_genfs_sid("proc", path, tclass, sid);
1147 free_page((unsigned long)buffer);
1148 return rc;
1149 }
1150 #else
1151 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1152 u16 tclass,
1153 u32 *sid)
1154 {
1155 return -EINVAL;
1156 }
1157 #endif
1158
1159 /* The inode's security attributes must be initialized before first use. */
1160 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1161 {
1162 struct superblock_security_struct *sbsec = NULL;
1163 struct inode_security_struct *isec = inode->i_security;
1164 u32 sid;
1165 struct dentry *dentry;
1166 #define INITCONTEXTLEN 255
1167 char *context = NULL;
1168 unsigned len = 0;
1169 int rc = 0;
1170
1171 if (isec->initialized)
1172 goto out;
1173
1174 mutex_lock(&isec->lock);
1175 if (isec->initialized)
1176 goto out_unlock;
1177
1178 sbsec = inode->i_sb->s_security;
1179 if (!sbsec->initialized) {
1180 /* Defer initialization until selinux_complete_init,
1181 after the initial policy is loaded and the security
1182 server is ready to handle calls. */
1183 spin_lock(&sbsec->isec_lock);
1184 if (list_empty(&isec->list))
1185 list_add(&isec->list, &sbsec->isec_head);
1186 spin_unlock(&sbsec->isec_lock);
1187 goto out_unlock;
1188 }
1189
1190 switch (sbsec->behavior) {
1191 case SECURITY_FS_USE_XATTR:
1192 if (!inode->i_op->getxattr) {
1193 isec->sid = sbsec->def_sid;
1194 break;
1195 }
1196
1197 /* Need a dentry, since the xattr API requires one.
1198 Life would be simpler if we could just pass the inode. */
1199 if (opt_dentry) {
1200 /* Called from d_instantiate or d_splice_alias. */
1201 dentry = dget(opt_dentry);
1202 } else {
1203 /* Called from selinux_complete_init, try to find a dentry. */
1204 dentry = d_find_alias(inode);
1205 }
1206 if (!dentry) {
1207 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
1208 "ino=%ld\n", __func__, inode->i_sb->s_id,
1209 inode->i_ino);
1210 goto out_unlock;
1211 }
1212
1213 len = INITCONTEXTLEN;
1214 context = kmalloc(len, GFP_NOFS);
1215 if (!context) {
1216 rc = -ENOMEM;
1217 dput(dentry);
1218 goto out_unlock;
1219 }
1220 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1221 context, len);
1222 if (rc == -ERANGE) {
1223 /* Need a larger buffer. Query for the right size. */
1224 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1225 NULL, 0);
1226 if (rc < 0) {
1227 dput(dentry);
1228 goto out_unlock;
1229 }
1230 kfree(context);
1231 len = rc;
1232 context = kmalloc(len, GFP_NOFS);
1233 if (!context) {
1234 rc = -ENOMEM;
1235 dput(dentry);
1236 goto out_unlock;
1237 }
1238 rc = inode->i_op->getxattr(dentry,
1239 XATTR_NAME_SELINUX,
1240 context, len);
1241 }
1242 dput(dentry);
1243 if (rc < 0) {
1244 if (rc != -ENODATA) {
1245 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1246 "%d for dev=%s ino=%ld\n", __func__,
1247 -rc, inode->i_sb->s_id, inode->i_ino);
1248 kfree(context);
1249 goto out_unlock;
1250 }
1251 /* Map ENODATA to the default file SID */
1252 sid = sbsec->def_sid;
1253 rc = 0;
1254 } else {
1255 rc = security_context_to_sid_default(context, rc, &sid,
1256 sbsec->def_sid,
1257 GFP_NOFS);
1258 if (rc) {
1259 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1260 "returned %d for dev=%s ino=%ld\n",
1261 __func__, context, -rc,
1262 inode->i_sb->s_id, inode->i_ino);
1263 kfree(context);
1264 /* Leave with the unlabeled SID */
1265 rc = 0;
1266 break;
1267 }
1268 }
1269 kfree(context);
1270 isec->sid = sid;
1271 break;
1272 case SECURITY_FS_USE_TASK:
1273 isec->sid = isec->task_sid;
1274 break;
1275 case SECURITY_FS_USE_TRANS:
1276 /* Default to the fs SID. */
1277 isec->sid = sbsec->sid;
1278
1279 /* Try to obtain a transition SID. */
1280 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1281 rc = security_transition_sid(isec->task_sid,
1282 sbsec->sid,
1283 isec->sclass,
1284 &sid);
1285 if (rc)
1286 goto out_unlock;
1287 isec->sid = sid;
1288 break;
1289 case SECURITY_FS_USE_MNTPOINT:
1290 isec->sid = sbsec->mntpoint_sid;
1291 break;
1292 default:
1293 /* Default to the fs superblock SID. */
1294 isec->sid = sbsec->sid;
1295
1296 if (sbsec->proc && !S_ISLNK(inode->i_mode)) {
1297 struct proc_inode *proci = PROC_I(inode);
1298 if (proci->pde) {
1299 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1300 rc = selinux_proc_get_sid(proci->pde,
1301 isec->sclass,
1302 &sid);
1303 if (rc)
1304 goto out_unlock;
1305 isec->sid = sid;
1306 }
1307 }
1308 break;
1309 }
1310
1311 isec->initialized = 1;
1312
1313 out_unlock:
1314 mutex_unlock(&isec->lock);
1315 out:
1316 if (isec->sclass == SECCLASS_FILE)
1317 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1318 return rc;
1319 }
1320
1321 /* Convert a Linux signal to an access vector. */
1322 static inline u32 signal_to_av(int sig)
1323 {
1324 u32 perm = 0;
1325
1326 switch (sig) {
1327 case SIGCHLD:
1328 /* Commonly granted from child to parent. */
1329 perm = PROCESS__SIGCHLD;
1330 break;
1331 case SIGKILL:
1332 /* Cannot be caught or ignored */
1333 perm = PROCESS__SIGKILL;
1334 break;
1335 case SIGSTOP:
1336 /* Cannot be caught or ignored */
1337 perm = PROCESS__SIGSTOP;
1338 break;
1339 default:
1340 /* All other signals. */
1341 perm = PROCESS__SIGNAL;
1342 break;
1343 }
1344
1345 return perm;
1346 }
1347
1348 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1349 fork check, ptrace check, etc. */
1350 static int task_has_perm(struct task_struct *tsk1,
1351 struct task_struct *tsk2,
1352 u32 perms)
1353 {
1354 struct task_security_struct *tsec1, *tsec2;
1355
1356 tsec1 = tsk1->security;
1357 tsec2 = tsk2->security;
1358 return avc_has_perm(tsec1->sid, tsec2->sid,
1359 SECCLASS_PROCESS, perms, NULL);
1360 }
1361
1362 #if CAP_LAST_CAP > 63
1363 #error Fix SELinux to handle capabilities > 63.
1364 #endif
1365
1366 /* Check whether a task is allowed to use a capability. */
1367 static int task_has_capability(struct task_struct *tsk,
1368 int cap)
1369 {
1370 struct task_security_struct *tsec;
1371 struct avc_audit_data ad;
1372 u16 sclass;
1373 u32 av = CAP_TO_MASK(cap);
1374
1375 tsec = tsk->security;
1376
1377 AVC_AUDIT_DATA_INIT(&ad, CAP);
1378 ad.tsk = tsk;
1379 ad.u.cap = cap;
1380
1381 switch (CAP_TO_INDEX(cap)) {
1382 case 0:
1383 sclass = SECCLASS_CAPABILITY;
1384 break;
1385 case 1:
1386 sclass = SECCLASS_CAPABILITY2;
1387 break;
1388 default:
1389 printk(KERN_ERR
1390 "SELinux: out of range capability %d\n", cap);
1391 BUG();
1392 }
1393 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1394 }
1395
1396 /* Check whether a task is allowed to use a system operation. */
1397 static int task_has_system(struct task_struct *tsk,
1398 u32 perms)
1399 {
1400 struct task_security_struct *tsec;
1401
1402 tsec = tsk->security;
1403
1404 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1405 SECCLASS_SYSTEM, perms, NULL);
1406 }
1407
1408 /* Check whether a task has a particular permission to an inode.
1409 The 'adp' parameter is optional and allows other audit
1410 data to be passed (e.g. the dentry). */
1411 static int inode_has_perm(struct task_struct *tsk,
1412 struct inode *inode,
1413 u32 perms,
1414 struct avc_audit_data *adp)
1415 {
1416 struct task_security_struct *tsec;
1417 struct inode_security_struct *isec;
1418 struct avc_audit_data ad;
1419
1420 if (unlikely(IS_PRIVATE(inode)))
1421 return 0;
1422
1423 tsec = tsk->security;
1424 isec = inode->i_security;
1425
1426 if (!adp) {
1427 adp = &ad;
1428 AVC_AUDIT_DATA_INIT(&ad, FS);
1429 ad.u.fs.inode = inode;
1430 }
1431
1432 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1433 }
1434
1435 /* Same as inode_has_perm, but pass explicit audit data containing
1436 the dentry to help the auditing code to more easily generate the
1437 pathname if needed. */
1438 static inline int dentry_has_perm(struct task_struct *tsk,
1439 struct vfsmount *mnt,
1440 struct dentry *dentry,
1441 u32 av)
1442 {
1443 struct inode *inode = dentry->d_inode;
1444 struct avc_audit_data ad;
1445 AVC_AUDIT_DATA_INIT(&ad, FS);
1446 ad.u.fs.path.mnt = mnt;
1447 ad.u.fs.path.dentry = dentry;
1448 return inode_has_perm(tsk, inode, av, &ad);
1449 }
1450
1451 /* Check whether a task can use an open file descriptor to
1452 access an inode in a given way. Check access to the
1453 descriptor itself, and then use dentry_has_perm to
1454 check a particular permission to the file.
1455 Access to the descriptor is implicitly granted if it
1456 has the same SID as the process. If av is zero, then
1457 access to the file is not checked, e.g. for cases
1458 where only the descriptor is affected like seek. */
1459 static int file_has_perm(struct task_struct *tsk,
1460 struct file *file,
1461 u32 av)
1462 {
1463 struct task_security_struct *tsec = tsk->security;
1464 struct file_security_struct *fsec = file->f_security;
1465 struct inode *inode = file->f_path.dentry->d_inode;
1466 struct avc_audit_data ad;
1467 int rc;
1468
1469 AVC_AUDIT_DATA_INIT(&ad, FS);
1470 ad.u.fs.path = file->f_path;
1471
1472 if (tsec->sid != fsec->sid) {
1473 rc = avc_has_perm(tsec->sid, fsec->sid,
1474 SECCLASS_FD,
1475 FD__USE,
1476 &ad);
1477 if (rc)
1478 return rc;
1479 }
1480
1481 /* av is zero if only checking access to the descriptor. */
1482 if (av)
1483 return inode_has_perm(tsk, inode, av, &ad);
1484
1485 return 0;
1486 }
1487
1488 /* Check whether a task can create a file. */
1489 static int may_create(struct inode *dir,
1490 struct dentry *dentry,
1491 u16 tclass)
1492 {
1493 struct task_security_struct *tsec;
1494 struct inode_security_struct *dsec;
1495 struct superblock_security_struct *sbsec;
1496 u32 newsid;
1497 struct avc_audit_data ad;
1498 int rc;
1499
1500 tsec = current->security;
1501 dsec = dir->i_security;
1502 sbsec = dir->i_sb->s_security;
1503
1504 AVC_AUDIT_DATA_INIT(&ad, FS);
1505 ad.u.fs.path.dentry = dentry;
1506
1507 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1508 DIR__ADD_NAME | DIR__SEARCH,
1509 &ad);
1510 if (rc)
1511 return rc;
1512
1513 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1514 newsid = tsec->create_sid;
1515 } else {
1516 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1517 &newsid);
1518 if (rc)
1519 return rc;
1520 }
1521
1522 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1523 if (rc)
1524 return rc;
1525
1526 return avc_has_perm(newsid, sbsec->sid,
1527 SECCLASS_FILESYSTEM,
1528 FILESYSTEM__ASSOCIATE, &ad);
1529 }
1530
1531 /* Check whether a task can create a key. */
1532 static int may_create_key(u32 ksid,
1533 struct task_struct *ctx)
1534 {
1535 struct task_security_struct *tsec;
1536
1537 tsec = ctx->security;
1538
1539 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1540 }
1541
1542 #define MAY_LINK 0
1543 #define MAY_UNLINK 1
1544 #define MAY_RMDIR 2
1545
1546 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1547 static int may_link(struct inode *dir,
1548 struct dentry *dentry,
1549 int kind)
1550
1551 {
1552 struct task_security_struct *tsec;
1553 struct inode_security_struct *dsec, *isec;
1554 struct avc_audit_data ad;
1555 u32 av;
1556 int rc;
1557
1558 tsec = current->security;
1559 dsec = dir->i_security;
1560 isec = dentry->d_inode->i_security;
1561
1562 AVC_AUDIT_DATA_INIT(&ad, FS);
1563 ad.u.fs.path.dentry = dentry;
1564
1565 av = DIR__SEARCH;
1566 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1567 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1568 if (rc)
1569 return rc;
1570
1571 switch (kind) {
1572 case MAY_LINK:
1573 av = FILE__LINK;
1574 break;
1575 case MAY_UNLINK:
1576 av = FILE__UNLINK;
1577 break;
1578 case MAY_RMDIR:
1579 av = DIR__RMDIR;
1580 break;
1581 default:
1582 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1583 __func__, kind);
1584 return 0;
1585 }
1586
1587 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1588 return rc;
1589 }
1590
1591 static inline int may_rename(struct inode *old_dir,
1592 struct dentry *old_dentry,
1593 struct inode *new_dir,
1594 struct dentry *new_dentry)
1595 {
1596 struct task_security_struct *tsec;
1597 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1598 struct avc_audit_data ad;
1599 u32 av;
1600 int old_is_dir, new_is_dir;
1601 int rc;
1602
1603 tsec = current->security;
1604 old_dsec = old_dir->i_security;
1605 old_isec = old_dentry->d_inode->i_security;
1606 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1607 new_dsec = new_dir->i_security;
1608
1609 AVC_AUDIT_DATA_INIT(&ad, FS);
1610
1611 ad.u.fs.path.dentry = old_dentry;
1612 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1613 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1614 if (rc)
1615 return rc;
1616 rc = avc_has_perm(tsec->sid, old_isec->sid,
1617 old_isec->sclass, FILE__RENAME, &ad);
1618 if (rc)
1619 return rc;
1620 if (old_is_dir && new_dir != old_dir) {
1621 rc = avc_has_perm(tsec->sid, old_isec->sid,
1622 old_isec->sclass, DIR__REPARENT, &ad);
1623 if (rc)
1624 return rc;
1625 }
1626
1627 ad.u.fs.path.dentry = new_dentry;
1628 av = DIR__ADD_NAME | DIR__SEARCH;
1629 if (new_dentry->d_inode)
1630 av |= DIR__REMOVE_NAME;
1631 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1632 if (rc)
1633 return rc;
1634 if (new_dentry->d_inode) {
1635 new_isec = new_dentry->d_inode->i_security;
1636 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1637 rc = avc_has_perm(tsec->sid, new_isec->sid,
1638 new_isec->sclass,
1639 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1640 if (rc)
1641 return rc;
1642 }
1643
1644 return 0;
1645 }
1646
1647 /* Check whether a task can perform a filesystem operation. */
1648 static int superblock_has_perm(struct task_struct *tsk,
1649 struct super_block *sb,
1650 u32 perms,
1651 struct avc_audit_data *ad)
1652 {
1653 struct task_security_struct *tsec;
1654 struct superblock_security_struct *sbsec;
1655
1656 tsec = tsk->security;
1657 sbsec = sb->s_security;
1658 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1659 perms, ad);
1660 }
1661
1662 /* Convert a Linux mode and permission mask to an access vector. */
1663 static inline u32 file_mask_to_av(int mode, int mask)
1664 {
1665 u32 av = 0;
1666
1667 if ((mode & S_IFMT) != S_IFDIR) {
1668 if (mask & MAY_EXEC)
1669 av |= FILE__EXECUTE;
1670 if (mask & MAY_READ)
1671 av |= FILE__READ;
1672
1673 if (mask & MAY_APPEND)
1674 av |= FILE__APPEND;
1675 else if (mask & MAY_WRITE)
1676 av |= FILE__WRITE;
1677
1678 } else {
1679 if (mask & MAY_EXEC)
1680 av |= DIR__SEARCH;
1681 if (mask & MAY_WRITE)
1682 av |= DIR__WRITE;
1683 if (mask & MAY_READ)
1684 av |= DIR__READ;
1685 }
1686
1687 return av;
1688 }
1689
1690 /*
1691 * Convert a file mask to an access vector and include the correct open
1692 * open permission.
1693 */
1694 static inline u32 open_file_mask_to_av(int mode, int mask)
1695 {
1696 u32 av = file_mask_to_av(mode, mask);
1697
1698 if (selinux_policycap_openperm) {
1699 /*
1700 * lnk files and socks do not really have an 'open'
1701 */
1702 if (S_ISREG(mode))
1703 av |= FILE__OPEN;
1704 else if (S_ISCHR(mode))
1705 av |= CHR_FILE__OPEN;
1706 else if (S_ISBLK(mode))
1707 av |= BLK_FILE__OPEN;
1708 else if (S_ISFIFO(mode))
1709 av |= FIFO_FILE__OPEN;
1710 else if (S_ISDIR(mode))
1711 av |= DIR__OPEN;
1712 else
1713 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1714 "unknown mode:%x\n", __func__, mode);
1715 }
1716 return av;
1717 }
1718
1719 /* Convert a Linux file to an access vector. */
1720 static inline u32 file_to_av(struct file *file)
1721 {
1722 u32 av = 0;
1723
1724 if (file->f_mode & FMODE_READ)
1725 av |= FILE__READ;
1726 if (file->f_mode & FMODE_WRITE) {
1727 if (file->f_flags & O_APPEND)
1728 av |= FILE__APPEND;
1729 else
1730 av |= FILE__WRITE;
1731 }
1732 if (!av) {
1733 /*
1734 * Special file opened with flags 3 for ioctl-only use.
1735 */
1736 av = FILE__IOCTL;
1737 }
1738
1739 return av;
1740 }
1741
1742 /* Hook functions begin here. */
1743
1744 static int selinux_ptrace_may_access(struct task_struct *child,
1745 unsigned int mode)
1746 {
1747 int rc;
1748
1749 rc = secondary_ops->ptrace_may_access(child, mode);
1750 if (rc)
1751 return rc;
1752
1753 if (mode == PTRACE_MODE_READ) {
1754 struct task_security_struct *tsec = current->security;
1755 struct task_security_struct *csec = child->security;
1756 return avc_has_perm(tsec->sid, csec->sid,
1757 SECCLASS_FILE, FILE__READ, NULL);
1758 }
1759
1760 return task_has_perm(current, child, PROCESS__PTRACE);
1761 }
1762
1763 static int selinux_ptrace_traceme(struct task_struct *parent)
1764 {
1765 int rc;
1766
1767 rc = secondary_ops->ptrace_traceme(parent);
1768 if (rc)
1769 return rc;
1770
1771 return task_has_perm(parent, current, PROCESS__PTRACE);
1772 }
1773
1774 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1775 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1776 {
1777 int error;
1778
1779 error = task_has_perm(current, target, PROCESS__GETCAP);
1780 if (error)
1781 return error;
1782
1783 return secondary_ops->capget(target, effective, inheritable, permitted);
1784 }
1785
1786 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1787 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1788 {
1789 int error;
1790
1791 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1792 if (error)
1793 return error;
1794
1795 return task_has_perm(current, target, PROCESS__SETCAP);
1796 }
1797
1798 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1799 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1800 {
1801 secondary_ops->capset_set(target, effective, inheritable, permitted);
1802 }
1803
1804 static int selinux_capable(struct task_struct *tsk, int cap)
1805 {
1806 int rc;
1807
1808 rc = secondary_ops->capable(tsk, cap);
1809 if (rc)
1810 return rc;
1811
1812 return task_has_capability(tsk, cap);
1813 }
1814
1815 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1816 {
1817 int buflen, rc;
1818 char *buffer, *path, *end;
1819
1820 rc = -ENOMEM;
1821 buffer = (char *)__get_free_page(GFP_KERNEL);
1822 if (!buffer)
1823 goto out;
1824
1825 buflen = PAGE_SIZE;
1826 end = buffer+buflen;
1827 *--end = '\0';
1828 buflen--;
1829 path = end-1;
1830 *path = '/';
1831 while (table) {
1832 const char *name = table->procname;
1833 size_t namelen = strlen(name);
1834 buflen -= namelen + 1;
1835 if (buflen < 0)
1836 goto out_free;
1837 end -= namelen;
1838 memcpy(end, name, namelen);
1839 *--end = '/';
1840 path = end;
1841 table = table->parent;
1842 }
1843 buflen -= 4;
1844 if (buflen < 0)
1845 goto out_free;
1846 end -= 4;
1847 memcpy(end, "/sys", 4);
1848 path = end;
1849 rc = security_genfs_sid("proc", path, tclass, sid);
1850 out_free:
1851 free_page((unsigned long)buffer);
1852 out:
1853 return rc;
1854 }
1855
1856 static int selinux_sysctl(ctl_table *table, int op)
1857 {
1858 int error = 0;
1859 u32 av;
1860 struct task_security_struct *tsec;
1861 u32 tsid;
1862 int rc;
1863
1864 rc = secondary_ops->sysctl(table, op);
1865 if (rc)
1866 return rc;
1867
1868 tsec = current->security;
1869
1870 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1871 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1872 if (rc) {
1873 /* Default to the well-defined sysctl SID. */
1874 tsid = SECINITSID_SYSCTL;
1875 }
1876
1877 /* The op values are "defined" in sysctl.c, thereby creating
1878 * a bad coupling between this module and sysctl.c */
1879 if (op == 001) {
1880 error = avc_has_perm(tsec->sid, tsid,
1881 SECCLASS_DIR, DIR__SEARCH, NULL);
1882 } else {
1883 av = 0;
1884 if (op & 004)
1885 av |= FILE__READ;
1886 if (op & 002)
1887 av |= FILE__WRITE;
1888 if (av)
1889 error = avc_has_perm(tsec->sid, tsid,
1890 SECCLASS_FILE, av, NULL);
1891 }
1892
1893 return error;
1894 }
1895
1896 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1897 {
1898 int rc = 0;
1899
1900 if (!sb)
1901 return 0;
1902
1903 switch (cmds) {
1904 case Q_SYNC:
1905 case Q_QUOTAON:
1906 case Q_QUOTAOFF:
1907 case Q_SETINFO:
1908 case Q_SETQUOTA:
1909 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1910 NULL);
1911 break;
1912 case Q_GETFMT:
1913 case Q_GETINFO:
1914 case Q_GETQUOTA:
1915 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1916 NULL);
1917 break;
1918 default:
1919 rc = 0; /* let the kernel handle invalid cmds */
1920 break;
1921 }
1922 return rc;
1923 }
1924
1925 static int selinux_quota_on(struct dentry *dentry)
1926 {
1927 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1928 }
1929
1930 static int selinux_syslog(int type)
1931 {
1932 int rc;
1933
1934 rc = secondary_ops->syslog(type);
1935 if (rc)
1936 return rc;
1937
1938 switch (type) {
1939 case 3: /* Read last kernel messages */
1940 case 10: /* Return size of the log buffer */
1941 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1942 break;
1943 case 6: /* Disable logging to console */
1944 case 7: /* Enable logging to console */
1945 case 8: /* Set level of messages printed to console */
1946 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1947 break;
1948 case 0: /* Close log */
1949 case 1: /* Open log */
1950 case 2: /* Read from log */
1951 case 4: /* Read/clear last kernel messages */
1952 case 5: /* Clear ring buffer */
1953 default:
1954 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1955 break;
1956 }
1957 return rc;
1958 }
1959
1960 /*
1961 * Check that a process has enough memory to allocate a new virtual
1962 * mapping. 0 means there is enough memory for the allocation to
1963 * succeed and -ENOMEM implies there is not.
1964 *
1965 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1966 * if the capability is granted, but __vm_enough_memory requires 1 if
1967 * the capability is granted.
1968 *
1969 * Do not audit the selinux permission check, as this is applied to all
1970 * processes that allocate mappings.
1971 */
1972 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1973 {
1974 int rc, cap_sys_admin = 0;
1975 struct task_security_struct *tsec = current->security;
1976
1977 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1978 if (rc == 0)
1979 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1980 SECCLASS_CAPABILITY,
1981 CAP_TO_MASK(CAP_SYS_ADMIN),
1982 0,
1983 NULL);
1984
1985 if (rc == 0)
1986 cap_sys_admin = 1;
1987
1988 return __vm_enough_memory(mm, pages, cap_sys_admin);
1989 }
1990
1991 /* binprm security operations */
1992
1993 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1994 {
1995 struct bprm_security_struct *bsec;
1996
1997 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1998 if (!bsec)
1999 return -ENOMEM;
2000
2001 bsec->sid = SECINITSID_UNLABELED;
2002 bsec->set = 0;
2003
2004 bprm->security = bsec;
2005 return 0;
2006 }
2007
2008 static int selinux_bprm_set_security(struct linux_binprm *bprm)
2009 {
2010 struct task_security_struct *tsec;
2011 struct inode *inode = bprm->file->f_path.dentry->d_inode;
2012 struct inode_security_struct *isec;
2013 struct bprm_security_struct *bsec;
2014 u32 newsid;
2015 struct avc_audit_data ad;
2016 int rc;
2017
2018 rc = secondary_ops->bprm_set_security(bprm);
2019 if (rc)
2020 return rc;
2021
2022 bsec = bprm->security;
2023
2024 if (bsec->set)
2025 return 0;
2026
2027 tsec = current->security;
2028 isec = inode->i_security;
2029
2030 /* Default to the current task SID. */
2031 bsec->sid = tsec->sid;
2032
2033 /* Reset fs, key, and sock SIDs on execve. */
2034 tsec->create_sid = 0;
2035 tsec->keycreate_sid = 0;
2036 tsec->sockcreate_sid = 0;
2037
2038 if (tsec->exec_sid) {
2039 newsid = tsec->exec_sid;
2040 /* Reset exec SID on execve. */
2041 tsec->exec_sid = 0;
2042 } else {
2043 /* Check for a default transition on this program. */
2044 rc = security_transition_sid(tsec->sid, isec->sid,
2045 SECCLASS_PROCESS, &newsid);
2046 if (rc)
2047 return rc;
2048 }
2049
2050 AVC_AUDIT_DATA_INIT(&ad, FS);
2051 ad.u.fs.path = bprm->file->f_path;
2052
2053 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2054 newsid = tsec->sid;
2055
2056 if (tsec->sid == newsid) {
2057 rc = avc_has_perm(tsec->sid, isec->sid,
2058 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2059 if (rc)
2060 return rc;
2061 } else {
2062 /* Check permissions for the transition. */
2063 rc = avc_has_perm(tsec->sid, newsid,
2064 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2065 if (rc)
2066 return rc;
2067
2068 rc = avc_has_perm(newsid, isec->sid,
2069 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2070 if (rc)
2071 return rc;
2072
2073 /* Clear any possibly unsafe personality bits on exec: */
2074 current->personality &= ~PER_CLEAR_ON_SETID;
2075
2076 /* Set the security field to the new SID. */
2077 bsec->sid = newsid;
2078 }
2079
2080 bsec->set = 1;
2081 return 0;
2082 }
2083
2084 static int selinux_bprm_check_security(struct linux_binprm *bprm)
2085 {
2086 return secondary_ops->bprm_check_security(bprm);
2087 }
2088
2089
2090 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2091 {
2092 struct task_security_struct *tsec = current->security;
2093 int atsecure = 0;
2094
2095 if (tsec->osid != tsec->sid) {
2096 /* Enable secure mode for SIDs transitions unless
2097 the noatsecure permission is granted between
2098 the two SIDs, i.e. ahp returns 0. */
2099 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2100 SECCLASS_PROCESS,
2101 PROCESS__NOATSECURE, NULL);
2102 }
2103
2104 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2105 }
2106
2107 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2108 {
2109 kfree(bprm->security);
2110 bprm->security = NULL;
2111 }
2112
2113 extern struct vfsmount *selinuxfs_mount;
2114 extern struct dentry *selinux_null;
2115
2116 /* Derived from fs/exec.c:flush_old_files. */
2117 static inline void flush_unauthorized_files(struct files_struct *files)
2118 {
2119 struct avc_audit_data ad;
2120 struct file *file, *devnull = NULL;
2121 struct tty_struct *tty;
2122 struct fdtable *fdt;
2123 long j = -1;
2124 int drop_tty = 0;
2125
2126 tty = get_current_tty();
2127 if (tty) {
2128 file_list_lock();
2129 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2130 if (file) {
2131 /* Revalidate access to controlling tty.
2132 Use inode_has_perm on the tty inode directly rather
2133 than using file_has_perm, as this particular open
2134 file may belong to another process and we are only
2135 interested in the inode-based check here. */
2136 struct inode *inode = file->f_path.dentry->d_inode;
2137 if (inode_has_perm(current, inode,
2138 FILE__READ | FILE__WRITE, NULL)) {
2139 drop_tty = 1;
2140 }
2141 }
2142 file_list_unlock();
2143 tty_kref_put(tty);
2144 }
2145 /* Reset controlling tty. */
2146 if (drop_tty)
2147 no_tty();
2148
2149 /* Revalidate access to inherited open files. */
2150
2151 AVC_AUDIT_DATA_INIT(&ad, FS);
2152
2153 spin_lock(&files->file_lock);
2154 for (;;) {
2155 unsigned long set, i;
2156 int fd;
2157
2158 j++;
2159 i = j * __NFDBITS;
2160 fdt = files_fdtable(files);
2161 if (i >= fdt->max_fds)
2162 break;
2163 set = fdt->open_fds->fds_bits[j];
2164 if (!set)
2165 continue;
2166 spin_unlock(&files->file_lock);
2167 for ( ; set ; i++, set >>= 1) {
2168 if (set & 1) {
2169 file = fget(i);
2170 if (!file)
2171 continue;
2172 if (file_has_perm(current,
2173 file,
2174 file_to_av(file))) {
2175 sys_close(i);
2176 fd = get_unused_fd();
2177 if (fd != i) {
2178 if (fd >= 0)
2179 put_unused_fd(fd);
2180 fput(file);
2181 continue;
2182 }
2183 if (devnull) {
2184 get_file(devnull);
2185 } else {
2186 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2187 if (IS_ERR(devnull)) {
2188 devnull = NULL;
2189 put_unused_fd(fd);
2190 fput(file);
2191 continue;
2192 }
2193 }
2194 fd_install(fd, devnull);
2195 }
2196 fput(file);
2197 }
2198 }
2199 spin_lock(&files->file_lock);
2200
2201 }
2202 spin_unlock(&files->file_lock);
2203 }
2204
2205 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2206 {
2207 struct task_security_struct *tsec;
2208 struct bprm_security_struct *bsec;
2209 u32 sid;
2210 int rc;
2211
2212 secondary_ops->bprm_apply_creds(bprm, unsafe);
2213
2214 tsec = current->security;
2215
2216 bsec = bprm->security;
2217 sid = bsec->sid;
2218
2219 tsec->osid = tsec->sid;
2220 bsec->unsafe = 0;
2221 if (tsec->sid != sid) {
2222 /* Check for shared state. If not ok, leave SID
2223 unchanged and kill. */
2224 if (unsafe & LSM_UNSAFE_SHARE) {
2225 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2226 PROCESS__SHARE, NULL);
2227 if (rc) {
2228 bsec->unsafe = 1;
2229 return;
2230 }
2231 }
2232
2233 /* Check for ptracing, and update the task SID if ok.
2234 Otherwise, leave SID unchanged and kill. */
2235 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2236 struct task_struct *tracer;
2237 struct task_security_struct *sec;
2238 u32 ptsid = 0;
2239
2240 rcu_read_lock();
2241 tracer = tracehook_tracer_task(current);
2242 if (likely(tracer != NULL)) {
2243 sec = tracer->security;
2244 ptsid = sec->sid;
2245 }
2246 rcu_read_unlock();
2247
2248 if (ptsid != 0) {
2249 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2250 PROCESS__PTRACE, NULL);
2251 if (rc) {
2252 bsec->unsafe = 1;
2253 return;
2254 }
2255 }
2256 }
2257 tsec->sid = sid;
2258 }
2259 }
2260
2261 /*
2262 * called after apply_creds without the task lock held
2263 */
2264 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2265 {
2266 struct task_security_struct *tsec;
2267 struct rlimit *rlim, *initrlim;
2268 struct itimerval itimer;
2269 struct bprm_security_struct *bsec;
2270 int rc, i;
2271
2272 tsec = current->security;
2273 bsec = bprm->security;
2274
2275 if (bsec->unsafe) {
2276 force_sig_specific(SIGKILL, current);
2277 return;
2278 }
2279 if (tsec->osid == tsec->sid)
2280 return;
2281
2282 /* Close files for which the new task SID is not authorized. */
2283 flush_unauthorized_files(current->files);
2284
2285 /* Check whether the new SID can inherit signal state
2286 from the old SID. If not, clear itimers to avoid
2287 subsequent signal generation and flush and unblock
2288 signals. This must occur _after_ the task SID has
2289 been updated so that any kill done after the flush
2290 will be checked against the new SID. */
2291 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2292 PROCESS__SIGINH, NULL);
2293 if (rc) {
2294 memset(&itimer, 0, sizeof itimer);
2295 for (i = 0; i < 3; i++)
2296 do_setitimer(i, &itimer, NULL);
2297 flush_signals(current);
2298 spin_lock_irq(&current->sighand->siglock);
2299 flush_signal_handlers(current, 1);
2300 sigemptyset(&current->blocked);
2301 recalc_sigpending();
2302 spin_unlock_irq(&current->sighand->siglock);
2303 }
2304
2305 /* Always clear parent death signal on SID transitions. */
2306 current->pdeath_signal = 0;
2307
2308 /* Check whether the new SID can inherit resource limits
2309 from the old SID. If not, reset all soft limits to
2310 the lower of the current task's hard limit and the init
2311 task's soft limit. Note that the setting of hard limits
2312 (even to lower them) can be controlled by the setrlimit
2313 check. The inclusion of the init task's soft limit into
2314 the computation is to avoid resetting soft limits higher
2315 than the default soft limit for cases where the default
2316 is lower than the hard limit, e.g. RLIMIT_CORE or
2317 RLIMIT_STACK.*/
2318 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2319 PROCESS__RLIMITINH, NULL);
2320 if (rc) {
2321 for (i = 0; i < RLIM_NLIMITS; i++) {
2322 rlim = current->signal->rlim + i;
2323 initrlim = init_task.signal->rlim+i;
2324 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2325 }
2326 update_rlimit_cpu(rlim->rlim_cur);
2327 }
2328
2329 /* Wake up the parent if it is waiting so that it can
2330 recheck wait permission to the new task SID. */
2331 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2332 }
2333
2334 /* superblock security operations */
2335
2336 static int selinux_sb_alloc_security(struct super_block *sb)
2337 {
2338 return superblock_alloc_security(sb);
2339 }
2340
2341 static void selinux_sb_free_security(struct super_block *sb)
2342 {
2343 superblock_free_security(sb);
2344 }
2345
2346 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2347 {
2348 if (plen > olen)
2349 return 0;
2350
2351 return !memcmp(prefix, option, plen);
2352 }
2353
2354 static inline int selinux_option(char *option, int len)
2355 {
2356 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2357 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2358 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2359 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2360 }
2361
2362 static inline void take_option(char **to, char *from, int *first, int len)
2363 {
2364 if (!*first) {
2365 **to = ',';
2366 *to += 1;
2367 } else
2368 *first = 0;
2369 memcpy(*to, from, len);
2370 *to += len;
2371 }
2372
2373 static inline void take_selinux_option(char **to, char *from, int *first,
2374 int len)
2375 {
2376 int current_size = 0;
2377
2378 if (!*first) {
2379 **to = '|';
2380 *to += 1;
2381 } else
2382 *first = 0;
2383
2384 while (current_size < len) {
2385 if (*from != '"') {
2386 **to = *from;
2387 *to += 1;
2388 }
2389 from += 1;
2390 current_size += 1;
2391 }
2392 }
2393
2394 static int selinux_sb_copy_data(char *orig, char *copy)
2395 {
2396 int fnosec, fsec, rc = 0;
2397 char *in_save, *in_curr, *in_end;
2398 char *sec_curr, *nosec_save, *nosec;
2399 int open_quote = 0;
2400
2401 in_curr = orig;
2402 sec_curr = copy;
2403
2404 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2405 if (!nosec) {
2406 rc = -ENOMEM;
2407 goto out;
2408 }
2409
2410 nosec_save = nosec;
2411 fnosec = fsec = 1;
2412 in_save = in_end = orig;
2413
2414 do {
2415 if (*in_end == '"')
2416 open_quote = !open_quote;
2417 if ((*in_end == ',' && open_quote == 0) ||
2418 *in_end == '\0') {
2419 int len = in_end - in_curr;
2420
2421 if (selinux_option(in_curr, len))
2422 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2423 else
2424 take_option(&nosec, in_curr, &fnosec, len);
2425
2426 in_curr = in_end + 1;
2427 }
2428 } while (*in_end++);
2429
2430 strcpy(in_save, nosec_save);
2431 free_page((unsigned long)nosec_save);
2432 out:
2433 return rc;
2434 }
2435
2436 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2437 {
2438 struct avc_audit_data ad;
2439 int rc;
2440
2441 rc = superblock_doinit(sb, data);
2442 if (rc)
2443 return rc;
2444
2445 AVC_AUDIT_DATA_INIT(&ad, FS);
2446 ad.u.fs.path.dentry = sb->s_root;
2447 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2448 }
2449
2450 static int selinux_sb_statfs(struct dentry *dentry)
2451 {
2452 struct avc_audit_data ad;
2453
2454 AVC_AUDIT_DATA_INIT(&ad, FS);
2455 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2456 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2457 }
2458
2459 static int selinux_mount(char *dev_name,
2460 struct path *path,
2461 char *type,
2462 unsigned long flags,
2463 void *data)
2464 {
2465 int rc;
2466
2467 rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
2468 if (rc)
2469 return rc;
2470
2471 if (flags & MS_REMOUNT)
2472 return superblock_has_perm(current, path->mnt->mnt_sb,
2473 FILESYSTEM__REMOUNT, NULL);
2474 else
2475 return dentry_has_perm(current, path->mnt, path->dentry,
2476 FILE__MOUNTON);
2477 }
2478
2479 static int selinux_umount(struct vfsmount *mnt, int flags)
2480 {
2481 int rc;
2482
2483 rc = secondary_ops->sb_umount(mnt, flags);
2484 if (rc)
2485 return rc;
2486
2487 return superblock_has_perm(current, mnt->mnt_sb,
2488 FILESYSTEM__UNMOUNT, NULL);
2489 }
2490
2491 /* inode security operations */
2492
2493 static int selinux_inode_alloc_security(struct inode *inode)
2494 {
2495 return inode_alloc_security(inode);
2496 }
2497
2498 static void selinux_inode_free_security(struct inode *inode)
2499 {
2500 inode_free_security(inode);
2501 }
2502
2503 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2504 char **name, void **value,
2505 size_t *len)
2506 {
2507 struct task_security_struct *tsec;
2508 struct inode_security_struct *dsec;
2509 struct superblock_security_struct *sbsec;
2510 u32 newsid, clen;
2511 int rc;
2512 char *namep = NULL, *context;
2513
2514 tsec = current->security;
2515 dsec = dir->i_security;
2516 sbsec = dir->i_sb->s_security;
2517
2518 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2519 newsid = tsec->create_sid;
2520 } else {
2521 rc = security_transition_sid(tsec->sid, dsec->sid,
2522 inode_mode_to_security_class(inode->i_mode),
2523 &newsid);
2524 if (rc) {
2525 printk(KERN_WARNING "%s: "
2526 "security_transition_sid failed, rc=%d (dev=%s "
2527 "ino=%ld)\n",
2528 __func__,
2529 -rc, inode->i_sb->s_id, inode->i_ino);
2530 return rc;
2531 }
2532 }
2533
2534 /* Possibly defer initialization to selinux_complete_init. */
2535 if (sbsec->initialized) {
2536 struct inode_security_struct *isec = inode->i_security;
2537 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2538 isec->sid = newsid;
2539 isec->initialized = 1;
2540 }
2541
2542 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2543 return -EOPNOTSUPP;
2544
2545 if (name) {
2546 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2547 if (!namep)
2548 return -ENOMEM;
2549 *name = namep;
2550 }
2551
2552 if (value && len) {
2553 rc = security_sid_to_context_force(newsid, &context, &clen);
2554 if (rc) {
2555 kfree(namep);
2556 return rc;
2557 }
2558 *value = context;
2559 *len = clen;
2560 }
2561
2562 return 0;
2563 }
2564
2565 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2566 {
2567 return may_create(dir, dentry, SECCLASS_FILE);
2568 }
2569
2570 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2571 {
2572 int rc;
2573
2574 rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
2575 if (rc)
2576 return rc;
2577 return may_link(dir, old_dentry, MAY_LINK);
2578 }
2579
2580 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2581 {
2582 int rc;
2583
2584 rc = secondary_ops->inode_unlink(dir, dentry);
2585 if (rc)
2586 return rc;
2587 return may_link(dir, dentry, MAY_UNLINK);
2588 }
2589
2590 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2591 {
2592 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2593 }
2594
2595 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2596 {
2597 return may_create(dir, dentry, SECCLASS_DIR);
2598 }
2599
2600 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2601 {
2602 return may_link(dir, dentry, MAY_RMDIR);
2603 }
2604
2605 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2606 {
2607 int rc;
2608
2609 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2610 if (rc)
2611 return rc;
2612
2613 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2614 }
2615
2616 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2617 struct inode *new_inode, struct dentry *new_dentry)
2618 {
2619 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2620 }
2621
2622 static int selinux_inode_readlink(struct dentry *dentry)
2623 {
2624 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2625 }
2626
2627 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2628 {
2629 int rc;
2630
2631 rc = secondary_ops->inode_follow_link(dentry, nameidata);
2632 if (rc)
2633 return rc;
2634 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2635 }
2636
2637 static int selinux_inode_permission(struct inode *inode, int mask)
2638 {
2639 int rc;
2640
2641 rc = secondary_ops->inode_permission(inode, mask);
2642 if (rc)
2643 return rc;
2644
2645 if (!mask) {
2646 /* No permission to check. Existence test. */
2647 return 0;
2648 }
2649
2650 return inode_has_perm(current, inode,
2651 open_file_mask_to_av(inode->i_mode, mask), NULL);
2652 }
2653
2654 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2655 {
2656 int rc;
2657
2658 rc = secondary_ops->inode_setattr(dentry, iattr);
2659 if (rc)
2660 return rc;
2661
2662 if (iattr->ia_valid & ATTR_FORCE)
2663 return 0;
2664
2665 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2666 ATTR_ATIME_SET | ATTR_MTIME_SET))
2667 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2668
2669 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2670 }
2671
2672 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2673 {
2674 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2675 }
2676
2677 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2678 {
2679 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2680 sizeof XATTR_SECURITY_PREFIX - 1)) {
2681 if (!strcmp(name, XATTR_NAME_CAPS)) {
2682 if (!capable(CAP_SETFCAP))
2683 return -EPERM;
2684 } else if (!capable(CAP_SYS_ADMIN)) {
2685 /* A different attribute in the security namespace.
2686 Restrict to administrator. */
2687 return -EPERM;
2688 }
2689 }
2690
2691 /* Not an attribute we recognize, so just check the
2692 ordinary setattr permission. */
2693 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2694 }
2695
2696 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2697 const void *value, size_t size, int flags)
2698 {
2699 struct task_security_struct *tsec = current->security;
2700 struct inode *inode = dentry->d_inode;
2701 struct inode_security_struct *isec = inode->i_security;
2702 struct superblock_security_struct *sbsec;
2703 struct avc_audit_data ad;
2704 u32 newsid;
2705 int rc = 0;
2706
2707 if (strcmp(name, XATTR_NAME_SELINUX))
2708 return selinux_inode_setotherxattr(dentry, name);
2709
2710 sbsec = inode->i_sb->s_security;
2711 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2712 return -EOPNOTSUPP;
2713
2714 if (!is_owner_or_cap(inode))
2715 return -EPERM;
2716
2717 AVC_AUDIT_DATA_INIT(&ad, FS);
2718 ad.u.fs.path.dentry = dentry;
2719
2720 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2721 FILE__RELABELFROM, &ad);
2722 if (rc)
2723 return rc;
2724
2725 rc = security_context_to_sid(value, size, &newsid);
2726 if (rc == -EINVAL) {
2727 if (!capable(CAP_MAC_ADMIN))
2728 return rc;
2729 rc = security_context_to_sid_force(value, size, &newsid);
2730 }
2731 if (rc)
2732 return rc;
2733
2734 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2735 FILE__RELABELTO, &ad);
2736 if (rc)
2737 return rc;
2738
2739 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2740 isec->sclass);
2741 if (rc)
2742 return rc;
2743
2744 return avc_has_perm(newsid,
2745 sbsec->sid,
2746 SECCLASS_FILESYSTEM,
2747 FILESYSTEM__ASSOCIATE,
2748 &ad);
2749 }
2750
2751 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2752 const void *value, size_t size,
2753 int flags)
2754 {
2755 struct inode *inode = dentry->d_inode;
2756 struct inode_security_struct *isec = inode->i_security;
2757 u32 newsid;
2758 int rc;
2759
2760 if (strcmp(name, XATTR_NAME_SELINUX)) {
2761 /* Not an attribute we recognize, so nothing to do. */
2762 return;
2763 }
2764
2765 rc = security_context_to_sid_force(value, size, &newsid);
2766 if (rc) {
2767 printk(KERN_ERR "SELinux: unable to map context to SID"
2768 "for (%s, %lu), rc=%d\n",
2769 inode->i_sb->s_id, inode->i_ino, -rc);
2770 return;
2771 }
2772
2773 isec->sid = newsid;
2774 return;
2775 }
2776
2777 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2778 {
2779 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2780 }
2781
2782 static int selinux_inode_listxattr(struct dentry *dentry)
2783 {
2784 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2785 }
2786
2787 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2788 {
2789 if (strcmp(name, XATTR_NAME_SELINUX))
2790 return selinux_inode_setotherxattr(dentry, name);
2791
2792 /* No one is allowed to remove a SELinux security label.
2793 You can change the label, but all data must be labeled. */
2794 return -EACCES;
2795 }
2796
2797 /*
2798 * Copy the inode security context value to the user.
2799 *
2800 * Permission check is handled by selinux_inode_getxattr hook.
2801 */
2802 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2803 {
2804 u32 size;
2805 int error;
2806 char *context = NULL;
2807 struct task_security_struct *tsec = current->security;
2808 struct inode_security_struct *isec = inode->i_security;
2809
2810 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2811 return -EOPNOTSUPP;
2812
2813 /*
2814 * If the caller has CAP_MAC_ADMIN, then get the raw context
2815 * value even if it is not defined by current policy; otherwise,
2816 * use the in-core value under current policy.
2817 * Use the non-auditing forms of the permission checks since
2818 * getxattr may be called by unprivileged processes commonly
2819 * and lack of permission just means that we fall back to the
2820 * in-core context value, not a denial.
2821 */
2822 error = secondary_ops->capable(current, CAP_MAC_ADMIN);
2823 if (!error)
2824 error = avc_has_perm_noaudit(tsec->sid, tsec->sid,
2825 SECCLASS_CAPABILITY2,
2826 CAPABILITY2__MAC_ADMIN,
2827 0,
2828 NULL);
2829 if (!error)
2830 error = security_sid_to_context_force(isec->sid, &context,
2831 &size);
2832 else
2833 error = security_sid_to_context(isec->sid, &context, &size);
2834 if (error)
2835 return error;
2836 error = size;
2837 if (alloc) {
2838 *buffer = context;
2839 goto out_nofree;
2840 }
2841 kfree(context);
2842 out_nofree:
2843 return error;
2844 }
2845
2846 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2847 const void *value, size_t size, int flags)
2848 {
2849 struct inode_security_struct *isec = inode->i_security;
2850 u32 newsid;
2851 int rc;
2852
2853 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2854 return -EOPNOTSUPP;
2855
2856 if (!value || !size)
2857 return -EACCES;
2858
2859 rc = security_context_to_sid((void *)value, size, &newsid);
2860 if (rc)
2861 return rc;
2862
2863 isec->sid = newsid;
2864 return 0;
2865 }
2866
2867 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2868 {
2869 const int len = sizeof(XATTR_NAME_SELINUX);
2870 if (buffer && len <= buffer_size)
2871 memcpy(buffer, XATTR_NAME_SELINUX, len);
2872 return len;
2873 }
2874
2875 static int selinux_inode_need_killpriv(struct dentry *dentry)
2876 {
2877 return secondary_ops->inode_need_killpriv(dentry);
2878 }
2879
2880 static int selinux_inode_killpriv(struct dentry *dentry)
2881 {
2882 return secondary_ops->inode_killpriv(dentry);
2883 }
2884
2885 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2886 {
2887 struct inode_security_struct *isec = inode->i_security;
2888 *secid = isec->sid;
2889 }
2890
2891 /* file security operations */
2892
2893 static int selinux_revalidate_file_permission(struct file *file, int mask)
2894 {
2895 int rc;
2896 struct inode *inode = file->f_path.dentry->d_inode;
2897
2898 if (!mask) {
2899 /* No permission to check. Existence test. */
2900 return 0;
2901 }
2902
2903 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2904 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2905 mask |= MAY_APPEND;
2906
2907 rc = file_has_perm(current, file,
2908 file_mask_to_av(inode->i_mode, mask));
2909 if (rc)
2910 return rc;
2911
2912 return selinux_netlbl_inode_permission(inode, mask);
2913 }
2914
2915 static int selinux_file_permission(struct file *file, int mask)
2916 {
2917 struct inode *inode = file->f_path.dentry->d_inode;
2918 struct task_security_struct *tsec = current->security;
2919 struct file_security_struct *fsec = file->f_security;
2920 struct inode_security_struct *isec = inode->i_security;
2921
2922 if (!mask) {
2923 /* No permission to check. Existence test. */
2924 return 0;
2925 }
2926
2927 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2928 && fsec->pseqno == avc_policy_seqno())
2929 return selinux_netlbl_inode_permission(inode, mask);
2930
2931 return selinux_revalidate_file_permission(file, mask);
2932 }
2933
2934 static int selinux_file_alloc_security(struct file *file)
2935 {
2936 return file_alloc_security(file);
2937 }
2938
2939 static void selinux_file_free_security(struct file *file)
2940 {
2941 file_free_security(file);
2942 }
2943
2944 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2945 unsigned long arg)
2946 {
2947 u32 av = 0;
2948
2949 if (_IOC_DIR(cmd) & _IOC_WRITE)
2950 av |= FILE__WRITE;
2951 if (_IOC_DIR(cmd) & _IOC_READ)
2952 av |= FILE__READ;
2953 if (!av)
2954 av = FILE__IOCTL;
2955
2956 return file_has_perm(current, file, av);
2957 }
2958
2959 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2960 {
2961 #ifndef CONFIG_PPC32
2962 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2963 /*
2964 * We are making executable an anonymous mapping or a
2965 * private file mapping that will also be writable.
2966 * This has an additional check.
2967 */
2968 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2969 if (rc)
2970 return rc;
2971 }
2972 #endif
2973
2974 if (file) {
2975 /* read access is always possible with a mapping */
2976 u32 av = FILE__READ;
2977
2978 /* write access only matters if the mapping is shared */
2979 if (shared && (prot & PROT_WRITE))
2980 av |= FILE__WRITE;
2981
2982 if (prot & PROT_EXEC)
2983 av |= FILE__EXECUTE;
2984
2985 return file_has_perm(current, file, av);
2986 }
2987 return 0;
2988 }
2989
2990 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2991 unsigned long prot, unsigned long flags,
2992 unsigned long addr, unsigned long addr_only)
2993 {
2994 int rc = 0;
2995 u32 sid = ((struct task_security_struct *)(current->security))->sid;
2996
2997 if (addr < mmap_min_addr)
2998 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2999 MEMPROTECT__MMAP_ZERO, NULL);
3000 if (rc || addr_only)
3001 return rc;
3002
3003 if (selinux_checkreqprot)
3004 prot = reqprot;
3005
3006 return file_map_prot_check(file, prot,
3007 (flags & MAP_TYPE) == MAP_SHARED);
3008 }
3009
3010 static int selinux_file_mprotect(struct vm_area_struct *vma,
3011 unsigned long reqprot,
3012 unsigned long prot)
3013 {
3014 int rc;
3015
3016 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
3017 if (rc)
3018 return rc;
3019
3020 if (selinux_checkreqprot)
3021 prot = reqprot;
3022
3023 #ifndef CONFIG_PPC32
3024 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3025 rc = 0;
3026 if (vma->vm_start >= vma->vm_mm->start_brk &&
3027 vma->vm_end <= vma->vm_mm->brk) {
3028 rc = task_has_perm(current, current,
3029 PROCESS__EXECHEAP);
3030 } else if (!vma->vm_file &&
3031 vma->vm_start <= vma->vm_mm->start_stack &&
3032 vma->vm_end >= vma->vm_mm->start_stack) {
3033 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
3034 } else if (vma->vm_file && vma->anon_vma) {
3035 /*
3036 * We are making executable a file mapping that has
3037 * had some COW done. Since pages might have been
3038 * written, check ability to execute the possibly
3039 * modified content. This typically should only
3040 * occur for text relocations.
3041 */
3042 rc = file_has_perm(current, vma->vm_file,
3043 FILE__EXECMOD);
3044 }
3045 if (rc)
3046 return rc;
3047 }
3048 #endif
3049
3050 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3051 }
3052
3053 static int selinux_file_lock(struct file *file, unsigned int cmd)
3054 {
3055 return file_has_perm(current, file, FILE__LOCK);
3056 }
3057
3058 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3059 unsigned long arg)
3060 {
3061 int err = 0;
3062
3063 switch (cmd) {
3064 case F_SETFL:
3065 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3066 err = -EINVAL;
3067 break;
3068 }
3069
3070 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3071 err = file_has_perm(current, file, FILE__WRITE);
3072 break;
3073 }
3074 /* fall through */
3075 case F_SETOWN:
3076 case F_SETSIG:
3077 case F_GETFL:
3078 case F_GETOWN:
3079 case F_GETSIG:
3080 /* Just check FD__USE permission */
3081 err = file_has_perm(current, file, 0);
3082 break;
3083 case F_GETLK:
3084 case F_SETLK:
3085 case F_SETLKW:
3086 #if BITS_PER_LONG == 32
3087 case F_GETLK64:
3088 case F_SETLK64:
3089 case F_SETLKW64:
3090 #endif
3091 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3092 err = -EINVAL;
3093 break;
3094 }
3095 err = file_has_perm(current, file, FILE__LOCK);
3096 break;
3097 }
3098
3099 return err;
3100 }
3101
3102 static int selinux_file_set_fowner(struct file *file)
3103 {
3104 struct task_security_struct *tsec;
3105 struct file_security_struct *fsec;
3106
3107 tsec = current->security;
3108 fsec = file->f_security;
3109 fsec->fown_sid = tsec->sid;
3110
3111 return 0;
3112 }
3113
3114 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3115 struct fown_struct *fown, int signum)
3116 {
3117 struct file *file;
3118 u32 perm;
3119 struct task_security_struct *tsec;
3120 struct file_security_struct *fsec;
3121
3122 /* struct fown_struct is never outside the context of a struct file */
3123 file = container_of(fown, struct file, f_owner);
3124
3125 tsec = tsk->security;
3126 fsec = file->f_security;
3127
3128 if (!signum)
3129 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3130 else
3131 perm = signal_to_av(signum);
3132
3133 return avc_has_perm(fsec->fown_sid, tsec->sid,
3134 SECCLASS_PROCESS, perm, NULL);
3135 }
3136
3137 static int selinux_file_receive(struct file *file)
3138 {
3139 return file_has_perm(current, file, file_to_av(file));
3140 }
3141
3142 static int selinux_dentry_open(struct file *file)
3143 {
3144 struct file_security_struct *fsec;
3145 struct inode *inode;
3146 struct inode_security_struct *isec;
3147 inode = file->f_path.dentry->d_inode;
3148 fsec = file->f_security;
3149 isec = inode->i_security;
3150 /*
3151 * Save inode label and policy sequence number
3152 * at open-time so that selinux_file_permission
3153 * can determine whether revalidation is necessary.
3154 * Task label is already saved in the file security
3155 * struct as its SID.
3156 */
3157 fsec->isid = isec->sid;
3158 fsec->pseqno = avc_policy_seqno();
3159 /*
3160 * Since the inode label or policy seqno may have changed
3161 * between the selinux_inode_permission check and the saving
3162 * of state above, recheck that access is still permitted.
3163 * Otherwise, access might never be revalidated against the
3164 * new inode label or new policy.
3165 * This check is not redundant - do not remove.
3166 */
3167 return inode_has_perm(current, inode, file_to_av(file), NULL);
3168 }
3169
3170 /* task security operations */
3171
3172 static int selinux_task_create(unsigned long clone_flags)
3173 {
3174 int rc;
3175
3176 rc = secondary_ops->task_create(clone_flags);
3177 if (rc)
3178 return rc;
3179
3180 return task_has_perm(current, current, PROCESS__FORK);
3181 }
3182
3183 static int selinux_task_alloc_security(struct task_struct *tsk)
3184 {
3185 struct task_security_struct *tsec1, *tsec2;
3186 int rc;
3187
3188 tsec1 = current->security;
3189
3190 rc = task_alloc_security(tsk);
3191 if (rc)
3192 return rc;
3193 tsec2 = tsk->security;
3194
3195 tsec2->osid = tsec1->osid;
3196 tsec2->sid = tsec1->sid;
3197
3198 /* Retain the exec, fs, key, and sock SIDs across fork */
3199 tsec2->exec_sid = tsec1->exec_sid;
3200 tsec2->create_sid = tsec1->create_sid;
3201 tsec2->keycreate_sid = tsec1->keycreate_sid;
3202 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3203
3204 return 0;
3205 }
3206
3207 static void selinux_task_free_security(struct task_struct *tsk)
3208 {
3209 task_free_security(tsk);
3210 }
3211
3212 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3213 {
3214 /* Since setuid only affects the current process, and
3215 since the SELinux controls are not based on the Linux
3216 identity attributes, SELinux does not need to control
3217 this operation. However, SELinux does control the use
3218 of the CAP_SETUID and CAP_SETGID capabilities using the
3219 capable hook. */
3220 return 0;
3221 }
3222
3223 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3224 {
3225 return secondary_ops->task_post_setuid(id0, id1, id2, flags);
3226 }
3227
3228 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3229 {
3230 /* See the comment for setuid above. */
3231 return 0;
3232 }
3233
3234 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3235 {
3236 return task_has_perm(current, p, PROCESS__SETPGID);
3237 }
3238
3239 static int selinux_task_getpgid(struct task_struct *p)
3240 {
3241 return task_has_perm(current, p, PROCESS__GETPGID);
3242 }
3243
3244 static int selinux_task_getsid(struct task_struct *p)
3245 {
3246 return task_has_perm(current, p, PROCESS__GETSESSION);
3247 }
3248
3249 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3250 {
3251 struct task_security_struct *tsec = p->security;
3252 *secid = tsec->sid;
3253 }
3254
3255 static int selinux_task_setgroups(struct group_info *group_info)
3256 {
3257 /* See the comment for setuid above. */
3258 return 0;
3259 }
3260
3261 static int selinux_task_setnice(struct task_struct *p, int nice)
3262 {
3263 int rc;
3264
3265 rc = secondary_ops->task_setnice(p, nice);
3266 if (rc)
3267 return rc;
3268
3269 return task_has_perm(current, p, PROCESS__SETSCHED);
3270 }
3271
3272 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3273 {
3274 int rc;
3275
3276 rc = secondary_ops->task_setioprio(p, ioprio);
3277 if (rc)
3278 return rc;
3279
3280 return task_has_perm(current, p, PROCESS__SETSCHED);
3281 }
3282
3283 static int selinux_task_getioprio(struct task_struct *p)
3284 {
3285 return task_has_perm(current, p, PROCESS__GETSCHED);
3286 }
3287
3288 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3289 {
3290 struct rlimit *old_rlim = current->signal->rlim + resource;
3291 int rc;
3292
3293 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3294 if (rc)
3295 return rc;
3296
3297 /* Control the ability to change the hard limit (whether
3298 lowering or raising it), so that the hard limit can
3299 later be used as a safe reset point for the soft limit
3300 upon context transitions. See selinux_bprm_apply_creds. */
3301 if (old_rlim->rlim_max != new_rlim->rlim_max)
3302 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3303
3304 return 0;
3305 }
3306
3307 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3308 {
3309 int rc;
3310
3311 rc = secondary_ops->task_setscheduler(p, policy, lp);
3312 if (rc)
3313 return rc;
3314
3315 return task_has_perm(current, p, PROCESS__SETSCHED);
3316 }
3317
3318 static int selinux_task_getscheduler(struct task_struct *p)
3319 {
3320 return task_has_perm(current, p, PROCESS__GETSCHED);
3321 }
3322
3323 static int selinux_task_movememory(struct task_struct *p)
3324 {
3325 return task_has_perm(current, p, PROCESS__SETSCHED);
3326 }
3327
3328 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3329 int sig, u32 secid)
3330 {
3331 u32 perm;
3332 int rc;
3333 struct task_security_struct *tsec;
3334
3335 rc = secondary_ops->task_kill(p, info, sig, secid);
3336 if (rc)
3337 return rc;
3338
3339 if (!sig)
3340 perm = PROCESS__SIGNULL; /* null signal; existence test */
3341 else
3342 perm = signal_to_av(sig);
3343 tsec = p->security;
3344 if (secid)
3345 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3346 else
3347 rc = task_has_perm(current, p, perm);
3348 return rc;
3349 }
3350
3351 static int selinux_task_prctl(int option,
3352 unsigned long arg2,
3353 unsigned long arg3,
3354 unsigned long arg4,
3355 unsigned long arg5,
3356 long *rc_p)
3357 {
3358 /* The current prctl operations do not appear to require
3359 any SELinux controls since they merely observe or modify
3360 the state of the current process. */
3361 return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
3362 }
3363
3364 static int selinux_task_wait(struct task_struct *p)
3365 {
3366 return task_has_perm(p, current, PROCESS__SIGCHLD);
3367 }
3368
3369 static void selinux_task_reparent_to_init(struct task_struct *p)
3370 {
3371 struct task_security_struct *tsec;
3372
3373 secondary_ops->task_reparent_to_init(p);
3374
3375 tsec = p->security;
3376 tsec->osid = tsec->sid;
3377 tsec->sid = SECINITSID_KERNEL;
3378 return;
3379 }
3380
3381 static void selinux_task_to_inode(struct task_struct *p,
3382 struct inode *inode)
3383 {
3384 struct task_security_struct *tsec = p->security;
3385 struct inode_security_struct *isec = inode->i_security;
3386
3387 isec->sid = tsec->sid;
3388 isec->initialized = 1;
3389 return;
3390 }
3391
3392 /* Returns error only if unable to parse addresses */
3393 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3394 struct avc_audit_data *ad, u8 *proto)
3395 {
3396 int offset, ihlen, ret = -EINVAL;
3397 struct iphdr _iph, *ih;
3398
3399 offset = skb_network_offset(skb);
3400 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3401 if (ih == NULL)
3402 goto out;
3403
3404 ihlen = ih->ihl * 4;
3405 if (ihlen < sizeof(_iph))
3406 goto out;
3407
3408 ad->u.net.v4info.saddr = ih->saddr;
3409 ad->u.net.v4info.daddr = ih->daddr;
3410 ret = 0;
3411
3412 if (proto)
3413 *proto = ih->protocol;
3414
3415 switch (ih->protocol) {
3416 case IPPROTO_TCP: {
3417 struct tcphdr _tcph, *th;
3418
3419 if (ntohs(ih->frag_off) & IP_OFFSET)
3420 break;
3421
3422 offset += ihlen;
3423 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3424 if (th == NULL)
3425 break;
3426
3427 ad->u.net.sport = th->source;
3428 ad->u.net.dport = th->dest;
3429 break;
3430 }
3431
3432 case IPPROTO_UDP: {
3433 struct udphdr _udph, *uh;
3434
3435 if (ntohs(ih->frag_off) & IP_OFFSET)
3436 break;
3437
3438 offset += ihlen;
3439 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3440 if (uh == NULL)
3441 break;
3442
3443 ad->u.net.sport = uh->source;
3444 ad->u.net.dport = uh->dest;
3445 break;
3446 }
3447
3448 case IPPROTO_DCCP: {
3449 struct dccp_hdr _dccph, *dh;
3450
3451 if (ntohs(ih->frag_off) & IP_OFFSET)
3452 break;
3453
3454 offset += ihlen;
3455 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3456 if (dh == NULL)
3457 break;
3458
3459 ad->u.net.sport = dh->dccph_sport;
3460 ad->u.net.dport = dh->dccph_dport;
3461 break;
3462 }
3463
3464 default:
3465 break;
3466 }
3467 out:
3468 return ret;
3469 }
3470
3471 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3472
3473 /* Returns error only if unable to parse addresses */
3474 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3475 struct avc_audit_data *ad, u8 *proto)
3476 {
3477 u8 nexthdr;
3478 int ret = -EINVAL, offset;
3479 struct ipv6hdr _ipv6h, *ip6;
3480
3481 offset = skb_network_offset(skb);
3482 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3483 if (ip6 == NULL)
3484 goto out;
3485
3486 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3487 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3488 ret = 0;
3489
3490 nexthdr = ip6->nexthdr;
3491 offset += sizeof(_ipv6h);
3492 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3493 if (offset < 0)
3494 goto out;
3495
3496 if (proto)
3497 *proto = nexthdr;
3498
3499 switch (nexthdr) {
3500 case IPPROTO_TCP: {
3501 struct tcphdr _tcph, *th;
3502
3503 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3504 if (th == NULL)
3505 break;
3506
3507 ad->u.net.sport = th->source;
3508 ad->u.net.dport = th->dest;
3509 break;
3510 }
3511
3512 case IPPROTO_UDP: {
3513 struct udphdr _udph, *uh;
3514
3515 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3516 if (uh == NULL)
3517 break;
3518
3519 ad->u.net.sport = uh->source;
3520 ad->u.net.dport = uh->dest;
3521 break;
3522 }
3523
3524 case IPPROTO_DCCP: {
3525 struct dccp_hdr _dccph, *dh;
3526
3527 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3528 if (dh == NULL)
3529 break;
3530
3531 ad->u.net.sport = dh->dccph_sport;
3532 ad->u.net.dport = dh->dccph_dport;
3533 break;
3534 }
3535
3536 /* includes fragments */
3537 default:
3538 break;
3539 }
3540 out:
3541 return ret;
3542 }
3543
3544 #endif /* IPV6 */
3545
3546 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3547 char **_addrp, int src, u8 *proto)
3548 {
3549 char *addrp;
3550 int ret;
3551
3552 switch (ad->u.net.family) {
3553 case PF_INET:
3554 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3555 if (ret)
3556 goto parse_error;
3557 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3558 &ad->u.net.v4info.daddr);
3559 goto okay;
3560
3561 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3562 case PF_INET6:
3563 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3564 if (ret)
3565 goto parse_error;
3566 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3567 &ad->u.net.v6info.daddr);
3568 goto okay;
3569 #endif /* IPV6 */
3570 default:
3571 addrp = NULL;
3572 goto okay;
3573 }
3574
3575 parse_error:
3576 printk(KERN_WARNING
3577 "SELinux: failure in selinux_parse_skb(),"
3578 " unable to parse packet\n");
3579 return ret;
3580
3581 okay:
3582 if (_addrp)
3583 *_addrp = addrp;
3584 return 0;
3585 }
3586
3587 /**
3588 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3589 * @skb: the packet
3590 * @family: protocol family
3591 * @sid: the packet's peer label SID
3592 *
3593 * Description:
3594 * Check the various different forms of network peer labeling and determine
3595 * the peer label/SID for the packet; most of the magic actually occurs in
3596 * the security server function security_net_peersid_cmp(). The function
3597 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3598 * or -EACCES if @sid is invalid due to inconsistencies with the different
3599 * peer labels.
3600 *
3601 */
3602 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3603 {
3604 int err;
3605 u32 xfrm_sid;
3606 u32 nlbl_sid;
3607 u32 nlbl_type;
3608
3609 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3610 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3611
3612 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3613 if (unlikely(err)) {
3614 printk(KERN_WARNING
3615 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3616 " unable to determine packet's peer label\n");
3617 return -EACCES;
3618 }
3619
3620 return 0;
3621 }
3622
3623 /* socket security operations */
3624 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3625 u32 perms)
3626 {
3627 struct inode_security_struct *isec;
3628 struct task_security_struct *tsec;
3629 struct avc_audit_data ad;
3630 int err = 0;
3631
3632 tsec = task->security;
3633 isec = SOCK_INODE(sock)->i_security;
3634
3635 if (isec->sid == SECINITSID_KERNEL)
3636 goto out;
3637
3638 AVC_AUDIT_DATA_INIT(&ad, NET);
3639 ad.u.net.sk = sock->sk;
3640 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3641
3642 out:
3643 return err;
3644 }
3645
3646 static int selinux_socket_create(int family, int type,
3647 int protocol, int kern)
3648 {
3649 int err = 0;
3650 struct task_security_struct *tsec;
3651 u32 newsid;
3652
3653 if (kern)
3654 goto out;
3655
3656 tsec = current->security;
3657 newsid = tsec->sockcreate_sid ? : tsec->sid;
3658 err = avc_has_perm(tsec->sid, newsid,
3659 socket_type_to_security_class(family, type,
3660 protocol), SOCKET__CREATE, NULL);
3661
3662 out:
3663 return err;
3664 }
3665
3666 static int selinux_socket_post_create(struct socket *sock, int family,
3667 int type, int protocol, int kern)
3668 {
3669 int err = 0;
3670 struct inode_security_struct *isec;
3671 struct task_security_struct *tsec;
3672 struct sk_security_struct *sksec;
3673 u32 newsid;
3674
3675 isec = SOCK_INODE(sock)->i_security;
3676
3677 tsec = current->security;
3678 newsid = tsec->sockcreate_sid ? : tsec->sid;
3679 isec->sclass = socket_type_to_security_class(family, type, protocol);
3680 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3681 isec->initialized = 1;
3682
3683 if (sock->sk) {
3684 sksec = sock->sk->sk_security;
3685 sksec->sid = isec->sid;
3686 sksec->sclass = isec->sclass;
3687 err = selinux_netlbl_socket_post_create(sock);
3688 }
3689
3690 return err;
3691 }
3692
3693 /* Range of port numbers used to automatically bind.
3694 Need to determine whether we should perform a name_bind
3695 permission check between the socket and the port number. */
3696
3697 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3698 {
3699 u16 family;
3700 int err;
3701
3702 err = socket_has_perm(current, sock, SOCKET__BIND);
3703 if (err)
3704 goto out;
3705
3706 /*
3707 * If PF_INET or PF_INET6, check name_bind permission for the port.
3708 * Multiple address binding for SCTP is not supported yet: we just
3709 * check the first address now.
3710 */
3711 family = sock->sk->sk_family;
3712 if (family == PF_INET || family == PF_INET6) {
3713 char *addrp;
3714 struct inode_security_struct *isec;
3715 struct task_security_struct *tsec;
3716 struct avc_audit_data ad;
3717 struct sockaddr_in *addr4 = NULL;
3718 struct sockaddr_in6 *addr6 = NULL;
3719 unsigned short snum;
3720 struct sock *sk = sock->sk;
3721 u32 sid, node_perm;
3722
3723 tsec = current->security;
3724 isec = SOCK_INODE(sock)->i_security;
3725
3726 if (family == PF_INET) {
3727 addr4 = (struct sockaddr_in *)address;
3728 snum = ntohs(addr4->sin_port);
3729 addrp = (char *)&addr4->sin_addr.s_addr;
3730 } else {
3731 addr6 = (struct sockaddr_in6 *)address;
3732 snum = ntohs(addr6->sin6_port);
3733 addrp = (char *)&addr6->sin6_addr.s6_addr;
3734 }
3735
3736 if (snum) {
3737 int low, high;
3738
3739 inet_get_local_port_range(&low, &high);
3740
3741 if (snum < max(PROT_SOCK, low) || snum > high) {
3742 err = sel_netport_sid(sk->sk_protocol,
3743 snum, &sid);
3744 if (err)
3745 goto out;
3746 AVC_AUDIT_DATA_INIT(&ad, NET);
3747 ad.u.net.sport = htons(snum);
3748 ad.u.net.family = family;
3749 err = avc_has_perm(isec->sid, sid,
3750 isec->sclass,
3751 SOCKET__NAME_BIND, &ad);
3752 if (err)
3753 goto out;
3754 }
3755 }
3756
3757 switch (isec->sclass) {
3758 case SECCLASS_TCP_SOCKET:
3759 node_perm = TCP_SOCKET__NODE_BIND;
3760 break;
3761
3762 case SECCLASS_UDP_SOCKET:
3763 node_perm = UDP_SOCKET__NODE_BIND;
3764 break;
3765
3766 case SECCLASS_DCCP_SOCKET:
3767 node_perm = DCCP_SOCKET__NODE_BIND;
3768 break;
3769
3770 default:
3771 node_perm = RAWIP_SOCKET__NODE_BIND;
3772 break;
3773 }
3774
3775 err = sel_netnode_sid(addrp, family, &sid);
3776 if (err)
3777 goto out;
3778
3779 AVC_AUDIT_DATA_INIT(&ad, NET);
3780 ad.u.net.sport = htons(snum);
3781 ad.u.net.family = family;
3782
3783 if (family == PF_INET)
3784 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3785 else
3786 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3787
3788 err = avc_has_perm(isec->sid, sid,
3789 isec->sclass, node_perm, &ad);
3790 if (err)
3791 goto out;
3792 }
3793 out:
3794 return err;
3795 }
3796
3797 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3798 {
3799 struct sock *sk = sock->sk;
3800 struct inode_security_struct *isec;
3801 int err;
3802
3803 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3804 if (err)
3805 return err;
3806
3807 /*
3808 * If a TCP or DCCP socket, check name_connect permission for the port.
3809 */
3810 isec = SOCK_INODE(sock)->i_security;
3811 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3812 isec->sclass == SECCLASS_DCCP_SOCKET) {
3813 struct avc_audit_data ad;
3814 struct sockaddr_in *addr4 = NULL;
3815 struct sockaddr_in6 *addr6 = NULL;
3816 unsigned short snum;
3817 u32 sid, perm;
3818
3819 if (sk->sk_family == PF_INET) {
3820 addr4 = (struct sockaddr_in *)address;
3821 if (addrlen < sizeof(struct sockaddr_in))
3822 return -EINVAL;
3823 snum = ntohs(addr4->sin_port);
3824 } else {
3825 addr6 = (struct sockaddr_in6 *)address;
3826 if (addrlen < SIN6_LEN_RFC2133)
3827 return -EINVAL;
3828 snum = ntohs(addr6->sin6_port);
3829 }
3830
3831 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3832 if (err)
3833 goto out;
3834
3835 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3836 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3837
3838 AVC_AUDIT_DATA_INIT(&ad, NET);
3839 ad.u.net.dport = htons(snum);
3840 ad.u.net.family = sk->sk_family;
3841 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3842 if (err)
3843 goto out;
3844 }
3845
3846 err = selinux_netlbl_socket_connect(sk, address);
3847
3848 out:
3849 return err;
3850 }
3851
3852 static int selinux_socket_listen(struct socket *sock, int backlog)
3853 {
3854 return socket_has_perm(current, sock, SOCKET__LISTEN);
3855 }
3856
3857 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3858 {
3859 int err;
3860 struct inode_security_struct *isec;
3861 struct inode_security_struct *newisec;
3862
3863 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3864 if (err)
3865 return err;
3866
3867 newisec = SOCK_INODE(newsock)->i_security;
3868
3869 isec = SOCK_INODE(sock)->i_security;
3870 newisec->sclass = isec->sclass;
3871 newisec->sid = isec->sid;
3872 newisec->initialized = 1;
3873
3874 return 0;
3875 }
3876
3877 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3878 int size)
3879 {
3880 int rc;
3881
3882 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3883 if (rc)
3884 return rc;
3885
3886 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3887 }
3888
3889 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3890 int size, int flags)
3891 {
3892 return socket_has_perm(current, sock, SOCKET__READ);
3893 }
3894
3895 static int selinux_socket_getsockname(struct socket *sock)
3896 {
3897 return socket_has_perm(current, sock, SOCKET__GETATTR);
3898 }
3899
3900 static int selinux_socket_getpeername(struct socket *sock)
3901 {
3902 return socket_has_perm(current, sock, SOCKET__GETATTR);
3903 }
3904
3905 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3906 {
3907 int err;
3908
3909 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3910 if (err)
3911 return err;
3912
3913 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3914 }
3915
3916 static int selinux_socket_getsockopt(struct socket *sock, int level,
3917 int optname)
3918 {
3919 return socket_has_perm(current, sock, SOCKET__GETOPT);
3920 }
3921
3922 static int selinux_socket_shutdown(struct socket *sock, int how)
3923 {
3924 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3925 }
3926
3927 static int selinux_socket_unix_stream_connect(struct socket *sock,
3928 struct socket *other,
3929 struct sock *newsk)
3930 {
3931 struct sk_security_struct *ssec;
3932 struct inode_security_struct *isec;
3933 struct inode_security_struct *other_isec;
3934 struct avc_audit_data ad;
3935 int err;
3936
3937 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3938 if (err)
3939 return err;
3940
3941 isec = SOCK_INODE(sock)->i_security;
3942 other_isec = SOCK_INODE(other)->i_security;
3943
3944 AVC_AUDIT_DATA_INIT(&ad, NET);
3945 ad.u.net.sk = other->sk;
3946
3947 err = avc_has_perm(isec->sid, other_isec->sid,
3948 isec->sclass,
3949 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3950 if (err)
3951 return err;
3952
3953 /* connecting socket */
3954 ssec = sock->sk->sk_security;
3955 ssec->peer_sid = other_isec->sid;
3956
3957 /* server child socket */
3958 ssec = newsk->sk_security;
3959 ssec->peer_sid = isec->sid;
3960 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3961
3962 return err;
3963 }
3964
3965 static int selinux_socket_unix_may_send(struct socket *sock,
3966 struct socket *other)
3967 {
3968 struct inode_security_struct *isec;
3969 struct inode_security_struct *other_isec;
3970 struct avc_audit_data ad;
3971 int err;
3972
3973 isec = SOCK_INODE(sock)->i_security;
3974 other_isec = SOCK_INODE(other)->i_security;
3975
3976 AVC_AUDIT_DATA_INIT(&ad, NET);
3977 ad.u.net.sk = other->sk;
3978
3979 err = avc_has_perm(isec->sid, other_isec->sid,
3980 isec->sclass, SOCKET__SENDTO, &ad);
3981 if (err)
3982 return err;
3983
3984 return 0;
3985 }
3986
3987 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3988 u32 peer_sid,
3989 struct avc_audit_data *ad)
3990 {
3991 int err;
3992 u32 if_sid;
3993 u32 node_sid;
3994
3995 err = sel_netif_sid(ifindex, &if_sid);
3996 if (err)
3997 return err;
3998 err = avc_has_perm(peer_sid, if_sid,
3999 SECCLASS_NETIF, NETIF__INGRESS, ad);
4000 if (err)
4001 return err;
4002
4003 err = sel_netnode_sid(addrp, family, &node_sid);
4004 if (err)
4005 return err;
4006 return avc_has_perm(peer_sid, node_sid,
4007 SECCLASS_NODE, NODE__RECVFROM, ad);
4008 }
4009
4010 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
4011 struct sk_buff *skb,
4012 struct avc_audit_data *ad,
4013 u16 family,
4014 char *addrp)
4015 {
4016 int err;
4017 struct sk_security_struct *sksec = sk->sk_security;
4018 u16 sk_class;
4019 u32 netif_perm, node_perm, recv_perm;
4020 u32 port_sid, node_sid, if_sid, sk_sid;
4021
4022 sk_sid = sksec->sid;
4023 sk_class = sksec->sclass;
4024
4025 switch (sk_class) {
4026 case SECCLASS_UDP_SOCKET:
4027 netif_perm = NETIF__UDP_RECV;
4028 node_perm = NODE__UDP_RECV;
4029 recv_perm = UDP_SOCKET__RECV_MSG;
4030 break;
4031 case SECCLASS_TCP_SOCKET:
4032 netif_perm = NETIF__TCP_RECV;
4033 node_perm = NODE__TCP_RECV;
4034 recv_perm = TCP_SOCKET__RECV_MSG;
4035 break;
4036 case SECCLASS_DCCP_SOCKET:
4037 netif_perm = NETIF__DCCP_RECV;
4038 node_perm = NODE__DCCP_RECV;
4039 recv_perm = DCCP_SOCKET__RECV_MSG;
4040 break;
4041 default:
4042 netif_perm = NETIF__RAWIP_RECV;
4043 node_perm = NODE__RAWIP_RECV;
4044 recv_perm = 0;
4045 break;
4046 }
4047
4048 err = sel_netif_sid(skb->iif, &if_sid);
4049 if (err)
4050 return err;
4051 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4052 if (err)
4053 return err;
4054
4055 err = sel_netnode_sid(addrp, family, &node_sid);
4056 if (err)
4057 return err;
4058 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4059 if (err)
4060 return err;
4061
4062 if (!recv_perm)
4063 return 0;
4064 err = sel_netport_sid(sk->sk_protocol,
4065 ntohs(ad->u.net.sport), &port_sid);
4066 if (unlikely(err)) {
4067 printk(KERN_WARNING
4068 "SELinux: failure in"
4069 " selinux_sock_rcv_skb_iptables_compat(),"
4070 " network port label not found\n");
4071 return err;
4072 }
4073 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4074 }
4075
4076 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4077 u16 family)
4078 {
4079 int err;
4080 struct sk_security_struct *sksec = sk->sk_security;
4081 u32 peer_sid;
4082 u32 sk_sid = sksec->sid;
4083 struct avc_audit_data ad;
4084 char *addrp;
4085
4086 AVC_AUDIT_DATA_INIT(&ad, NET);
4087 ad.u.net.netif = skb->iif;
4088 ad.u.net.family = family;
4089 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4090 if (err)
4091 return err;
4092
4093 if (selinux_compat_net)
4094 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, &ad,
4095 family, addrp);
4096 else
4097 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4098 PACKET__RECV, &ad);
4099 if (err)
4100 return err;
4101
4102 if (selinux_policycap_netpeer) {
4103 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4104 if (err)
4105 return err;
4106 err = avc_has_perm(sk_sid, peer_sid,
4107 SECCLASS_PEER, PEER__RECV, &ad);
4108 if (err)
4109 selinux_netlbl_err(skb, err, 0);
4110 } else {
4111 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4112 if (err)
4113 return err;
4114 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4115 }
4116
4117 return err;
4118 }
4119
4120 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4121 {
4122 int err;
4123 struct sk_security_struct *sksec = sk->sk_security;
4124 u16 family = sk->sk_family;
4125 u32 sk_sid = sksec->sid;
4126 struct avc_audit_data ad;
4127 char *addrp;
4128 u8 secmark_active;
4129 u8 peerlbl_active;
4130
4131 if (family != PF_INET && family != PF_INET6)
4132 return 0;
4133
4134 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4135 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4136 family = PF_INET;
4137
4138 /* If any sort of compatibility mode is enabled then handoff processing
4139 * to the selinux_sock_rcv_skb_compat() function to deal with the
4140 * special handling. We do this in an attempt to keep this function
4141 * as fast and as clean as possible. */
4142 if (selinux_compat_net || !selinux_policycap_netpeer)
4143 return selinux_sock_rcv_skb_compat(sk, skb, family);
4144
4145 secmark_active = selinux_secmark_enabled();
4146 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4147 if (!secmark_active && !peerlbl_active)
4148 return 0;
4149
4150 AVC_AUDIT_DATA_INIT(&ad, NET);
4151 ad.u.net.netif = skb->iif;
4152 ad.u.net.family = family;
4153 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4154 if (err)
4155 return err;
4156
4157 if (peerlbl_active) {
4158 u32 peer_sid;
4159
4160 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4161 if (err)
4162 return err;
4163 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4164 peer_sid, &ad);
4165 if (err) {
4166 selinux_netlbl_err(skb, err, 0);
4167 return err;
4168 }
4169 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4170 PEER__RECV, &ad);
4171 if (err)
4172 selinux_netlbl_err(skb, err, 0);
4173 }
4174
4175 if (secmark_active) {
4176 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4177 PACKET__RECV, &ad);
4178 if (err)
4179 return err;
4180 }
4181
4182 return err;
4183 }
4184
4185 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4186 int __user *optlen, unsigned len)
4187 {
4188 int err = 0;
4189 char *scontext;
4190 u32 scontext_len;
4191 struct sk_security_struct *ssec;
4192 struct inode_security_struct *isec;
4193 u32 peer_sid = SECSID_NULL;
4194
4195 isec = SOCK_INODE(sock)->i_security;
4196
4197 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4198 isec->sclass == SECCLASS_TCP_SOCKET) {
4199 ssec = sock->sk->sk_security;
4200 peer_sid = ssec->peer_sid;
4201 }
4202 if (peer_sid == SECSID_NULL) {
4203 err = -ENOPROTOOPT;
4204 goto out;
4205 }
4206
4207 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4208
4209 if (err)
4210 goto out;
4211
4212 if (scontext_len > len) {
4213 err = -ERANGE;
4214 goto out_len;
4215 }
4216
4217 if (copy_to_user(optval, scontext, scontext_len))
4218 err = -EFAULT;
4219
4220 out_len:
4221 if (put_user(scontext_len, optlen))
4222 err = -EFAULT;
4223
4224 kfree(scontext);
4225 out:
4226 return err;
4227 }
4228
4229 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4230 {
4231 u32 peer_secid = SECSID_NULL;
4232 u16 family;
4233
4234 if (skb && skb->protocol == htons(ETH_P_IP))
4235 family = PF_INET;
4236 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4237 family = PF_INET6;
4238 else if (sock)
4239 family = sock->sk->sk_family;
4240 else
4241 goto out;
4242
4243 if (sock && family == PF_UNIX)
4244 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4245 else if (skb)
4246 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4247
4248 out:
4249 *secid = peer_secid;
4250 if (peer_secid == SECSID_NULL)
4251 return -EINVAL;
4252 return 0;
4253 }
4254
4255 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4256 {
4257 return sk_alloc_security(sk, family, priority);
4258 }
4259
4260 static void selinux_sk_free_security(struct sock *sk)
4261 {
4262 sk_free_security(sk);
4263 }
4264
4265 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4266 {
4267 struct sk_security_struct *ssec = sk->sk_security;
4268 struct sk_security_struct *newssec = newsk->sk_security;
4269
4270 newssec->sid = ssec->sid;
4271 newssec->peer_sid = ssec->peer_sid;
4272 newssec->sclass = ssec->sclass;
4273
4274 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4275 }
4276
4277 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4278 {
4279 if (!sk)
4280 *secid = SECINITSID_ANY_SOCKET;
4281 else {
4282 struct sk_security_struct *sksec = sk->sk_security;
4283
4284 *secid = sksec->sid;
4285 }
4286 }
4287
4288 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4289 {
4290 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4291 struct sk_security_struct *sksec = sk->sk_security;
4292
4293 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4294 sk->sk_family == PF_UNIX)
4295 isec->sid = sksec->sid;
4296 sksec->sclass = isec->sclass;
4297 }
4298
4299 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4300 struct request_sock *req)
4301 {
4302 struct sk_security_struct *sksec = sk->sk_security;
4303 int err;
4304 u16 family = sk->sk_family;
4305 u32 newsid;
4306 u32 peersid;
4307
4308 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4309 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4310 family = PF_INET;
4311
4312 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4313 if (err)
4314 return err;
4315 if (peersid == SECSID_NULL) {
4316 req->secid = sksec->sid;
4317 req->peer_secid = SECSID_NULL;
4318 return 0;
4319 }
4320
4321 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4322 if (err)
4323 return err;
4324
4325 req->secid = newsid;
4326 req->peer_secid = peersid;
4327 return 0;
4328 }
4329
4330 static void selinux_inet_csk_clone(struct sock *newsk,
4331 const struct request_sock *req)
4332 {
4333 struct sk_security_struct *newsksec = newsk->sk_security;
4334
4335 newsksec->sid = req->secid;
4336 newsksec->peer_sid = req->peer_secid;
4337 /* NOTE: Ideally, we should also get the isec->sid for the
4338 new socket in sync, but we don't have the isec available yet.
4339 So we will wait until sock_graft to do it, by which
4340 time it will have been created and available. */
4341
4342 /* We don't need to take any sort of lock here as we are the only
4343 * thread with access to newsksec */
4344 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4345 }
4346
4347 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4348 {
4349 u16 family = sk->sk_family;
4350 struct sk_security_struct *sksec = sk->sk_security;
4351
4352 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4353 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4354 family = PF_INET;
4355
4356 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4357
4358 selinux_netlbl_inet_conn_established(sk, family);
4359 }
4360
4361 static void selinux_req_classify_flow(const struct request_sock *req,
4362 struct flowi *fl)
4363 {
4364 fl->secid = req->secid;
4365 }
4366
4367 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4368 {
4369 int err = 0;
4370 u32 perm;
4371 struct nlmsghdr *nlh;
4372 struct socket *sock = sk->sk_socket;
4373 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4374
4375 if (skb->len < NLMSG_SPACE(0)) {
4376 err = -EINVAL;
4377 goto out;
4378 }
4379 nlh = nlmsg_hdr(skb);
4380
4381 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4382 if (err) {
4383 if (err == -EINVAL) {
4384 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4385 "SELinux: unrecognized netlink message"
4386 " type=%hu for sclass=%hu\n",
4387 nlh->nlmsg_type, isec->sclass);
4388 if (!selinux_enforcing)
4389 err = 0;
4390 }
4391
4392 /* Ignore */
4393 if (err == -ENOENT)
4394 err = 0;
4395 goto out;
4396 }
4397
4398 err = socket_has_perm(current, sock, perm);
4399 out:
4400 return err;
4401 }
4402
4403 #ifdef CONFIG_NETFILTER
4404
4405 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4406 u16 family)
4407 {
4408 int err;
4409 char *addrp;
4410 u32 peer_sid;
4411 struct avc_audit_data ad;
4412 u8 secmark_active;
4413 u8 netlbl_active;
4414 u8 peerlbl_active;
4415
4416 if (!selinux_policycap_netpeer)
4417 return NF_ACCEPT;
4418
4419 secmark_active = selinux_secmark_enabled();
4420 netlbl_active = netlbl_enabled();
4421 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4422 if (!secmark_active && !peerlbl_active)
4423 return NF_ACCEPT;
4424
4425 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4426 return NF_DROP;
4427
4428 AVC_AUDIT_DATA_INIT(&ad, NET);
4429 ad.u.net.netif = ifindex;
4430 ad.u.net.family = family;
4431 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4432 return NF_DROP;
4433
4434 if (peerlbl_active) {
4435 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4436 peer_sid, &ad);
4437 if (err) {
4438 selinux_netlbl_err(skb, err, 1);
4439 return NF_DROP;
4440 }
4441 }
4442
4443 if (secmark_active)
4444 if (avc_has_perm(peer_sid, skb->secmark,
4445 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4446 return NF_DROP;
4447
4448 if (netlbl_active)
4449 /* we do this in the FORWARD path and not the POST_ROUTING
4450 * path because we want to make sure we apply the necessary
4451 * labeling before IPsec is applied so we can leverage AH
4452 * protection */
4453 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4454 return NF_DROP;
4455
4456 return NF_ACCEPT;
4457 }
4458
4459 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4460 struct sk_buff *skb,
4461 const struct net_device *in,
4462 const struct net_device *out,
4463 int (*okfn)(struct sk_buff *))
4464 {
4465 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4466 }
4467
4468 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4469 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4470 struct sk_buff *skb,
4471 const struct net_device *in,
4472 const struct net_device *out,
4473 int (*okfn)(struct sk_buff *))
4474 {
4475 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4476 }
4477 #endif /* IPV6 */
4478
4479 static unsigned int selinux_ip_output(struct sk_buff *skb,
4480 u16 family)
4481 {
4482 u32 sid;
4483
4484 if (!netlbl_enabled())
4485 return NF_ACCEPT;
4486
4487 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4488 * because we want to make sure we apply the necessary labeling
4489 * before IPsec is applied so we can leverage AH protection */
4490 if (skb->sk) {
4491 struct sk_security_struct *sksec = skb->sk->sk_security;
4492 sid = sksec->sid;
4493 } else
4494 sid = SECINITSID_KERNEL;
4495 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4496 return NF_DROP;
4497
4498 return NF_ACCEPT;
4499 }
4500
4501 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4502 struct sk_buff *skb,
4503 const struct net_device *in,
4504 const struct net_device *out,
4505 int (*okfn)(struct sk_buff *))
4506 {
4507 return selinux_ip_output(skb, PF_INET);
4508 }
4509
4510 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4511 int ifindex,
4512 struct avc_audit_data *ad,
4513 u16 family, char *addrp)
4514 {
4515 int err;
4516 struct sk_security_struct *sksec = sk->sk_security;
4517 u16 sk_class;
4518 u32 netif_perm, node_perm, send_perm;
4519 u32 port_sid, node_sid, if_sid, sk_sid;
4520
4521 sk_sid = sksec->sid;
4522 sk_class = sksec->sclass;
4523
4524 switch (sk_class) {
4525 case SECCLASS_UDP_SOCKET:
4526 netif_perm = NETIF__UDP_SEND;
4527 node_perm = NODE__UDP_SEND;
4528 send_perm = UDP_SOCKET__SEND_MSG;
4529 break;
4530 case SECCLASS_TCP_SOCKET:
4531 netif_perm = NETIF__TCP_SEND;
4532 node_perm = NODE__TCP_SEND;
4533 send_perm = TCP_SOCKET__SEND_MSG;
4534 break;
4535 case SECCLASS_DCCP_SOCKET:
4536 netif_perm = NETIF__DCCP_SEND;
4537 node_perm = NODE__DCCP_SEND;
4538 send_perm = DCCP_SOCKET__SEND_MSG;
4539 break;
4540 default:
4541 netif_perm = NETIF__RAWIP_SEND;
4542 node_perm = NODE__RAWIP_SEND;
4543 send_perm = 0;
4544 break;
4545 }
4546
4547 err = sel_netif_sid(ifindex, &if_sid);
4548 if (err)
4549 return err;
4550 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4551 return err;
4552
4553 err = sel_netnode_sid(addrp, family, &node_sid);
4554 if (err)
4555 return err;
4556 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4557 if (err)
4558 return err;
4559
4560 if (send_perm != 0)
4561 return 0;
4562
4563 err = sel_netport_sid(sk->sk_protocol,
4564 ntohs(ad->u.net.dport), &port_sid);
4565 if (unlikely(err)) {
4566 printk(KERN_WARNING
4567 "SELinux: failure in"
4568 " selinux_ip_postroute_iptables_compat(),"
4569 " network port label not found\n");
4570 return err;
4571 }
4572 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4573 }
4574
4575 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4576 int ifindex,
4577 u16 family)
4578 {
4579 struct sock *sk = skb->sk;
4580 struct sk_security_struct *sksec;
4581 struct avc_audit_data ad;
4582 char *addrp;
4583 u8 proto;
4584
4585 if (sk == NULL)
4586 return NF_ACCEPT;
4587 sksec = sk->sk_security;
4588
4589 AVC_AUDIT_DATA_INIT(&ad, NET);
4590 ad.u.net.netif = ifindex;
4591 ad.u.net.family = family;
4592 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4593 return NF_DROP;
4594
4595 if (selinux_compat_net) {
4596 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4597 &ad, family, addrp))
4598 return NF_DROP;
4599 } else {
4600 if (avc_has_perm(sksec->sid, skb->secmark,
4601 SECCLASS_PACKET, PACKET__SEND, &ad))
4602 return NF_DROP;
4603 }
4604
4605 if (selinux_policycap_netpeer)
4606 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4607 return NF_DROP;
4608
4609 return NF_ACCEPT;
4610 }
4611
4612 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4613 u16 family)
4614 {
4615 u32 secmark_perm;
4616 u32 peer_sid;
4617 struct sock *sk;
4618 struct avc_audit_data ad;
4619 char *addrp;
4620 u8 secmark_active;
4621 u8 peerlbl_active;
4622
4623 /* If any sort of compatibility mode is enabled then handoff processing
4624 * to the selinux_ip_postroute_compat() function to deal with the
4625 * special handling. We do this in an attempt to keep this function
4626 * as fast and as clean as possible. */
4627 if (selinux_compat_net || !selinux_policycap_netpeer)
4628 return selinux_ip_postroute_compat(skb, ifindex, family);
4629
4630 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4631 * packet transformation so allow the packet to pass without any checks
4632 * since we'll have another chance to perform access control checks
4633 * when the packet is on it's final way out.
4634 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4635 * is NULL, in this case go ahead and apply access control. */
4636 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4637 return NF_ACCEPT;
4638
4639 secmark_active = selinux_secmark_enabled();
4640 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4641 if (!secmark_active && !peerlbl_active)
4642 return NF_ACCEPT;
4643
4644 /* if the packet is being forwarded then get the peer label from the
4645 * packet itself; otherwise check to see if it is from a local
4646 * application or the kernel, if from an application get the peer label
4647 * from the sending socket, otherwise use the kernel's sid */
4648 sk = skb->sk;
4649 if (sk == NULL) {
4650 switch (family) {
4651 case PF_INET:
4652 if (IPCB(skb)->flags & IPSKB_FORWARDED)
4653 secmark_perm = PACKET__FORWARD_OUT;
4654 else
4655 secmark_perm = PACKET__SEND;
4656 break;
4657 case PF_INET6:
4658 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4659 secmark_perm = PACKET__FORWARD_OUT;
4660 else
4661 secmark_perm = PACKET__SEND;
4662 break;
4663 default:
4664 return NF_DROP;
4665 }
4666 if (secmark_perm == PACKET__FORWARD_OUT) {
4667 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4668 return NF_DROP;
4669 } else
4670 peer_sid = SECINITSID_KERNEL;
4671 } else {
4672 struct sk_security_struct *sksec = sk->sk_security;
4673 peer_sid = sksec->sid;
4674 secmark_perm = PACKET__SEND;
4675 }
4676
4677 AVC_AUDIT_DATA_INIT(&ad, NET);
4678 ad.u.net.netif = ifindex;
4679 ad.u.net.family = family;
4680 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4681 return NF_DROP;
4682
4683 if (secmark_active)
4684 if (avc_has_perm(peer_sid, skb->secmark,
4685 SECCLASS_PACKET, secmark_perm, &ad))
4686 return NF_DROP;
4687
4688 if (peerlbl_active) {
4689 u32 if_sid;
4690 u32 node_sid;
4691
4692 if (sel_netif_sid(ifindex, &if_sid))
4693 return NF_DROP;
4694 if (avc_has_perm(peer_sid, if_sid,
4695 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4696 return NF_DROP;
4697
4698 if (sel_netnode_sid(addrp, family, &node_sid))
4699 return NF_DROP;
4700 if (avc_has_perm(peer_sid, node_sid,
4701 SECCLASS_NODE, NODE__SENDTO, &ad))
4702 return NF_DROP;
4703 }
4704
4705 return NF_ACCEPT;
4706 }
4707
4708 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4709 struct sk_buff *skb,
4710 const struct net_device *in,
4711 const struct net_device *out,
4712 int (*okfn)(struct sk_buff *))
4713 {
4714 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4715 }
4716
4717 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4718 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4719 struct sk_buff *skb,
4720 const struct net_device *in,
4721 const struct net_device *out,
4722 int (*okfn)(struct sk_buff *))
4723 {
4724 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4725 }
4726 #endif /* IPV6 */
4727
4728 #endif /* CONFIG_NETFILTER */
4729
4730 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4731 {
4732 int err;
4733
4734 err = secondary_ops->netlink_send(sk, skb);
4735 if (err)
4736 return err;
4737
4738 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4739 err = selinux_nlmsg_perm(sk, skb);
4740
4741 return err;
4742 }
4743
4744 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4745 {
4746 int err;
4747 struct avc_audit_data ad;
4748
4749 err = secondary_ops->netlink_recv(skb, capability);
4750 if (err)
4751 return err;
4752
4753 AVC_AUDIT_DATA_INIT(&ad, CAP);
4754 ad.u.cap = capability;
4755
4756 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4757 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4758 }
4759
4760 static int ipc_alloc_security(struct task_struct *task,
4761 struct kern_ipc_perm *perm,
4762 u16 sclass)
4763 {
4764 struct task_security_struct *tsec = task->security;
4765 struct ipc_security_struct *isec;
4766
4767 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4768 if (!isec)
4769 return -ENOMEM;
4770
4771 isec->sclass = sclass;
4772 isec->sid = tsec->sid;
4773 perm->security = isec;
4774
4775 return 0;
4776 }
4777
4778 static void ipc_free_security(struct kern_ipc_perm *perm)
4779 {
4780 struct ipc_security_struct *isec = perm->security;
4781 perm->security = NULL;
4782 kfree(isec);
4783 }
4784
4785 static int msg_msg_alloc_security(struct msg_msg *msg)
4786 {
4787 struct msg_security_struct *msec;
4788
4789 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4790 if (!msec)
4791 return -ENOMEM;
4792
4793 msec->sid = SECINITSID_UNLABELED;
4794 msg->security = msec;
4795
4796 return 0;
4797 }
4798
4799 static void msg_msg_free_security(struct msg_msg *msg)
4800 {
4801 struct msg_security_struct *msec = msg->security;
4802
4803 msg->security = NULL;
4804 kfree(msec);
4805 }
4806
4807 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4808 u32 perms)
4809 {
4810 struct task_security_struct *tsec;
4811 struct ipc_security_struct *isec;
4812 struct avc_audit_data ad;
4813
4814 tsec = current->security;
4815 isec = ipc_perms->security;
4816
4817 AVC_AUDIT_DATA_INIT(&ad, IPC);
4818 ad.u.ipc_id = ipc_perms->key;
4819
4820 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4821 }
4822
4823 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4824 {
4825 return msg_msg_alloc_security(msg);
4826 }
4827
4828 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4829 {
4830 msg_msg_free_security(msg);
4831 }
4832
4833 /* message queue security operations */
4834 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4835 {
4836 struct task_security_struct *tsec;
4837 struct ipc_security_struct *isec;
4838 struct avc_audit_data ad;
4839 int rc;
4840
4841 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4842 if (rc)
4843 return rc;
4844
4845 tsec = current->security;
4846 isec = msq->q_perm.security;
4847
4848 AVC_AUDIT_DATA_INIT(&ad, IPC);
4849 ad.u.ipc_id = msq->q_perm.key;
4850
4851 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4852 MSGQ__CREATE, &ad);
4853 if (rc) {
4854 ipc_free_security(&msq->q_perm);
4855 return rc;
4856 }
4857 return 0;
4858 }
4859
4860 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4861 {
4862 ipc_free_security(&msq->q_perm);
4863 }
4864
4865 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4866 {
4867 struct task_security_struct *tsec;
4868 struct ipc_security_struct *isec;
4869 struct avc_audit_data ad;
4870
4871 tsec = current->security;
4872 isec = msq->q_perm.security;
4873
4874 AVC_AUDIT_DATA_INIT(&ad, IPC);
4875 ad.u.ipc_id = msq->q_perm.key;
4876
4877 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4878 MSGQ__ASSOCIATE, &ad);
4879 }
4880
4881 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4882 {
4883 int err;
4884 int perms;
4885
4886 switch (cmd) {
4887 case IPC_INFO:
4888 case MSG_INFO:
4889 /* No specific object, just general system-wide information. */
4890 return task_has_system(current, SYSTEM__IPC_INFO);
4891 case IPC_STAT:
4892 case MSG_STAT:
4893 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4894 break;
4895 case IPC_SET:
4896 perms = MSGQ__SETATTR;
4897 break;
4898 case IPC_RMID:
4899 perms = MSGQ__DESTROY;
4900 break;
4901 default:
4902 return 0;
4903 }
4904
4905 err = ipc_has_perm(&msq->q_perm, perms);
4906 return err;
4907 }
4908
4909 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4910 {
4911 struct task_security_struct *tsec;
4912 struct ipc_security_struct *isec;
4913 struct msg_security_struct *msec;
4914 struct avc_audit_data ad;
4915 int rc;
4916
4917 tsec = current->security;
4918 isec = msq->q_perm.security;
4919 msec = msg->security;
4920
4921 /*
4922 * First time through, need to assign label to the message
4923 */
4924 if (msec->sid == SECINITSID_UNLABELED) {
4925 /*
4926 * Compute new sid based on current process and
4927 * message queue this message will be stored in
4928 */
4929 rc = security_transition_sid(tsec->sid,
4930 isec->sid,
4931 SECCLASS_MSG,
4932 &msec->sid);
4933 if (rc)
4934 return rc;
4935 }
4936
4937 AVC_AUDIT_DATA_INIT(&ad, IPC);
4938 ad.u.ipc_id = msq->q_perm.key;
4939
4940 /* Can this process write to the queue? */
4941 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4942 MSGQ__WRITE, &ad);
4943 if (!rc)
4944 /* Can this process send the message */
4945 rc = avc_has_perm(tsec->sid, msec->sid,
4946 SECCLASS_MSG, MSG__SEND, &ad);
4947 if (!rc)
4948 /* Can the message be put in the queue? */
4949 rc = avc_has_perm(msec->sid, isec->sid,
4950 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4951
4952 return rc;
4953 }
4954
4955 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4956 struct task_struct *target,
4957 long type, int mode)
4958 {
4959 struct task_security_struct *tsec;
4960 struct ipc_security_struct *isec;
4961 struct msg_security_struct *msec;
4962 struct avc_audit_data ad;
4963 int rc;
4964
4965 tsec = target->security;
4966 isec = msq->q_perm.security;
4967 msec = msg->security;
4968
4969 AVC_AUDIT_DATA_INIT(&ad, IPC);
4970 ad.u.ipc_id = msq->q_perm.key;
4971
4972 rc = avc_has_perm(tsec->sid, isec->sid,
4973 SECCLASS_MSGQ, MSGQ__READ, &ad);
4974 if (!rc)
4975 rc = avc_has_perm(tsec->sid, msec->sid,
4976 SECCLASS_MSG, MSG__RECEIVE, &ad);
4977 return rc;
4978 }
4979
4980 /* Shared Memory security operations */
4981 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4982 {
4983 struct task_security_struct *tsec;
4984 struct ipc_security_struct *isec;
4985 struct avc_audit_data ad;
4986 int rc;
4987
4988 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4989 if (rc)
4990 return rc;
4991
4992 tsec = current->security;
4993 isec = shp->shm_perm.security;
4994
4995 AVC_AUDIT_DATA_INIT(&ad, IPC);
4996 ad.u.ipc_id = shp->shm_perm.key;
4997
4998 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4999 SHM__CREATE, &ad);
5000 if (rc) {
5001 ipc_free_security(&shp->shm_perm);
5002 return rc;
5003 }
5004 return 0;
5005 }
5006
5007 static void selinux_shm_free_security(struct shmid_kernel *shp)
5008 {
5009 ipc_free_security(&shp->shm_perm);
5010 }
5011
5012 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5013 {
5014 struct task_security_struct *tsec;
5015 struct ipc_security_struct *isec;
5016 struct avc_audit_data ad;
5017
5018 tsec = current->security;
5019 isec = shp->shm_perm.security;
5020
5021 AVC_AUDIT_DATA_INIT(&ad, IPC);
5022 ad.u.ipc_id = shp->shm_perm.key;
5023
5024 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
5025 SHM__ASSOCIATE, &ad);
5026 }
5027
5028 /* Note, at this point, shp is locked down */
5029 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5030 {
5031 int perms;
5032 int err;
5033
5034 switch (cmd) {
5035 case IPC_INFO:
5036 case SHM_INFO:
5037 /* No specific object, just general system-wide information. */
5038 return task_has_system(current, SYSTEM__IPC_INFO);
5039 case IPC_STAT:
5040 case SHM_STAT:
5041 perms = SHM__GETATTR | SHM__ASSOCIATE;
5042 break;
5043 case IPC_SET:
5044 perms = SHM__SETATTR;
5045 break;
5046 case SHM_LOCK:
5047 case SHM_UNLOCK:
5048 perms = SHM__LOCK;
5049 break;
5050 case IPC_RMID:
5051 perms = SHM__DESTROY;
5052 break;
5053 default:
5054 return 0;
5055 }
5056
5057 err = ipc_has_perm(&shp->shm_perm, perms);
5058 return err;
5059 }
5060
5061 static int selinux_shm_shmat(struct shmid_kernel *shp,
5062 char __user *shmaddr, int shmflg)
5063 {
5064 u32 perms;
5065 int rc;
5066
5067 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
5068 if (rc)
5069 return rc;
5070
5071 if (shmflg & SHM_RDONLY)
5072 perms = SHM__READ;
5073 else
5074 perms = SHM__READ | SHM__WRITE;
5075
5076 return ipc_has_perm(&shp->shm_perm, perms);
5077 }
5078
5079 /* Semaphore security operations */
5080 static int selinux_sem_alloc_security(struct sem_array *sma)
5081 {
5082 struct task_security_struct *tsec;
5083 struct ipc_security_struct *isec;
5084 struct avc_audit_data ad;
5085 int rc;
5086
5087 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5088 if (rc)
5089 return rc;
5090
5091 tsec = current->security;
5092 isec = sma->sem_perm.security;
5093
5094 AVC_AUDIT_DATA_INIT(&ad, IPC);
5095 ad.u.ipc_id = sma->sem_perm.key;
5096
5097 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
5098 SEM__CREATE, &ad);
5099 if (rc) {
5100 ipc_free_security(&sma->sem_perm);
5101 return rc;
5102 }
5103 return 0;
5104 }
5105
5106 static void selinux_sem_free_security(struct sem_array *sma)
5107 {
5108 ipc_free_security(&sma->sem_perm);
5109 }
5110
5111 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5112 {
5113 struct task_security_struct *tsec;
5114 struct ipc_security_struct *isec;
5115 struct avc_audit_data ad;
5116
5117 tsec = current->security;
5118 isec = sma->sem_perm.security;
5119
5120 AVC_AUDIT_DATA_INIT(&ad, IPC);
5121 ad.u.ipc_id = sma->sem_perm.key;
5122
5123 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
5124 SEM__ASSOCIATE, &ad);
5125 }
5126
5127 /* Note, at this point, sma is locked down */
5128 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5129 {
5130 int err;
5131 u32 perms;
5132
5133 switch (cmd) {
5134 case IPC_INFO:
5135 case SEM_INFO:
5136 /* No specific object, just general system-wide information. */
5137 return task_has_system(current, SYSTEM__IPC_INFO);
5138 case GETPID:
5139 case GETNCNT:
5140 case GETZCNT:
5141 perms = SEM__GETATTR;
5142 break;
5143 case GETVAL:
5144 case GETALL:
5145 perms = SEM__READ;
5146 break;
5147 case SETVAL:
5148 case SETALL:
5149 perms = SEM__WRITE;
5150 break;
5151 case IPC_RMID:
5152 perms = SEM__DESTROY;
5153 break;
5154 case IPC_SET:
5155 perms = SEM__SETATTR;
5156 break;
5157 case IPC_STAT:
5158 case SEM_STAT:
5159 perms = SEM__GETATTR | SEM__ASSOCIATE;
5160 break;
5161 default:
5162 return 0;
5163 }
5164
5165 err = ipc_has_perm(&sma->sem_perm, perms);
5166 return err;
5167 }
5168
5169 static int selinux_sem_semop(struct sem_array *sma,
5170 struct sembuf *sops, unsigned nsops, int alter)
5171 {
5172 u32 perms;
5173
5174 if (alter)
5175 perms = SEM__READ | SEM__WRITE;
5176 else
5177 perms = SEM__READ;
5178
5179 return ipc_has_perm(&sma->sem_perm, perms);
5180 }
5181
5182 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5183 {
5184 u32 av = 0;
5185
5186 av = 0;
5187 if (flag & S_IRUGO)
5188 av |= IPC__UNIX_READ;
5189 if (flag & S_IWUGO)
5190 av |= IPC__UNIX_WRITE;
5191
5192 if (av == 0)
5193 return 0;
5194
5195 return ipc_has_perm(ipcp, av);
5196 }
5197
5198 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5199 {
5200 struct ipc_security_struct *isec = ipcp->security;
5201 *secid = isec->sid;
5202 }
5203
5204 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5205 {
5206 if (inode)
5207 inode_doinit_with_dentry(inode, dentry);
5208 }
5209
5210 static int selinux_getprocattr(struct task_struct *p,
5211 char *name, char **value)
5212 {
5213 struct task_security_struct *tsec;
5214 u32 sid;
5215 int error;
5216 unsigned len;
5217
5218 if (current != p) {
5219 error = task_has_perm(current, p, PROCESS__GETATTR);
5220 if (error)
5221 return error;
5222 }
5223
5224 tsec = p->security;
5225
5226 if (!strcmp(name, "current"))
5227 sid = tsec->sid;
5228 else if (!strcmp(name, "prev"))
5229 sid = tsec->osid;
5230 else if (!strcmp(name, "exec"))
5231 sid = tsec->exec_sid;
5232 else if (!strcmp(name, "fscreate"))
5233 sid = tsec->create_sid;
5234 else if (!strcmp(name, "keycreate"))
5235 sid = tsec->keycreate_sid;
5236 else if (!strcmp(name, "sockcreate"))
5237 sid = tsec->sockcreate_sid;
5238 else
5239 return -EINVAL;
5240
5241 if (!sid)
5242 return 0;
5243
5244 error = security_sid_to_context(sid, value, &len);
5245 if (error)
5246 return error;
5247 return len;
5248 }
5249
5250 static int selinux_setprocattr(struct task_struct *p,
5251 char *name, void *value, size_t size)
5252 {
5253 struct task_security_struct *tsec;
5254 struct task_struct *tracer;
5255 u32 sid = 0;
5256 int error;
5257 char *str = value;
5258
5259 if (current != p) {
5260 /* SELinux only allows a process to change its own
5261 security attributes. */
5262 return -EACCES;
5263 }
5264
5265 /*
5266 * Basic control over ability to set these attributes at all.
5267 * current == p, but we'll pass them separately in case the
5268 * above restriction is ever removed.
5269 */
5270 if (!strcmp(name, "exec"))
5271 error = task_has_perm(current, p, PROCESS__SETEXEC);
5272 else if (!strcmp(name, "fscreate"))
5273 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5274 else if (!strcmp(name, "keycreate"))
5275 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5276 else if (!strcmp(name, "sockcreate"))
5277 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5278 else if (!strcmp(name, "current"))
5279 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5280 else
5281 error = -EINVAL;
5282 if (error)
5283 return error;
5284
5285 /* Obtain a SID for the context, if one was specified. */
5286 if (size && str[1] && str[1] != '\n') {
5287 if (str[size-1] == '\n') {
5288 str[size-1] = 0;
5289 size--;
5290 }
5291 error = security_context_to_sid(value, size, &sid);
5292 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5293 if (!capable(CAP_MAC_ADMIN))
5294 return error;
5295 error = security_context_to_sid_force(value, size,
5296 &sid);
5297 }
5298 if (error)
5299 return error;
5300 }
5301
5302 /* Permission checking based on the specified context is
5303 performed during the actual operation (execve,
5304 open/mkdir/...), when we know the full context of the
5305 operation. See selinux_bprm_set_security for the execve
5306 checks and may_create for the file creation checks. The
5307 operation will then fail if the context is not permitted. */
5308 tsec = p->security;
5309 if (!strcmp(name, "exec"))
5310 tsec->exec_sid = sid;
5311 else if (!strcmp(name, "fscreate"))
5312 tsec->create_sid = sid;
5313 else if (!strcmp(name, "keycreate")) {
5314 error = may_create_key(sid, p);
5315 if (error)
5316 return error;
5317 tsec->keycreate_sid = sid;
5318 } else if (!strcmp(name, "sockcreate"))
5319 tsec->sockcreate_sid = sid;
5320 else if (!strcmp(name, "current")) {
5321 struct av_decision avd;
5322
5323 if (sid == 0)
5324 return -EINVAL;
5325 /*
5326 * SELinux allows to change context in the following case only.
5327 * - Single threaded processes.
5328 * - Multi threaded processes intend to change its context into
5329 * more restricted domain (defined by TYPEBOUNDS statement).
5330 */
5331 if (atomic_read(&p->mm->mm_users) != 1) {
5332 struct task_struct *g, *t;
5333 struct mm_struct *mm = p->mm;
5334 read_lock(&tasklist_lock);
5335 do_each_thread(g, t) {
5336 if (t->mm == mm && t != p) {
5337 read_unlock(&tasklist_lock);
5338 error = security_bounded_transition(tsec->sid, sid);
5339 if (!error)
5340 goto boundary_ok;
5341
5342 return error;
5343 }
5344 } while_each_thread(g, t);
5345 read_unlock(&tasklist_lock);
5346 }
5347 boundary_ok:
5348
5349 /* Check permissions for the transition. */
5350 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5351 PROCESS__DYNTRANSITION, NULL);
5352 if (error)
5353 return error;
5354
5355 /* Check for ptracing, and update the task SID if ok.
5356 Otherwise, leave SID unchanged and fail. */
5357 task_lock(p);
5358 rcu_read_lock();
5359 tracer = tracehook_tracer_task(p);
5360 if (tracer != NULL) {
5361 struct task_security_struct *ptsec = tracer->security;
5362 u32 ptsid = ptsec->sid;
5363 rcu_read_unlock();
5364 error = avc_has_perm_noaudit(ptsid, sid,
5365 SECCLASS_PROCESS,
5366 PROCESS__PTRACE, 0, &avd);
5367 if (!error)
5368 tsec->sid = sid;
5369 task_unlock(p);
5370 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5371 PROCESS__PTRACE, &avd, error, NULL);
5372 if (error)
5373 return error;
5374 } else {
5375 rcu_read_unlock();
5376 tsec->sid = sid;
5377 task_unlock(p);
5378 }
5379 } else
5380 return -EINVAL;
5381
5382 return size;
5383 }
5384
5385 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5386 {
5387 return security_sid_to_context(secid, secdata, seclen);
5388 }
5389
5390 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5391 {
5392 return security_context_to_sid(secdata, seclen, secid);
5393 }
5394
5395 static void selinux_release_secctx(char *secdata, u32 seclen)
5396 {
5397 kfree(secdata);
5398 }
5399
5400 #ifdef CONFIG_KEYS
5401
5402 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5403 unsigned long flags)
5404 {
5405 struct task_security_struct *tsec = tsk->security;
5406 struct key_security_struct *ksec;
5407
5408 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5409 if (!ksec)
5410 return -ENOMEM;
5411
5412 if (tsec->keycreate_sid)
5413 ksec->sid = tsec->keycreate_sid;
5414 else
5415 ksec->sid = tsec->sid;
5416 k->security = ksec;
5417
5418 return 0;
5419 }
5420
5421 static void selinux_key_free(struct key *k)
5422 {
5423 struct key_security_struct *ksec = k->security;
5424
5425 k->security = NULL;
5426 kfree(ksec);
5427 }
5428
5429 static int selinux_key_permission(key_ref_t key_ref,
5430 struct task_struct *ctx,
5431 key_perm_t perm)
5432 {
5433 struct key *key;
5434 struct task_security_struct *tsec;
5435 struct key_security_struct *ksec;
5436
5437 key = key_ref_to_ptr(key_ref);
5438
5439 tsec = ctx->security;
5440 ksec = key->security;
5441
5442 /* if no specific permissions are requested, we skip the
5443 permission check. No serious, additional covert channels
5444 appear to be created. */
5445 if (perm == 0)
5446 return 0;
5447
5448 return avc_has_perm(tsec->sid, ksec->sid,
5449 SECCLASS_KEY, perm, NULL);
5450 }
5451
5452 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5453 {
5454 struct key_security_struct *ksec = key->security;
5455 char *context = NULL;
5456 unsigned len;
5457 int rc;
5458
5459 rc = security_sid_to_context(ksec->sid, &context, &len);
5460 if (!rc)
5461 rc = len;
5462 *_buffer = context;
5463 return rc;
5464 }
5465
5466 #endif
5467
5468 static struct security_operations selinux_ops = {
5469 .name = "selinux",
5470
5471 .ptrace_may_access = selinux_ptrace_may_access,
5472 .ptrace_traceme = selinux_ptrace_traceme,
5473 .capget = selinux_capget,
5474 .capset_check = selinux_capset_check,
5475 .capset_set = selinux_capset_set,
5476 .sysctl = selinux_sysctl,
5477 .capable = selinux_capable,
5478 .quotactl = selinux_quotactl,
5479 .quota_on = selinux_quota_on,
5480 .syslog = selinux_syslog,
5481 .vm_enough_memory = selinux_vm_enough_memory,
5482
5483 .netlink_send = selinux_netlink_send,
5484 .netlink_recv = selinux_netlink_recv,
5485
5486 .bprm_alloc_security = selinux_bprm_alloc_security,
5487 .bprm_free_security = selinux_bprm_free_security,
5488 .bprm_apply_creds = selinux_bprm_apply_creds,
5489 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5490 .bprm_set_security = selinux_bprm_set_security,
5491 .bprm_check_security = selinux_bprm_check_security,
5492 .bprm_secureexec = selinux_bprm_secureexec,
5493
5494 .sb_alloc_security = selinux_sb_alloc_security,
5495 .sb_free_security = selinux_sb_free_security,
5496 .sb_copy_data = selinux_sb_copy_data,
5497 .sb_kern_mount = selinux_sb_kern_mount,
5498 .sb_show_options = selinux_sb_show_options,
5499 .sb_statfs = selinux_sb_statfs,
5500 .sb_mount = selinux_mount,
5501 .sb_umount = selinux_umount,
5502 .sb_set_mnt_opts = selinux_set_mnt_opts,
5503 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5504 .sb_parse_opts_str = selinux_parse_opts_str,
5505
5506
5507 .inode_alloc_security = selinux_inode_alloc_security,
5508 .inode_free_security = selinux_inode_free_security,
5509 .inode_init_security = selinux_inode_init_security,
5510 .inode_create = selinux_inode_create,
5511 .inode_link = selinux_inode_link,
5512 .inode_unlink = selinux_inode_unlink,
5513 .inode_symlink = selinux_inode_symlink,
5514 .inode_mkdir = selinux_inode_mkdir,
5515 .inode_rmdir = selinux_inode_rmdir,
5516 .inode_mknod = selinux_inode_mknod,
5517 .inode_rename = selinux_inode_rename,
5518 .inode_readlink = selinux_inode_readlink,
5519 .inode_follow_link = selinux_inode_follow_link,
5520 .inode_permission = selinux_inode_permission,
5521 .inode_setattr = selinux_inode_setattr,
5522 .inode_getattr = selinux_inode_getattr,
5523 .inode_setxattr = selinux_inode_setxattr,
5524 .inode_post_setxattr = selinux_inode_post_setxattr,
5525 .inode_getxattr = selinux_inode_getxattr,
5526 .inode_listxattr = selinux_inode_listxattr,
5527 .inode_removexattr = selinux_inode_removexattr,
5528 .inode_getsecurity = selinux_inode_getsecurity,
5529 .inode_setsecurity = selinux_inode_setsecurity,
5530 .inode_listsecurity = selinux_inode_listsecurity,
5531 .inode_need_killpriv = selinux_inode_need_killpriv,
5532 .inode_killpriv = selinux_inode_killpriv,
5533 .inode_getsecid = selinux_inode_getsecid,
5534
5535 .file_permission = selinux_file_permission,
5536 .file_alloc_security = selinux_file_alloc_security,
5537 .file_free_security = selinux_file_free_security,
5538 .file_ioctl = selinux_file_ioctl,
5539 .file_mmap = selinux_file_mmap,
5540 .file_mprotect = selinux_file_mprotect,
5541 .file_lock = selinux_file_lock,
5542 .file_fcntl = selinux_file_fcntl,
5543 .file_set_fowner = selinux_file_set_fowner,
5544 .file_send_sigiotask = selinux_file_send_sigiotask,
5545 .file_receive = selinux_file_receive,
5546
5547 .dentry_open = selinux_dentry_open,
5548
5549 .task_create = selinux_task_create,
5550 .task_alloc_security = selinux_task_alloc_security,
5551 .task_free_security = selinux_task_free_security,
5552 .task_setuid = selinux_task_setuid,
5553 .task_post_setuid = selinux_task_post_setuid,
5554 .task_setgid = selinux_task_setgid,
5555 .task_setpgid = selinux_task_setpgid,
5556 .task_getpgid = selinux_task_getpgid,
5557 .task_getsid = selinux_task_getsid,
5558 .task_getsecid = selinux_task_getsecid,
5559 .task_setgroups = selinux_task_setgroups,
5560 .task_setnice = selinux_task_setnice,
5561 .task_setioprio = selinux_task_setioprio,
5562 .task_getioprio = selinux_task_getioprio,
5563 .task_setrlimit = selinux_task_setrlimit,
5564 .task_setscheduler = selinux_task_setscheduler,
5565 .task_getscheduler = selinux_task_getscheduler,
5566 .task_movememory = selinux_task_movememory,
5567 .task_kill = selinux_task_kill,
5568 .task_wait = selinux_task_wait,
5569 .task_prctl = selinux_task_prctl,
5570 .task_reparent_to_init = selinux_task_reparent_to_init,
5571 .task_to_inode = selinux_task_to_inode,
5572
5573 .ipc_permission = selinux_ipc_permission,
5574 .ipc_getsecid = selinux_ipc_getsecid,
5575
5576 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5577 .msg_msg_free_security = selinux_msg_msg_free_security,
5578
5579 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5580 .msg_queue_free_security = selinux_msg_queue_free_security,
5581 .msg_queue_associate = selinux_msg_queue_associate,
5582 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5583 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5584 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5585
5586 .shm_alloc_security = selinux_shm_alloc_security,
5587 .shm_free_security = selinux_shm_free_security,
5588 .shm_associate = selinux_shm_associate,
5589 .shm_shmctl = selinux_shm_shmctl,
5590 .shm_shmat = selinux_shm_shmat,
5591
5592 .sem_alloc_security = selinux_sem_alloc_security,
5593 .sem_free_security = selinux_sem_free_security,
5594 .sem_associate = selinux_sem_associate,
5595 .sem_semctl = selinux_sem_semctl,
5596 .sem_semop = selinux_sem_semop,
5597
5598 .d_instantiate = selinux_d_instantiate,
5599
5600 .getprocattr = selinux_getprocattr,
5601 .setprocattr = selinux_setprocattr,
5602
5603 .secid_to_secctx = selinux_secid_to_secctx,
5604 .secctx_to_secid = selinux_secctx_to_secid,
5605 .release_secctx = selinux_release_secctx,
5606
5607 .unix_stream_connect = selinux_socket_unix_stream_connect,
5608 .unix_may_send = selinux_socket_unix_may_send,
5609
5610 .socket_create = selinux_socket_create,
5611 .socket_post_create = selinux_socket_post_create,
5612 .socket_bind = selinux_socket_bind,
5613 .socket_connect = selinux_socket_connect,
5614 .socket_listen = selinux_socket_listen,
5615 .socket_accept = selinux_socket_accept,
5616 .socket_sendmsg = selinux_socket_sendmsg,
5617 .socket_recvmsg = selinux_socket_recvmsg,
5618 .socket_getsockname = selinux_socket_getsockname,
5619 .socket_getpeername = selinux_socket_getpeername,
5620 .socket_getsockopt = selinux_socket_getsockopt,
5621 .socket_setsockopt = selinux_socket_setsockopt,
5622 .socket_shutdown = selinux_socket_shutdown,
5623 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5624 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5625 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5626 .sk_alloc_security = selinux_sk_alloc_security,
5627 .sk_free_security = selinux_sk_free_security,
5628 .sk_clone_security = selinux_sk_clone_security,
5629 .sk_getsecid = selinux_sk_getsecid,
5630 .sock_graft = selinux_sock_graft,
5631 .inet_conn_request = selinux_inet_conn_request,
5632 .inet_csk_clone = selinux_inet_csk_clone,
5633 .inet_conn_established = selinux_inet_conn_established,
5634 .req_classify_flow = selinux_req_classify_flow,
5635
5636 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5637 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5638 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5639 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5640 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5641 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5642 .xfrm_state_free_security = selinux_xfrm_state_free,
5643 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5644 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5645 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5646 .xfrm_decode_session = selinux_xfrm_decode_session,
5647 #endif
5648
5649 #ifdef CONFIG_KEYS
5650 .key_alloc = selinux_key_alloc,
5651 .key_free = selinux_key_free,
5652 .key_permission = selinux_key_permission,
5653 .key_getsecurity = selinux_key_getsecurity,
5654 #endif
5655
5656 #ifdef CONFIG_AUDIT
5657 .audit_rule_init = selinux_audit_rule_init,
5658 .audit_rule_known = selinux_audit_rule_known,
5659 .audit_rule_match = selinux_audit_rule_match,
5660 .audit_rule_free = selinux_audit_rule_free,
5661 #endif
5662 };
5663
5664 static __init int selinux_init(void)
5665 {
5666 struct task_security_struct *tsec;
5667
5668 if (!security_module_enable(&selinux_ops)) {
5669 selinux_enabled = 0;
5670 return 0;
5671 }
5672
5673 if (!selinux_enabled) {
5674 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5675 return 0;
5676 }
5677
5678 printk(KERN_INFO "SELinux: Initializing.\n");
5679
5680 /* Set the security state for the initial task. */
5681 if (task_alloc_security(current))
5682 panic("SELinux: Failed to initialize initial task.\n");
5683 tsec = current->security;
5684 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5685
5686 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5687 sizeof(struct inode_security_struct),
5688 0, SLAB_PANIC, NULL);
5689 avc_init();
5690
5691 secondary_ops = security_ops;
5692 if (!secondary_ops)
5693 panic("SELinux: No initial security operations\n");
5694 if (register_security(&selinux_ops))
5695 panic("SELinux: Unable to register with kernel.\n");
5696
5697 if (selinux_enforcing)
5698 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5699 else
5700 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5701
5702 return 0;
5703 }
5704
5705 void selinux_complete_init(void)
5706 {
5707 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5708
5709 /* Set up any superblocks initialized prior to the policy load. */
5710 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5711 spin_lock(&sb_lock);
5712 spin_lock(&sb_security_lock);
5713 next_sb:
5714 if (!list_empty(&superblock_security_head)) {
5715 struct superblock_security_struct *sbsec =
5716 list_entry(superblock_security_head.next,
5717 struct superblock_security_struct,
5718 list);
5719 struct super_block *sb = sbsec->sb;
5720 sb->s_count++;
5721 spin_unlock(&sb_security_lock);
5722 spin_unlock(&sb_lock);
5723 down_read(&sb->s_umount);
5724 if (sb->s_root)
5725 superblock_doinit(sb, NULL);
5726 drop_super(sb);
5727 spin_lock(&sb_lock);
5728 spin_lock(&sb_security_lock);
5729 list_del_init(&sbsec->list);
5730 goto next_sb;
5731 }
5732 spin_unlock(&sb_security_lock);
5733 spin_unlock(&sb_lock);
5734 }
5735
5736 /* SELinux requires early initialization in order to label
5737 all processes and objects when they are created. */
5738 security_initcall(selinux_init);
5739
5740 #if defined(CONFIG_NETFILTER)
5741
5742 static struct nf_hook_ops selinux_ipv4_ops[] = {
5743 {
5744 .hook = selinux_ipv4_postroute,
5745 .owner = THIS_MODULE,
5746 .pf = PF_INET,
5747 .hooknum = NF_INET_POST_ROUTING,
5748 .priority = NF_IP_PRI_SELINUX_LAST,
5749 },
5750 {
5751 .hook = selinux_ipv4_forward,
5752 .owner = THIS_MODULE,
5753 .pf = PF_INET,
5754 .hooknum = NF_INET_FORWARD,
5755 .priority = NF_IP_PRI_SELINUX_FIRST,
5756 },
5757 {
5758 .hook = selinux_ipv4_output,
5759 .owner = THIS_MODULE,
5760 .pf = PF_INET,
5761 .hooknum = NF_INET_LOCAL_OUT,
5762 .priority = NF_IP_PRI_SELINUX_FIRST,
5763 }
5764 };
5765
5766 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5767
5768 static struct nf_hook_ops selinux_ipv6_ops[] = {
5769 {
5770 .hook = selinux_ipv6_postroute,
5771 .owner = THIS_MODULE,
5772 .pf = PF_INET6,
5773 .hooknum = NF_INET_POST_ROUTING,
5774 .priority = NF_IP6_PRI_SELINUX_LAST,
5775 },
5776 {
5777 .hook = selinux_ipv6_forward,
5778 .owner = THIS_MODULE,
5779 .pf = PF_INET6,
5780 .hooknum = NF_INET_FORWARD,
5781 .priority = NF_IP6_PRI_SELINUX_FIRST,
5782 }
5783 };
5784
5785 #endif /* IPV6 */
5786
5787 static int __init selinux_nf_ip_init(void)
5788 {
5789 int err = 0;
5790
5791 if (!selinux_enabled)
5792 goto out;
5793
5794 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5795
5796 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5797 if (err)
5798 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5799
5800 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5801 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5802 if (err)
5803 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5804 #endif /* IPV6 */
5805
5806 out:
5807 return err;
5808 }
5809
5810 __initcall(selinux_nf_ip_init);
5811
5812 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5813 static void selinux_nf_ip_exit(void)
5814 {
5815 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5816
5817 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5818 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5819 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5820 #endif /* IPV6 */
5821 }
5822 #endif
5823
5824 #else /* CONFIG_NETFILTER */
5825
5826 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5827 #define selinux_nf_ip_exit()
5828 #endif
5829
5830 #endif /* CONFIG_NETFILTER */
5831
5832 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5833 static int selinux_disabled;
5834
5835 int selinux_disable(void)
5836 {
5837 extern void exit_sel_fs(void);
5838
5839 if (ss_initialized) {
5840 /* Not permitted after initial policy load. */
5841 return -EINVAL;
5842 }
5843
5844 if (selinux_disabled) {
5845 /* Only do this once. */
5846 return -EINVAL;
5847 }
5848
5849 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5850
5851 selinux_disabled = 1;
5852 selinux_enabled = 0;
5853
5854 /* Reset security_ops to the secondary module, dummy or capability. */
5855 security_ops = secondary_ops;
5856
5857 /* Unregister netfilter hooks. */
5858 selinux_nf_ip_exit();
5859
5860 /* Unregister selinuxfs. */
5861 exit_sel_fs();
5862
5863 return 0;
5864 }
5865 #endif
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree