?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Currently SELinux jumps through some ugly hoops to not audit a capbility
[linux-2.6/mini2440.git] / security / selinux / hooks.c
blob378dc53c08e857d914d889df9f3713bdd94eff5e
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kernel.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched.h>
31 #include <linux/security.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/swap.h>
40 #include <linux/spinlock.h>
41 #include <linux/syscalls.h>
42 #include <linux/file.h>
43 #include <linux/fdtable.h>
44 #include <linux/namei.h>
45 #include <linux/mount.h>
46 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <linux/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78 #include <linux/posix-timers.h>
79
80 #include "avc.h"
81 #include "objsec.h"
82 #include "netif.h"
83 #include "netnode.h"
84 #include "netport.h"
85 #include "xfrm.h"
86 #include "netlabel.h"
87 #include "audit.h"
88
89 #define XATTR_SELINUX_SUFFIX "selinux"
90 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
91
92 #define NUM_SEL_MNT_OPTS 4
93
94 extern unsigned int policydb_loaded_version;
95 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
96 extern int selinux_compat_net;
97 extern struct security_operations *security_ops;
98
99 /* SECMARK reference count */
100 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101
102 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
103 int selinux_enforcing;
104
105 static int __init enforcing_setup(char *str)
106 {
107 unsigned long enforcing;
108 if (!strict_strtoul(str, 0, &enforcing))
109 selinux_enforcing = enforcing ? 1 : 0;
110 return 1;
111 }
112 __setup("enforcing=", enforcing_setup);
113 #endif
114
115 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
116 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117
118 static int __init selinux_enabled_setup(char *str)
119 {
120 unsigned long enabled;
121 if (!strict_strtoul(str, 0, &enabled))
122 selinux_enabled = enabled ? 1 : 0;
123 return 1;
124 }
125 __setup("selinux=", selinux_enabled_setup);
126 #else
127 int selinux_enabled = 1;
128 #endif
129
130
131 /*
132 * Minimal support for a secondary security module,
133 * just to allow the use of the capability module.
134 */
135 static struct security_operations *secondary_ops;
136
137 /* Lists of inode and superblock security structures initialized
138 before the policy was loaded. */
139 static LIST_HEAD(superblock_security_head);
140 static DEFINE_SPINLOCK(sb_security_lock);
141
142 static struct kmem_cache *sel_inode_cache;
143
144 /**
145 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
146 *
147 * Description:
148 * This function checks the SECMARK reference counter to see if any SECMARK
149 * targets are currently configured, if the reference counter is greater than
150 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
151 * enabled, false (0) if SECMARK is disabled.
152 *
153 */
154 static int selinux_secmark_enabled(void)
155 {
156 return (atomic_read(&selinux_secmark_refcount) > 0);
157 }
158
159 /* Allocate and free functions for each kind of security blob. */
160
161 static int task_alloc_security(struct task_struct *task)
162 {
163 struct task_security_struct *tsec;
164
165 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
166 if (!tsec)
167 return -ENOMEM;
168
169 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
170 task->security = tsec;
171
172 return 0;
173 }
174
175 static void task_free_security(struct task_struct *task)
176 {
177 struct task_security_struct *tsec = task->security;
178 task->security = NULL;
179 kfree(tsec);
180 }
181
182 static int inode_alloc_security(struct inode *inode)
183 {
184 struct task_security_struct *tsec = current->security;
185 struct inode_security_struct *isec;
186
187 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
188 if (!isec)
189 return -ENOMEM;
190
191 mutex_init(&isec->lock);
192 INIT_LIST_HEAD(&isec->list);
193 isec->inode = inode;
194 isec->sid = SECINITSID_UNLABELED;
195 isec->sclass = SECCLASS_FILE;
196 isec->task_sid = tsec->sid;
197 inode->i_security = isec;
198
199 return 0;
200 }
201
202 static void inode_free_security(struct inode *inode)
203 {
204 struct inode_security_struct *isec = inode->i_security;
205 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
206
207 spin_lock(&sbsec->isec_lock);
208 if (!list_empty(&isec->list))
209 list_del_init(&isec->list);
210 spin_unlock(&sbsec->isec_lock);
211
212 inode->i_security = NULL;
213 kmem_cache_free(sel_inode_cache, isec);
214 }
215
216 static int file_alloc_security(struct file *file)
217 {
218 struct task_security_struct *tsec = current->security;
219 struct file_security_struct *fsec;
220
221 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
222 if (!fsec)
223 return -ENOMEM;
224
225 fsec->sid = tsec->sid;
226 fsec->fown_sid = tsec->sid;
227 file->f_security = fsec;
228
229 return 0;
230 }
231
232 static void file_free_security(struct file *file)
233 {
234 struct file_security_struct *fsec = file->f_security;
235 file->f_security = NULL;
236 kfree(fsec);
237 }
238
239 static int superblock_alloc_security(struct super_block *sb)
240 {
241 struct superblock_security_struct *sbsec;
242
243 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
244 if (!sbsec)
245 return -ENOMEM;
246
247 mutex_init(&sbsec->lock);
248 INIT_LIST_HEAD(&sbsec->list);
249 INIT_LIST_HEAD(&sbsec->isec_head);
250 spin_lock_init(&sbsec->isec_lock);
251 sbsec->sb = sb;
252 sbsec->sid = SECINITSID_UNLABELED;
253 sbsec->def_sid = SECINITSID_FILE;
254 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
255 sb->s_security = sbsec;
256
257 return 0;
258 }
259
260 static void superblock_free_security(struct super_block *sb)
261 {
262 struct superblock_security_struct *sbsec = sb->s_security;
263
264 spin_lock(&sb_security_lock);
265 if (!list_empty(&sbsec->list))
266 list_del_init(&sbsec->list);
267 spin_unlock(&sb_security_lock);
268
269 sb->s_security = NULL;
270 kfree(sbsec);
271 }
272
273 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
274 {
275 struct sk_security_struct *ssec;
276
277 ssec = kzalloc(sizeof(*ssec), priority);
278 if (!ssec)
279 return -ENOMEM;
280
281 ssec->peer_sid = SECINITSID_UNLABELED;
282 ssec->sid = SECINITSID_UNLABELED;
283 sk->sk_security = ssec;
284
285 selinux_netlbl_sk_security_reset(ssec, family);
286
287 return 0;
288 }
289
290 static void sk_free_security(struct sock *sk)
291 {
292 struct sk_security_struct *ssec = sk->sk_security;
293
294 sk->sk_security = NULL;
295 selinux_netlbl_sk_security_free(ssec);
296 kfree(ssec);
297 }
298
299 /* The security server must be initialized before
300 any labeling or access decisions can be provided. */
301 extern int ss_initialized;
302
303 /* The file system's label must be initialized prior to use. */
304
305 static char *labeling_behaviors[6] = {
306 "uses xattr",
307 "uses transition SIDs",
308 "uses task SIDs",
309 "uses genfs_contexts",
310 "not configured for labeling",
311 "uses mountpoint labeling",
312 };
313
314 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
315
316 static inline int inode_doinit(struct inode *inode)
317 {
318 return inode_doinit_with_dentry(inode, NULL);
319 }
320
321 enum {
322 Opt_error = -1,
323 Opt_context = 1,
324 Opt_fscontext = 2,
325 Opt_defcontext = 3,
326 Opt_rootcontext = 4,
327 };
328
329 static const match_table_t tokens = {
330 {Opt_context, CONTEXT_STR "%s"},
331 {Opt_fscontext, FSCONTEXT_STR "%s"},
332 {Opt_defcontext, DEFCONTEXT_STR "%s"},
333 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
334 {Opt_error, NULL},
335 };
336
337 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
338
339 static int may_context_mount_sb_relabel(u32 sid,
340 struct superblock_security_struct *sbsec,
341 struct task_security_struct *tsec)
342 {
343 int rc;
344
345 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELFROM, NULL);
347 if (rc)
348 return rc;
349
350 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
351 FILESYSTEM__RELABELTO, NULL);
352 return rc;
353 }
354
355 static int may_context_mount_inode_relabel(u32 sid,
356 struct superblock_security_struct *sbsec,
357 struct task_security_struct *tsec)
358 {
359 int rc;
360 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
361 FILESYSTEM__RELABELFROM, NULL);
362 if (rc)
363 return rc;
364
365 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
366 FILESYSTEM__ASSOCIATE, NULL);
367 return rc;
368 }
369
370 static int sb_finish_set_opts(struct super_block *sb)
371 {
372 struct superblock_security_struct *sbsec = sb->s_security;
373 struct dentry *root = sb->s_root;
374 struct inode *root_inode = root->d_inode;
375 int rc = 0;
376
377 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
378 /* Make sure that the xattr handler exists and that no
379 error other than -ENODATA is returned by getxattr on
380 the root directory. -ENODATA is ok, as this may be
381 the first boot of the SELinux kernel before we have
382 assigned xattr values to the filesystem. */
383 if (!root_inode->i_op->getxattr) {
384 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
385 "xattr support\n", sb->s_id, sb->s_type->name);
386 rc = -EOPNOTSUPP;
387 goto out;
388 }
389 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
390 if (rc < 0 && rc != -ENODATA) {
391 if (rc == -EOPNOTSUPP)
392 printk(KERN_WARNING "SELinux: (dev %s, type "
393 "%s) has no security xattr handler\n",
394 sb->s_id, sb->s_type->name);
395 else
396 printk(KERN_WARNING "SELinux: (dev %s, type "
397 "%s) getxattr errno %d\n", sb->s_id,
398 sb->s_type->name, -rc);
399 goto out;
400 }
401 }
402
403 sbsec->initialized = 1;
404
405 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
406 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
407 sb->s_id, sb->s_type->name);
408 else
409 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
410 sb->s_id, sb->s_type->name,
411 labeling_behaviors[sbsec->behavior-1]);
412
413 /* Initialize the root inode. */
414 rc = inode_doinit_with_dentry(root_inode, root);
415
416 /* Initialize any other inodes associated with the superblock, e.g.
417 inodes created prior to initial policy load or inodes created
418 during get_sb by a pseudo filesystem that directly
419 populates itself. */
420 spin_lock(&sbsec->isec_lock);
421 next_inode:
422 if (!list_empty(&sbsec->isec_head)) {
423 struct inode_security_struct *isec =
424 list_entry(sbsec->isec_head.next,
425 struct inode_security_struct, list);
426 struct inode *inode = isec->inode;
427 spin_unlock(&sbsec->isec_lock);
428 inode = igrab(inode);
429 if (inode) {
430 if (!IS_PRIVATE(inode))
431 inode_doinit(inode);
432 iput(inode);
433 }
434 spin_lock(&sbsec->isec_lock);
435 list_del_init(&isec->list);
436 goto next_inode;
437 }
438 spin_unlock(&sbsec->isec_lock);
439 out:
440 return rc;
441 }
442
443 /*
444 * This function should allow an FS to ask what it's mount security
445 * options were so it can use those later for submounts, displaying
446 * mount options, or whatever.
447 */
448 static int selinux_get_mnt_opts(const struct super_block *sb,
449 struct security_mnt_opts *opts)
450 {
451 int rc = 0, i;
452 struct superblock_security_struct *sbsec = sb->s_security;
453 char *context = NULL;
454 u32 len;
455 char tmp;
456
457 security_init_mnt_opts(opts);
458
459 if (!sbsec->initialized)
460 return -EINVAL;
461
462 if (!ss_initialized)
463 return -EINVAL;
464
465 /*
466 * if we ever use sbsec flags for anything other than tracking mount
467 * settings this is going to need a mask
468 */
469 tmp = sbsec->flags;
470 /* count the number of mount options for this sb */
471 for (i = 0; i < 8; i++) {
472 if (tmp & 0x01)
473 opts->num_mnt_opts++;
474 tmp >>= 1;
475 }
476
477 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
478 if (!opts->mnt_opts) {
479 rc = -ENOMEM;
480 goto out_free;
481 }
482
483 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
484 if (!opts->mnt_opts_flags) {
485 rc = -ENOMEM;
486 goto out_free;
487 }
488
489 i = 0;
490 if (sbsec->flags & FSCONTEXT_MNT) {
491 rc = security_sid_to_context(sbsec->sid, &context, &len);
492 if (rc)
493 goto out_free;
494 opts->mnt_opts[i] = context;
495 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
496 }
497 if (sbsec->flags & CONTEXT_MNT) {
498 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
499 if (rc)
500 goto out_free;
501 opts->mnt_opts[i] = context;
502 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
503 }
504 if (sbsec->flags & DEFCONTEXT_MNT) {
505 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
506 if (rc)
507 goto out_free;
508 opts->mnt_opts[i] = context;
509 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
510 }
511 if (sbsec->flags & ROOTCONTEXT_MNT) {
512 struct inode *root = sbsec->sb->s_root->d_inode;
513 struct inode_security_struct *isec = root->i_security;
514
515 rc = security_sid_to_context(isec->sid, &context, &len);
516 if (rc)
517 goto out_free;
518 opts->mnt_opts[i] = context;
519 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
520 }
521
522 BUG_ON(i != opts->num_mnt_opts);
523
524 return 0;
525
526 out_free:
527 security_free_mnt_opts(opts);
528 return rc;
529 }
530
531 static int bad_option(struct superblock_security_struct *sbsec, char flag,
532 u32 old_sid, u32 new_sid)
533 {
534 /* check if the old mount command had the same options */
535 if (sbsec->initialized)
536 if (!(sbsec->flags & flag) ||
537 (old_sid != new_sid))
538 return 1;
539
540 /* check if we were passed the same options twice,
541 * aka someone passed context=a,context=b
542 */
543 if (!sbsec->initialized)
544 if (sbsec->flags & flag)
545 return 1;
546 return 0;
547 }
548
549 /*
550 * Allow filesystems with binary mount data to explicitly set mount point
551 * labeling information.
552 */
553 static int selinux_set_mnt_opts(struct super_block *sb,
554 struct security_mnt_opts *opts)
555 {
556 int rc = 0, i;
557 struct task_security_struct *tsec = current->security;
558 struct superblock_security_struct *sbsec = sb->s_security;
559 const char *name = sb->s_type->name;
560 struct inode *inode = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *root_isec = inode->i_security;
562 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
563 u32 defcontext_sid = 0;
564 char **mount_options = opts->mnt_opts;
565 int *flags = opts->mnt_opts_flags;
566 int num_opts = opts->num_mnt_opts;
567
568 mutex_lock(&sbsec->lock);
569
570 if (!ss_initialized) {
571 if (!num_opts) {
572 /* Defer initialization until selinux_complete_init,
573 after the initial policy is loaded and the security
574 server is ready to handle calls. */
575 spin_lock(&sb_security_lock);
576 if (list_empty(&sbsec->list))
577 list_add(&sbsec->list, &superblock_security_head);
578 spin_unlock(&sb_security_lock);
579 goto out;
580 }
581 rc = -EINVAL;
582 printk(KERN_WARNING "SELinux: Unable to set superblock options "
583 "before the security server is initialized\n");
584 goto out;
585 }
586
587 /*
588 * Binary mount data FS will come through this function twice. Once
589 * from an explicit call and once from the generic calls from the vfs.
590 * Since the generic VFS calls will not contain any security mount data
591 * we need to skip the double mount verification.
592 *
593 * This does open a hole in which we will not notice if the first
594 * mount using this sb set explict options and a second mount using
595 * this sb does not set any security options. (The first options
596 * will be used for both mounts)
597 */
598 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
599 && (num_opts == 0))
600 goto out;
601
602 /*
603 * parse the mount options, check if they are valid sids.
604 * also check if someone is trying to mount the same sb more
605 * than once with different security options.
606 */
607 for (i = 0; i < num_opts; i++) {
608 u32 sid;
609 rc = security_context_to_sid(mount_options[i],
610 strlen(mount_options[i]), &sid);
611 if (rc) {
612 printk(KERN_WARNING "SELinux: security_context_to_sid"
613 "(%s) failed for (dev %s, type %s) errno=%d\n",
614 mount_options[i], sb->s_id, name, rc);
615 goto out;
616 }
617 switch (flags[i]) {
618 case FSCONTEXT_MNT:
619 fscontext_sid = sid;
620
621 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
622 fscontext_sid))
623 goto out_double_mount;
624
625 sbsec->flags |= FSCONTEXT_MNT;
626 break;
627 case CONTEXT_MNT:
628 context_sid = sid;
629
630 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
631 context_sid))
632 goto out_double_mount;
633
634 sbsec->flags |= CONTEXT_MNT;
635 break;
636 case ROOTCONTEXT_MNT:
637 rootcontext_sid = sid;
638
639 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
640 rootcontext_sid))
641 goto out_double_mount;
642
643 sbsec->flags |= ROOTCONTEXT_MNT;
644
645 break;
646 case DEFCONTEXT_MNT:
647 defcontext_sid = sid;
648
649 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
650 defcontext_sid))
651 goto out_double_mount;
652
653 sbsec->flags |= DEFCONTEXT_MNT;
654
655 break;
656 default:
657 rc = -EINVAL;
658 goto out;
659 }
660 }
661
662 if (sbsec->initialized) {
663 /* previously mounted with options, but not on this attempt? */
664 if (sbsec->flags && !num_opts)
665 goto out_double_mount;
666 rc = 0;
667 goto out;
668 }
669
670 if (strcmp(sb->s_type->name, "proc") == 0)
671 sbsec->proc = 1;
672
673 /* Determine the labeling behavior to use for this filesystem type. */
674 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
675 if (rc) {
676 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
677 __func__, sb->s_type->name, rc);
678 goto out;
679 }
680
681 /* sets the context of the superblock for the fs being mounted. */
682 if (fscontext_sid) {
683
684 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
685 if (rc)
686 goto out;
687
688 sbsec->sid = fscontext_sid;
689 }
690
691 /*
692 * Switch to using mount point labeling behavior.
693 * sets the label used on all file below the mountpoint, and will set
694 * the superblock context if not already set.
695 */
696 if (context_sid) {
697 if (!fscontext_sid) {
698 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
699 if (rc)
700 goto out;
701 sbsec->sid = context_sid;
702 } else {
703 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
704 if (rc)
705 goto out;
706 }
707 if (!rootcontext_sid)
708 rootcontext_sid = context_sid;
709
710 sbsec->mntpoint_sid = context_sid;
711 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
712 }
713
714 if (rootcontext_sid) {
715 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
716 if (rc)
717 goto out;
718
719 root_isec->sid = rootcontext_sid;
720 root_isec->initialized = 1;
721 }
722
723 if (defcontext_sid) {
724 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
725 rc = -EINVAL;
726 printk(KERN_WARNING "SELinux: defcontext option is "
727 "invalid for this filesystem type\n");
728 goto out;
729 }
730
731 if (defcontext_sid != sbsec->def_sid) {
732 rc = may_context_mount_inode_relabel(defcontext_sid,
733 sbsec, tsec);
734 if (rc)
735 goto out;
736 }
737
738 sbsec->def_sid = defcontext_sid;
739 }
740
741 rc = sb_finish_set_opts(sb);
742 out:
743 mutex_unlock(&sbsec->lock);
744 return rc;
745 out_double_mount:
746 rc = -EINVAL;
747 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
748 "security settings for (dev %s, type %s)\n", sb->s_id, name);
749 goto out;
750 }
751
752 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
753 struct super_block *newsb)
754 {
755 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
756 struct superblock_security_struct *newsbsec = newsb->s_security;
757
758 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
759 int set_context = (oldsbsec->flags & CONTEXT_MNT);
760 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
761
762 /*
763 * if the parent was able to be mounted it clearly had no special lsm
764 * mount options. thus we can safely put this sb on the list and deal
765 * with it later
766 */
767 if (!ss_initialized) {
768 spin_lock(&sb_security_lock);
769 if (list_empty(&newsbsec->list))
770 list_add(&newsbsec->list, &superblock_security_head);
771 spin_unlock(&sb_security_lock);
772 return;
773 }
774
775 /* how can we clone if the old one wasn't set up?? */
776 BUG_ON(!oldsbsec->initialized);
777
778 /* if fs is reusing a sb, just let its options stand... */
779 if (newsbsec->initialized)
780 return;
781
782 mutex_lock(&newsbsec->lock);
783
784 newsbsec->flags = oldsbsec->flags;
785
786 newsbsec->sid = oldsbsec->sid;
787 newsbsec->def_sid = oldsbsec->def_sid;
788 newsbsec->behavior = oldsbsec->behavior;
789
790 if (set_context) {
791 u32 sid = oldsbsec->mntpoint_sid;
792
793 if (!set_fscontext)
794 newsbsec->sid = sid;
795 if (!set_rootcontext) {
796 struct inode *newinode = newsb->s_root->d_inode;
797 struct inode_security_struct *newisec = newinode->i_security;
798 newisec->sid = sid;
799 }
800 newsbsec->mntpoint_sid = sid;
801 }
802 if (set_rootcontext) {
803 const struct inode *oldinode = oldsb->s_root->d_inode;
804 const struct inode_security_struct *oldisec = oldinode->i_security;
805 struct inode *newinode = newsb->s_root->d_inode;
806 struct inode_security_struct *newisec = newinode->i_security;
807
808 newisec->sid = oldisec->sid;
809 }
810
811 sb_finish_set_opts(newsb);
812 mutex_unlock(&newsbsec->lock);
813 }
814
815 static int selinux_parse_opts_str(char *options,
816 struct security_mnt_opts *opts)
817 {
818 char *p;
819 char *context = NULL, *defcontext = NULL;
820 char *fscontext = NULL, *rootcontext = NULL;
821 int rc, num_mnt_opts = 0;
822
823 opts->num_mnt_opts = 0;
824
825 /* Standard string-based options. */
826 while ((p = strsep(&options, "|")) != NULL) {
827 int token;
828 substring_t args[MAX_OPT_ARGS];
829
830 if (!*p)
831 continue;
832
833 token = match_token(p, tokens, args);
834
835 switch (token) {
836 case Opt_context:
837 if (context || defcontext) {
838 rc = -EINVAL;
839 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
840 goto out_err;
841 }
842 context = match_strdup(&args[0]);
843 if (!context) {
844 rc = -ENOMEM;
845 goto out_err;
846 }
847 break;
848
849 case Opt_fscontext:
850 if (fscontext) {
851 rc = -EINVAL;
852 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
853 goto out_err;
854 }
855 fscontext = match_strdup(&args[0]);
856 if (!fscontext) {
857 rc = -ENOMEM;
858 goto out_err;
859 }
860 break;
861
862 case Opt_rootcontext:
863 if (rootcontext) {
864 rc = -EINVAL;
865 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
866 goto out_err;
867 }
868 rootcontext = match_strdup(&args[0]);
869 if (!rootcontext) {
870 rc = -ENOMEM;
871 goto out_err;
872 }
873 break;
874
875 case Opt_defcontext:
876 if (context || defcontext) {
877 rc = -EINVAL;
878 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
879 goto out_err;
880 }
881 defcontext = match_strdup(&args[0]);
882 if (!defcontext) {
883 rc = -ENOMEM;
884 goto out_err;
885 }
886 break;
887
888 default:
889 rc = -EINVAL;
890 printk(KERN_WARNING "SELinux: unknown mount option\n");
891 goto out_err;
892
893 }
894 }
895
896 rc = -ENOMEM;
897 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
898 if (!opts->mnt_opts)
899 goto out_err;
900
901 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
902 if (!opts->mnt_opts_flags) {
903 kfree(opts->mnt_opts);
904 goto out_err;
905 }
906
907 if (fscontext) {
908 opts->mnt_opts[num_mnt_opts] = fscontext;
909 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
910 }
911 if (context) {
912 opts->mnt_opts[num_mnt_opts] = context;
913 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
914 }
915 if (rootcontext) {
916 opts->mnt_opts[num_mnt_opts] = rootcontext;
917 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
918 }
919 if (defcontext) {
920 opts->mnt_opts[num_mnt_opts] = defcontext;
921 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
922 }
923
924 opts->num_mnt_opts = num_mnt_opts;
925 return 0;
926
927 out_err:
928 kfree(context);
929 kfree(defcontext);
930 kfree(fscontext);
931 kfree(rootcontext);
932 return rc;
933 }
934 /*
935 * string mount options parsing and call set the sbsec
936 */
937 static int superblock_doinit(struct super_block *sb, void *data)
938 {
939 int rc = 0;
940 char *options = data;
941 struct security_mnt_opts opts;
942
943 security_init_mnt_opts(&opts);
944
945 if (!data)
946 goto out;
947
948 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
949
950 rc = selinux_parse_opts_str(options, &opts);
951 if (rc)
952 goto out_err;
953
954 out:
955 rc = selinux_set_mnt_opts(sb, &opts);
956
957 out_err:
958 security_free_mnt_opts(&opts);
959 return rc;
960 }
961
962 static void selinux_write_opts(struct seq_file *m,
963 struct security_mnt_opts *opts)
964 {
965 int i;
966 char *prefix;
967
968 for (i = 0; i < opts->num_mnt_opts; i++) {
969 char *has_comma = strchr(opts->mnt_opts[i], ',');
970
971 switch (opts->mnt_opts_flags[i]) {
972 case CONTEXT_MNT:
973 prefix = CONTEXT_STR;
974 break;
975 case FSCONTEXT_MNT:
976 prefix = FSCONTEXT_STR;
977 break;
978 case ROOTCONTEXT_MNT:
979 prefix = ROOTCONTEXT_STR;
980 break;
981 case DEFCONTEXT_MNT:
982 prefix = DEFCONTEXT_STR;
983 break;
984 default:
985 BUG();
986 };
987 /* we need a comma before each option */
988 seq_putc(m, ',');
989 seq_puts(m, prefix);
990 if (has_comma)
991 seq_putc(m, '\"');
992 seq_puts(m, opts->mnt_opts[i]);
993 if (has_comma)
994 seq_putc(m, '\"');
995 }
996 }
997
998 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
999 {
1000 struct security_mnt_opts opts;
1001 int rc;
1002
1003 rc = selinux_get_mnt_opts(sb, &opts);
1004 if (rc) {
1005 /* before policy load we may get EINVAL, don't show anything */
1006 if (rc == -EINVAL)
1007 rc = 0;
1008 return rc;
1009 }
1010
1011 selinux_write_opts(m, &opts);
1012
1013 security_free_mnt_opts(&opts);
1014
1015 return rc;
1016 }
1017
1018 static inline u16 inode_mode_to_security_class(umode_t mode)
1019 {
1020 switch (mode & S_IFMT) {
1021 case S_IFSOCK:
1022 return SECCLASS_SOCK_FILE;
1023 case S_IFLNK:
1024 return SECCLASS_LNK_FILE;
1025 case S_IFREG:
1026 return SECCLASS_FILE;
1027 case S_IFBLK:
1028 return SECCLASS_BLK_FILE;
1029 case S_IFDIR:
1030 return SECCLASS_DIR;
1031 case S_IFCHR:
1032 return SECCLASS_CHR_FILE;
1033 case S_IFIFO:
1034 return SECCLASS_FIFO_FILE;
1035
1036 }
1037
1038 return SECCLASS_FILE;
1039 }
1040
1041 static inline int default_protocol_stream(int protocol)
1042 {
1043 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1044 }
1045
1046 static inline int default_protocol_dgram(int protocol)
1047 {
1048 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1049 }
1050
1051 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1052 {
1053 switch (family) {
1054 case PF_UNIX:
1055 switch (type) {
1056 case SOCK_STREAM:
1057 case SOCK_SEQPACKET:
1058 return SECCLASS_UNIX_STREAM_SOCKET;
1059 case SOCK_DGRAM:
1060 return SECCLASS_UNIX_DGRAM_SOCKET;
1061 }
1062 break;
1063 case PF_INET:
1064 case PF_INET6:
1065 switch (type) {
1066 case SOCK_STREAM:
1067 if (default_protocol_stream(protocol))
1068 return SECCLASS_TCP_SOCKET;
1069 else
1070 return SECCLASS_RAWIP_SOCKET;
1071 case SOCK_DGRAM:
1072 if (default_protocol_dgram(protocol))
1073 return SECCLASS_UDP_SOCKET;
1074 else
1075 return SECCLASS_RAWIP_SOCKET;
1076 case SOCK_DCCP:
1077 return SECCLASS_DCCP_SOCKET;
1078 default:
1079 return SECCLASS_RAWIP_SOCKET;
1080 }
1081 break;
1082 case PF_NETLINK:
1083 switch (protocol) {
1084 case NETLINK_ROUTE:
1085 return SECCLASS_NETLINK_ROUTE_SOCKET;
1086 case NETLINK_FIREWALL:
1087 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1088 case NETLINK_INET_DIAG:
1089 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1090 case NETLINK_NFLOG:
1091 return SECCLASS_NETLINK_NFLOG_SOCKET;
1092 case NETLINK_XFRM:
1093 return SECCLASS_NETLINK_XFRM_SOCKET;
1094 case NETLINK_SELINUX:
1095 return SECCLASS_NETLINK_SELINUX_SOCKET;
1096 case NETLINK_AUDIT:
1097 return SECCLASS_NETLINK_AUDIT_SOCKET;
1098 case NETLINK_IP6_FW:
1099 return SECCLASS_NETLINK_IP6FW_SOCKET;
1100 case NETLINK_DNRTMSG:
1101 return SECCLASS_NETLINK_DNRT_SOCKET;
1102 case NETLINK_KOBJECT_UEVENT:
1103 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1104 default:
1105 return SECCLASS_NETLINK_SOCKET;
1106 }
1107 case PF_PACKET:
1108 return SECCLASS_PACKET_SOCKET;
1109 case PF_KEY:
1110 return SECCLASS_KEY_SOCKET;
1111 case PF_APPLETALK:
1112 return SECCLASS_APPLETALK_SOCKET;
1113 }
1114
1115 return SECCLASS_SOCKET;
1116 }
1117
1118 #ifdef CONFIG_PROC_FS
1119 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1120 u16 tclass,
1121 u32 *sid)
1122 {
1123 int buflen, rc;
1124 char *buffer, *path, *end;
1125
1126 buffer = (char *)__get_free_page(GFP_KERNEL);
1127 if (!buffer)
1128 return -ENOMEM;
1129
1130 buflen = PAGE_SIZE;
1131 end = buffer+buflen;
1132 *--end = '\0';
1133 buflen--;
1134 path = end-1;
1135 *path = '/';
1136 while (de && de != de->parent) {
1137 buflen -= de->namelen + 1;
1138 if (buflen < 0)
1139 break;
1140 end -= de->namelen;
1141 memcpy(end, de->name, de->namelen);
1142 *--end = '/';
1143 path = end;
1144 de = de->parent;
1145 }
1146 rc = security_genfs_sid("proc", path, tclass, sid);
1147 free_page((unsigned long)buffer);
1148 return rc;
1149 }
1150 #else
1151 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1152 u16 tclass,
1153 u32 *sid)
1154 {
1155 return -EINVAL;
1156 }
1157 #endif
1158
1159 /* The inode's security attributes must be initialized before first use. */
1160 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1161 {
1162 struct superblock_security_struct *sbsec = NULL;
1163 struct inode_security_struct *isec = inode->i_security;
1164 u32 sid;
1165 struct dentry *dentry;
1166 #define INITCONTEXTLEN 255
1167 char *context = NULL;
1168 unsigned len = 0;
1169 int rc = 0;
1170
1171 if (isec->initialized)
1172 goto out;
1173
1174 mutex_lock(&isec->lock);
1175 if (isec->initialized)
1176 goto out_unlock;
1177
1178 sbsec = inode->i_sb->s_security;
1179 if (!sbsec->initialized) {
1180 /* Defer initialization until selinux_complete_init,
1181 after the initial policy is loaded and the security
1182 server is ready to handle calls. */
1183 spin_lock(&sbsec->isec_lock);
1184 if (list_empty(&isec->list))
1185 list_add(&isec->list, &sbsec->isec_head);
1186 spin_unlock(&sbsec->isec_lock);
1187 goto out_unlock;
1188 }
1189
1190 switch (sbsec->behavior) {
1191 case SECURITY_FS_USE_XATTR:
1192 if (!inode->i_op->getxattr) {
1193 isec->sid = sbsec->def_sid;
1194 break;
1195 }
1196
1197 /* Need a dentry, since the xattr API requires one.
1198 Life would be simpler if we could just pass the inode. */
1199 if (opt_dentry) {
1200 /* Called from d_instantiate or d_splice_alias. */
1201 dentry = dget(opt_dentry);
1202 } else {
1203 /* Called from selinux_complete_init, try to find a dentry. */
1204 dentry = d_find_alias(inode);
1205 }
1206 if (!dentry) {
1207 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
1208 "ino=%ld\n", __func__, inode->i_sb->s_id,
1209 inode->i_ino);
1210 goto out_unlock;
1211 }
1212
1213 len = INITCONTEXTLEN;
1214 context = kmalloc(len, GFP_NOFS);
1215 if (!context) {
1216 rc = -ENOMEM;
1217 dput(dentry);
1218 goto out_unlock;
1219 }
1220 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1221 context, len);
1222 if (rc == -ERANGE) {
1223 /* Need a larger buffer. Query for the right size. */
1224 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1225 NULL, 0);
1226 if (rc < 0) {
1227 dput(dentry);
1228 goto out_unlock;
1229 }
1230 kfree(context);
1231 len = rc;
1232 context = kmalloc(len, GFP_NOFS);
1233 if (!context) {
1234 rc = -ENOMEM;
1235 dput(dentry);
1236 goto out_unlock;
1237 }
1238 rc = inode->i_op->getxattr(dentry,
1239 XATTR_NAME_SELINUX,
1240 context, len);
1241 }
1242 dput(dentry);
1243 if (rc < 0) {
1244 if (rc != -ENODATA) {
1245 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1246 "%d for dev=%s ino=%ld\n", __func__,
1247 -rc, inode->i_sb->s_id, inode->i_ino);
1248 kfree(context);
1249 goto out_unlock;
1250 }
1251 /* Map ENODATA to the default file SID */
1252 sid = sbsec->def_sid;
1253 rc = 0;
1254 } else {
1255 rc = security_context_to_sid_default(context, rc, &sid,
1256 sbsec->def_sid,
1257 GFP_NOFS);
1258 if (rc) {
1259 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1260 "returned %d for dev=%s ino=%ld\n",
1261 __func__, context, -rc,
1262 inode->i_sb->s_id, inode->i_ino);
1263 kfree(context);
1264 /* Leave with the unlabeled SID */
1265 rc = 0;
1266 break;
1267 }
1268 }
1269 kfree(context);
1270 isec->sid = sid;
1271 break;
1272 case SECURITY_FS_USE_TASK:
1273 isec->sid = isec->task_sid;
1274 break;
1275 case SECURITY_FS_USE_TRANS:
1276 /* Default to the fs SID. */
1277 isec->sid = sbsec->sid;
1278
1279 /* Try to obtain a transition SID. */
1280 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1281 rc = security_transition_sid(isec->task_sid,
1282 sbsec->sid,
1283 isec->sclass,
1284 &sid);
1285 if (rc)
1286 goto out_unlock;
1287 isec->sid = sid;
1288 break;
1289 case SECURITY_FS_USE_MNTPOINT:
1290 isec->sid = sbsec->mntpoint_sid;
1291 break;
1292 default:
1293 /* Default to the fs superblock SID. */
1294 isec->sid = sbsec->sid;
1295
1296 if (sbsec->proc && !S_ISLNK(inode->i_mode)) {
1297 struct proc_inode *proci = PROC_I(inode);
1298 if (proci->pde) {
1299 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1300 rc = selinux_proc_get_sid(proci->pde,
1301 isec->sclass,
1302 &sid);
1303 if (rc)
1304 goto out_unlock;
1305 isec->sid = sid;
1306 }
1307 }
1308 break;
1309 }
1310
1311 isec->initialized = 1;
1312
1313 out_unlock:
1314 mutex_unlock(&isec->lock);
1315 out:
1316 if (isec->sclass == SECCLASS_FILE)
1317 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1318 return rc;
1319 }
1320
1321 /* Convert a Linux signal to an access vector. */
1322 static inline u32 signal_to_av(int sig)
1323 {
1324 u32 perm = 0;
1325
1326 switch (sig) {
1327 case SIGCHLD:
1328 /* Commonly granted from child to parent. */
1329 perm = PROCESS__SIGCHLD;
1330 break;
1331 case SIGKILL:
1332 /* Cannot be caught or ignored */
1333 perm = PROCESS__SIGKILL;
1334 break;
1335 case SIGSTOP:
1336 /* Cannot be caught or ignored */
1337 perm = PROCESS__SIGSTOP;
1338 break;
1339 default:
1340 /* All other signals. */
1341 perm = PROCESS__SIGNAL;
1342 break;
1343 }
1344
1345 return perm;
1346 }
1347
1348 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1349 fork check, ptrace check, etc. */
1350 static int task_has_perm(struct task_struct *tsk1,
1351 struct task_struct *tsk2,
1352 u32 perms)
1353 {
1354 struct task_security_struct *tsec1, *tsec2;
1355
1356 tsec1 = tsk1->security;
1357 tsec2 = tsk2->security;
1358 return avc_has_perm(tsec1->sid, tsec2->sid,
1359 SECCLASS_PROCESS, perms, NULL);
1360 }
1361
1362 #if CAP_LAST_CAP > 63
1363 #error Fix SELinux to handle capabilities > 63.
1364 #endif
1365
1366 /* Check whether a task is allowed to use a capability. */
1367 static int task_has_capability(struct task_struct *tsk,
1368 int cap, int audit)
1369 {
1370 struct task_security_struct *tsec;
1371 struct avc_audit_data ad;
1372 struct av_decision avd;
1373 u16 sclass;
1374 u32 av = CAP_TO_MASK(cap);
1375 int rc;
1376
1377 tsec = tsk->security;
1378
1379 AVC_AUDIT_DATA_INIT(&ad, CAP);
1380 ad.tsk = tsk;
1381 ad.u.cap = cap;
1382
1383 switch (CAP_TO_INDEX(cap)) {
1384 case 0:
1385 sclass = SECCLASS_CAPABILITY;
1386 break;
1387 case 1:
1388 sclass = SECCLASS_CAPABILITY2;
1389 break;
1390 default:
1391 printk(KERN_ERR
1392 "SELinux: out of range capability %d\n", cap);
1393 BUG();
1394 }
1395
1396 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid, sclass, av, 0, &avd);
1397 if (audit == SECURITY_CAP_AUDIT)
1398 avc_audit(tsec->sid, tsec->sid, sclass, av, &avd, rc, &ad);
1399 return rc;
1400 }
1401
1402 /* Check whether a task is allowed to use a system operation. */
1403 static int task_has_system(struct task_struct *tsk,
1404 u32 perms)
1405 {
1406 struct task_security_struct *tsec;
1407
1408 tsec = tsk->security;
1409
1410 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1411 SECCLASS_SYSTEM, perms, NULL);
1412 }
1413
1414 /* Check whether a task has a particular permission to an inode.
1415 The 'adp' parameter is optional and allows other audit
1416 data to be passed (e.g. the dentry). */
1417 static int inode_has_perm(struct task_struct *tsk,
1418 struct inode *inode,
1419 u32 perms,
1420 struct avc_audit_data *adp)
1421 {
1422 struct task_security_struct *tsec;
1423 struct inode_security_struct *isec;
1424 struct avc_audit_data ad;
1425
1426 if (unlikely(IS_PRIVATE(inode)))
1427 return 0;
1428
1429 tsec = tsk->security;
1430 isec = inode->i_security;
1431
1432 if (!adp) {
1433 adp = &ad;
1434 AVC_AUDIT_DATA_INIT(&ad, FS);
1435 ad.u.fs.inode = inode;
1436 }
1437
1438 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1439 }
1440
1441 /* Same as inode_has_perm, but pass explicit audit data containing
1442 the dentry to help the auditing code to more easily generate the
1443 pathname if needed. */
1444 static inline int dentry_has_perm(struct task_struct *tsk,
1445 struct vfsmount *mnt,
1446 struct dentry *dentry,
1447 u32 av)
1448 {
1449 struct inode *inode = dentry->d_inode;
1450 struct avc_audit_data ad;
1451 AVC_AUDIT_DATA_INIT(&ad, FS);
1452 ad.u.fs.path.mnt = mnt;
1453 ad.u.fs.path.dentry = dentry;
1454 return inode_has_perm(tsk, inode, av, &ad);
1455 }
1456
1457 /* Check whether a task can use an open file descriptor to
1458 access an inode in a given way. Check access to the
1459 descriptor itself, and then use dentry_has_perm to
1460 check a particular permission to the file.
1461 Access to the descriptor is implicitly granted if it
1462 has the same SID as the process. If av is zero, then
1463 access to the file is not checked, e.g. for cases
1464 where only the descriptor is affected like seek. */
1465 static int file_has_perm(struct task_struct *tsk,
1466 struct file *file,
1467 u32 av)
1468 {
1469 struct task_security_struct *tsec = tsk->security;
1470 struct file_security_struct *fsec = file->f_security;
1471 struct inode *inode = file->f_path.dentry->d_inode;
1472 struct avc_audit_data ad;
1473 int rc;
1474
1475 AVC_AUDIT_DATA_INIT(&ad, FS);
1476 ad.u.fs.path = file->f_path;
1477
1478 if (tsec->sid != fsec->sid) {
1479 rc = avc_has_perm(tsec->sid, fsec->sid,
1480 SECCLASS_FD,
1481 FD__USE,
1482 &ad);
1483 if (rc)
1484 return rc;
1485 }
1486
1487 /* av is zero if only checking access to the descriptor. */
1488 if (av)
1489 return inode_has_perm(tsk, inode, av, &ad);
1490
1491 return 0;
1492 }
1493
1494 /* Check whether a task can create a file. */
1495 static int may_create(struct inode *dir,
1496 struct dentry *dentry,
1497 u16 tclass)
1498 {
1499 struct task_security_struct *tsec;
1500 struct inode_security_struct *dsec;
1501 struct superblock_security_struct *sbsec;
1502 u32 newsid;
1503 struct avc_audit_data ad;
1504 int rc;
1505
1506 tsec = current->security;
1507 dsec = dir->i_security;
1508 sbsec = dir->i_sb->s_security;
1509
1510 AVC_AUDIT_DATA_INIT(&ad, FS);
1511 ad.u.fs.path.dentry = dentry;
1512
1513 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1514 DIR__ADD_NAME | DIR__SEARCH,
1515 &ad);
1516 if (rc)
1517 return rc;
1518
1519 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1520 newsid = tsec->create_sid;
1521 } else {
1522 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1523 &newsid);
1524 if (rc)
1525 return rc;
1526 }
1527
1528 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1529 if (rc)
1530 return rc;
1531
1532 return avc_has_perm(newsid, sbsec->sid,
1533 SECCLASS_FILESYSTEM,
1534 FILESYSTEM__ASSOCIATE, &ad);
1535 }
1536
1537 /* Check whether a task can create a key. */
1538 static int may_create_key(u32 ksid,
1539 struct task_struct *ctx)
1540 {
1541 struct task_security_struct *tsec;
1542
1543 tsec = ctx->security;
1544
1545 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1546 }
1547
1548 #define MAY_LINK 0
1549 #define MAY_UNLINK 1
1550 #define MAY_RMDIR 2
1551
1552 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1553 static int may_link(struct inode *dir,
1554 struct dentry *dentry,
1555 int kind)
1556
1557 {
1558 struct task_security_struct *tsec;
1559 struct inode_security_struct *dsec, *isec;
1560 struct avc_audit_data ad;
1561 u32 av;
1562 int rc;
1563
1564 tsec = current->security;
1565 dsec = dir->i_security;
1566 isec = dentry->d_inode->i_security;
1567
1568 AVC_AUDIT_DATA_INIT(&ad, FS);
1569 ad.u.fs.path.dentry = dentry;
1570
1571 av = DIR__SEARCH;
1572 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1573 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1574 if (rc)
1575 return rc;
1576
1577 switch (kind) {
1578 case MAY_LINK:
1579 av = FILE__LINK;
1580 break;
1581 case MAY_UNLINK:
1582 av = FILE__UNLINK;
1583 break;
1584 case MAY_RMDIR:
1585 av = DIR__RMDIR;
1586 break;
1587 default:
1588 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1589 __func__, kind);
1590 return 0;
1591 }
1592
1593 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1594 return rc;
1595 }
1596
1597 static inline int may_rename(struct inode *old_dir,
1598 struct dentry *old_dentry,
1599 struct inode *new_dir,
1600 struct dentry *new_dentry)
1601 {
1602 struct task_security_struct *tsec;
1603 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1604 struct avc_audit_data ad;
1605 u32 av;
1606 int old_is_dir, new_is_dir;
1607 int rc;
1608
1609 tsec = current->security;
1610 old_dsec = old_dir->i_security;
1611 old_isec = old_dentry->d_inode->i_security;
1612 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1613 new_dsec = new_dir->i_security;
1614
1615 AVC_AUDIT_DATA_INIT(&ad, FS);
1616
1617 ad.u.fs.path.dentry = old_dentry;
1618 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1619 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1620 if (rc)
1621 return rc;
1622 rc = avc_has_perm(tsec->sid, old_isec->sid,
1623 old_isec->sclass, FILE__RENAME, &ad);
1624 if (rc)
1625 return rc;
1626 if (old_is_dir && new_dir != old_dir) {
1627 rc = avc_has_perm(tsec->sid, old_isec->sid,
1628 old_isec->sclass, DIR__REPARENT, &ad);
1629 if (rc)
1630 return rc;
1631 }
1632
1633 ad.u.fs.path.dentry = new_dentry;
1634 av = DIR__ADD_NAME | DIR__SEARCH;
1635 if (new_dentry->d_inode)
1636 av |= DIR__REMOVE_NAME;
1637 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1638 if (rc)
1639 return rc;
1640 if (new_dentry->d_inode) {
1641 new_isec = new_dentry->d_inode->i_security;
1642 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1643 rc = avc_has_perm(tsec->sid, new_isec->sid,
1644 new_isec->sclass,
1645 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1646 if (rc)
1647 return rc;
1648 }
1649
1650 return 0;
1651 }
1652
1653 /* Check whether a task can perform a filesystem operation. */
1654 static int superblock_has_perm(struct task_struct *tsk,
1655 struct super_block *sb,
1656 u32 perms,
1657 struct avc_audit_data *ad)
1658 {
1659 struct task_security_struct *tsec;
1660 struct superblock_security_struct *sbsec;
1661
1662 tsec = tsk->security;
1663 sbsec = sb->s_security;
1664 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1665 perms, ad);
1666 }
1667
1668 /* Convert a Linux mode and permission mask to an access vector. */
1669 static inline u32 file_mask_to_av(int mode, int mask)
1670 {
1671 u32 av = 0;
1672
1673 if ((mode & S_IFMT) != S_IFDIR) {
1674 if (mask & MAY_EXEC)
1675 av |= FILE__EXECUTE;
1676 if (mask & MAY_READ)
1677 av |= FILE__READ;
1678
1679 if (mask & MAY_APPEND)
1680 av |= FILE__APPEND;
1681 else if (mask & MAY_WRITE)
1682 av |= FILE__WRITE;
1683
1684 } else {
1685 if (mask & MAY_EXEC)
1686 av |= DIR__SEARCH;
1687 if (mask & MAY_WRITE)
1688 av |= DIR__WRITE;
1689 if (mask & MAY_READ)
1690 av |= DIR__READ;
1691 }
1692
1693 return av;
1694 }
1695
1696 /* Convert a Linux file to an access vector. */
1697 static inline u32 file_to_av(struct file *file)
1698 {
1699 u32 av = 0;
1700
1701 if (file->f_mode & FMODE_READ)
1702 av |= FILE__READ;
1703 if (file->f_mode & FMODE_WRITE) {
1704 if (file->f_flags & O_APPEND)
1705 av |= FILE__APPEND;
1706 else
1707 av |= FILE__WRITE;
1708 }
1709 if (!av) {
1710 /*
1711 * Special file opened with flags 3 for ioctl-only use.
1712 */
1713 av = FILE__IOCTL;
1714 }
1715
1716 return av;
1717 }
1718
1719 /*
1720 * Convert a file to an access vector and include the correct open
1721 * open permission.
1722 */
1723 static inline u32 open_file_to_av(struct file *file)
1724 {
1725 u32 av = file_to_av(file);
1726
1727 if (selinux_policycap_openperm) {
1728 mode_t mode = file->f_path.dentry->d_inode->i_mode;
1729 /*
1730 * lnk files and socks do not really have an 'open'
1731 */
1732 if (S_ISREG(mode))
1733 av |= FILE__OPEN;
1734 else if (S_ISCHR(mode))
1735 av |= CHR_FILE__OPEN;
1736 else if (S_ISBLK(mode))
1737 av |= BLK_FILE__OPEN;
1738 else if (S_ISFIFO(mode))
1739 av |= FIFO_FILE__OPEN;
1740 else if (S_ISDIR(mode))
1741 av |= DIR__OPEN;
1742 else
1743 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1744 "unknown mode:%o\n", __func__, mode);
1745 }
1746 return av;
1747 }
1748
1749 /* Hook functions begin here. */
1750
1751 static int selinux_ptrace_may_access(struct task_struct *child,
1752 unsigned int mode)
1753 {
1754 int rc;
1755
1756 rc = secondary_ops->ptrace_may_access(child, mode);
1757 if (rc)
1758 return rc;
1759
1760 if (mode == PTRACE_MODE_READ) {
1761 struct task_security_struct *tsec = current->security;
1762 struct task_security_struct *csec = child->security;
1763 return avc_has_perm(tsec->sid, csec->sid,
1764 SECCLASS_FILE, FILE__READ, NULL);
1765 }
1766
1767 return task_has_perm(current, child, PROCESS__PTRACE);
1768 }
1769
1770 static int selinux_ptrace_traceme(struct task_struct *parent)
1771 {
1772 int rc;
1773
1774 rc = secondary_ops->ptrace_traceme(parent);
1775 if (rc)
1776 return rc;
1777
1778 return task_has_perm(parent, current, PROCESS__PTRACE);
1779 }
1780
1781 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1782 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1783 {
1784 int error;
1785
1786 error = task_has_perm(current, target, PROCESS__GETCAP);
1787 if (error)
1788 return error;
1789
1790 return secondary_ops->capget(target, effective, inheritable, permitted);
1791 }
1792
1793 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1794 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1795 {
1796 int error;
1797
1798 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1799 if (error)
1800 return error;
1801
1802 return task_has_perm(current, target, PROCESS__SETCAP);
1803 }
1804
1805 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1806 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1807 {
1808 secondary_ops->capset_set(target, effective, inheritable, permitted);
1809 }
1810
1811 static int selinux_capable(struct task_struct *tsk, int cap, int audit)
1812 {
1813 int rc;
1814
1815 rc = secondary_ops->capable(tsk, cap, audit);
1816 if (rc)
1817 return rc;
1818
1819 return task_has_capability(tsk, cap, audit);
1820 }
1821
1822 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1823 {
1824 int buflen, rc;
1825 char *buffer, *path, *end;
1826
1827 rc = -ENOMEM;
1828 buffer = (char *)__get_free_page(GFP_KERNEL);
1829 if (!buffer)
1830 goto out;
1831
1832 buflen = PAGE_SIZE;
1833 end = buffer+buflen;
1834 *--end = '\0';
1835 buflen--;
1836 path = end-1;
1837 *path = '/';
1838 while (table) {
1839 const char *name = table->procname;
1840 size_t namelen = strlen(name);
1841 buflen -= namelen + 1;
1842 if (buflen < 0)
1843 goto out_free;
1844 end -= namelen;
1845 memcpy(end, name, namelen);
1846 *--end = '/';
1847 path = end;
1848 table = table->parent;
1849 }
1850 buflen -= 4;
1851 if (buflen < 0)
1852 goto out_free;
1853 end -= 4;
1854 memcpy(end, "/sys", 4);
1855 path = end;
1856 rc = security_genfs_sid("proc", path, tclass, sid);
1857 out_free:
1858 free_page((unsigned long)buffer);
1859 out:
1860 return rc;
1861 }
1862
1863 static int selinux_sysctl(ctl_table *table, int op)
1864 {
1865 int error = 0;
1866 u32 av;
1867 struct task_security_struct *tsec;
1868 u32 tsid;
1869 int rc;
1870
1871 rc = secondary_ops->sysctl(table, op);
1872 if (rc)
1873 return rc;
1874
1875 tsec = current->security;
1876
1877 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1878 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1879 if (rc) {
1880 /* Default to the well-defined sysctl SID. */
1881 tsid = SECINITSID_SYSCTL;
1882 }
1883
1884 /* The op values are "defined" in sysctl.c, thereby creating
1885 * a bad coupling between this module and sysctl.c */
1886 if (op == 001) {
1887 error = avc_has_perm(tsec->sid, tsid,
1888 SECCLASS_DIR, DIR__SEARCH, NULL);
1889 } else {
1890 av = 0;
1891 if (op & 004)
1892 av |= FILE__READ;
1893 if (op & 002)
1894 av |= FILE__WRITE;
1895 if (av)
1896 error = avc_has_perm(tsec->sid, tsid,
1897 SECCLASS_FILE, av, NULL);
1898 }
1899
1900 return error;
1901 }
1902
1903 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1904 {
1905 int rc = 0;
1906
1907 if (!sb)
1908 return 0;
1909
1910 switch (cmds) {
1911 case Q_SYNC:
1912 case Q_QUOTAON:
1913 case Q_QUOTAOFF:
1914 case Q_SETINFO:
1915 case Q_SETQUOTA:
1916 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1917 NULL);
1918 break;
1919 case Q_GETFMT:
1920 case Q_GETINFO:
1921 case Q_GETQUOTA:
1922 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1923 NULL);
1924 break;
1925 default:
1926 rc = 0; /* let the kernel handle invalid cmds */
1927 break;
1928 }
1929 return rc;
1930 }
1931
1932 static int selinux_quota_on(struct dentry *dentry)
1933 {
1934 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1935 }
1936
1937 static int selinux_syslog(int type)
1938 {
1939 int rc;
1940
1941 rc = secondary_ops->syslog(type);
1942 if (rc)
1943 return rc;
1944
1945 switch (type) {
1946 case 3: /* Read last kernel messages */
1947 case 10: /* Return size of the log buffer */
1948 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1949 break;
1950 case 6: /* Disable logging to console */
1951 case 7: /* Enable logging to console */
1952 case 8: /* Set level of messages printed to console */
1953 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1954 break;
1955 case 0: /* Close log */
1956 case 1: /* Open log */
1957 case 2: /* Read from log */
1958 case 4: /* Read/clear last kernel messages */
1959 case 5: /* Clear ring buffer */
1960 default:
1961 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1962 break;
1963 }
1964 return rc;
1965 }
1966
1967 /*
1968 * Check that a process has enough memory to allocate a new virtual
1969 * mapping. 0 means there is enough memory for the allocation to
1970 * succeed and -ENOMEM implies there is not.
1971 *
1972 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1973 * if the capability is granted, but __vm_enough_memory requires 1 if
1974 * the capability is granted.
1975 *
1976 * Do not audit the selinux permission check, as this is applied to all
1977 * processes that allocate mappings.
1978 */
1979 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1980 {
1981 int rc, cap_sys_admin = 0;
1982
1983 rc = selinux_capable(current, CAP_SYS_ADMIN, SECURITY_CAP_NOAUDIT);
1984 if (rc == 0)
1985 cap_sys_admin = 1;
1986
1987 return __vm_enough_memory(mm, pages, cap_sys_admin);
1988 }
1989
1990 /* binprm security operations */
1991
1992 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1993 {
1994 struct bprm_security_struct *bsec;
1995
1996 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1997 if (!bsec)
1998 return -ENOMEM;
1999
2000 bsec->sid = SECINITSID_UNLABELED;
2001 bsec->set = 0;
2002
2003 bprm->security = bsec;
2004 return 0;
2005 }
2006
2007 static int selinux_bprm_set_security(struct linux_binprm *bprm)
2008 {
2009 struct task_security_struct *tsec;
2010 struct inode *inode = bprm->file->f_path.dentry->d_inode;
2011 struct inode_security_struct *isec;
2012 struct bprm_security_struct *bsec;
2013 u32 newsid;
2014 struct avc_audit_data ad;
2015 int rc;
2016
2017 rc = secondary_ops->bprm_set_security(bprm);
2018 if (rc)
2019 return rc;
2020
2021 bsec = bprm->security;
2022
2023 if (bsec->set)
2024 return 0;
2025
2026 tsec = current->security;
2027 isec = inode->i_security;
2028
2029 /* Default to the current task SID. */
2030 bsec->sid = tsec->sid;
2031
2032 /* Reset fs, key, and sock SIDs on execve. */
2033 tsec->create_sid = 0;
2034 tsec->keycreate_sid = 0;
2035 tsec->sockcreate_sid = 0;
2036
2037 if (tsec->exec_sid) {
2038 newsid = tsec->exec_sid;
2039 /* Reset exec SID on execve. */
2040 tsec->exec_sid = 0;
2041 } else {
2042 /* Check for a default transition on this program. */
2043 rc = security_transition_sid(tsec->sid, isec->sid,
2044 SECCLASS_PROCESS, &newsid);
2045 if (rc)
2046 return rc;
2047 }
2048
2049 AVC_AUDIT_DATA_INIT(&ad, FS);
2050 ad.u.fs.path = bprm->file->f_path;
2051
2052 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2053 newsid = tsec->sid;
2054
2055 if (tsec->sid == newsid) {
2056 rc = avc_has_perm(tsec->sid, isec->sid,
2057 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2058 if (rc)
2059 return rc;
2060 } else {
2061 /* Check permissions for the transition. */
2062 rc = avc_has_perm(tsec->sid, newsid,
2063 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2064 if (rc)
2065 return rc;
2066
2067 rc = avc_has_perm(newsid, isec->sid,
2068 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2069 if (rc)
2070 return rc;
2071
2072 /* Clear any possibly unsafe personality bits on exec: */
2073 current->personality &= ~PER_CLEAR_ON_SETID;
2074
2075 /* Set the security field to the new SID. */
2076 bsec->sid = newsid;
2077 }
2078
2079 bsec->set = 1;
2080 return 0;
2081 }
2082
2083 static int selinux_bprm_check_security(struct linux_binprm *bprm)
2084 {
2085 return secondary_ops->bprm_check_security(bprm);
2086 }
2087
2088
2089 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2090 {
2091 struct task_security_struct *tsec = current->security;
2092 int atsecure = 0;
2093
2094 if (tsec->osid != tsec->sid) {
2095 /* Enable secure mode for SIDs transitions unless
2096 the noatsecure permission is granted between
2097 the two SIDs, i.e. ahp returns 0. */
2098 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2099 SECCLASS_PROCESS,
2100 PROCESS__NOATSECURE, NULL);
2101 }
2102
2103 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2104 }
2105
2106 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2107 {
2108 kfree(bprm->security);
2109 bprm->security = NULL;
2110 }
2111
2112 extern struct vfsmount *selinuxfs_mount;
2113 extern struct dentry *selinux_null;
2114
2115 /* Derived from fs/exec.c:flush_old_files. */
2116 static inline void flush_unauthorized_files(struct files_struct *files)
2117 {
2118 struct avc_audit_data ad;
2119 struct file *file, *devnull = NULL;
2120 struct tty_struct *tty;
2121 struct fdtable *fdt;
2122 long j = -1;
2123 int drop_tty = 0;
2124
2125 tty = get_current_tty();
2126 if (tty) {
2127 file_list_lock();
2128 if (!list_empty(&tty->tty_files)) {
2129 struct inode *inode;
2130
2131 /* Revalidate access to controlling tty.
2132 Use inode_has_perm on the tty inode directly rather
2133 than using file_has_perm, as this particular open
2134 file may belong to another process and we are only
2135 interested in the inode-based check here. */
2136 file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
2137 inode = file->f_path.dentry->d_inode;
2138 if (inode_has_perm(current, inode,
2139 FILE__READ | FILE__WRITE, NULL)) {
2140 drop_tty = 1;
2141 }
2142 }
2143 file_list_unlock();
2144 tty_kref_put(tty);
2145 }
2146 /* Reset controlling tty. */
2147 if (drop_tty)
2148 no_tty();
2149
2150 /* Revalidate access to inherited open files. */
2151
2152 AVC_AUDIT_DATA_INIT(&ad, FS);
2153
2154 spin_lock(&files->file_lock);
2155 for (;;) {
2156 unsigned long set, i;
2157 int fd;
2158
2159 j++;
2160 i = j * __NFDBITS;
2161 fdt = files_fdtable(files);
2162 if (i >= fdt->max_fds)
2163 break;
2164 set = fdt->open_fds->fds_bits[j];
2165 if (!set)
2166 continue;
2167 spin_unlock(&files->file_lock);
2168 for ( ; set ; i++, set >>= 1) {
2169 if (set & 1) {
2170 file = fget(i);
2171 if (!file)
2172 continue;
2173 if (file_has_perm(current,
2174 file,
2175 file_to_av(file))) {
2176 sys_close(i);
2177 fd = get_unused_fd();
2178 if (fd != i) {
2179 if (fd >= 0)
2180 put_unused_fd(fd);
2181 fput(file);
2182 continue;
2183 }
2184 if (devnull) {
2185 get_file(devnull);
2186 } else {
2187 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2188 if (IS_ERR(devnull)) {
2189 devnull = NULL;
2190 put_unused_fd(fd);
2191 fput(file);
2192 continue;
2193 }
2194 }
2195 fd_install(fd, devnull);
2196 }
2197 fput(file);
2198 }
2199 }
2200 spin_lock(&files->file_lock);
2201
2202 }
2203 spin_unlock(&files->file_lock);
2204 }
2205
2206 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2207 {
2208 struct task_security_struct *tsec;
2209 struct bprm_security_struct *bsec;
2210 u32 sid;
2211 int rc;
2212
2213 secondary_ops->bprm_apply_creds(bprm, unsafe);
2214
2215 tsec = current->security;
2216
2217 bsec = bprm->security;
2218 sid = bsec->sid;
2219
2220 tsec->osid = tsec->sid;
2221 bsec->unsafe = 0;
2222 if (tsec->sid != sid) {
2223 /* Check for shared state. If not ok, leave SID
2224 unchanged and kill. */
2225 if (unsafe & LSM_UNSAFE_SHARE) {
2226 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2227 PROCESS__SHARE, NULL);
2228 if (rc) {
2229 bsec->unsafe = 1;
2230 return;
2231 }
2232 }
2233
2234 /* Check for ptracing, and update the task SID if ok.
2235 Otherwise, leave SID unchanged and kill. */
2236 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2237 struct task_struct *tracer;
2238 struct task_security_struct *sec;
2239 u32 ptsid = 0;
2240
2241 rcu_read_lock();
2242 tracer = tracehook_tracer_task(current);
2243 if (likely(tracer != NULL)) {
2244 sec = tracer->security;
2245 ptsid = sec->sid;
2246 }
2247 rcu_read_unlock();
2248
2249 if (ptsid != 0) {
2250 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2251 PROCESS__PTRACE, NULL);
2252 if (rc) {
2253 bsec->unsafe = 1;
2254 return;
2255 }
2256 }
2257 }
2258 tsec->sid = sid;
2259 }
2260 }
2261
2262 /*
2263 * called after apply_creds without the task lock held
2264 */
2265 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2266 {
2267 struct task_security_struct *tsec;
2268 struct rlimit *rlim, *initrlim;
2269 struct itimerval itimer;
2270 struct bprm_security_struct *bsec;
2271 struct sighand_struct *psig;
2272 int rc, i;
2273 unsigned long flags;
2274
2275 tsec = current->security;
2276 bsec = bprm->security;
2277
2278 if (bsec->unsafe) {
2279 force_sig_specific(SIGKILL, current);
2280 return;
2281 }
2282 if (tsec->osid == tsec->sid)
2283 return;
2284
2285 /* Close files for which the new task SID is not authorized. */
2286 flush_unauthorized_files(current->files);
2287
2288 /* Check whether the new SID can inherit signal state
2289 from the old SID. If not, clear itimers to avoid
2290 subsequent signal generation and flush and unblock
2291 signals. This must occur _after_ the task SID has
2292 been updated so that any kill done after the flush
2293 will be checked against the new SID. */
2294 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2295 PROCESS__SIGINH, NULL);
2296 if (rc) {
2297 memset(&itimer, 0, sizeof itimer);
2298 for (i = 0; i < 3; i++)
2299 do_setitimer(i, &itimer, NULL);
2300 flush_signals(current);
2301 spin_lock_irq(&current->sighand->siglock);
2302 flush_signal_handlers(current, 1);
2303 sigemptyset(&current->blocked);
2304 recalc_sigpending();
2305 spin_unlock_irq(&current->sighand->siglock);
2306 }
2307
2308 /* Always clear parent death signal on SID transitions. */
2309 current->pdeath_signal = 0;
2310
2311 /* Check whether the new SID can inherit resource limits
2312 from the old SID. If not, reset all soft limits to
2313 the lower of the current task's hard limit and the init
2314 task's soft limit. Note that the setting of hard limits
2315 (even to lower them) can be controlled by the setrlimit
2316 check. The inclusion of the init task's soft limit into
2317 the computation is to avoid resetting soft limits higher
2318 than the default soft limit for cases where the default
2319 is lower than the hard limit, e.g. RLIMIT_CORE or
2320 RLIMIT_STACK.*/
2321 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2322 PROCESS__RLIMITINH, NULL);
2323 if (rc) {
2324 for (i = 0; i < RLIM_NLIMITS; i++) {
2325 rlim = current->signal->rlim + i;
2326 initrlim = init_task.signal->rlim+i;
2327 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2328 }
2329 update_rlimit_cpu(rlim->rlim_cur);
2330 }
2331
2332 /* Wake up the parent if it is waiting so that it can
2333 recheck wait permission to the new task SID. */
2334 read_lock_irq(&tasklist_lock);
2335 psig = current->parent->sighand;
2336 spin_lock_irqsave(&psig->siglock, flags);
2337 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2338 spin_unlock_irqrestore(&psig->siglock, flags);
2339 read_unlock_irq(&tasklist_lock);
2340 }
2341
2342 /* superblock security operations */
2343
2344 static int selinux_sb_alloc_security(struct super_block *sb)
2345 {
2346 return superblock_alloc_security(sb);
2347 }
2348
2349 static void selinux_sb_free_security(struct super_block *sb)
2350 {
2351 superblock_free_security(sb);
2352 }
2353
2354 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2355 {
2356 if (plen > olen)
2357 return 0;
2358
2359 return !memcmp(prefix, option, plen);
2360 }
2361
2362 static inline int selinux_option(char *option, int len)
2363 {
2364 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2365 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2366 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2367 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2368 }
2369
2370 static inline void take_option(char **to, char *from, int *first, int len)
2371 {
2372 if (!*first) {
2373 **to = ',';
2374 *to += 1;
2375 } else
2376 *first = 0;
2377 memcpy(*to, from, len);
2378 *to += len;
2379 }
2380
2381 static inline void take_selinux_option(char **to, char *from, int *first,
2382 int len)
2383 {
2384 int current_size = 0;
2385
2386 if (!*first) {
2387 **to = '|';
2388 *to += 1;
2389 } else
2390 *first = 0;
2391
2392 while (current_size < len) {
2393 if (*from != '"') {
2394 **to = *from;
2395 *to += 1;
2396 }
2397 from += 1;
2398 current_size += 1;
2399 }
2400 }
2401
2402 static int selinux_sb_copy_data(char *orig, char *copy)
2403 {
2404 int fnosec, fsec, rc = 0;
2405 char *in_save, *in_curr, *in_end;
2406 char *sec_curr, *nosec_save, *nosec;
2407 int open_quote = 0;
2408
2409 in_curr = orig;
2410 sec_curr = copy;
2411
2412 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2413 if (!nosec) {
2414 rc = -ENOMEM;
2415 goto out;
2416 }
2417
2418 nosec_save = nosec;
2419 fnosec = fsec = 1;
2420 in_save = in_end = orig;
2421
2422 do {
2423 if (*in_end == '"')
2424 open_quote = !open_quote;
2425 if ((*in_end == ',' && open_quote == 0) ||
2426 *in_end == '\0') {
2427 int len = in_end - in_curr;
2428
2429 if (selinux_option(in_curr, len))
2430 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2431 else
2432 take_option(&nosec, in_curr, &fnosec, len);
2433
2434 in_curr = in_end + 1;
2435 }
2436 } while (*in_end++);
2437
2438 strcpy(in_save, nosec_save);
2439 free_page((unsigned long)nosec_save);
2440 out:
2441 return rc;
2442 }
2443
2444 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2445 {
2446 struct avc_audit_data ad;
2447 int rc;
2448
2449 rc = superblock_doinit(sb, data);
2450 if (rc)
2451 return rc;
2452
2453 AVC_AUDIT_DATA_INIT(&ad, FS);
2454 ad.u.fs.path.dentry = sb->s_root;
2455 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2456 }
2457
2458 static int selinux_sb_statfs(struct dentry *dentry)
2459 {
2460 struct avc_audit_data ad;
2461
2462 AVC_AUDIT_DATA_INIT(&ad, FS);
2463 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2464 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2465 }
2466
2467 static int selinux_mount(char *dev_name,
2468 struct path *path,
2469 char *type,
2470 unsigned long flags,
2471 void *data)
2472 {
2473 int rc;
2474
2475 rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
2476 if (rc)
2477 return rc;
2478
2479 if (flags & MS_REMOUNT)
2480 return superblock_has_perm(current, path->mnt->mnt_sb,
2481 FILESYSTEM__REMOUNT, NULL);
2482 else
2483 return dentry_has_perm(current, path->mnt, path->dentry,
2484 FILE__MOUNTON);
2485 }
2486
2487 static int selinux_umount(struct vfsmount *mnt, int flags)
2488 {
2489 int rc;
2490
2491 rc = secondary_ops->sb_umount(mnt, flags);
2492 if (rc)
2493 return rc;
2494
2495 return superblock_has_perm(current, mnt->mnt_sb,
2496 FILESYSTEM__UNMOUNT, NULL);
2497 }
2498
2499 /* inode security operations */
2500
2501 static int selinux_inode_alloc_security(struct inode *inode)
2502 {
2503 return inode_alloc_security(inode);
2504 }
2505
2506 static void selinux_inode_free_security(struct inode *inode)
2507 {
2508 inode_free_security(inode);
2509 }
2510
2511 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2512 char **name, void **value,
2513 size_t *len)
2514 {
2515 struct task_security_struct *tsec;
2516 struct inode_security_struct *dsec;
2517 struct superblock_security_struct *sbsec;
2518 u32 newsid, clen;
2519 int rc;
2520 char *namep = NULL, *context;
2521
2522 tsec = current->security;
2523 dsec = dir->i_security;
2524 sbsec = dir->i_sb->s_security;
2525
2526 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2527 newsid = tsec->create_sid;
2528 } else {
2529 rc = security_transition_sid(tsec->sid, dsec->sid,
2530 inode_mode_to_security_class(inode->i_mode),
2531 &newsid);
2532 if (rc) {
2533 printk(KERN_WARNING "%s: "
2534 "security_transition_sid failed, rc=%d (dev=%s "
2535 "ino=%ld)\n",
2536 __func__,
2537 -rc, inode->i_sb->s_id, inode->i_ino);
2538 return rc;
2539 }
2540 }
2541
2542 /* Possibly defer initialization to selinux_complete_init. */
2543 if (sbsec->initialized) {
2544 struct inode_security_struct *isec = inode->i_security;
2545 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2546 isec->sid = newsid;
2547 isec->initialized = 1;
2548 }
2549
2550 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2551 return -EOPNOTSUPP;
2552
2553 if (name) {
2554 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2555 if (!namep)
2556 return -ENOMEM;
2557 *name = namep;
2558 }
2559
2560 if (value && len) {
2561 rc = security_sid_to_context_force(newsid, &context, &clen);
2562 if (rc) {
2563 kfree(namep);
2564 return rc;
2565 }
2566 *value = context;
2567 *len = clen;
2568 }
2569
2570 return 0;
2571 }
2572
2573 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2574 {
2575 return may_create(dir, dentry, SECCLASS_FILE);
2576 }
2577
2578 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2579 {
2580 int rc;
2581
2582 rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
2583 if (rc)
2584 return rc;
2585 return may_link(dir, old_dentry, MAY_LINK);
2586 }
2587
2588 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2589 {
2590 int rc;
2591
2592 rc = secondary_ops->inode_unlink(dir, dentry);
2593 if (rc)
2594 return rc;
2595 return may_link(dir, dentry, MAY_UNLINK);
2596 }
2597
2598 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2599 {
2600 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2601 }
2602
2603 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2604 {
2605 return may_create(dir, dentry, SECCLASS_DIR);
2606 }
2607
2608 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2609 {
2610 return may_link(dir, dentry, MAY_RMDIR);
2611 }
2612
2613 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2614 {
2615 int rc;
2616
2617 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2618 if (rc)
2619 return rc;
2620
2621 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2622 }
2623
2624 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2625 struct inode *new_inode, struct dentry *new_dentry)
2626 {
2627 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2628 }
2629
2630 static int selinux_inode_readlink(struct dentry *dentry)
2631 {
2632 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2633 }
2634
2635 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2636 {
2637 int rc;
2638
2639 rc = secondary_ops->inode_follow_link(dentry, nameidata);
2640 if (rc)
2641 return rc;
2642 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2643 }
2644
2645 static int selinux_inode_permission(struct inode *inode, int mask)
2646 {
2647 int rc;
2648
2649 rc = secondary_ops->inode_permission(inode, mask);
2650 if (rc)
2651 return rc;
2652
2653 if (!mask) {
2654 /* No permission to check. Existence test. */
2655 return 0;
2656 }
2657
2658 return inode_has_perm(current, inode,
2659 file_mask_to_av(inode->i_mode, mask), NULL);
2660 }
2661
2662 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2663 {
2664 int rc;
2665
2666 rc = secondary_ops->inode_setattr(dentry, iattr);
2667 if (rc)
2668 return rc;
2669
2670 if (iattr->ia_valid & ATTR_FORCE)
2671 return 0;
2672
2673 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2674 ATTR_ATIME_SET | ATTR_MTIME_SET))
2675 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2676
2677 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2678 }
2679
2680 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2681 {
2682 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2683 }
2684
2685 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2686 {
2687 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2688 sizeof XATTR_SECURITY_PREFIX - 1)) {
2689 if (!strcmp(name, XATTR_NAME_CAPS)) {
2690 if (!capable(CAP_SETFCAP))
2691 return -EPERM;
2692 } else if (!capable(CAP_SYS_ADMIN)) {
2693 /* A different attribute in the security namespace.
2694 Restrict to administrator. */
2695 return -EPERM;
2696 }
2697 }
2698
2699 /* Not an attribute we recognize, so just check the
2700 ordinary setattr permission. */
2701 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2702 }
2703
2704 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2705 const void *value, size_t size, int flags)
2706 {
2707 struct task_security_struct *tsec = current->security;
2708 struct inode *inode = dentry->d_inode;
2709 struct inode_security_struct *isec = inode->i_security;
2710 struct superblock_security_struct *sbsec;
2711 struct avc_audit_data ad;
2712 u32 newsid;
2713 int rc = 0;
2714
2715 if (strcmp(name, XATTR_NAME_SELINUX))
2716 return selinux_inode_setotherxattr(dentry, name);
2717
2718 sbsec = inode->i_sb->s_security;
2719 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2720 return -EOPNOTSUPP;
2721
2722 if (!is_owner_or_cap(inode))
2723 return -EPERM;
2724
2725 AVC_AUDIT_DATA_INIT(&ad, FS);
2726 ad.u.fs.path.dentry = dentry;
2727
2728 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2729 FILE__RELABELFROM, &ad);
2730 if (rc)
2731 return rc;
2732
2733 rc = security_context_to_sid(value, size, &newsid);
2734 if (rc == -EINVAL) {
2735 if (!capable(CAP_MAC_ADMIN))
2736 return rc;
2737 rc = security_context_to_sid_force(value, size, &newsid);
2738 }
2739 if (rc)
2740 return rc;
2741
2742 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2743 FILE__RELABELTO, &ad);
2744 if (rc)
2745 return rc;
2746
2747 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2748 isec->sclass);
2749 if (rc)
2750 return rc;
2751
2752 return avc_has_perm(newsid,
2753 sbsec->sid,
2754 SECCLASS_FILESYSTEM,
2755 FILESYSTEM__ASSOCIATE,
2756 &ad);
2757 }
2758
2759 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2760 const void *value, size_t size,
2761 int flags)
2762 {
2763 struct inode *inode = dentry->d_inode;
2764 struct inode_security_struct *isec = inode->i_security;
2765 u32 newsid;
2766 int rc;
2767
2768 if (strcmp(name, XATTR_NAME_SELINUX)) {
2769 /* Not an attribute we recognize, so nothing to do. */
2770 return;
2771 }
2772
2773 rc = security_context_to_sid_force(value, size, &newsid);
2774 if (rc) {
2775 printk(KERN_ERR "SELinux: unable to map context to SID"
2776 "for (%s, %lu), rc=%d\n",
2777 inode->i_sb->s_id, inode->i_ino, -rc);
2778 return;
2779 }
2780
2781 isec->sid = newsid;
2782 return;
2783 }
2784
2785 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2786 {
2787 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2788 }
2789
2790 static int selinux_inode_listxattr(struct dentry *dentry)
2791 {
2792 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2793 }
2794
2795 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2796 {
2797 if (strcmp(name, XATTR_NAME_SELINUX))
2798 return selinux_inode_setotherxattr(dentry, name);
2799
2800 /* No one is allowed to remove a SELinux security label.
2801 You can change the label, but all data must be labeled. */
2802 return -EACCES;
2803 }
2804
2805 /*
2806 * Copy the inode security context value to the user.
2807 *
2808 * Permission check is handled by selinux_inode_getxattr hook.
2809 */
2810 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2811 {
2812 u32 size;
2813 int error;
2814 char *context = NULL;
2815 struct inode_security_struct *isec = inode->i_security;
2816
2817 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2818 return -EOPNOTSUPP;
2819
2820 /*
2821 * If the caller has CAP_MAC_ADMIN, then get the raw context
2822 * value even if it is not defined by current policy; otherwise,
2823 * use the in-core value under current policy.
2824 * Use the non-auditing forms of the permission checks since
2825 * getxattr may be called by unprivileged processes commonly
2826 * and lack of permission just means that we fall back to the
2827 * in-core context value, not a denial.
2828 */
2829 error = selinux_capable(current, CAP_MAC_ADMIN, SECURITY_CAP_NOAUDIT);
2830 if (!error)
2831 error = security_sid_to_context_force(isec->sid, &context,
2832 &size);
2833 else
2834 error = security_sid_to_context(isec->sid, &context, &size);
2835 if (error)
2836 return error;
2837 error = size;
2838 if (alloc) {
2839 *buffer = context;
2840 goto out_nofree;
2841 }
2842 kfree(context);
2843 out_nofree:
2844 return error;
2845 }
2846
2847 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2848 const void *value, size_t size, int flags)
2849 {
2850 struct inode_security_struct *isec = inode->i_security;
2851 u32 newsid;
2852 int rc;
2853
2854 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2855 return -EOPNOTSUPP;
2856
2857 if (!value || !size)
2858 return -EACCES;
2859
2860 rc = security_context_to_sid((void *)value, size, &newsid);
2861 if (rc)
2862 return rc;
2863
2864 isec->sid = newsid;
2865 return 0;
2866 }
2867
2868 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2869 {
2870 const int len = sizeof(XATTR_NAME_SELINUX);
2871 if (buffer && len <= buffer_size)
2872 memcpy(buffer, XATTR_NAME_SELINUX, len);
2873 return len;
2874 }
2875
2876 static int selinux_inode_need_killpriv(struct dentry *dentry)
2877 {
2878 return secondary_ops->inode_need_killpriv(dentry);
2879 }
2880
2881 static int selinux_inode_killpriv(struct dentry *dentry)
2882 {
2883 return secondary_ops->inode_killpriv(dentry);
2884 }
2885
2886 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2887 {
2888 struct inode_security_struct *isec = inode->i_security;
2889 *secid = isec->sid;
2890 }
2891
2892 /* file security operations */
2893
2894 static int selinux_revalidate_file_permission(struct file *file, int mask)
2895 {
2896 int rc;
2897 struct inode *inode = file->f_path.dentry->d_inode;
2898
2899 if (!mask) {
2900 /* No permission to check. Existence test. */
2901 return 0;
2902 }
2903
2904 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2905 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2906 mask |= MAY_APPEND;
2907
2908 rc = file_has_perm(current, file,
2909 file_mask_to_av(inode->i_mode, mask));
2910 if (rc)
2911 return rc;
2912
2913 return selinux_netlbl_inode_permission(inode, mask);
2914 }
2915
2916 static int selinux_file_permission(struct file *file, int mask)
2917 {
2918 struct inode *inode = file->f_path.dentry->d_inode;
2919 struct task_security_struct *tsec = current->security;
2920 struct file_security_struct *fsec = file->f_security;
2921 struct inode_security_struct *isec = inode->i_security;
2922
2923 if (!mask) {
2924 /* No permission to check. Existence test. */
2925 return 0;
2926 }
2927
2928 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2929 && fsec->pseqno == avc_policy_seqno())
2930 return selinux_netlbl_inode_permission(inode, mask);
2931
2932 return selinux_revalidate_file_permission(file, mask);
2933 }
2934
2935 static int selinux_file_alloc_security(struct file *file)
2936 {
2937 return file_alloc_security(file);
2938 }
2939
2940 static void selinux_file_free_security(struct file *file)
2941 {
2942 file_free_security(file);
2943 }
2944
2945 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2946 unsigned long arg)
2947 {
2948 u32 av = 0;
2949
2950 if (_IOC_DIR(cmd) & _IOC_WRITE)
2951 av |= FILE__WRITE;
2952 if (_IOC_DIR(cmd) & _IOC_READ)
2953 av |= FILE__READ;
2954 if (!av)
2955 av = FILE__IOCTL;
2956
2957 return file_has_perm(current, file, av);
2958 }
2959
2960 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2961 {
2962 #ifndef CONFIG_PPC32
2963 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2964 /*
2965 * We are making executable an anonymous mapping or a
2966 * private file mapping that will also be writable.
2967 * This has an additional check.
2968 */
2969 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2970 if (rc)
2971 return rc;
2972 }
2973 #endif
2974
2975 if (file) {
2976 /* read access is always possible with a mapping */
2977 u32 av = FILE__READ;
2978
2979 /* write access only matters if the mapping is shared */
2980 if (shared && (prot & PROT_WRITE))
2981 av |= FILE__WRITE;
2982
2983 if (prot & PROT_EXEC)
2984 av |= FILE__EXECUTE;
2985
2986 return file_has_perm(current, file, av);
2987 }
2988 return 0;
2989 }
2990
2991 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2992 unsigned long prot, unsigned long flags,
2993 unsigned long addr, unsigned long addr_only)
2994 {
2995 int rc = 0;
2996 u32 sid = ((struct task_security_struct *)(current->security))->sid;
2997
2998 if (addr < mmap_min_addr)
2999 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3000 MEMPROTECT__MMAP_ZERO, NULL);
3001 if (rc || addr_only)
3002 return rc;
3003
3004 if (selinux_checkreqprot)
3005 prot = reqprot;
3006
3007 return file_map_prot_check(file, prot,
3008 (flags & MAP_TYPE) == MAP_SHARED);
3009 }
3010
3011 static int selinux_file_mprotect(struct vm_area_struct *vma,
3012 unsigned long reqprot,
3013 unsigned long prot)
3014 {
3015 int rc;
3016
3017 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
3018 if (rc)
3019 return rc;
3020
3021 if (selinux_checkreqprot)
3022 prot = reqprot;
3023
3024 #ifndef CONFIG_PPC32
3025 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3026 rc = 0;
3027 if (vma->vm_start >= vma->vm_mm->start_brk &&
3028 vma->vm_end <= vma->vm_mm->brk) {
3029 rc = task_has_perm(current, current,
3030 PROCESS__EXECHEAP);
3031 } else if (!vma->vm_file &&
3032 vma->vm_start <= vma->vm_mm->start_stack &&
3033 vma->vm_end >= vma->vm_mm->start_stack) {
3034 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
3035 } else if (vma->vm_file && vma->anon_vma) {
3036 /*
3037 * We are making executable a file mapping that has
3038 * had some COW done. Since pages might have been
3039 * written, check ability to execute the possibly
3040 * modified content. This typically should only
3041 * occur for text relocations.
3042 */
3043 rc = file_has_perm(current, vma->vm_file,
3044 FILE__EXECMOD);
3045 }
3046 if (rc)
3047 return rc;
3048 }
3049 #endif
3050
3051 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3052 }
3053
3054 static int selinux_file_lock(struct file *file, unsigned int cmd)
3055 {
3056 return file_has_perm(current, file, FILE__LOCK);
3057 }
3058
3059 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3060 unsigned long arg)
3061 {
3062 int err = 0;
3063
3064 switch (cmd) {
3065 case F_SETFL:
3066 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3067 err = -EINVAL;
3068 break;
3069 }
3070
3071 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3072 err = file_has_perm(current, file, FILE__WRITE);
3073 break;
3074 }
3075 /* fall through */
3076 case F_SETOWN:
3077 case F_SETSIG:
3078 case F_GETFL:
3079 case F_GETOWN:
3080 case F_GETSIG:
3081 /* Just check FD__USE permission */
3082 err = file_has_perm(current, file, 0);
3083 break;
3084 case F_GETLK:
3085 case F_SETLK:
3086 case F_SETLKW:
3087 #if BITS_PER_LONG == 32
3088 case F_GETLK64:
3089 case F_SETLK64:
3090 case F_SETLKW64:
3091 #endif
3092 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3093 err = -EINVAL;
3094 break;
3095 }
3096 err = file_has_perm(current, file, FILE__LOCK);
3097 break;
3098 }
3099
3100 return err;
3101 }
3102
3103 static int selinux_file_set_fowner(struct file *file)
3104 {
3105 struct task_security_struct *tsec;
3106 struct file_security_struct *fsec;
3107
3108 tsec = current->security;
3109 fsec = file->f_security;
3110 fsec->fown_sid = tsec->sid;
3111
3112 return 0;
3113 }
3114
3115 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3116 struct fown_struct *fown, int signum)
3117 {
3118 struct file *file;
3119 u32 perm;
3120 struct task_security_struct *tsec;
3121 struct file_security_struct *fsec;
3122
3123 /* struct fown_struct is never outside the context of a struct file */
3124 file = container_of(fown, struct file, f_owner);
3125
3126 tsec = tsk->security;
3127 fsec = file->f_security;
3128
3129 if (!signum)
3130 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3131 else
3132 perm = signal_to_av(signum);
3133
3134 return avc_has_perm(fsec->fown_sid, tsec->sid,
3135 SECCLASS_PROCESS, perm, NULL);
3136 }
3137
3138 static int selinux_file_receive(struct file *file)
3139 {
3140 return file_has_perm(current, file, file_to_av(file));
3141 }
3142
3143 static int selinux_dentry_open(struct file *file)
3144 {
3145 struct file_security_struct *fsec;
3146 struct inode *inode;
3147 struct inode_security_struct *isec;
3148 inode = file->f_path.dentry->d_inode;
3149 fsec = file->f_security;
3150 isec = inode->i_security;
3151 /*
3152 * Save inode label and policy sequence number
3153 * at open-time so that selinux_file_permission
3154 * can determine whether revalidation is necessary.
3155 * Task label is already saved in the file security
3156 * struct as its SID.
3157 */
3158 fsec->isid = isec->sid;
3159 fsec->pseqno = avc_policy_seqno();
3160 /*
3161 * Since the inode label or policy seqno may have changed
3162 * between the selinux_inode_permission check and the saving
3163 * of state above, recheck that access is still permitted.
3164 * Otherwise, access might never be revalidated against the
3165 * new inode label or new policy.
3166 * This check is not redundant - do not remove.
3167 */
3168 return inode_has_perm(current, inode, open_file_to_av(file), NULL);
3169 }
3170
3171 /* task security operations */
3172
3173 static int selinux_task_create(unsigned long clone_flags)
3174 {
3175 int rc;
3176
3177 rc = secondary_ops->task_create(clone_flags);
3178 if (rc)
3179 return rc;
3180
3181 return task_has_perm(current, current, PROCESS__FORK);
3182 }
3183
3184 static int selinux_task_alloc_security(struct task_struct *tsk)
3185 {
3186 struct task_security_struct *tsec1, *tsec2;
3187 int rc;
3188
3189 tsec1 = current->security;
3190
3191 rc = task_alloc_security(tsk);
3192 if (rc)
3193 return rc;
3194 tsec2 = tsk->security;
3195
3196 tsec2->osid = tsec1->osid;
3197 tsec2->sid = tsec1->sid;
3198
3199 /* Retain the exec, fs, key, and sock SIDs across fork */
3200 tsec2->exec_sid = tsec1->exec_sid;
3201 tsec2->create_sid = tsec1->create_sid;
3202 tsec2->keycreate_sid = tsec1->keycreate_sid;
3203 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3204
3205 return 0;
3206 }
3207
3208 static void selinux_task_free_security(struct task_struct *tsk)
3209 {
3210 task_free_security(tsk);
3211 }
3212
3213 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3214 {
3215 /* Since setuid only affects the current process, and
3216 since the SELinux controls are not based on the Linux
3217 identity attributes, SELinux does not need to control
3218 this operation. However, SELinux does control the use
3219 of the CAP_SETUID and CAP_SETGID capabilities using the
3220 capable hook. */
3221 return 0;
3222 }
3223
3224 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3225 {
3226 return secondary_ops->task_post_setuid(id0, id1, id2, flags);
3227 }
3228
3229 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3230 {
3231 /* See the comment for setuid above. */
3232 return 0;
3233 }
3234
3235 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3236 {
3237 return task_has_perm(current, p, PROCESS__SETPGID);
3238 }
3239
3240 static int selinux_task_getpgid(struct task_struct *p)
3241 {
3242 return task_has_perm(current, p, PROCESS__GETPGID);
3243 }
3244
3245 static int selinux_task_getsid(struct task_struct *p)
3246 {
3247 return task_has_perm(current, p, PROCESS__GETSESSION);
3248 }
3249
3250 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3251 {
3252 struct task_security_struct *tsec = p->security;
3253 *secid = tsec->sid;
3254 }
3255
3256 static int selinux_task_setgroups(struct group_info *group_info)
3257 {
3258 /* See the comment for setuid above. */
3259 return 0;
3260 }
3261
3262 static int selinux_task_setnice(struct task_struct *p, int nice)
3263 {
3264 int rc;
3265
3266 rc = secondary_ops->task_setnice(p, nice);
3267 if (rc)
3268 return rc;
3269
3270 return task_has_perm(current, p, PROCESS__SETSCHED);
3271 }
3272
3273 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3274 {
3275 int rc;
3276
3277 rc = secondary_ops->task_setioprio(p, ioprio);
3278 if (rc)
3279 return rc;
3280
3281 return task_has_perm(current, p, PROCESS__SETSCHED);
3282 }
3283
3284 static int selinux_task_getioprio(struct task_struct *p)
3285 {
3286 return task_has_perm(current, p, PROCESS__GETSCHED);
3287 }
3288
3289 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3290 {
3291 struct rlimit *old_rlim = current->signal->rlim + resource;
3292 int rc;
3293
3294 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3295 if (rc)
3296 return rc;
3297
3298 /* Control the ability to change the hard limit (whether
3299 lowering or raising it), so that the hard limit can
3300 later be used as a safe reset point for the soft limit
3301 upon context transitions. See selinux_bprm_apply_creds. */
3302 if (old_rlim->rlim_max != new_rlim->rlim_max)
3303 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3304
3305 return 0;
3306 }
3307
3308 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3309 {
3310 int rc;
3311
3312 rc = secondary_ops->task_setscheduler(p, policy, lp);
3313 if (rc)
3314 return rc;
3315
3316 return task_has_perm(current, p, PROCESS__SETSCHED);
3317 }
3318
3319 static int selinux_task_getscheduler(struct task_struct *p)
3320 {
3321 return task_has_perm(current, p, PROCESS__GETSCHED);
3322 }
3323
3324 static int selinux_task_movememory(struct task_struct *p)
3325 {
3326 return task_has_perm(current, p, PROCESS__SETSCHED);
3327 }
3328
3329 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3330 int sig, u32 secid)
3331 {
3332 u32 perm;
3333 int rc;
3334 struct task_security_struct *tsec;
3335
3336 rc = secondary_ops->task_kill(p, info, sig, secid);
3337 if (rc)
3338 return rc;
3339
3340 if (!sig)
3341 perm = PROCESS__SIGNULL; /* null signal; existence test */
3342 else
3343 perm = signal_to_av(sig);
3344 tsec = p->security;
3345 if (secid)
3346 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3347 else
3348 rc = task_has_perm(current, p, perm);
3349 return rc;
3350 }
3351
3352 static int selinux_task_prctl(int option,
3353 unsigned long arg2,
3354 unsigned long arg3,
3355 unsigned long arg4,
3356 unsigned long arg5,
3357 long *rc_p)
3358 {
3359 /* The current prctl operations do not appear to require
3360 any SELinux controls since they merely observe or modify
3361 the state of the current process. */
3362 return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
3363 }
3364
3365 static int selinux_task_wait(struct task_struct *p)
3366 {
3367 return task_has_perm(p, current, PROCESS__SIGCHLD);
3368 }
3369
3370 static void selinux_task_reparent_to_init(struct task_struct *p)
3371 {
3372 struct task_security_struct *tsec;
3373
3374 secondary_ops->task_reparent_to_init(p);
3375
3376 tsec = p->security;
3377 tsec->osid = tsec->sid;
3378 tsec->sid = SECINITSID_KERNEL;
3379 return;
3380 }
3381
3382 static void selinux_task_to_inode(struct task_struct *p,
3383 struct inode *inode)
3384 {
3385 struct task_security_struct *tsec = p->security;
3386 struct inode_security_struct *isec = inode->i_security;
3387
3388 isec->sid = tsec->sid;
3389 isec->initialized = 1;
3390 return;
3391 }
3392
3393 /* Returns error only if unable to parse addresses */
3394 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3395 struct avc_audit_data *ad, u8 *proto)
3396 {
3397 int offset, ihlen, ret = -EINVAL;
3398 struct iphdr _iph, *ih;
3399
3400 offset = skb_network_offset(skb);
3401 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3402 if (ih == NULL)
3403 goto out;
3404
3405 ihlen = ih->ihl * 4;
3406 if (ihlen < sizeof(_iph))
3407 goto out;
3408
3409 ad->u.net.v4info.saddr = ih->saddr;
3410 ad->u.net.v4info.daddr = ih->daddr;
3411 ret = 0;
3412
3413 if (proto)
3414 *proto = ih->protocol;
3415
3416 switch (ih->protocol) {
3417 case IPPROTO_TCP: {
3418 struct tcphdr _tcph, *th;
3419
3420 if (ntohs(ih->frag_off) & IP_OFFSET)
3421 break;
3422
3423 offset += ihlen;
3424 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3425 if (th == NULL)
3426 break;
3427
3428 ad->u.net.sport = th->source;
3429 ad->u.net.dport = th->dest;
3430 break;
3431 }
3432
3433 case IPPROTO_UDP: {
3434 struct udphdr _udph, *uh;
3435
3436 if (ntohs(ih->frag_off) & IP_OFFSET)
3437 break;
3438
3439 offset += ihlen;
3440 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3441 if (uh == NULL)
3442 break;
3443
3444 ad->u.net.sport = uh->source;
3445 ad->u.net.dport = uh->dest;
3446 break;
3447 }
3448
3449 case IPPROTO_DCCP: {
3450 struct dccp_hdr _dccph, *dh;
3451
3452 if (ntohs(ih->frag_off) & IP_OFFSET)
3453 break;
3454
3455 offset += ihlen;
3456 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3457 if (dh == NULL)
3458 break;
3459
3460 ad->u.net.sport = dh->dccph_sport;
3461 ad->u.net.dport = dh->dccph_dport;
3462 break;
3463 }
3464
3465 default:
3466 break;
3467 }
3468 out:
3469 return ret;
3470 }
3471
3472 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3473
3474 /* Returns error only if unable to parse addresses */
3475 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3476 struct avc_audit_data *ad, u8 *proto)
3477 {
3478 u8 nexthdr;
3479 int ret = -EINVAL, offset;
3480 struct ipv6hdr _ipv6h, *ip6;
3481
3482 offset = skb_network_offset(skb);
3483 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3484 if (ip6 == NULL)
3485 goto out;
3486
3487 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3488 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3489 ret = 0;
3490
3491 nexthdr = ip6->nexthdr;
3492 offset += sizeof(_ipv6h);
3493 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3494 if (offset < 0)
3495 goto out;
3496
3497 if (proto)
3498 *proto = nexthdr;
3499
3500 switch (nexthdr) {
3501 case IPPROTO_TCP: {
3502 struct tcphdr _tcph, *th;
3503
3504 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3505 if (th == NULL)
3506 break;
3507
3508 ad->u.net.sport = th->source;
3509 ad->u.net.dport = th->dest;
3510 break;
3511 }
3512
3513 case IPPROTO_UDP: {
3514 struct udphdr _udph, *uh;
3515
3516 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3517 if (uh == NULL)
3518 break;
3519
3520 ad->u.net.sport = uh->source;
3521 ad->u.net.dport = uh->dest;
3522 break;
3523 }
3524
3525 case IPPROTO_DCCP: {
3526 struct dccp_hdr _dccph, *dh;
3527
3528 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3529 if (dh == NULL)
3530 break;
3531
3532 ad->u.net.sport = dh->dccph_sport;
3533 ad->u.net.dport = dh->dccph_dport;
3534 break;
3535 }
3536
3537 /* includes fragments */
3538 default:
3539 break;
3540 }
3541 out:
3542 return ret;
3543 }
3544
3545 #endif /* IPV6 */
3546
3547 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3548 char **_addrp, int src, u8 *proto)
3549 {
3550 char *addrp;
3551 int ret;
3552
3553 switch (ad->u.net.family) {
3554 case PF_INET:
3555 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3556 if (ret)
3557 goto parse_error;
3558 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3559 &ad->u.net.v4info.daddr);
3560 goto okay;
3561
3562 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3563 case PF_INET6:
3564 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3565 if (ret)
3566 goto parse_error;
3567 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3568 &ad->u.net.v6info.daddr);
3569 goto okay;
3570 #endif /* IPV6 */
3571 default:
3572 addrp = NULL;
3573 goto okay;
3574 }
3575
3576 parse_error:
3577 printk(KERN_WARNING
3578 "SELinux: failure in selinux_parse_skb(),"
3579 " unable to parse packet\n");
3580 return ret;
3581
3582 okay:
3583 if (_addrp)
3584 *_addrp = addrp;
3585 return 0;
3586 }
3587
3588 /**
3589 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3590 * @skb: the packet
3591 * @family: protocol family
3592 * @sid: the packet's peer label SID
3593 *
3594 * Description:
3595 * Check the various different forms of network peer labeling and determine
3596 * the peer label/SID for the packet; most of the magic actually occurs in
3597 * the security server function security_net_peersid_cmp(). The function
3598 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3599 * or -EACCES if @sid is invalid due to inconsistencies with the different
3600 * peer labels.
3601 *
3602 */
3603 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3604 {
3605 int err;
3606 u32 xfrm_sid;
3607 u32 nlbl_sid;
3608 u32 nlbl_type;
3609
3610 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3611 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3612
3613 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3614 if (unlikely(err)) {
3615 printk(KERN_WARNING
3616 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3617 " unable to determine packet's peer label\n");
3618 return -EACCES;
3619 }
3620
3621 return 0;
3622 }
3623
3624 /* socket security operations */
3625 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3626 u32 perms)
3627 {
3628 struct inode_security_struct *isec;
3629 struct task_security_struct *tsec;
3630 struct avc_audit_data ad;
3631 int err = 0;
3632
3633 tsec = task->security;
3634 isec = SOCK_INODE(sock)->i_security;
3635
3636 if (isec->sid == SECINITSID_KERNEL)
3637 goto out;
3638
3639 AVC_AUDIT_DATA_INIT(&ad, NET);
3640 ad.u.net.sk = sock->sk;
3641 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3642
3643 out:
3644 return err;
3645 }
3646
3647 static int selinux_socket_create(int family, int type,
3648 int protocol, int kern)
3649 {
3650 int err = 0;
3651 struct task_security_struct *tsec;
3652 u32 newsid;
3653
3654 if (kern)
3655 goto out;
3656
3657 tsec = current->security;
3658 newsid = tsec->sockcreate_sid ? : tsec->sid;
3659 err = avc_has_perm(tsec->sid, newsid,
3660 socket_type_to_security_class(family, type,
3661 protocol), SOCKET__CREATE, NULL);
3662
3663 out:
3664 return err;
3665 }
3666
3667 static int selinux_socket_post_create(struct socket *sock, int family,
3668 int type, int protocol, int kern)
3669 {
3670 int err = 0;
3671 struct inode_security_struct *isec;
3672 struct task_security_struct *tsec;
3673 struct sk_security_struct *sksec;
3674 u32 newsid;
3675
3676 isec = SOCK_INODE(sock)->i_security;
3677
3678 tsec = current->security;
3679 newsid = tsec->sockcreate_sid ? : tsec->sid;
3680 isec->sclass = socket_type_to_security_class(family, type, protocol);
3681 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3682 isec->initialized = 1;
3683
3684 if (sock->sk) {
3685 sksec = sock->sk->sk_security;
3686 sksec->sid = isec->sid;
3687 sksec->sclass = isec->sclass;
3688 err = selinux_netlbl_socket_post_create(sock);
3689 }
3690
3691 return err;
3692 }
3693
3694 /* Range of port numbers used to automatically bind.
3695 Need to determine whether we should perform a name_bind
3696 permission check between the socket and the port number. */
3697
3698 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3699 {
3700 u16 family;
3701 int err;
3702
3703 err = socket_has_perm(current, sock, SOCKET__BIND);
3704 if (err)
3705 goto out;
3706
3707 /*
3708 * If PF_INET or PF_INET6, check name_bind permission for the port.
3709 * Multiple address binding for SCTP is not supported yet: we just
3710 * check the first address now.
3711 */
3712 family = sock->sk->sk_family;
3713 if (family == PF_INET || family == PF_INET6) {
3714 char *addrp;
3715 struct inode_security_struct *isec;
3716 struct task_security_struct *tsec;
3717 struct avc_audit_data ad;
3718 struct sockaddr_in *addr4 = NULL;
3719 struct sockaddr_in6 *addr6 = NULL;
3720 unsigned short snum;
3721 struct sock *sk = sock->sk;
3722 u32 sid, node_perm;
3723
3724 tsec = current->security;
3725 isec = SOCK_INODE(sock)->i_security;
3726
3727 if (family == PF_INET) {
3728 addr4 = (struct sockaddr_in *)address;
3729 snum = ntohs(addr4->sin_port);
3730 addrp = (char *)&addr4->sin_addr.s_addr;
3731 } else {
3732 addr6 = (struct sockaddr_in6 *)address;
3733 snum = ntohs(addr6->sin6_port);
3734 addrp = (char *)&addr6->sin6_addr.s6_addr;
3735 }
3736
3737 if (snum) {
3738 int low, high;
3739
3740 inet_get_local_port_range(&low, &high);
3741
3742 if (snum < max(PROT_SOCK, low) || snum > high) {
3743 err = sel_netport_sid(sk->sk_protocol,
3744 snum, &sid);
3745 if (err)
3746 goto out;
3747 AVC_AUDIT_DATA_INIT(&ad, NET);
3748 ad.u.net.sport = htons(snum);
3749 ad.u.net.family = family;
3750 err = avc_has_perm(isec->sid, sid,
3751 isec->sclass,
3752 SOCKET__NAME_BIND, &ad);
3753 if (err)
3754 goto out;
3755 }
3756 }
3757
3758 switch (isec->sclass) {
3759 case SECCLASS_TCP_SOCKET:
3760 node_perm = TCP_SOCKET__NODE_BIND;
3761 break;
3762
3763 case SECCLASS_UDP_SOCKET:
3764 node_perm = UDP_SOCKET__NODE_BIND;
3765 break;
3766
3767 case SECCLASS_DCCP_SOCKET:
3768 node_perm = DCCP_SOCKET__NODE_BIND;
3769 break;
3770
3771 default:
3772 node_perm = RAWIP_SOCKET__NODE_BIND;
3773 break;
3774 }
3775
3776 err = sel_netnode_sid(addrp, family, &sid);
3777 if (err)
3778 goto out;
3779
3780 AVC_AUDIT_DATA_INIT(&ad, NET);
3781 ad.u.net.sport = htons(snum);
3782 ad.u.net.family = family;
3783
3784 if (family == PF_INET)
3785 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3786 else
3787 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3788
3789 err = avc_has_perm(isec->sid, sid,
3790 isec->sclass, node_perm, &ad);
3791 if (err)
3792 goto out;
3793 }
3794 out:
3795 return err;
3796 }
3797
3798 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3799 {
3800 struct sock *sk = sock->sk;
3801 struct inode_security_struct *isec;
3802 int err;
3803
3804 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3805 if (err)
3806 return err;
3807
3808 /*
3809 * If a TCP or DCCP socket, check name_connect permission for the port.
3810 */
3811 isec = SOCK_INODE(sock)->i_security;
3812 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3813 isec->sclass == SECCLASS_DCCP_SOCKET) {
3814 struct avc_audit_data ad;
3815 struct sockaddr_in *addr4 = NULL;
3816 struct sockaddr_in6 *addr6 = NULL;
3817 unsigned short snum;
3818 u32 sid, perm;
3819
3820 if (sk->sk_family == PF_INET) {
3821 addr4 = (struct sockaddr_in *)address;
3822 if (addrlen < sizeof(struct sockaddr_in))
3823 return -EINVAL;
3824 snum = ntohs(addr4->sin_port);
3825 } else {
3826 addr6 = (struct sockaddr_in6 *)address;
3827 if (addrlen < SIN6_LEN_RFC2133)
3828 return -EINVAL;
3829 snum = ntohs(addr6->sin6_port);
3830 }
3831
3832 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3833 if (err)
3834 goto out;
3835
3836 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3837 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3838
3839 AVC_AUDIT_DATA_INIT(&ad, NET);
3840 ad.u.net.dport = htons(snum);
3841 ad.u.net.family = sk->sk_family;
3842 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3843 if (err)
3844 goto out;
3845 }
3846
3847 err = selinux_netlbl_socket_connect(sk, address);
3848
3849 out:
3850 return err;
3851 }
3852
3853 static int selinux_socket_listen(struct socket *sock, int backlog)
3854 {
3855 return socket_has_perm(current, sock, SOCKET__LISTEN);
3856 }
3857
3858 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3859 {
3860 int err;
3861 struct inode_security_struct *isec;
3862 struct inode_security_struct *newisec;
3863
3864 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3865 if (err)
3866 return err;
3867
3868 newisec = SOCK_INODE(newsock)->i_security;
3869
3870 isec = SOCK_INODE(sock)->i_security;
3871 newisec->sclass = isec->sclass;
3872 newisec->sid = isec->sid;
3873 newisec->initialized = 1;
3874
3875 return 0;
3876 }
3877
3878 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3879 int size)
3880 {
3881 int rc;
3882
3883 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3884 if (rc)
3885 return rc;
3886
3887 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3888 }
3889
3890 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3891 int size, int flags)
3892 {
3893 return socket_has_perm(current, sock, SOCKET__READ);
3894 }
3895
3896 static int selinux_socket_getsockname(struct socket *sock)
3897 {
3898 return socket_has_perm(current, sock, SOCKET__GETATTR);
3899 }
3900
3901 static int selinux_socket_getpeername(struct socket *sock)
3902 {
3903 return socket_has_perm(current, sock, SOCKET__GETATTR);
3904 }
3905
3906 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3907 {
3908 int err;
3909
3910 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3911 if (err)
3912 return err;
3913
3914 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3915 }
3916
3917 static int selinux_socket_getsockopt(struct socket *sock, int level,
3918 int optname)
3919 {
3920 return socket_has_perm(current, sock, SOCKET__GETOPT);
3921 }
3922
3923 static int selinux_socket_shutdown(struct socket *sock, int how)
3924 {
3925 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3926 }
3927
3928 static int selinux_socket_unix_stream_connect(struct socket *sock,
3929 struct socket *other,
3930 struct sock *newsk)
3931 {
3932 struct sk_security_struct *ssec;
3933 struct inode_security_struct *isec;
3934 struct inode_security_struct *other_isec;
3935 struct avc_audit_data ad;
3936 int err;
3937
3938 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3939 if (err)
3940 return err;
3941
3942 isec = SOCK_INODE(sock)->i_security;
3943 other_isec = SOCK_INODE(other)->i_security;
3944
3945 AVC_AUDIT_DATA_INIT(&ad, NET);
3946 ad.u.net.sk = other->sk;
3947
3948 err = avc_has_perm(isec->sid, other_isec->sid,
3949 isec->sclass,
3950 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3951 if (err)
3952 return err;
3953
3954 /* connecting socket */
3955 ssec = sock->sk->sk_security;
3956 ssec->peer_sid = other_isec->sid;
3957
3958 /* server child socket */
3959 ssec = newsk->sk_security;
3960 ssec->peer_sid = isec->sid;
3961 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3962
3963 return err;
3964 }
3965
3966 static int selinux_socket_unix_may_send(struct socket *sock,
3967 struct socket *other)
3968 {
3969 struct inode_security_struct *isec;
3970 struct inode_security_struct *other_isec;
3971 struct avc_audit_data ad;
3972 int err;
3973
3974 isec = SOCK_INODE(sock)->i_security;
3975 other_isec = SOCK_INODE(other)->i_security;
3976
3977 AVC_AUDIT_DATA_INIT(&ad, NET);
3978 ad.u.net.sk = other->sk;
3979
3980 err = avc_has_perm(isec->sid, other_isec->sid,
3981 isec->sclass, SOCKET__SENDTO, &ad);
3982 if (err)
3983 return err;
3984
3985 return 0;
3986 }
3987
3988 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3989 u32 peer_sid,
3990 struct avc_audit_data *ad)
3991 {
3992 int err;
3993 u32 if_sid;
3994 u32 node_sid;
3995
3996 err = sel_netif_sid(ifindex, &if_sid);
3997 if (err)
3998 return err;
3999 err = avc_has_perm(peer_sid, if_sid,
4000 SECCLASS_NETIF, NETIF__INGRESS, ad);
4001 if (err)
4002 return err;
4003
4004 err = sel_netnode_sid(addrp, family, &node_sid);
4005 if (err)
4006 return err;
4007 return avc_has_perm(peer_sid, node_sid,
4008 SECCLASS_NODE, NODE__RECVFROM, ad);
4009 }
4010
4011 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
4012 struct sk_buff *skb,
4013 struct avc_audit_data *ad,
4014 u16 family,
4015 char *addrp)
4016 {
4017 int err;
4018 struct sk_security_struct *sksec = sk->sk_security;
4019 u16 sk_class;
4020 u32 netif_perm, node_perm, recv_perm;
4021 u32 port_sid, node_sid, if_sid, sk_sid;
4022
4023 sk_sid = sksec->sid;
4024 sk_class = sksec->sclass;
4025
4026 switch (sk_class) {
4027 case SECCLASS_UDP_SOCKET:
4028 netif_perm = NETIF__UDP_RECV;
4029 node_perm = NODE__UDP_RECV;
4030 recv_perm = UDP_SOCKET__RECV_MSG;
4031 break;
4032 case SECCLASS_TCP_SOCKET:
4033 netif_perm = NETIF__TCP_RECV;
4034 node_perm = NODE__TCP_RECV;
4035 recv_perm = TCP_SOCKET__RECV_MSG;
4036 break;
4037 case SECCLASS_DCCP_SOCKET:
4038 netif_perm = NETIF__DCCP_RECV;
4039 node_perm = NODE__DCCP_RECV;
4040 recv_perm = DCCP_SOCKET__RECV_MSG;
4041 break;
4042 default:
4043 netif_perm = NETIF__RAWIP_RECV;
4044 node_perm = NODE__RAWIP_RECV;
4045 recv_perm = 0;
4046 break;
4047 }
4048
4049 err = sel_netif_sid(skb->iif, &if_sid);
4050 if (err)
4051 return err;
4052 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4053 if (err)
4054 return err;
4055
4056 err = sel_netnode_sid(addrp, family, &node_sid);
4057 if (err)
4058 return err;
4059 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4060 if (err)
4061 return err;
4062
4063 if (!recv_perm)
4064 return 0;
4065 err = sel_netport_sid(sk->sk_protocol,
4066 ntohs(ad->u.net.sport), &port_sid);
4067 if (unlikely(err)) {
4068 printk(KERN_WARNING
4069 "SELinux: failure in"
4070 " selinux_sock_rcv_skb_iptables_compat(),"
4071 " network port label not found\n");
4072 return err;
4073 }
4074 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4075 }
4076
4077 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4078 u16 family)
4079 {
4080 int err;
4081 struct sk_security_struct *sksec = sk->sk_security;
4082 u32 peer_sid;
4083 u32 sk_sid = sksec->sid;
4084 struct avc_audit_data ad;
4085 char *addrp;
4086
4087 AVC_AUDIT_DATA_INIT(&ad, NET);
4088 ad.u.net.netif = skb->iif;
4089 ad.u.net.family = family;
4090 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4091 if (err)
4092 return err;
4093
4094 if (selinux_compat_net)
4095 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, &ad,
4096 family, addrp);
4097 else
4098 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4099 PACKET__RECV, &ad);
4100 if (err)
4101 return err;
4102
4103 if (selinux_policycap_netpeer) {
4104 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4105 if (err)
4106 return err;
4107 err = avc_has_perm(sk_sid, peer_sid,
4108 SECCLASS_PEER, PEER__RECV, &ad);
4109 if (err)
4110 selinux_netlbl_err(skb, err, 0);
4111 } else {
4112 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4113 if (err)
4114 return err;
4115 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4116 }
4117
4118 return err;
4119 }
4120
4121 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4122 {
4123 int err;
4124 struct sk_security_struct *sksec = sk->sk_security;
4125 u16 family = sk->sk_family;
4126 u32 sk_sid = sksec->sid;
4127 struct avc_audit_data ad;
4128 char *addrp;
4129 u8 secmark_active;
4130 u8 peerlbl_active;
4131
4132 if (family != PF_INET && family != PF_INET6)
4133 return 0;
4134
4135 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4136 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4137 family = PF_INET;
4138
4139 /* If any sort of compatibility mode is enabled then handoff processing
4140 * to the selinux_sock_rcv_skb_compat() function to deal with the
4141 * special handling. We do this in an attempt to keep this function
4142 * as fast and as clean as possible. */
4143 if (selinux_compat_net || !selinux_policycap_netpeer)
4144 return selinux_sock_rcv_skb_compat(sk, skb, family);
4145
4146 secmark_active = selinux_secmark_enabled();
4147 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4148 if (!secmark_active && !peerlbl_active)
4149 return 0;
4150
4151 AVC_AUDIT_DATA_INIT(&ad, NET);
4152 ad.u.net.netif = skb->iif;
4153 ad.u.net.family = family;
4154 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4155 if (err)
4156 return err;
4157
4158 if (peerlbl_active) {
4159 u32 peer_sid;
4160
4161 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4162 if (err)
4163 return err;
4164 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4165 peer_sid, &ad);
4166 if (err) {
4167 selinux_netlbl_err(skb, err, 0);
4168 return err;
4169 }
4170 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4171 PEER__RECV, &ad);
4172 if (err)
4173 selinux_netlbl_err(skb, err, 0);
4174 }
4175
4176 if (secmark_active) {
4177 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4178 PACKET__RECV, &ad);
4179 if (err)
4180 return err;
4181 }
4182
4183 return err;
4184 }
4185
4186 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4187 int __user *optlen, unsigned len)
4188 {
4189 int err = 0;
4190 char *scontext;
4191 u32 scontext_len;
4192 struct sk_security_struct *ssec;
4193 struct inode_security_struct *isec;
4194 u32 peer_sid = SECSID_NULL;
4195
4196 isec = SOCK_INODE(sock)->i_security;
4197
4198 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4199 isec->sclass == SECCLASS_TCP_SOCKET) {
4200 ssec = sock->sk->sk_security;
4201 peer_sid = ssec->peer_sid;
4202 }
4203 if (peer_sid == SECSID_NULL) {
4204 err = -ENOPROTOOPT;
4205 goto out;
4206 }
4207
4208 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4209
4210 if (err)
4211 goto out;
4212
4213 if (scontext_len > len) {
4214 err = -ERANGE;
4215 goto out_len;
4216 }
4217
4218 if (copy_to_user(optval, scontext, scontext_len))
4219 err = -EFAULT;
4220
4221 out_len:
4222 if (put_user(scontext_len, optlen))
4223 err = -EFAULT;
4224
4225 kfree(scontext);
4226 out:
4227 return err;
4228 }
4229
4230 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4231 {
4232 u32 peer_secid = SECSID_NULL;
4233 u16 family;
4234
4235 if (skb && skb->protocol == htons(ETH_P_IP))
4236 family = PF_INET;
4237 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4238 family = PF_INET6;
4239 else if (sock)
4240 family = sock->sk->sk_family;
4241 else
4242 goto out;
4243
4244 if (sock && family == PF_UNIX)
4245 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4246 else if (skb)
4247 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4248
4249 out:
4250 *secid = peer_secid;
4251 if (peer_secid == SECSID_NULL)
4252 return -EINVAL;
4253 return 0;
4254 }
4255
4256 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4257 {
4258 return sk_alloc_security(sk, family, priority);
4259 }
4260
4261 static void selinux_sk_free_security(struct sock *sk)
4262 {
4263 sk_free_security(sk);
4264 }
4265
4266 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4267 {
4268 struct sk_security_struct *ssec = sk->sk_security;
4269 struct sk_security_struct *newssec = newsk->sk_security;
4270
4271 newssec->sid = ssec->sid;
4272 newssec->peer_sid = ssec->peer_sid;
4273 newssec->sclass = ssec->sclass;
4274
4275 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4276 }
4277
4278 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4279 {
4280 if (!sk)
4281 *secid = SECINITSID_ANY_SOCKET;
4282 else {
4283 struct sk_security_struct *sksec = sk->sk_security;
4284
4285 *secid = sksec->sid;
4286 }
4287 }
4288
4289 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4290 {
4291 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4292 struct sk_security_struct *sksec = sk->sk_security;
4293
4294 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4295 sk->sk_family == PF_UNIX)
4296 isec->sid = sksec->sid;
4297 sksec->sclass = isec->sclass;
4298 }
4299
4300 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4301 struct request_sock *req)
4302 {
4303 struct sk_security_struct *sksec = sk->sk_security;
4304 int err;
4305 u16 family = sk->sk_family;
4306 u32 newsid;
4307 u32 peersid;
4308
4309 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4310 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4311 family = PF_INET;
4312
4313 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4314 if (err)
4315 return err;
4316 if (peersid == SECSID_NULL) {
4317 req->secid = sksec->sid;
4318 req->peer_secid = SECSID_NULL;
4319 return 0;
4320 }
4321
4322 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4323 if (err)
4324 return err;
4325
4326 req->secid = newsid;
4327 req->peer_secid = peersid;
4328 return 0;
4329 }
4330
4331 static void selinux_inet_csk_clone(struct sock *newsk,
4332 const struct request_sock *req)
4333 {
4334 struct sk_security_struct *newsksec = newsk->sk_security;
4335
4336 newsksec->sid = req->secid;
4337 newsksec->peer_sid = req->peer_secid;
4338 /* NOTE: Ideally, we should also get the isec->sid for the
4339 new socket in sync, but we don't have the isec available yet.
4340 So we will wait until sock_graft to do it, by which
4341 time it will have been created and available. */
4342
4343 /* We don't need to take any sort of lock here as we are the only
4344 * thread with access to newsksec */
4345 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4346 }
4347
4348 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4349 {
4350 u16 family = sk->sk_family;
4351 struct sk_security_struct *sksec = sk->sk_security;
4352
4353 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4354 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4355 family = PF_INET;
4356
4357 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4358
4359 selinux_netlbl_inet_conn_established(sk, family);
4360 }
4361
4362 static void selinux_req_classify_flow(const struct request_sock *req,
4363 struct flowi *fl)
4364 {
4365 fl->secid = req->secid;
4366 }
4367
4368 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4369 {
4370 int err = 0;
4371 u32 perm;
4372 struct nlmsghdr *nlh;
4373 struct socket *sock = sk->sk_socket;
4374 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4375
4376 if (skb->len < NLMSG_SPACE(0)) {
4377 err = -EINVAL;
4378 goto out;
4379 }
4380 nlh = nlmsg_hdr(skb);
4381
4382 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4383 if (err) {
4384 if (err == -EINVAL) {
4385 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4386 "SELinux: unrecognized netlink message"
4387 " type=%hu for sclass=%hu\n",
4388 nlh->nlmsg_type, isec->sclass);
4389 if (!selinux_enforcing || security_get_allow_unknown())
4390 err = 0;
4391 }
4392
4393 /* Ignore */
4394 if (err == -ENOENT)
4395 err = 0;
4396 goto out;
4397 }
4398
4399 err = socket_has_perm(current, sock, perm);
4400 out:
4401 return err;
4402 }
4403
4404 #ifdef CONFIG_NETFILTER
4405
4406 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4407 u16 family)
4408 {
4409 int err;
4410 char *addrp;
4411 u32 peer_sid;
4412 struct avc_audit_data ad;
4413 u8 secmark_active;
4414 u8 netlbl_active;
4415 u8 peerlbl_active;
4416
4417 if (!selinux_policycap_netpeer)
4418 return NF_ACCEPT;
4419
4420 secmark_active = selinux_secmark_enabled();
4421 netlbl_active = netlbl_enabled();
4422 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4423 if (!secmark_active && !peerlbl_active)
4424 return NF_ACCEPT;
4425
4426 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4427 return NF_DROP;
4428
4429 AVC_AUDIT_DATA_INIT(&ad, NET);
4430 ad.u.net.netif = ifindex;
4431 ad.u.net.family = family;
4432 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4433 return NF_DROP;
4434
4435 if (peerlbl_active) {
4436 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4437 peer_sid, &ad);
4438 if (err) {
4439 selinux_netlbl_err(skb, err, 1);
4440 return NF_DROP;
4441 }
4442 }
4443
4444 if (secmark_active)
4445 if (avc_has_perm(peer_sid, skb->secmark,
4446 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4447 return NF_DROP;
4448
4449 if (netlbl_active)
4450 /* we do this in the FORWARD path and not the POST_ROUTING
4451 * path because we want to make sure we apply the necessary
4452 * labeling before IPsec is applied so we can leverage AH
4453 * protection */
4454 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4455 return NF_DROP;
4456
4457 return NF_ACCEPT;
4458 }
4459
4460 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4461 struct sk_buff *skb,
4462 const struct net_device *in,
4463 const struct net_device *out,
4464 int (*okfn)(struct sk_buff *))
4465 {
4466 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4467 }
4468
4469 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4470 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4471 struct sk_buff *skb,
4472 const struct net_device *in,
4473 const struct net_device *out,
4474 int (*okfn)(struct sk_buff *))
4475 {
4476 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4477 }
4478 #endif /* IPV6 */
4479
4480 static unsigned int selinux_ip_output(struct sk_buff *skb,
4481 u16 family)
4482 {
4483 u32 sid;
4484
4485 if (!netlbl_enabled())
4486 return NF_ACCEPT;
4487
4488 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4489 * because we want to make sure we apply the necessary labeling
4490 * before IPsec is applied so we can leverage AH protection */
4491 if (skb->sk) {
4492 struct sk_security_struct *sksec = skb->sk->sk_security;
4493 sid = sksec->sid;
4494 } else
4495 sid = SECINITSID_KERNEL;
4496 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4497 return NF_DROP;
4498
4499 return NF_ACCEPT;
4500 }
4501
4502 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4503 struct sk_buff *skb,
4504 const struct net_device *in,
4505 const struct net_device *out,
4506 int (*okfn)(struct sk_buff *))
4507 {
4508 return selinux_ip_output(skb, PF_INET);
4509 }
4510
4511 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4512 int ifindex,
4513 struct avc_audit_data *ad,
4514 u16 family, char *addrp)
4515 {
4516 int err;
4517 struct sk_security_struct *sksec = sk->sk_security;
4518 u16 sk_class;
4519 u32 netif_perm, node_perm, send_perm;
4520 u32 port_sid, node_sid, if_sid, sk_sid;
4521
4522 sk_sid = sksec->sid;
4523 sk_class = sksec->sclass;
4524
4525 switch (sk_class) {
4526 case SECCLASS_UDP_SOCKET:
4527 netif_perm = NETIF__UDP_SEND;
4528 node_perm = NODE__UDP_SEND;
4529 send_perm = UDP_SOCKET__SEND_MSG;
4530 break;
4531 case SECCLASS_TCP_SOCKET:
4532 netif_perm = NETIF__TCP_SEND;
4533 node_perm = NODE__TCP_SEND;
4534 send_perm = TCP_SOCKET__SEND_MSG;
4535 break;
4536 case SECCLASS_DCCP_SOCKET:
4537 netif_perm = NETIF__DCCP_SEND;
4538 node_perm = NODE__DCCP_SEND;
4539 send_perm = DCCP_SOCKET__SEND_MSG;
4540 break;
4541 default:
4542 netif_perm = NETIF__RAWIP_SEND;
4543 node_perm = NODE__RAWIP_SEND;
4544 send_perm = 0;
4545 break;
4546 }
4547
4548 err = sel_netif_sid(ifindex, &if_sid);
4549 if (err)
4550 return err;
4551 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4552 return err;
4553
4554 err = sel_netnode_sid(addrp, family, &node_sid);
4555 if (err)
4556 return err;
4557 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4558 if (err)
4559 return err;
4560
4561 if (send_perm != 0)
4562 return 0;
4563
4564 err = sel_netport_sid(sk->sk_protocol,
4565 ntohs(ad->u.net.dport), &port_sid);
4566 if (unlikely(err)) {
4567 printk(KERN_WARNING
4568 "SELinux: failure in"
4569 " selinux_ip_postroute_iptables_compat(),"
4570 " network port label not found\n");
4571 return err;
4572 }
4573 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4574 }
4575
4576 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4577 int ifindex,
4578 u16 family)
4579 {
4580 struct sock *sk = skb->sk;
4581 struct sk_security_struct *sksec;
4582 struct avc_audit_data ad;
4583 char *addrp;
4584 u8 proto;
4585
4586 if (sk == NULL)
4587 return NF_ACCEPT;
4588 sksec = sk->sk_security;
4589
4590 AVC_AUDIT_DATA_INIT(&ad, NET);
4591 ad.u.net.netif = ifindex;
4592 ad.u.net.family = family;
4593 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4594 return NF_DROP;
4595
4596 if (selinux_compat_net) {
4597 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4598 &ad, family, addrp))
4599 return NF_DROP;
4600 } else {
4601 if (avc_has_perm(sksec->sid, skb->secmark,
4602 SECCLASS_PACKET, PACKET__SEND, &ad))
4603 return NF_DROP;
4604 }
4605
4606 if (selinux_policycap_netpeer)
4607 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4608 return NF_DROP;
4609
4610 return NF_ACCEPT;
4611 }
4612
4613 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4614 u16 family)
4615 {
4616 u32 secmark_perm;
4617 u32 peer_sid;
4618 struct sock *sk;
4619 struct avc_audit_data ad;
4620 char *addrp;
4621 u8 secmark_active;
4622 u8 peerlbl_active;
4623
4624 /* If any sort of compatibility mode is enabled then handoff processing
4625 * to the selinux_ip_postroute_compat() function to deal with the
4626 * special handling. We do this in an attempt to keep this function
4627 * as fast and as clean as possible. */
4628 if (selinux_compat_net || !selinux_policycap_netpeer)
4629 return selinux_ip_postroute_compat(skb, ifindex, family);
4630
4631 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4632 * packet transformation so allow the packet to pass without any checks
4633 * since we'll have another chance to perform access control checks
4634 * when the packet is on it's final way out.
4635 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4636 * is NULL, in this case go ahead and apply access control. */
4637 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4638 return NF_ACCEPT;
4639
4640 secmark_active = selinux_secmark_enabled();
4641 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4642 if (!secmark_active && !peerlbl_active)
4643 return NF_ACCEPT;
4644
4645 /* if the packet is being forwarded then get the peer label from the
4646 * packet itself; otherwise check to see if it is from a local
4647 * application or the kernel, if from an application get the peer label
4648 * from the sending socket, otherwise use the kernel's sid */
4649 sk = skb->sk;
4650 if (sk == NULL) {
4651 switch (family) {
4652 case PF_INET:
4653 if (IPCB(skb)->flags & IPSKB_FORWARDED)
4654 secmark_perm = PACKET__FORWARD_OUT;
4655 else
4656 secmark_perm = PACKET__SEND;
4657 break;
4658 case PF_INET6:
4659 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4660 secmark_perm = PACKET__FORWARD_OUT;
4661 else
4662 secmark_perm = PACKET__SEND;
4663 break;
4664 default:
4665 return NF_DROP;
4666 }
4667 if (secmark_perm == PACKET__FORWARD_OUT) {
4668 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4669 return NF_DROP;
4670 } else
4671 peer_sid = SECINITSID_KERNEL;
4672 } else {
4673 struct sk_security_struct *sksec = sk->sk_security;
4674 peer_sid = sksec->sid;
4675 secmark_perm = PACKET__SEND;
4676 }
4677
4678 AVC_AUDIT_DATA_INIT(&ad, NET);
4679 ad.u.net.netif = ifindex;
4680 ad.u.net.family = family;
4681 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4682 return NF_DROP;
4683
4684 if (secmark_active)
4685 if (avc_has_perm(peer_sid, skb->secmark,
4686 SECCLASS_PACKET, secmark_perm, &ad))
4687 return NF_DROP;
4688
4689 if (peerlbl_active) {
4690 u32 if_sid;
4691 u32 node_sid;
4692
4693 if (sel_netif_sid(ifindex, &if_sid))
4694 return NF_DROP;
4695 if (avc_has_perm(peer_sid, if_sid,
4696 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4697 return NF_DROP;
4698
4699 if (sel_netnode_sid(addrp, family, &node_sid))
4700 return NF_DROP;
4701 if (avc_has_perm(peer_sid, node_sid,
4702 SECCLASS_NODE, NODE__SENDTO, &ad))
4703 return NF_DROP;
4704 }
4705
4706 return NF_ACCEPT;
4707 }
4708
4709 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4710 struct sk_buff *skb,
4711 const struct net_device *in,
4712 const struct net_device *out,
4713 int (*okfn)(struct sk_buff *))
4714 {
4715 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4716 }
4717
4718 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4719 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4720 struct sk_buff *skb,
4721 const struct net_device *in,
4722 const struct net_device *out,
4723 int (*okfn)(struct sk_buff *))
4724 {
4725 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4726 }
4727 #endif /* IPV6 */
4728
4729 #endif /* CONFIG_NETFILTER */
4730
4731 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4732 {
4733 int err;
4734
4735 err = secondary_ops->netlink_send(sk, skb);
4736 if (err)
4737 return err;
4738
4739 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4740 err = selinux_nlmsg_perm(sk, skb);
4741
4742 return err;
4743 }
4744
4745 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4746 {
4747 int err;
4748 struct avc_audit_data ad;
4749
4750 err = secondary_ops->netlink_recv(skb, capability);
4751 if (err)
4752 return err;
4753
4754 AVC_AUDIT_DATA_INIT(&ad, CAP);
4755 ad.u.cap = capability;
4756
4757 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4758 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4759 }
4760
4761 static int ipc_alloc_security(struct task_struct *task,
4762 struct kern_ipc_perm *perm,
4763 u16 sclass)
4764 {
4765 struct task_security_struct *tsec = task->security;
4766 struct ipc_security_struct *isec;
4767
4768 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4769 if (!isec)
4770 return -ENOMEM;
4771
4772 isec->sclass = sclass;
4773 isec->sid = tsec->sid;
4774 perm->security = isec;
4775
4776 return 0;
4777 }
4778
4779 static void ipc_free_security(struct kern_ipc_perm *perm)
4780 {
4781 struct ipc_security_struct *isec = perm->security;
4782 perm->security = NULL;
4783 kfree(isec);
4784 }
4785
4786 static int msg_msg_alloc_security(struct msg_msg *msg)
4787 {
4788 struct msg_security_struct *msec;
4789
4790 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4791 if (!msec)
4792 return -ENOMEM;
4793
4794 msec->sid = SECINITSID_UNLABELED;
4795 msg->security = msec;
4796
4797 return 0;
4798 }
4799
4800 static void msg_msg_free_security(struct msg_msg *msg)
4801 {
4802 struct msg_security_struct *msec = msg->security;
4803
4804 msg->security = NULL;
4805 kfree(msec);
4806 }
4807
4808 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4809 u32 perms)
4810 {
4811 struct task_security_struct *tsec;
4812 struct ipc_security_struct *isec;
4813 struct avc_audit_data ad;
4814
4815 tsec = current->security;
4816 isec = ipc_perms->security;
4817
4818 AVC_AUDIT_DATA_INIT(&ad, IPC);
4819 ad.u.ipc_id = ipc_perms->key;
4820
4821 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4822 }
4823
4824 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4825 {
4826 return msg_msg_alloc_security(msg);
4827 }
4828
4829 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4830 {
4831 msg_msg_free_security(msg);
4832 }
4833
4834 /* message queue security operations */
4835 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4836 {
4837 struct task_security_struct *tsec;
4838 struct ipc_security_struct *isec;
4839 struct avc_audit_data ad;
4840 int rc;
4841
4842 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4843 if (rc)
4844 return rc;
4845
4846 tsec = current->security;
4847 isec = msq->q_perm.security;
4848
4849 AVC_AUDIT_DATA_INIT(&ad, IPC);
4850 ad.u.ipc_id = msq->q_perm.key;
4851
4852 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4853 MSGQ__CREATE, &ad);
4854 if (rc) {
4855 ipc_free_security(&msq->q_perm);
4856 return rc;
4857 }
4858 return 0;
4859 }
4860
4861 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4862 {
4863 ipc_free_security(&msq->q_perm);
4864 }
4865
4866 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4867 {
4868 struct task_security_struct *tsec;
4869 struct ipc_security_struct *isec;
4870 struct avc_audit_data ad;
4871
4872 tsec = current->security;
4873 isec = msq->q_perm.security;
4874
4875 AVC_AUDIT_DATA_INIT(&ad, IPC);
4876 ad.u.ipc_id = msq->q_perm.key;
4877
4878 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4879 MSGQ__ASSOCIATE, &ad);
4880 }
4881
4882 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4883 {
4884 int err;
4885 int perms;
4886
4887 switch (cmd) {
4888 case IPC_INFO:
4889 case MSG_INFO:
4890 /* No specific object, just general system-wide information. */
4891 return task_has_system(current, SYSTEM__IPC_INFO);
4892 case IPC_STAT:
4893 case MSG_STAT:
4894 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4895 break;
4896 case IPC_SET:
4897 perms = MSGQ__SETATTR;
4898 break;
4899 case IPC_RMID:
4900 perms = MSGQ__DESTROY;
4901 break;
4902 default:
4903 return 0;
4904 }
4905
4906 err = ipc_has_perm(&msq->q_perm, perms);
4907 return err;
4908 }
4909
4910 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4911 {
4912 struct task_security_struct *tsec;
4913 struct ipc_security_struct *isec;
4914 struct msg_security_struct *msec;
4915 struct avc_audit_data ad;
4916 int rc;
4917
4918 tsec = current->security;
4919 isec = msq->q_perm.security;
4920 msec = msg->security;
4921
4922 /*
4923 * First time through, need to assign label to the message
4924 */
4925 if (msec->sid == SECINITSID_UNLABELED) {
4926 /*
4927 * Compute new sid based on current process and
4928 * message queue this message will be stored in
4929 */
4930 rc = security_transition_sid(tsec->sid,
4931 isec->sid,
4932 SECCLASS_MSG,
4933 &msec->sid);
4934 if (rc)
4935 return rc;
4936 }
4937
4938 AVC_AUDIT_DATA_INIT(&ad, IPC);
4939 ad.u.ipc_id = msq->q_perm.key;
4940
4941 /* Can this process write to the queue? */
4942 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4943 MSGQ__WRITE, &ad);
4944 if (!rc)
4945 /* Can this process send the message */
4946 rc = avc_has_perm(tsec->sid, msec->sid,
4947 SECCLASS_MSG, MSG__SEND, &ad);
4948 if (!rc)
4949 /* Can the message be put in the queue? */
4950 rc = avc_has_perm(msec->sid, isec->sid,
4951 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4952
4953 return rc;
4954 }
4955
4956 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4957 struct task_struct *target,
4958 long type, int mode)
4959 {
4960 struct task_security_struct *tsec;
4961 struct ipc_security_struct *isec;
4962 struct msg_security_struct *msec;
4963 struct avc_audit_data ad;
4964 int rc;
4965
4966 tsec = target->security;
4967 isec = msq->q_perm.security;
4968 msec = msg->security;
4969
4970 AVC_AUDIT_DATA_INIT(&ad, IPC);
4971 ad.u.ipc_id = msq->q_perm.key;
4972
4973 rc = avc_has_perm(tsec->sid, isec->sid,
4974 SECCLASS_MSGQ, MSGQ__READ, &ad);
4975 if (!rc)
4976 rc = avc_has_perm(tsec->sid, msec->sid,
4977 SECCLASS_MSG, MSG__RECEIVE, &ad);
4978 return rc;
4979 }
4980
4981 /* Shared Memory security operations */
4982 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4983 {
4984 struct task_security_struct *tsec;
4985 struct ipc_security_struct *isec;
4986 struct avc_audit_data ad;
4987 int rc;
4988
4989 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4990 if (rc)
4991 return rc;
4992
4993 tsec = current->security;
4994 isec = shp->shm_perm.security;
4995
4996 AVC_AUDIT_DATA_INIT(&ad, IPC);
4997 ad.u.ipc_id = shp->shm_perm.key;
4998
4999 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
5000 SHM__CREATE, &ad);
5001 if (rc) {
5002 ipc_free_security(&shp->shm_perm);
5003 return rc;
5004 }
5005 return 0;
5006 }
5007
5008 static void selinux_shm_free_security(struct shmid_kernel *shp)
5009 {
5010 ipc_free_security(&shp->shm_perm);
5011 }
5012
5013 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5014 {
5015 struct task_security_struct *tsec;
5016 struct ipc_security_struct *isec;
5017 struct avc_audit_data ad;
5018
5019 tsec = current->security;
5020 isec = shp->shm_perm.security;
5021
5022 AVC_AUDIT_DATA_INIT(&ad, IPC);
5023 ad.u.ipc_id = shp->shm_perm.key;
5024
5025 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
5026 SHM__ASSOCIATE, &ad);
5027 }
5028
5029 /* Note, at this point, shp is locked down */
5030 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5031 {
5032 int perms;
5033 int err;
5034
5035 switch (cmd) {
5036 case IPC_INFO:
5037 case SHM_INFO:
5038 /* No specific object, just general system-wide information. */
5039 return task_has_system(current, SYSTEM__IPC_INFO);
5040 case IPC_STAT:
5041 case SHM_STAT:
5042 perms = SHM__GETATTR | SHM__ASSOCIATE;
5043 break;
5044 case IPC_SET:
5045 perms = SHM__SETATTR;
5046 break;
5047 case SHM_LOCK:
5048 case SHM_UNLOCK:
5049 perms = SHM__LOCK;
5050 break;
5051 case IPC_RMID:
5052 perms = SHM__DESTROY;
5053 break;
5054 default:
5055 return 0;
5056 }
5057
5058 err = ipc_has_perm(&shp->shm_perm, perms);
5059 return err;
5060 }
5061
5062 static int selinux_shm_shmat(struct shmid_kernel *shp,
5063 char __user *shmaddr, int shmflg)
5064 {
5065 u32 perms;
5066 int rc;
5067
5068 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
5069 if (rc)
5070 return rc;
5071
5072 if (shmflg & SHM_RDONLY)
5073 perms = SHM__READ;
5074 else
5075 perms = SHM__READ | SHM__WRITE;
5076
5077 return ipc_has_perm(&shp->shm_perm, perms);
5078 }
5079
5080 /* Semaphore security operations */
5081 static int selinux_sem_alloc_security(struct sem_array *sma)
5082 {
5083 struct task_security_struct *tsec;
5084 struct ipc_security_struct *isec;
5085 struct avc_audit_data ad;
5086 int rc;
5087
5088 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5089 if (rc)
5090 return rc;
5091
5092 tsec = current->security;
5093 isec = sma->sem_perm.security;
5094
5095 AVC_AUDIT_DATA_INIT(&ad, IPC);
5096 ad.u.ipc_id = sma->sem_perm.key;
5097
5098 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
5099 SEM__CREATE, &ad);
5100 if (rc) {
5101 ipc_free_security(&sma->sem_perm);
5102 return rc;
5103 }
5104 return 0;
5105 }
5106
5107 static void selinux_sem_free_security(struct sem_array *sma)
5108 {
5109 ipc_free_security(&sma->sem_perm);
5110 }
5111
5112 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5113 {
5114 struct task_security_struct *tsec;
5115 struct ipc_security_struct *isec;
5116 struct avc_audit_data ad;
5117
5118 tsec = current->security;
5119 isec = sma->sem_perm.security;
5120
5121 AVC_AUDIT_DATA_INIT(&ad, IPC);
5122 ad.u.ipc_id = sma->sem_perm.key;
5123
5124 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
5125 SEM__ASSOCIATE, &ad);
5126 }
5127
5128 /* Note, at this point, sma is locked down */
5129 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5130 {
5131 int err;
5132 u32 perms;
5133
5134 switch (cmd) {
5135 case IPC_INFO:
5136 case SEM_INFO:
5137 /* No specific object, just general system-wide information. */
5138 return task_has_system(current, SYSTEM__IPC_INFO);
5139 case GETPID:
5140 case GETNCNT:
5141 case GETZCNT:
5142 perms = SEM__GETATTR;
5143 break;
5144 case GETVAL:
5145 case GETALL:
5146 perms = SEM__READ;
5147 break;
5148 case SETVAL:
5149 case SETALL:
5150 perms = SEM__WRITE;
5151 break;
5152 case IPC_RMID:
5153 perms = SEM__DESTROY;
5154 break;
5155 case IPC_SET:
5156 perms = SEM__SETATTR;
5157 break;
5158 case IPC_STAT:
5159 case SEM_STAT:
5160 perms = SEM__GETATTR | SEM__ASSOCIATE;
5161 break;
5162 default:
5163 return 0;
5164 }
5165
5166 err = ipc_has_perm(&sma->sem_perm, perms);
5167 return err;
5168 }
5169
5170 static int selinux_sem_semop(struct sem_array *sma,
5171 struct sembuf *sops, unsigned nsops, int alter)
5172 {
5173 u32 perms;
5174
5175 if (alter)
5176 perms = SEM__READ | SEM__WRITE;
5177 else
5178 perms = SEM__READ;
5179
5180 return ipc_has_perm(&sma->sem_perm, perms);
5181 }
5182
5183 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5184 {
5185 u32 av = 0;
5186
5187 av = 0;
5188 if (flag & S_IRUGO)
5189 av |= IPC__UNIX_READ;
5190 if (flag & S_IWUGO)
5191 av |= IPC__UNIX_WRITE;
5192
5193 if (av == 0)
5194 return 0;
5195
5196 return ipc_has_perm(ipcp, av);
5197 }
5198
5199 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5200 {
5201 struct ipc_security_struct *isec = ipcp->security;
5202 *secid = isec->sid;
5203 }
5204
5205 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5206 {
5207 if (inode)
5208 inode_doinit_with_dentry(inode, dentry);
5209 }
5210
5211 static int selinux_getprocattr(struct task_struct *p,
5212 char *name, char **value)
5213 {
5214 struct task_security_struct *tsec;
5215 u32 sid;
5216 int error;
5217 unsigned len;
5218
5219 if (current != p) {
5220 error = task_has_perm(current, p, PROCESS__GETATTR);
5221 if (error)
5222 return error;
5223 }
5224
5225 tsec = p->security;
5226
5227 if (!strcmp(name, "current"))
5228 sid = tsec->sid;
5229 else if (!strcmp(name, "prev"))
5230 sid = tsec->osid;
5231 else if (!strcmp(name, "exec"))
5232 sid = tsec->exec_sid;
5233 else if (!strcmp(name, "fscreate"))
5234 sid = tsec->create_sid;
5235 else if (!strcmp(name, "keycreate"))
5236 sid = tsec->keycreate_sid;
5237 else if (!strcmp(name, "sockcreate"))
5238 sid = tsec->sockcreate_sid;
5239 else
5240 return -EINVAL;
5241
5242 if (!sid)
5243 return 0;
5244
5245 error = security_sid_to_context(sid, value, &len);
5246 if (error)
5247 return error;
5248 return len;
5249 }
5250
5251 static int selinux_setprocattr(struct task_struct *p,
5252 char *name, void *value, size_t size)
5253 {
5254 struct task_security_struct *tsec;
5255 struct task_struct *tracer;
5256 u32 sid = 0;
5257 int error;
5258 char *str = value;
5259
5260 if (current != p) {
5261 /* SELinux only allows a process to change its own
5262 security attributes. */
5263 return -EACCES;
5264 }
5265
5266 /*
5267 * Basic control over ability to set these attributes at all.
5268 * current == p, but we'll pass them separately in case the
5269 * above restriction is ever removed.
5270 */
5271 if (!strcmp(name, "exec"))
5272 error = task_has_perm(current, p, PROCESS__SETEXEC);
5273 else if (!strcmp(name, "fscreate"))
5274 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5275 else if (!strcmp(name, "keycreate"))
5276 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5277 else if (!strcmp(name, "sockcreate"))
5278 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5279 else if (!strcmp(name, "current"))
5280 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5281 else
5282 error = -EINVAL;
5283 if (error)
5284 return error;
5285
5286 /* Obtain a SID for the context, if one was specified. */
5287 if (size && str[1] && str[1] != '\n') {
5288 if (str[size-1] == '\n') {
5289 str[size-1] = 0;
5290 size--;
5291 }
5292 error = security_context_to_sid(value, size, &sid);
5293 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5294 if (!capable(CAP_MAC_ADMIN))
5295 return error;
5296 error = security_context_to_sid_force(value, size,
5297 &sid);
5298 }
5299 if (error)
5300 return error;
5301 }
5302
5303 /* Permission checking based on the specified context is
5304 performed during the actual operation (execve,
5305 open/mkdir/...), when we know the full context of the
5306 operation. See selinux_bprm_set_security for the execve
5307 checks and may_create for the file creation checks. The
5308 operation will then fail if the context is not permitted. */
5309 tsec = p->security;
5310 if (!strcmp(name, "exec"))
5311 tsec->exec_sid = sid;
5312 else if (!strcmp(name, "fscreate"))
5313 tsec->create_sid = sid;
5314 else if (!strcmp(name, "keycreate")) {
5315 error = may_create_key(sid, p);
5316 if (error)
5317 return error;
5318 tsec->keycreate_sid = sid;
5319 } else if (!strcmp(name, "sockcreate"))
5320 tsec->sockcreate_sid = sid;
5321 else if (!strcmp(name, "current")) {
5322 struct av_decision avd;
5323
5324 if (sid == 0)
5325 return -EINVAL;
5326 /*
5327 * SELinux allows to change context in the following case only.
5328 * - Single threaded processes.
5329 * - Multi threaded processes intend to change its context into
5330 * more restricted domain (defined by TYPEBOUNDS statement).
5331 */
5332 if (atomic_read(&p->mm->mm_users) != 1) {
5333 struct task_struct *g, *t;
5334 struct mm_struct *mm = p->mm;
5335 read_lock(&tasklist_lock);
5336 do_each_thread(g, t) {
5337 if (t->mm == mm && t != p) {
5338 read_unlock(&tasklist_lock);
5339 error = security_bounded_transition(tsec->sid, sid);
5340 if (!error)
5341 goto boundary_ok;
5342
5343 return error;
5344 }
5345 } while_each_thread(g, t);
5346 read_unlock(&tasklist_lock);
5347 }
5348 boundary_ok:
5349
5350 /* Check permissions for the transition. */
5351 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5352 PROCESS__DYNTRANSITION, NULL);
5353 if (error)
5354 return error;
5355
5356 /* Check for ptracing, and update the task SID if ok.
5357 Otherwise, leave SID unchanged and fail. */
5358 task_lock(p);
5359 rcu_read_lock();
5360 tracer = tracehook_tracer_task(p);
5361 if (tracer != NULL) {
5362 struct task_security_struct *ptsec = tracer->security;
5363 u32 ptsid = ptsec->sid;
5364 rcu_read_unlock();
5365 error = avc_has_perm_noaudit(ptsid, sid,
5366 SECCLASS_PROCESS,
5367 PROCESS__PTRACE, 0, &avd);
5368 if (!error)
5369 tsec->sid = sid;
5370 task_unlock(p);
5371 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5372 PROCESS__PTRACE, &avd, error, NULL);
5373 if (error)
5374 return error;
5375 } else {
5376 rcu_read_unlock();
5377 tsec->sid = sid;
5378 task_unlock(p);
5379 }
5380 } else
5381 return -EINVAL;
5382
5383 return size;
5384 }
5385
5386 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5387 {
5388 return security_sid_to_context(secid, secdata, seclen);
5389 }
5390
5391 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5392 {
5393 return security_context_to_sid(secdata, seclen, secid);
5394 }
5395
5396 static void selinux_release_secctx(char *secdata, u32 seclen)
5397 {
5398 kfree(secdata);
5399 }
5400
5401 #ifdef CONFIG_KEYS
5402
5403 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5404 unsigned long flags)
5405 {
5406 struct task_security_struct *tsec = tsk->security;
5407 struct key_security_struct *ksec;
5408
5409 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5410 if (!ksec)
5411 return -ENOMEM;
5412
5413 if (tsec->keycreate_sid)
5414 ksec->sid = tsec->keycreate_sid;
5415 else
5416 ksec->sid = tsec->sid;
5417 k->security = ksec;
5418
5419 return 0;
5420 }
5421
5422 static void selinux_key_free(struct key *k)
5423 {
5424 struct key_security_struct *ksec = k->security;
5425
5426 k->security = NULL;
5427 kfree(ksec);
5428 }
5429
5430 static int selinux_key_permission(key_ref_t key_ref,
5431 struct task_struct *ctx,
5432 key_perm_t perm)
5433 {
5434 struct key *key;
5435 struct task_security_struct *tsec;
5436 struct key_security_struct *ksec;
5437
5438 key = key_ref_to_ptr(key_ref);
5439
5440 tsec = ctx->security;
5441 ksec = key->security;
5442
5443 /* if no specific permissions are requested, we skip the
5444 permission check. No serious, additional covert channels
5445 appear to be created. */
5446 if (perm == 0)
5447 return 0;
5448
5449 return avc_has_perm(tsec->sid, ksec->sid,
5450 SECCLASS_KEY, perm, NULL);
5451 }
5452
5453 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5454 {
5455 struct key_security_struct *ksec = key->security;
5456 char *context = NULL;
5457 unsigned len;
5458 int rc;
5459
5460 rc = security_sid_to_context(ksec->sid, &context, &len);
5461 if (!rc)
5462 rc = len;
5463 *_buffer = context;
5464 return rc;
5465 }
5466
5467 #endif
5468
5469 static struct security_operations selinux_ops = {
5470 .name = "selinux",
5471
5472 .ptrace_may_access = selinux_ptrace_may_access,
5473 .ptrace_traceme = selinux_ptrace_traceme,
5474 .capget = selinux_capget,
5475 .capset_check = selinux_capset_check,
5476 .capset_set = selinux_capset_set,
5477 .sysctl = selinux_sysctl,
5478 .capable = selinux_capable,
5479 .quotactl = selinux_quotactl,
5480 .quota_on = selinux_quota_on,
5481 .syslog = selinux_syslog,
5482 .vm_enough_memory = selinux_vm_enough_memory,
5483
5484 .netlink_send = selinux_netlink_send,
5485 .netlink_recv = selinux_netlink_recv,
5486
5487 .bprm_alloc_security = selinux_bprm_alloc_security,
5488 .bprm_free_security = selinux_bprm_free_security,
5489 .bprm_apply_creds = selinux_bprm_apply_creds,
5490 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5491 .bprm_set_security = selinux_bprm_set_security,
5492 .bprm_check_security = selinux_bprm_check_security,
5493 .bprm_secureexec = selinux_bprm_secureexec,
5494
5495 .sb_alloc_security = selinux_sb_alloc_security,
5496 .sb_free_security = selinux_sb_free_security,
5497 .sb_copy_data = selinux_sb_copy_data,
5498 .sb_kern_mount = selinux_sb_kern_mount,
5499 .sb_show_options = selinux_sb_show_options,
5500 .sb_statfs = selinux_sb_statfs,
5501 .sb_mount = selinux_mount,
5502 .sb_umount = selinux_umount,
5503 .sb_set_mnt_opts = selinux_set_mnt_opts,
5504 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5505 .sb_parse_opts_str = selinux_parse_opts_str,
5506
5507
5508 .inode_alloc_security = selinux_inode_alloc_security,
5509 .inode_free_security = selinux_inode_free_security,
5510 .inode_init_security = selinux_inode_init_security,
5511 .inode_create = selinux_inode_create,
5512 .inode_link = selinux_inode_link,
5513 .inode_unlink = selinux_inode_unlink,
5514 .inode_symlink = selinux_inode_symlink,
5515 .inode_mkdir = selinux_inode_mkdir,
5516 .inode_rmdir = selinux_inode_rmdir,
5517 .inode_mknod = selinux_inode_mknod,
5518 .inode_rename = selinux_inode_rename,
5519 .inode_readlink = selinux_inode_readlink,
5520 .inode_follow_link = selinux_inode_follow_link,
5521 .inode_permission = selinux_inode_permission,
5522 .inode_setattr = selinux_inode_setattr,
5523 .inode_getattr = selinux_inode_getattr,
5524 .inode_setxattr = selinux_inode_setxattr,
5525 .inode_post_setxattr = selinux_inode_post_setxattr,
5526 .inode_getxattr = selinux_inode_getxattr,
5527 .inode_listxattr = selinux_inode_listxattr,
5528 .inode_removexattr = selinux_inode_removexattr,
5529 .inode_getsecurity = selinux_inode_getsecurity,
5530 .inode_setsecurity = selinux_inode_setsecurity,
5531 .inode_listsecurity = selinux_inode_listsecurity,
5532 .inode_need_killpriv = selinux_inode_need_killpriv,
5533 .inode_killpriv = selinux_inode_killpriv,
5534 .inode_getsecid = selinux_inode_getsecid,
5535
5536 .file_permission = selinux_file_permission,
5537 .file_alloc_security = selinux_file_alloc_security,
5538 .file_free_security = selinux_file_free_security,
5539 .file_ioctl = selinux_file_ioctl,
5540 .file_mmap = selinux_file_mmap,
5541 .file_mprotect = selinux_file_mprotect,
5542 .file_lock = selinux_file_lock,
5543 .file_fcntl = selinux_file_fcntl,
5544 .file_set_fowner = selinux_file_set_fowner,
5545 .file_send_sigiotask = selinux_file_send_sigiotask,
5546 .file_receive = selinux_file_receive,
5547
5548 .dentry_open = selinux_dentry_open,
5549
5550 .task_create = selinux_task_create,
5551 .task_alloc_security = selinux_task_alloc_security,
5552 .task_free_security = selinux_task_free_security,
5553 .task_setuid = selinux_task_setuid,
5554 .task_post_setuid = selinux_task_post_setuid,
5555 .task_setgid = selinux_task_setgid,
5556 .task_setpgid = selinux_task_setpgid,
5557 .task_getpgid = selinux_task_getpgid,
5558 .task_getsid = selinux_task_getsid,
5559 .task_getsecid = selinux_task_getsecid,
5560 .task_setgroups = selinux_task_setgroups,
5561 .task_setnice = selinux_task_setnice,
5562 .task_setioprio = selinux_task_setioprio,
5563 .task_getioprio = selinux_task_getioprio,
5564 .task_setrlimit = selinux_task_setrlimit,
5565 .task_setscheduler = selinux_task_setscheduler,
5566 .task_getscheduler = selinux_task_getscheduler,
5567 .task_movememory = selinux_task_movememory,
5568 .task_kill = selinux_task_kill,
5569 .task_wait = selinux_task_wait,
5570 .task_prctl = selinux_task_prctl,
5571 .task_reparent_to_init = selinux_task_reparent_to_init,
5572 .task_to_inode = selinux_task_to_inode,
5573
5574 .ipc_permission = selinux_ipc_permission,
5575 .ipc_getsecid = selinux_ipc_getsecid,
5576
5577 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5578 .msg_msg_free_security = selinux_msg_msg_free_security,
5579
5580 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5581 .msg_queue_free_security = selinux_msg_queue_free_security,
5582 .msg_queue_associate = selinux_msg_queue_associate,
5583 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5584 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5585 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5586
5587 .shm_alloc_security = selinux_shm_alloc_security,
5588 .shm_free_security = selinux_shm_free_security,
5589 .shm_associate = selinux_shm_associate,
5590 .shm_shmctl = selinux_shm_shmctl,
5591 .shm_shmat = selinux_shm_shmat,
5592
5593 .sem_alloc_security = selinux_sem_alloc_security,
5594 .sem_free_security = selinux_sem_free_security,
5595 .sem_associate = selinux_sem_associate,
5596 .sem_semctl = selinux_sem_semctl,
5597 .sem_semop = selinux_sem_semop,
5598
5599 .d_instantiate = selinux_d_instantiate,
5600
5601 .getprocattr = selinux_getprocattr,
5602 .setprocattr = selinux_setprocattr,
5603
5604 .secid_to_secctx = selinux_secid_to_secctx,
5605 .secctx_to_secid = selinux_secctx_to_secid,
5606 .release_secctx = selinux_release_secctx,
5607
5608 .unix_stream_connect = selinux_socket_unix_stream_connect,
5609 .unix_may_send = selinux_socket_unix_may_send,
5610
5611 .socket_create = selinux_socket_create,
5612 .socket_post_create = selinux_socket_post_create,
5613 .socket_bind = selinux_socket_bind,
5614 .socket_connect = selinux_socket_connect,
5615 .socket_listen = selinux_socket_listen,
5616 .socket_accept = selinux_socket_accept,
5617 .socket_sendmsg = selinux_socket_sendmsg,
5618 .socket_recvmsg = selinux_socket_recvmsg,
5619 .socket_getsockname = selinux_socket_getsockname,
5620 .socket_getpeername = selinux_socket_getpeername,
5621 .socket_getsockopt = selinux_socket_getsockopt,
5622 .socket_setsockopt = selinux_socket_setsockopt,
5623 .socket_shutdown = selinux_socket_shutdown,
5624 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5625 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5626 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5627 .sk_alloc_security = selinux_sk_alloc_security,
5628 .sk_free_security = selinux_sk_free_security,
5629 .sk_clone_security = selinux_sk_clone_security,
5630 .sk_getsecid = selinux_sk_getsecid,
5631 .sock_graft = selinux_sock_graft,
5632 .inet_conn_request = selinux_inet_conn_request,
5633 .inet_csk_clone = selinux_inet_csk_clone,
5634 .inet_conn_established = selinux_inet_conn_established,
5635 .req_classify_flow = selinux_req_classify_flow,
5636
5637 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5638 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5639 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5640 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5641 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5642 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5643 .xfrm_state_free_security = selinux_xfrm_state_free,
5644 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5645 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5646 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5647 .xfrm_decode_session = selinux_xfrm_decode_session,
5648 #endif
5649
5650 #ifdef CONFIG_KEYS
5651 .key_alloc = selinux_key_alloc,
5652 .key_free = selinux_key_free,
5653 .key_permission = selinux_key_permission,
5654 .key_getsecurity = selinux_key_getsecurity,
5655 #endif
5656
5657 #ifdef CONFIG_AUDIT
5658 .audit_rule_init = selinux_audit_rule_init,
5659 .audit_rule_known = selinux_audit_rule_known,
5660 .audit_rule_match = selinux_audit_rule_match,
5661 .audit_rule_free = selinux_audit_rule_free,
5662 #endif
5663 };
5664
5665 static __init int selinux_init(void)
5666 {
5667 struct task_security_struct *tsec;
5668
5669 if (!security_module_enable(&selinux_ops)) {
5670 selinux_enabled = 0;
5671 return 0;
5672 }
5673
5674 if (!selinux_enabled) {
5675 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5676 return 0;
5677 }
5678
5679 printk(KERN_INFO "SELinux: Initializing.\n");
5680
5681 /* Set the security state for the initial task. */
5682 if (task_alloc_security(current))
5683 panic("SELinux: Failed to initialize initial task.\n");
5684 tsec = current->security;
5685 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5686
5687 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5688 sizeof(struct inode_security_struct),
5689 0, SLAB_PANIC, NULL);
5690 avc_init();
5691
5692 secondary_ops = security_ops;
5693 if (!secondary_ops)
5694 panic("SELinux: No initial security operations\n");
5695 if (register_security(&selinux_ops))
5696 panic("SELinux: Unable to register with kernel.\n");
5697
5698 if (selinux_enforcing)
5699 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5700 else
5701 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5702
5703 return 0;
5704 }
5705
5706 void selinux_complete_init(void)
5707 {
5708 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5709
5710 /* Set up any superblocks initialized prior to the policy load. */
5711 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5712 spin_lock(&sb_lock);
5713 spin_lock(&sb_security_lock);
5714 next_sb:
5715 if (!list_empty(&superblock_security_head)) {
5716 struct superblock_security_struct *sbsec =
5717 list_entry(superblock_security_head.next,
5718 struct superblock_security_struct,
5719 list);
5720 struct super_block *sb = sbsec->sb;
5721 sb->s_count++;
5722 spin_unlock(&sb_security_lock);
5723 spin_unlock(&sb_lock);
5724 down_read(&sb->s_umount);
5725 if (sb->s_root)
5726 superblock_doinit(sb, NULL);
5727 drop_super(sb);
5728 spin_lock(&sb_lock);
5729 spin_lock(&sb_security_lock);
5730 list_del_init(&sbsec->list);
5731 goto next_sb;
5732 }
5733 spin_unlock(&sb_security_lock);
5734 spin_unlock(&sb_lock);
5735 }
5736
5737 /* SELinux requires early initialization in order to label
5738 all processes and objects when they are created. */
5739 security_initcall(selinux_init);
5740
5741 #if defined(CONFIG_NETFILTER)
5742
5743 static struct nf_hook_ops selinux_ipv4_ops[] = {
5744 {
5745 .hook = selinux_ipv4_postroute,
5746 .owner = THIS_MODULE,
5747 .pf = PF_INET,
5748 .hooknum = NF_INET_POST_ROUTING,
5749 .priority = NF_IP_PRI_SELINUX_LAST,
5750 },
5751 {
5752 .hook = selinux_ipv4_forward,
5753 .owner = THIS_MODULE,
5754 .pf = PF_INET,
5755 .hooknum = NF_INET_FORWARD,
5756 .priority = NF_IP_PRI_SELINUX_FIRST,
5757 },
5758 {
5759 .hook = selinux_ipv4_output,
5760 .owner = THIS_MODULE,
5761 .pf = PF_INET,
5762 .hooknum = NF_INET_LOCAL_OUT,
5763 .priority = NF_IP_PRI_SELINUX_FIRST,
5764 }
5765 };
5766
5767 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5768
5769 static struct nf_hook_ops selinux_ipv6_ops[] = {
5770 {
5771 .hook = selinux_ipv6_postroute,
5772 .owner = THIS_MODULE,
5773 .pf = PF_INET6,
5774 .hooknum = NF_INET_POST_ROUTING,
5775 .priority = NF_IP6_PRI_SELINUX_LAST,
5776 },
5777 {
5778 .hook = selinux_ipv6_forward,
5779 .owner = THIS_MODULE,
5780 .pf = PF_INET6,
5781 .hooknum = NF_INET_FORWARD,
5782 .priority = NF_IP6_PRI_SELINUX_FIRST,
5783 }
5784 };
5785
5786 #endif /* IPV6 */
5787
5788 static int __init selinux_nf_ip_init(void)
5789 {
5790 int err = 0;
5791
5792 if (!selinux_enabled)
5793 goto out;
5794
5795 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5796
5797 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5798 if (err)
5799 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5800
5801 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5802 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5803 if (err)
5804 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5805 #endif /* IPV6 */
5806
5807 out:
5808 return err;
5809 }
5810
5811 __initcall(selinux_nf_ip_init);
5812
5813 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5814 static void selinux_nf_ip_exit(void)
5815 {
5816 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5817
5818 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5819 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5820 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5821 #endif /* IPV6 */
5822 }
5823 #endif
5824
5825 #else /* CONFIG_NETFILTER */
5826
5827 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5828 #define selinux_nf_ip_exit()
5829 #endif
5830
5831 #endif /* CONFIG_NETFILTER */
5832
5833 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5834 static int selinux_disabled;
5835
5836 int selinux_disable(void)
5837 {
5838 extern void exit_sel_fs(void);
5839
5840 if (ss_initialized) {
5841 /* Not permitted after initial policy load. */
5842 return -EINVAL;
5843 }
5844
5845 if (selinux_disabled) {
5846 /* Only do this once. */
5847 return -EINVAL;
5848 }
5849
5850 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5851
5852 selinux_disabled = 1;
5853 selinux_enabled = 0;
5854
5855 /* Reset security_ops to the secondary module, dummy or capability. */
5856 security_ops = secondary_ops;
5857
5858 /* Unregister netfilter hooks. */
5859 selinux_nf_ip_exit();
5860
5861 /* Unregister selinuxfs. */
5862 exit_sel_fs();
5863
5864 return 0;
5865 }
5866 #endif
Support for the Chinese Samsung S3C2440 based development boards