?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
SELinux: allow fstype unknown to policy to use xattrs if present
[linux-2.6/mini2440.git] / security / selinux / hooks.c
blob85f74f665765e33006cd0996fab42be5a457acdb
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
16 * Paul Moore <paul.moore@hp.com>
17 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
18 * Yuichi Nakamura <ynakam@hitachisoft.jp>
19 *
20 * This program is free software; you can redistribute it and/or modify
21 * it under the terms of the GNU General Public License version 2,
22 * as published by the Free Software Foundation.
23 */
24
25 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/ptrace.h>
28 #include <linux/errno.h>
29 #include <linux/sched.h>
30 #include <linux/security.h>
31 #include <linux/xattr.h>
32 #include <linux/capability.h>
33 #include <linux/unistd.h>
34 #include <linux/mm.h>
35 #include <linux/mman.h>
36 #include <linux/slab.h>
37 #include <linux/pagemap.h>
38 #include <linux/swap.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/fdtable.h>
43 #include <linux/namei.h>
44 #include <linux/mount.h>
45 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
49 #include <net/icmp.h>
50 #include <net/ip.h> /* for local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <net/net_namespace.h>
53 #include <net/netlabel.h>
54 #include <linux/uaccess.h>
55 #include <asm/ioctls.h>
56 #include <asm/atomic.h>
57 #include <linux/bitops.h>
58 #include <linux/interrupt.h>
59 #include <linux/netdevice.h> /* for network interface checks */
60 #include <linux/netlink.h>
61 #include <linux/tcp.h>
62 #include <linux/udp.h>
63 #include <linux/dccp.h>
64 #include <linux/quota.h>
65 #include <linux/un.h> /* for Unix socket types */
66 #include <net/af_unix.h> /* for Unix socket types */
67 #include <linux/parser.h>
68 #include <linux/nfs_mount.h>
69 #include <net/ipv6.h>
70 #include <linux/hugetlb.h>
71 #include <linux/personality.h>
72 #include <linux/sysctl.h>
73 #include <linux/audit.h>
74 #include <linux/string.h>
75 #include <linux/selinux.h>
76 #include <linux/mutex.h>
77
78 #include "avc.h"
79 #include "objsec.h"
80 #include "netif.h"
81 #include "netnode.h"
82 #include "netport.h"
83 #include "xfrm.h"
84 #include "netlabel.h"
85 #include "audit.h"
86
87 #define XATTR_SELINUX_SUFFIX "selinux"
88 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
89
90 #define NUM_SEL_MNT_OPTS 4
91
92 extern unsigned int policydb_loaded_version;
93 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
94 extern int selinux_compat_net;
95 extern struct security_operations *security_ops;
96
97 /* SECMARK reference count */
98 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
99
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
102
103 static int __init enforcing_setup(char *str)
104 {
105 unsigned long enforcing;
106 if (!strict_strtoul(str, 0, &enforcing))
107 selinux_enforcing = enforcing ? 1 : 0;
108 return 1;
109 }
110 __setup("enforcing=", enforcing_setup);
111 #endif
112
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116 static int __init selinux_enabled_setup(char *str)
117 {
118 unsigned long enabled;
119 if (!strict_strtoul(str, 0, &enabled))
120 selinux_enabled = enabled ? 1 : 0;
121 return 1;
122 }
123 __setup("selinux=", selinux_enabled_setup);
124 #else
125 int selinux_enabled = 1;
126 #endif
127
128 /* Original (dummy) security module. */
129 static struct security_operations *original_ops;
130
131 /* Minimal support for a secondary security module,
132 just to allow the use of the dummy or capability modules.
133 The owlsm module can alternatively be used as a secondary
134 module as long as CONFIG_OWLSM_FD is not enabled. */
135 static struct security_operations *secondary_ops;
136
137 /* Lists of inode and superblock security structures initialized
138 before the policy was loaded. */
139 static LIST_HEAD(superblock_security_head);
140 static DEFINE_SPINLOCK(sb_security_lock);
141
142 static struct kmem_cache *sel_inode_cache;
143
144 /**
145 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
146 *
147 * Description:
148 * This function checks the SECMARK reference counter to see if any SECMARK
149 * targets are currently configured, if the reference counter is greater than
150 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
151 * enabled, false (0) if SECMARK is disabled.
152 *
153 */
154 static int selinux_secmark_enabled(void)
155 {
156 return (atomic_read(&selinux_secmark_refcount) > 0);
157 }
158
159 /* Allocate and free functions for each kind of security blob. */
160
161 static int task_alloc_security(struct task_struct *task)
162 {
163 struct task_security_struct *tsec;
164
165 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
166 if (!tsec)
167 return -ENOMEM;
168
169 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
170 task->security = tsec;
171
172 return 0;
173 }
174
175 static void task_free_security(struct task_struct *task)
176 {
177 struct task_security_struct *tsec = task->security;
178 task->security = NULL;
179 kfree(tsec);
180 }
181
182 static int inode_alloc_security(struct inode *inode)
183 {
184 struct task_security_struct *tsec = current->security;
185 struct inode_security_struct *isec;
186
187 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
188 if (!isec)
189 return -ENOMEM;
190
191 mutex_init(&isec->lock);
192 INIT_LIST_HEAD(&isec->list);
193 isec->inode = inode;
194 isec->sid = SECINITSID_UNLABELED;
195 isec->sclass = SECCLASS_FILE;
196 isec->task_sid = tsec->sid;
197 inode->i_security = isec;
198
199 return 0;
200 }
201
202 static void inode_free_security(struct inode *inode)
203 {
204 struct inode_security_struct *isec = inode->i_security;
205 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
206
207 spin_lock(&sbsec->isec_lock);
208 if (!list_empty(&isec->list))
209 list_del_init(&isec->list);
210 spin_unlock(&sbsec->isec_lock);
211
212 inode->i_security = NULL;
213 kmem_cache_free(sel_inode_cache, isec);
214 }
215
216 static int file_alloc_security(struct file *file)
217 {
218 struct task_security_struct *tsec = current->security;
219 struct file_security_struct *fsec;
220
221 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
222 if (!fsec)
223 return -ENOMEM;
224
225 fsec->sid = tsec->sid;
226 fsec->fown_sid = tsec->sid;
227 file->f_security = fsec;
228
229 return 0;
230 }
231
232 static void file_free_security(struct file *file)
233 {
234 struct file_security_struct *fsec = file->f_security;
235 file->f_security = NULL;
236 kfree(fsec);
237 }
238
239 static int superblock_alloc_security(struct super_block *sb)
240 {
241 struct superblock_security_struct *sbsec;
242
243 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
244 if (!sbsec)
245 return -ENOMEM;
246
247 mutex_init(&sbsec->lock);
248 INIT_LIST_HEAD(&sbsec->list);
249 INIT_LIST_HEAD(&sbsec->isec_head);
250 spin_lock_init(&sbsec->isec_lock);
251 sbsec->sb = sb;
252 sbsec->sid = SECINITSID_UNLABELED;
253 sbsec->def_sid = SECINITSID_FILE;
254 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
255 sb->s_security = sbsec;
256
257 return 0;
258 }
259
260 static void superblock_free_security(struct super_block *sb)
261 {
262 struct superblock_security_struct *sbsec = sb->s_security;
263
264 spin_lock(&sb_security_lock);
265 if (!list_empty(&sbsec->list))
266 list_del_init(&sbsec->list);
267 spin_unlock(&sb_security_lock);
268
269 sb->s_security = NULL;
270 kfree(sbsec);
271 }
272
273 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
274 {
275 struct sk_security_struct *ssec;
276
277 ssec = kzalloc(sizeof(*ssec), priority);
278 if (!ssec)
279 return -ENOMEM;
280
281 ssec->peer_sid = SECINITSID_UNLABELED;
282 ssec->sid = SECINITSID_UNLABELED;
283 sk->sk_security = ssec;
284
285 selinux_netlbl_sk_security_reset(ssec, family);
286
287 return 0;
288 }
289
290 static void sk_free_security(struct sock *sk)
291 {
292 struct sk_security_struct *ssec = sk->sk_security;
293
294 sk->sk_security = NULL;
295 kfree(ssec);
296 }
297
298 /* The security server must be initialized before
299 any labeling or access decisions can be provided. */
300 extern int ss_initialized;
301
302 /* The file system's label must be initialized prior to use. */
303
304 static char *labeling_behaviors[6] = {
305 "uses xattr",
306 "uses transition SIDs",
307 "uses task SIDs",
308 "uses genfs_contexts",
309 "not configured for labeling",
310 "uses mountpoint labeling",
311 };
312
313 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
314
315 static inline int inode_doinit(struct inode *inode)
316 {
317 return inode_doinit_with_dentry(inode, NULL);
318 }
319
320 enum {
321 Opt_error = -1,
322 Opt_context = 1,
323 Opt_fscontext = 2,
324 Opt_defcontext = 3,
325 Opt_rootcontext = 4,
326 };
327
328 static match_table_t tokens = {
329 {Opt_context, CONTEXT_STR "%s"},
330 {Opt_fscontext, FSCONTEXT_STR "%s"},
331 {Opt_defcontext, DEFCONTEXT_STR "%s"},
332 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
333 {Opt_error, NULL},
334 };
335
336 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
337
338 static int may_context_mount_sb_relabel(u32 sid,
339 struct superblock_security_struct *sbsec,
340 struct task_security_struct *tsec)
341 {
342 int rc;
343
344 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
345 FILESYSTEM__RELABELFROM, NULL);
346 if (rc)
347 return rc;
348
349 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
350 FILESYSTEM__RELABELTO, NULL);
351 return rc;
352 }
353
354 static int may_context_mount_inode_relabel(u32 sid,
355 struct superblock_security_struct *sbsec,
356 struct task_security_struct *tsec)
357 {
358 int rc;
359 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
360 FILESYSTEM__RELABELFROM, NULL);
361 if (rc)
362 return rc;
363
364 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
365 FILESYSTEM__ASSOCIATE, NULL);
366 return rc;
367 }
368
369 static int sb_finish_set_opts(struct super_block *sb)
370 {
371 struct superblock_security_struct *sbsec = sb->s_security;
372 struct dentry *root = sb->s_root;
373 struct inode *root_inode = root->d_inode;
374 int rc = 0;
375
376 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
377 /* Make sure that the xattr handler exists and that no
378 error other than -ENODATA is returned by getxattr on
379 the root directory. -ENODATA is ok, as this may be
380 the first boot of the SELinux kernel before we have
381 assigned xattr values to the filesystem. */
382 if (!root_inode->i_op->getxattr) {
383 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
384 "xattr support\n", sb->s_id, sb->s_type->name);
385 rc = -EOPNOTSUPP;
386 goto out;
387 }
388 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
389 if (rc < 0 && rc != -ENODATA) {
390 if (rc == -EOPNOTSUPP)
391 printk(KERN_WARNING "SELinux: (dev %s, type "
392 "%s) has no security xattr handler\n",
393 sb->s_id, sb->s_type->name);
394 else
395 printk(KERN_WARNING "SELinux: (dev %s, type "
396 "%s) getxattr errno %d\n", sb->s_id,
397 sb->s_type->name, -rc);
398 goto out;
399 }
400 }
401
402 sbsec->initialized = 1;
403
404 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
405 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
406 sb->s_id, sb->s_type->name);
407 else
408 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
409 sb->s_id, sb->s_type->name,
410 labeling_behaviors[sbsec->behavior-1]);
411
412 /* Initialize the root inode. */
413 rc = inode_doinit_with_dentry(root_inode, root);
414
415 /* Initialize any other inodes associated with the superblock, e.g.
416 inodes created prior to initial policy load or inodes created
417 during get_sb by a pseudo filesystem that directly
418 populates itself. */
419 spin_lock(&sbsec->isec_lock);
420 next_inode:
421 if (!list_empty(&sbsec->isec_head)) {
422 struct inode_security_struct *isec =
423 list_entry(sbsec->isec_head.next,
424 struct inode_security_struct, list);
425 struct inode *inode = isec->inode;
426 spin_unlock(&sbsec->isec_lock);
427 inode = igrab(inode);
428 if (inode) {
429 if (!IS_PRIVATE(inode))
430 inode_doinit(inode);
431 iput(inode);
432 }
433 spin_lock(&sbsec->isec_lock);
434 list_del_init(&isec->list);
435 goto next_inode;
436 }
437 spin_unlock(&sbsec->isec_lock);
438 out:
439 return rc;
440 }
441
442 /*
443 * This function should allow an FS to ask what it's mount security
444 * options were so it can use those later for submounts, displaying
445 * mount options, or whatever.
446 */
447 static int selinux_get_mnt_opts(const struct super_block *sb,
448 struct security_mnt_opts *opts)
449 {
450 int rc = 0, i;
451 struct superblock_security_struct *sbsec = sb->s_security;
452 char *context = NULL;
453 u32 len;
454 char tmp;
455
456 security_init_mnt_opts(opts);
457
458 if (!sbsec->initialized)
459 return -EINVAL;
460
461 if (!ss_initialized)
462 return -EINVAL;
463
464 /*
465 * if we ever use sbsec flags for anything other than tracking mount
466 * settings this is going to need a mask
467 */
468 tmp = sbsec->flags;
469 /* count the number of mount options for this sb */
470 for (i = 0; i < 8; i++) {
471 if (tmp & 0x01)
472 opts->num_mnt_opts++;
473 tmp >>= 1;
474 }
475
476 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
477 if (!opts->mnt_opts) {
478 rc = -ENOMEM;
479 goto out_free;
480 }
481
482 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
483 if (!opts->mnt_opts_flags) {
484 rc = -ENOMEM;
485 goto out_free;
486 }
487
488 i = 0;
489 if (sbsec->flags & FSCONTEXT_MNT) {
490 rc = security_sid_to_context(sbsec->sid, &context, &len);
491 if (rc)
492 goto out_free;
493 opts->mnt_opts[i] = context;
494 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
495 }
496 if (sbsec->flags & CONTEXT_MNT) {
497 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
498 if (rc)
499 goto out_free;
500 opts->mnt_opts[i] = context;
501 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
502 }
503 if (sbsec->flags & DEFCONTEXT_MNT) {
504 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
505 if (rc)
506 goto out_free;
507 opts->mnt_opts[i] = context;
508 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
509 }
510 if (sbsec->flags & ROOTCONTEXT_MNT) {
511 struct inode *root = sbsec->sb->s_root->d_inode;
512 struct inode_security_struct *isec = root->i_security;
513
514 rc = security_sid_to_context(isec->sid, &context, &len);
515 if (rc)
516 goto out_free;
517 opts->mnt_opts[i] = context;
518 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
519 }
520
521 BUG_ON(i != opts->num_mnt_opts);
522
523 return 0;
524
525 out_free:
526 security_free_mnt_opts(opts);
527 return rc;
528 }
529
530 static int bad_option(struct superblock_security_struct *sbsec, char flag,
531 u32 old_sid, u32 new_sid)
532 {
533 /* check if the old mount command had the same options */
534 if (sbsec->initialized)
535 if (!(sbsec->flags & flag) ||
536 (old_sid != new_sid))
537 return 1;
538
539 /* check if we were passed the same options twice,
540 * aka someone passed context=a,context=b
541 */
542 if (!sbsec->initialized)
543 if (sbsec->flags & flag)
544 return 1;
545 return 0;
546 }
547
548 /*
549 * Allow filesystems with binary mount data to explicitly set mount point
550 * labeling information.
551 */
552 static int selinux_set_mnt_opts(struct super_block *sb,
553 struct security_mnt_opts *opts)
554 {
555 int rc = 0, i;
556 struct task_security_struct *tsec = current->security;
557 struct superblock_security_struct *sbsec = sb->s_security;
558 const char *name = sb->s_type->name;
559 struct dentry *root = sb->s_root;
560 struct inode *root_inode = root->d_inode;
561 struct inode_security_struct *root_isec = root_inode->i_security;
562 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
563 u32 defcontext_sid = 0;
564 char **mount_options = opts->mnt_opts;
565 int *flags = opts->mnt_opts_flags;
566 int num_opts = opts->num_mnt_opts;
567 bool can_xattr = false;
568
569 mutex_lock(&sbsec->lock);
570
571 if (!ss_initialized) {
572 if (!num_opts) {
573 /* Defer initialization until selinux_complete_init,
574 after the initial policy is loaded and the security
575 server is ready to handle calls. */
576 spin_lock(&sb_security_lock);
577 if (list_empty(&sbsec->list))
578 list_add(&sbsec->list, &superblock_security_head);
579 spin_unlock(&sb_security_lock);
580 goto out;
581 }
582 rc = -EINVAL;
583 printk(KERN_WARNING "SELinux: Unable to set superblock options "
584 "before the security server is initialized\n");
585 goto out;
586 }
587
588 /*
589 * Binary mount data FS will come through this function twice. Once
590 * from an explicit call and once from the generic calls from the vfs.
591 * Since the generic VFS calls will not contain any security mount data
592 * we need to skip the double mount verification.
593 *
594 * This does open a hole in which we will not notice if the first
595 * mount using this sb set explict options and a second mount using
596 * this sb does not set any security options. (The first options
597 * will be used for both mounts)
598 */
599 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
600 && (num_opts == 0))
601 goto out;
602
603 /*
604 * parse the mount options, check if they are valid sids.
605 * also check if someone is trying to mount the same sb more
606 * than once with different security options.
607 */
608 for (i = 0; i < num_opts; i++) {
609 u32 sid;
610 rc = security_context_to_sid(mount_options[i],
611 strlen(mount_options[i]), &sid);
612 if (rc) {
613 printk(KERN_WARNING "SELinux: security_context_to_sid"
614 "(%s) failed for (dev %s, type %s) errno=%d\n",
615 mount_options[i], sb->s_id, name, rc);
616 goto out;
617 }
618 switch (flags[i]) {
619 case FSCONTEXT_MNT:
620 fscontext_sid = sid;
621
622 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
623 fscontext_sid))
624 goto out_double_mount;
625
626 sbsec->flags |= FSCONTEXT_MNT;
627 break;
628 case CONTEXT_MNT:
629 context_sid = sid;
630
631 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
632 context_sid))
633 goto out_double_mount;
634
635 sbsec->flags |= CONTEXT_MNT;
636 break;
637 case ROOTCONTEXT_MNT:
638 rootcontext_sid = sid;
639
640 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
641 rootcontext_sid))
642 goto out_double_mount;
643
644 sbsec->flags |= ROOTCONTEXT_MNT;
645
646 break;
647 case DEFCONTEXT_MNT:
648 defcontext_sid = sid;
649
650 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
651 defcontext_sid))
652 goto out_double_mount;
653
654 sbsec->flags |= DEFCONTEXT_MNT;
655
656 break;
657 default:
658 rc = -EINVAL;
659 goto out;
660 }
661 }
662
663 if (sbsec->initialized) {
664 /* previously mounted with options, but not on this attempt? */
665 if (sbsec->flags && !num_opts)
666 goto out_double_mount;
667 rc = 0;
668 goto out;
669 }
670
671 if (strcmp(name, "proc") == 0)
672 sbsec->proc = 1;
673
674 /*
675 * test if the fs supports xattrs, fs_use might make use of this if the
676 * fs has no definition in policy.
677 */
678 if (root_inode->i_op->getxattr) {
679 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
680 if (rc >= 0 || rc == -ENODATA)
681 can_xattr = true;
682 }
683
684 /* Determine the labeling behavior to use for this filesystem type. */
685 rc = security_fs_use(name, &sbsec->behavior, &sbsec->sid, can_xattr);
686 if (rc) {
687 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
688 __func__, name, rc);
689 goto out;
690 }
691
692 /* sets the context of the superblock for the fs being mounted. */
693 if (fscontext_sid) {
694
695 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
696 if (rc)
697 goto out;
698
699 sbsec->sid = fscontext_sid;
700 }
701
702 /*
703 * Switch to using mount point labeling behavior.
704 * sets the label used on all file below the mountpoint, and will set
705 * the superblock context if not already set.
706 */
707 if (context_sid) {
708 if (!fscontext_sid) {
709 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
710 if (rc)
711 goto out;
712 sbsec->sid = context_sid;
713 } else {
714 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
715 if (rc)
716 goto out;
717 }
718 if (!rootcontext_sid)
719 rootcontext_sid = context_sid;
720
721 sbsec->mntpoint_sid = context_sid;
722 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
723 }
724
725 if (rootcontext_sid) {
726 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
727 if (rc)
728 goto out;
729
730 root_isec->sid = rootcontext_sid;
731 root_isec->initialized = 1;
732 }
733
734 if (defcontext_sid) {
735 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
736 rc = -EINVAL;
737 printk(KERN_WARNING "SELinux: defcontext option is "
738 "invalid for this filesystem type\n");
739 goto out;
740 }
741
742 if (defcontext_sid != sbsec->def_sid) {
743 rc = may_context_mount_inode_relabel(defcontext_sid,
744 sbsec, tsec);
745 if (rc)
746 goto out;
747 }
748
749 sbsec->def_sid = defcontext_sid;
750 }
751
752 rc = sb_finish_set_opts(sb);
753 out:
754 mutex_unlock(&sbsec->lock);
755 return rc;
756 out_double_mount:
757 rc = -EINVAL;
758 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
759 "security settings for (dev %s, type %s)\n", sb->s_id, name);
760 goto out;
761 }
762
763 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
764 struct super_block *newsb)
765 {
766 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
767 struct superblock_security_struct *newsbsec = newsb->s_security;
768
769 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
770 int set_context = (oldsbsec->flags & CONTEXT_MNT);
771 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
772
773 /*
774 * if the parent was able to be mounted it clearly had no special lsm
775 * mount options. thus we can safely put this sb on the list and deal
776 * with it later
777 */
778 if (!ss_initialized) {
779 spin_lock(&sb_security_lock);
780 if (list_empty(&newsbsec->list))
781 list_add(&newsbsec->list, &superblock_security_head);
782 spin_unlock(&sb_security_lock);
783 return;
784 }
785
786 /* how can we clone if the old one wasn't set up?? */
787 BUG_ON(!oldsbsec->initialized);
788
789 /* if fs is reusing a sb, just let its options stand... */
790 if (newsbsec->initialized)
791 return;
792
793 mutex_lock(&newsbsec->lock);
794
795 newsbsec->flags = oldsbsec->flags;
796
797 newsbsec->sid = oldsbsec->sid;
798 newsbsec->def_sid = oldsbsec->def_sid;
799 newsbsec->behavior = oldsbsec->behavior;
800
801 if (set_context) {
802 u32 sid = oldsbsec->mntpoint_sid;
803
804 if (!set_fscontext)
805 newsbsec->sid = sid;
806 if (!set_rootcontext) {
807 struct inode *newinode = newsb->s_root->d_inode;
808 struct inode_security_struct *newisec = newinode->i_security;
809 newisec->sid = sid;
810 }
811 newsbsec->mntpoint_sid = sid;
812 }
813 if (set_rootcontext) {
814 const struct inode *oldinode = oldsb->s_root->d_inode;
815 const struct inode_security_struct *oldisec = oldinode->i_security;
816 struct inode *newinode = newsb->s_root->d_inode;
817 struct inode_security_struct *newisec = newinode->i_security;
818
819 newisec->sid = oldisec->sid;
820 }
821
822 sb_finish_set_opts(newsb);
823 mutex_unlock(&newsbsec->lock);
824 }
825
826 static int selinux_parse_opts_str(char *options,
827 struct security_mnt_opts *opts)
828 {
829 char *p;
830 char *context = NULL, *defcontext = NULL;
831 char *fscontext = NULL, *rootcontext = NULL;
832 int rc, num_mnt_opts = 0;
833
834 opts->num_mnt_opts = 0;
835
836 /* Standard string-based options. */
837 while ((p = strsep(&options, "|")) != NULL) {
838 int token;
839 substring_t args[MAX_OPT_ARGS];
840
841 if (!*p)
842 continue;
843
844 token = match_token(p, tokens, args);
845
846 switch (token) {
847 case Opt_context:
848 if (context || defcontext) {
849 rc = -EINVAL;
850 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
851 goto out_err;
852 }
853 context = match_strdup(&args[0]);
854 if (!context) {
855 rc = -ENOMEM;
856 goto out_err;
857 }
858 break;
859
860 case Opt_fscontext:
861 if (fscontext) {
862 rc = -EINVAL;
863 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
864 goto out_err;
865 }
866 fscontext = match_strdup(&args[0]);
867 if (!fscontext) {
868 rc = -ENOMEM;
869 goto out_err;
870 }
871 break;
872
873 case Opt_rootcontext:
874 if (rootcontext) {
875 rc = -EINVAL;
876 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
877 goto out_err;
878 }
879 rootcontext = match_strdup(&args[0]);
880 if (!rootcontext) {
881 rc = -ENOMEM;
882 goto out_err;
883 }
884 break;
885
886 case Opt_defcontext:
887 if (context || defcontext) {
888 rc = -EINVAL;
889 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
890 goto out_err;
891 }
892 defcontext = match_strdup(&args[0]);
893 if (!defcontext) {
894 rc = -ENOMEM;
895 goto out_err;
896 }
897 break;
898
899 default:
900 rc = -EINVAL;
901 printk(KERN_WARNING "SELinux: unknown mount option\n");
902 goto out_err;
903
904 }
905 }
906
907 rc = -ENOMEM;
908 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
909 if (!opts->mnt_opts)
910 goto out_err;
911
912 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
913 if (!opts->mnt_opts_flags) {
914 kfree(opts->mnt_opts);
915 goto out_err;
916 }
917
918 if (fscontext) {
919 opts->mnt_opts[num_mnt_opts] = fscontext;
920 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
921 }
922 if (context) {
923 opts->mnt_opts[num_mnt_opts] = context;
924 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
925 }
926 if (rootcontext) {
927 opts->mnt_opts[num_mnt_opts] = rootcontext;
928 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
929 }
930 if (defcontext) {
931 opts->mnt_opts[num_mnt_opts] = defcontext;
932 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
933 }
934
935 opts->num_mnt_opts = num_mnt_opts;
936 return 0;
937
938 out_err:
939 kfree(context);
940 kfree(defcontext);
941 kfree(fscontext);
942 kfree(rootcontext);
943 return rc;
944 }
945 /*
946 * string mount options parsing and call set the sbsec
947 */
948 static int superblock_doinit(struct super_block *sb, void *data)
949 {
950 int rc = 0;
951 char *options = data;
952 struct security_mnt_opts opts;
953
954 security_init_mnt_opts(&opts);
955
956 if (!data)
957 goto out;
958
959 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
960
961 rc = selinux_parse_opts_str(options, &opts);
962 if (rc)
963 goto out_err;
964
965 out:
966 rc = selinux_set_mnt_opts(sb, &opts);
967
968 out_err:
969 security_free_mnt_opts(&opts);
970 return rc;
971 }
972
973 static inline u16 inode_mode_to_security_class(umode_t mode)
974 {
975 switch (mode & S_IFMT) {
976 case S_IFSOCK:
977 return SECCLASS_SOCK_FILE;
978 case S_IFLNK:
979 return SECCLASS_LNK_FILE;
980 case S_IFREG:
981 return SECCLASS_FILE;
982 case S_IFBLK:
983 return SECCLASS_BLK_FILE;
984 case S_IFDIR:
985 return SECCLASS_DIR;
986 case S_IFCHR:
987 return SECCLASS_CHR_FILE;
988 case S_IFIFO:
989 return SECCLASS_FIFO_FILE;
990
991 }
992
993 return SECCLASS_FILE;
994 }
995
996 static inline int default_protocol_stream(int protocol)
997 {
998 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
999 }
1000
1001 static inline int default_protocol_dgram(int protocol)
1002 {
1003 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1004 }
1005
1006 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1007 {
1008 switch (family) {
1009 case PF_UNIX:
1010 switch (type) {
1011 case SOCK_STREAM:
1012 case SOCK_SEQPACKET:
1013 return SECCLASS_UNIX_STREAM_SOCKET;
1014 case SOCK_DGRAM:
1015 return SECCLASS_UNIX_DGRAM_SOCKET;
1016 }
1017 break;
1018 case PF_INET:
1019 case PF_INET6:
1020 switch (type) {
1021 case SOCK_STREAM:
1022 if (default_protocol_stream(protocol))
1023 return SECCLASS_TCP_SOCKET;
1024 else
1025 return SECCLASS_RAWIP_SOCKET;
1026 case SOCK_DGRAM:
1027 if (default_protocol_dgram(protocol))
1028 return SECCLASS_UDP_SOCKET;
1029 else
1030 return SECCLASS_RAWIP_SOCKET;
1031 case SOCK_DCCP:
1032 return SECCLASS_DCCP_SOCKET;
1033 default:
1034 return SECCLASS_RAWIP_SOCKET;
1035 }
1036 break;
1037 case PF_NETLINK:
1038 switch (protocol) {
1039 case NETLINK_ROUTE:
1040 return SECCLASS_NETLINK_ROUTE_SOCKET;
1041 case NETLINK_FIREWALL:
1042 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1043 case NETLINK_INET_DIAG:
1044 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1045 case NETLINK_NFLOG:
1046 return SECCLASS_NETLINK_NFLOG_SOCKET;
1047 case NETLINK_XFRM:
1048 return SECCLASS_NETLINK_XFRM_SOCKET;
1049 case NETLINK_SELINUX:
1050 return SECCLASS_NETLINK_SELINUX_SOCKET;
1051 case NETLINK_AUDIT:
1052 return SECCLASS_NETLINK_AUDIT_SOCKET;
1053 case NETLINK_IP6_FW:
1054 return SECCLASS_NETLINK_IP6FW_SOCKET;
1055 case NETLINK_DNRTMSG:
1056 return SECCLASS_NETLINK_DNRT_SOCKET;
1057 case NETLINK_KOBJECT_UEVENT:
1058 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1059 default:
1060 return SECCLASS_NETLINK_SOCKET;
1061 }
1062 case PF_PACKET:
1063 return SECCLASS_PACKET_SOCKET;
1064 case PF_KEY:
1065 return SECCLASS_KEY_SOCKET;
1066 case PF_APPLETALK:
1067 return SECCLASS_APPLETALK_SOCKET;
1068 }
1069
1070 return SECCLASS_SOCKET;
1071 }
1072
1073 #ifdef CONFIG_PROC_FS
1074 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1075 u16 tclass,
1076 u32 *sid)
1077 {
1078 int buflen, rc;
1079 char *buffer, *path, *end;
1080
1081 buffer = (char *)__get_free_page(GFP_KERNEL);
1082 if (!buffer)
1083 return -ENOMEM;
1084
1085 buflen = PAGE_SIZE;
1086 end = buffer+buflen;
1087 *--end = '\0';
1088 buflen--;
1089 path = end-1;
1090 *path = '/';
1091 while (de && de != de->parent) {
1092 buflen -= de->namelen + 1;
1093 if (buflen < 0)
1094 break;
1095 end -= de->namelen;
1096 memcpy(end, de->name, de->namelen);
1097 *--end = '/';
1098 path = end;
1099 de = de->parent;
1100 }
1101 rc = security_genfs_sid("proc", path, tclass, sid);
1102 free_page((unsigned long)buffer);
1103 return rc;
1104 }
1105 #else
1106 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1107 u16 tclass,
1108 u32 *sid)
1109 {
1110 return -EINVAL;
1111 }
1112 #endif
1113
1114 /* The inode's security attributes must be initialized before first use. */
1115 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1116 {
1117 struct superblock_security_struct *sbsec = NULL;
1118 struct inode_security_struct *isec = inode->i_security;
1119 u32 sid;
1120 struct dentry *dentry;
1121 #define INITCONTEXTLEN 255
1122 char *context = NULL;
1123 unsigned len = 0;
1124 int rc = 0;
1125
1126 if (isec->initialized)
1127 goto out;
1128
1129 mutex_lock(&isec->lock);
1130 if (isec->initialized)
1131 goto out_unlock;
1132
1133 sbsec = inode->i_sb->s_security;
1134 if (!sbsec->initialized) {
1135 /* Defer initialization until selinux_complete_init,
1136 after the initial policy is loaded and the security
1137 server is ready to handle calls. */
1138 spin_lock(&sbsec->isec_lock);
1139 if (list_empty(&isec->list))
1140 list_add(&isec->list, &sbsec->isec_head);
1141 spin_unlock(&sbsec->isec_lock);
1142 goto out_unlock;
1143 }
1144
1145 switch (sbsec->behavior) {
1146 case SECURITY_FS_USE_XATTR:
1147 if (!inode->i_op->getxattr) {
1148 isec->sid = sbsec->def_sid;
1149 break;
1150 }
1151
1152 /* Need a dentry, since the xattr API requires one.
1153 Life would be simpler if we could just pass the inode. */
1154 if (opt_dentry) {
1155 /* Called from d_instantiate or d_splice_alias. */
1156 dentry = dget(opt_dentry);
1157 } else {
1158 /* Called from selinux_complete_init, try to find a dentry. */
1159 dentry = d_find_alias(inode);
1160 }
1161 if (!dentry) {
1162 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
1163 "ino=%ld\n", __func__, inode->i_sb->s_id,
1164 inode->i_ino);
1165 goto out_unlock;
1166 }
1167
1168 len = INITCONTEXTLEN;
1169 context = kmalloc(len, GFP_NOFS);
1170 if (!context) {
1171 rc = -ENOMEM;
1172 dput(dentry);
1173 goto out_unlock;
1174 }
1175 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1176 context, len);
1177 if (rc == -ERANGE) {
1178 /* Need a larger buffer. Query for the right size. */
1179 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1180 NULL, 0);
1181 if (rc < 0) {
1182 dput(dentry);
1183 goto out_unlock;
1184 }
1185 kfree(context);
1186 len = rc;
1187 context = kmalloc(len, GFP_NOFS);
1188 if (!context) {
1189 rc = -ENOMEM;
1190 dput(dentry);
1191 goto out_unlock;
1192 }
1193 rc = inode->i_op->getxattr(dentry,
1194 XATTR_NAME_SELINUX,
1195 context, len);
1196 }
1197 dput(dentry);
1198 if (rc < 0) {
1199 if (rc != -ENODATA) {
1200 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1201 "%d for dev=%s ino=%ld\n", __func__,
1202 -rc, inode->i_sb->s_id, inode->i_ino);
1203 kfree(context);
1204 goto out_unlock;
1205 }
1206 /* Map ENODATA to the default file SID */
1207 sid = sbsec->def_sid;
1208 rc = 0;
1209 } else {
1210 rc = security_context_to_sid_default(context, rc, &sid,
1211 sbsec->def_sid,
1212 GFP_NOFS);
1213 if (rc) {
1214 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1215 "returned %d for dev=%s ino=%ld\n",
1216 __func__, context, -rc,
1217 inode->i_sb->s_id, inode->i_ino);
1218 kfree(context);
1219 /* Leave with the unlabeled SID */
1220 rc = 0;
1221 break;
1222 }
1223 }
1224 kfree(context);
1225 isec->sid = sid;
1226 break;
1227 case SECURITY_FS_USE_TASK:
1228 isec->sid = isec->task_sid;
1229 break;
1230 case SECURITY_FS_USE_TRANS:
1231 /* Default to the fs SID. */
1232 isec->sid = sbsec->sid;
1233
1234 /* Try to obtain a transition SID. */
1235 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1236 rc = security_transition_sid(isec->task_sid,
1237 sbsec->sid,
1238 isec->sclass,
1239 &sid);
1240 if (rc)
1241 goto out_unlock;
1242 isec->sid = sid;
1243 break;
1244 case SECURITY_FS_USE_MNTPOINT:
1245 isec->sid = sbsec->mntpoint_sid;
1246 break;
1247 default:
1248 /* Default to the fs superblock SID. */
1249 isec->sid = sbsec->sid;
1250
1251 if (sbsec->proc) {
1252 struct proc_inode *proci = PROC_I(inode);
1253 if (proci->pde) {
1254 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1255 rc = selinux_proc_get_sid(proci->pde,
1256 isec->sclass,
1257 &sid);
1258 if (rc)
1259 goto out_unlock;
1260 isec->sid = sid;
1261 }
1262 }
1263 break;
1264 }
1265
1266 isec->initialized = 1;
1267
1268 out_unlock:
1269 mutex_unlock(&isec->lock);
1270 out:
1271 if (isec->sclass == SECCLASS_FILE)
1272 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1273 return rc;
1274 }
1275
1276 /* Convert a Linux signal to an access vector. */
1277 static inline u32 signal_to_av(int sig)
1278 {
1279 u32 perm = 0;
1280
1281 switch (sig) {
1282 case SIGCHLD:
1283 /* Commonly granted from child to parent. */
1284 perm = PROCESS__SIGCHLD;
1285 break;
1286 case SIGKILL:
1287 /* Cannot be caught or ignored */
1288 perm = PROCESS__SIGKILL;
1289 break;
1290 case SIGSTOP:
1291 /* Cannot be caught or ignored */
1292 perm = PROCESS__SIGSTOP;
1293 break;
1294 default:
1295 /* All other signals. */
1296 perm = PROCESS__SIGNAL;
1297 break;
1298 }
1299
1300 return perm;
1301 }
1302
1303 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1304 fork check, ptrace check, etc. */
1305 static int task_has_perm(struct task_struct *tsk1,
1306 struct task_struct *tsk2,
1307 u32 perms)
1308 {
1309 struct task_security_struct *tsec1, *tsec2;
1310
1311 tsec1 = tsk1->security;
1312 tsec2 = tsk2->security;
1313 return avc_has_perm(tsec1->sid, tsec2->sid,
1314 SECCLASS_PROCESS, perms, NULL);
1315 }
1316
1317 #if CAP_LAST_CAP > 63
1318 #error Fix SELinux to handle capabilities > 63.
1319 #endif
1320
1321 /* Check whether a task is allowed to use a capability. */
1322 static int task_has_capability(struct task_struct *tsk,
1323 int cap)
1324 {
1325 struct task_security_struct *tsec;
1326 struct avc_audit_data ad;
1327 u16 sclass;
1328 u32 av = CAP_TO_MASK(cap);
1329
1330 tsec = tsk->security;
1331
1332 AVC_AUDIT_DATA_INIT(&ad, CAP);
1333 ad.tsk = tsk;
1334 ad.u.cap = cap;
1335
1336 switch (CAP_TO_INDEX(cap)) {
1337 case 0:
1338 sclass = SECCLASS_CAPABILITY;
1339 break;
1340 case 1:
1341 sclass = SECCLASS_CAPABILITY2;
1342 break;
1343 default:
1344 printk(KERN_ERR
1345 "SELinux: out of range capability %d\n", cap);
1346 BUG();
1347 }
1348 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1349 }
1350
1351 /* Check whether a task is allowed to use a system operation. */
1352 static int task_has_system(struct task_struct *tsk,
1353 u32 perms)
1354 {
1355 struct task_security_struct *tsec;
1356
1357 tsec = tsk->security;
1358
1359 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1360 SECCLASS_SYSTEM, perms, NULL);
1361 }
1362
1363 /* Check whether a task has a particular permission to an inode.
1364 The 'adp' parameter is optional and allows other audit
1365 data to be passed (e.g. the dentry). */
1366 static int inode_has_perm(struct task_struct *tsk,
1367 struct inode *inode,
1368 u32 perms,
1369 struct avc_audit_data *adp)
1370 {
1371 struct task_security_struct *tsec;
1372 struct inode_security_struct *isec;
1373 struct avc_audit_data ad;
1374
1375 if (unlikely(IS_PRIVATE(inode)))
1376 return 0;
1377
1378 tsec = tsk->security;
1379 isec = inode->i_security;
1380
1381 if (!adp) {
1382 adp = &ad;
1383 AVC_AUDIT_DATA_INIT(&ad, FS);
1384 ad.u.fs.inode = inode;
1385 }
1386
1387 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1388 }
1389
1390 /* Same as inode_has_perm, but pass explicit audit data containing
1391 the dentry to help the auditing code to more easily generate the
1392 pathname if needed. */
1393 static inline int dentry_has_perm(struct task_struct *tsk,
1394 struct vfsmount *mnt,
1395 struct dentry *dentry,
1396 u32 av)
1397 {
1398 struct inode *inode = dentry->d_inode;
1399 struct avc_audit_data ad;
1400 AVC_AUDIT_DATA_INIT(&ad, FS);
1401 ad.u.fs.path.mnt = mnt;
1402 ad.u.fs.path.dentry = dentry;
1403 return inode_has_perm(tsk, inode, av, &ad);
1404 }
1405
1406 /* Check whether a task can use an open file descriptor to
1407 access an inode in a given way. Check access to the
1408 descriptor itself, and then use dentry_has_perm to
1409 check a particular permission to the file.
1410 Access to the descriptor is implicitly granted if it
1411 has the same SID as the process. If av is zero, then
1412 access to the file is not checked, e.g. for cases
1413 where only the descriptor is affected like seek. */
1414 static int file_has_perm(struct task_struct *tsk,
1415 struct file *file,
1416 u32 av)
1417 {
1418 struct task_security_struct *tsec = tsk->security;
1419 struct file_security_struct *fsec = file->f_security;
1420 struct inode *inode = file->f_path.dentry->d_inode;
1421 struct avc_audit_data ad;
1422 int rc;
1423
1424 AVC_AUDIT_DATA_INIT(&ad, FS);
1425 ad.u.fs.path = file->f_path;
1426
1427 if (tsec->sid != fsec->sid) {
1428 rc = avc_has_perm(tsec->sid, fsec->sid,
1429 SECCLASS_FD,
1430 FD__USE,
1431 &ad);
1432 if (rc)
1433 return rc;
1434 }
1435
1436 /* av is zero if only checking access to the descriptor. */
1437 if (av)
1438 return inode_has_perm(tsk, inode, av, &ad);
1439
1440 return 0;
1441 }
1442
1443 /* Check whether a task can create a file. */
1444 static int may_create(struct inode *dir,
1445 struct dentry *dentry,
1446 u16 tclass)
1447 {
1448 struct task_security_struct *tsec;
1449 struct inode_security_struct *dsec;
1450 struct superblock_security_struct *sbsec;
1451 u32 newsid;
1452 struct avc_audit_data ad;
1453 int rc;
1454
1455 tsec = current->security;
1456 dsec = dir->i_security;
1457 sbsec = dir->i_sb->s_security;
1458
1459 AVC_AUDIT_DATA_INIT(&ad, FS);
1460 ad.u.fs.path.dentry = dentry;
1461
1462 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1463 DIR__ADD_NAME | DIR__SEARCH,
1464 &ad);
1465 if (rc)
1466 return rc;
1467
1468 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1469 newsid = tsec->create_sid;
1470 } else {
1471 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1472 &newsid);
1473 if (rc)
1474 return rc;
1475 }
1476
1477 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1478 if (rc)
1479 return rc;
1480
1481 return avc_has_perm(newsid, sbsec->sid,
1482 SECCLASS_FILESYSTEM,
1483 FILESYSTEM__ASSOCIATE, &ad);
1484 }
1485
1486 /* Check whether a task can create a key. */
1487 static int may_create_key(u32 ksid,
1488 struct task_struct *ctx)
1489 {
1490 struct task_security_struct *tsec;
1491
1492 tsec = ctx->security;
1493
1494 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1495 }
1496
1497 #define MAY_LINK 0
1498 #define MAY_UNLINK 1
1499 #define MAY_RMDIR 2
1500
1501 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1502 static int may_link(struct inode *dir,
1503 struct dentry *dentry,
1504 int kind)
1505
1506 {
1507 struct task_security_struct *tsec;
1508 struct inode_security_struct *dsec, *isec;
1509 struct avc_audit_data ad;
1510 u32 av;
1511 int rc;
1512
1513 tsec = current->security;
1514 dsec = dir->i_security;
1515 isec = dentry->d_inode->i_security;
1516
1517 AVC_AUDIT_DATA_INIT(&ad, FS);
1518 ad.u.fs.path.dentry = dentry;
1519
1520 av = DIR__SEARCH;
1521 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1522 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1523 if (rc)
1524 return rc;
1525
1526 switch (kind) {
1527 case MAY_LINK:
1528 av = FILE__LINK;
1529 break;
1530 case MAY_UNLINK:
1531 av = FILE__UNLINK;
1532 break;
1533 case MAY_RMDIR:
1534 av = DIR__RMDIR;
1535 break;
1536 default:
1537 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1538 __func__, kind);
1539 return 0;
1540 }
1541
1542 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1543 return rc;
1544 }
1545
1546 static inline int may_rename(struct inode *old_dir,
1547 struct dentry *old_dentry,
1548 struct inode *new_dir,
1549 struct dentry *new_dentry)
1550 {
1551 struct task_security_struct *tsec;
1552 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1553 struct avc_audit_data ad;
1554 u32 av;
1555 int old_is_dir, new_is_dir;
1556 int rc;
1557
1558 tsec = current->security;
1559 old_dsec = old_dir->i_security;
1560 old_isec = old_dentry->d_inode->i_security;
1561 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1562 new_dsec = new_dir->i_security;
1563
1564 AVC_AUDIT_DATA_INIT(&ad, FS);
1565
1566 ad.u.fs.path.dentry = old_dentry;
1567 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1568 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1569 if (rc)
1570 return rc;
1571 rc = avc_has_perm(tsec->sid, old_isec->sid,
1572 old_isec->sclass, FILE__RENAME, &ad);
1573 if (rc)
1574 return rc;
1575 if (old_is_dir && new_dir != old_dir) {
1576 rc = avc_has_perm(tsec->sid, old_isec->sid,
1577 old_isec->sclass, DIR__REPARENT, &ad);
1578 if (rc)
1579 return rc;
1580 }
1581
1582 ad.u.fs.path.dentry = new_dentry;
1583 av = DIR__ADD_NAME | DIR__SEARCH;
1584 if (new_dentry->d_inode)
1585 av |= DIR__REMOVE_NAME;
1586 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1587 if (rc)
1588 return rc;
1589 if (new_dentry->d_inode) {
1590 new_isec = new_dentry->d_inode->i_security;
1591 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1592 rc = avc_has_perm(tsec->sid, new_isec->sid,
1593 new_isec->sclass,
1594 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1595 if (rc)
1596 return rc;
1597 }
1598
1599 return 0;
1600 }
1601
1602 /* Check whether a task can perform a filesystem operation. */
1603 static int superblock_has_perm(struct task_struct *tsk,
1604 struct super_block *sb,
1605 u32 perms,
1606 struct avc_audit_data *ad)
1607 {
1608 struct task_security_struct *tsec;
1609 struct superblock_security_struct *sbsec;
1610
1611 tsec = tsk->security;
1612 sbsec = sb->s_security;
1613 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1614 perms, ad);
1615 }
1616
1617 /* Convert a Linux mode and permission mask to an access vector. */
1618 static inline u32 file_mask_to_av(int mode, int mask)
1619 {
1620 u32 av = 0;
1621
1622 if ((mode & S_IFMT) != S_IFDIR) {
1623 if (mask & MAY_EXEC)
1624 av |= FILE__EXECUTE;
1625 if (mask & MAY_READ)
1626 av |= FILE__READ;
1627
1628 if (mask & MAY_APPEND)
1629 av |= FILE__APPEND;
1630 else if (mask & MAY_WRITE)
1631 av |= FILE__WRITE;
1632
1633 } else {
1634 if (mask & MAY_EXEC)
1635 av |= DIR__SEARCH;
1636 if (mask & MAY_WRITE)
1637 av |= DIR__WRITE;
1638 if (mask & MAY_READ)
1639 av |= DIR__READ;
1640 }
1641
1642 return av;
1643 }
1644
1645 /*
1646 * Convert a file mask to an access vector and include the correct open
1647 * open permission.
1648 */
1649 static inline u32 open_file_mask_to_av(int mode, int mask)
1650 {
1651 u32 av = file_mask_to_av(mode, mask);
1652
1653 if (selinux_policycap_openperm) {
1654 /*
1655 * lnk files and socks do not really have an 'open'
1656 */
1657 if (S_ISREG(mode))
1658 av |= FILE__OPEN;
1659 else if (S_ISCHR(mode))
1660 av |= CHR_FILE__OPEN;
1661 else if (S_ISBLK(mode))
1662 av |= BLK_FILE__OPEN;
1663 else if (S_ISFIFO(mode))
1664 av |= FIFO_FILE__OPEN;
1665 else if (S_ISDIR(mode))
1666 av |= DIR__OPEN;
1667 else
1668 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1669 "unknown mode:%x\n", __func__, mode);
1670 }
1671 return av;
1672 }
1673
1674 /* Convert a Linux file to an access vector. */
1675 static inline u32 file_to_av(struct file *file)
1676 {
1677 u32 av = 0;
1678
1679 if (file->f_mode & FMODE_READ)
1680 av |= FILE__READ;
1681 if (file->f_mode & FMODE_WRITE) {
1682 if (file->f_flags & O_APPEND)
1683 av |= FILE__APPEND;
1684 else
1685 av |= FILE__WRITE;
1686 }
1687 if (!av) {
1688 /*
1689 * Special file opened with flags 3 for ioctl-only use.
1690 */
1691 av = FILE__IOCTL;
1692 }
1693
1694 return av;
1695 }
1696
1697 /* Hook functions begin here. */
1698
1699 static int selinux_ptrace(struct task_struct *parent,
1700 struct task_struct *child,
1701 unsigned int mode)
1702 {
1703 int rc;
1704
1705 rc = secondary_ops->ptrace(parent, child, mode);
1706 if (rc)
1707 return rc;
1708
1709 if (mode == PTRACE_MODE_READ) {
1710 struct task_security_struct *tsec = parent->security;
1711 struct task_security_struct *csec = child->security;
1712 return avc_has_perm(tsec->sid, csec->sid,
1713 SECCLASS_FILE, FILE__READ, NULL);
1714 }
1715
1716 return task_has_perm(parent, child, PROCESS__PTRACE);
1717 }
1718
1719 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1720 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1721 {
1722 int error;
1723
1724 error = task_has_perm(current, target, PROCESS__GETCAP);
1725 if (error)
1726 return error;
1727
1728 return secondary_ops->capget(target, effective, inheritable, permitted);
1729 }
1730
1731 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1732 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1733 {
1734 int error;
1735
1736 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1737 if (error)
1738 return error;
1739
1740 return task_has_perm(current, target, PROCESS__SETCAP);
1741 }
1742
1743 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1744 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1745 {
1746 secondary_ops->capset_set(target, effective, inheritable, permitted);
1747 }
1748
1749 static int selinux_capable(struct task_struct *tsk, int cap)
1750 {
1751 int rc;
1752
1753 rc = secondary_ops->capable(tsk, cap);
1754 if (rc)
1755 return rc;
1756
1757 return task_has_capability(tsk, cap);
1758 }
1759
1760 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1761 {
1762 int buflen, rc;
1763 char *buffer, *path, *end;
1764
1765 rc = -ENOMEM;
1766 buffer = (char *)__get_free_page(GFP_KERNEL);
1767 if (!buffer)
1768 goto out;
1769
1770 buflen = PAGE_SIZE;
1771 end = buffer+buflen;
1772 *--end = '\0';
1773 buflen--;
1774 path = end-1;
1775 *path = '/';
1776 while (table) {
1777 const char *name = table->procname;
1778 size_t namelen = strlen(name);
1779 buflen -= namelen + 1;
1780 if (buflen < 0)
1781 goto out_free;
1782 end -= namelen;
1783 memcpy(end, name, namelen);
1784 *--end = '/';
1785 path = end;
1786 table = table->parent;
1787 }
1788 buflen -= 4;
1789 if (buflen < 0)
1790 goto out_free;
1791 end -= 4;
1792 memcpy(end, "/sys", 4);
1793 path = end;
1794 rc = security_genfs_sid("proc", path, tclass, sid);
1795 out_free:
1796 free_page((unsigned long)buffer);
1797 out:
1798 return rc;
1799 }
1800
1801 static int selinux_sysctl(ctl_table *table, int op)
1802 {
1803 int error = 0;
1804 u32 av;
1805 struct task_security_struct *tsec;
1806 u32 tsid;
1807 int rc;
1808
1809 rc = secondary_ops->sysctl(table, op);
1810 if (rc)
1811 return rc;
1812
1813 tsec = current->security;
1814
1815 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1816 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1817 if (rc) {
1818 /* Default to the well-defined sysctl SID. */
1819 tsid = SECINITSID_SYSCTL;
1820 }
1821
1822 /* The op values are "defined" in sysctl.c, thereby creating
1823 * a bad coupling between this module and sysctl.c */
1824 if (op == 001) {
1825 error = avc_has_perm(tsec->sid, tsid,
1826 SECCLASS_DIR, DIR__SEARCH, NULL);
1827 } else {
1828 av = 0;
1829 if (op & 004)
1830 av |= FILE__READ;
1831 if (op & 002)
1832 av |= FILE__WRITE;
1833 if (av)
1834 error = avc_has_perm(tsec->sid, tsid,
1835 SECCLASS_FILE, av, NULL);
1836 }
1837
1838 return error;
1839 }
1840
1841 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1842 {
1843 int rc = 0;
1844
1845 if (!sb)
1846 return 0;
1847
1848 switch (cmds) {
1849 case Q_SYNC:
1850 case Q_QUOTAON:
1851 case Q_QUOTAOFF:
1852 case Q_SETINFO:
1853 case Q_SETQUOTA:
1854 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1855 NULL);
1856 break;
1857 case Q_GETFMT:
1858 case Q_GETINFO:
1859 case Q_GETQUOTA:
1860 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1861 NULL);
1862 break;
1863 default:
1864 rc = 0; /* let the kernel handle invalid cmds */
1865 break;
1866 }
1867 return rc;
1868 }
1869
1870 static int selinux_quota_on(struct dentry *dentry)
1871 {
1872 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1873 }
1874
1875 static int selinux_syslog(int type)
1876 {
1877 int rc;
1878
1879 rc = secondary_ops->syslog(type);
1880 if (rc)
1881 return rc;
1882
1883 switch (type) {
1884 case 3: /* Read last kernel messages */
1885 case 10: /* Return size of the log buffer */
1886 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1887 break;
1888 case 6: /* Disable logging to console */
1889 case 7: /* Enable logging to console */
1890 case 8: /* Set level of messages printed to console */
1891 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1892 break;
1893 case 0: /* Close log */
1894 case 1: /* Open log */
1895 case 2: /* Read from log */
1896 case 4: /* Read/clear last kernel messages */
1897 case 5: /* Clear ring buffer */
1898 default:
1899 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1900 break;
1901 }
1902 return rc;
1903 }
1904
1905 /*
1906 * Check that a process has enough memory to allocate a new virtual
1907 * mapping. 0 means there is enough memory for the allocation to
1908 * succeed and -ENOMEM implies there is not.
1909 *
1910 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1911 * if the capability is granted, but __vm_enough_memory requires 1 if
1912 * the capability is granted.
1913 *
1914 * Do not audit the selinux permission check, as this is applied to all
1915 * processes that allocate mappings.
1916 */
1917 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1918 {
1919 int rc, cap_sys_admin = 0;
1920 struct task_security_struct *tsec = current->security;
1921
1922 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1923 if (rc == 0)
1924 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1925 SECCLASS_CAPABILITY,
1926 CAP_TO_MASK(CAP_SYS_ADMIN),
1927 0,
1928 NULL);
1929
1930 if (rc == 0)
1931 cap_sys_admin = 1;
1932
1933 return __vm_enough_memory(mm, pages, cap_sys_admin);
1934 }
1935
1936 /**
1937 * task_tracer_task - return the task that is tracing the given task
1938 * @task: task to consider
1939 *
1940 * Returns NULL if noone is tracing @task, or the &struct task_struct
1941 * pointer to its tracer.
1942 *
1943 * Must be called under rcu_read_lock().
1944 */
1945 static struct task_struct *task_tracer_task(struct task_struct *task)
1946 {
1947 if (task->ptrace & PT_PTRACED)
1948 return rcu_dereference(task->parent);
1949 return NULL;
1950 }
1951
1952 /* binprm security operations */
1953
1954 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1955 {
1956 struct bprm_security_struct *bsec;
1957
1958 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1959 if (!bsec)
1960 return -ENOMEM;
1961
1962 bsec->sid = SECINITSID_UNLABELED;
1963 bsec->set = 0;
1964
1965 bprm->security = bsec;
1966 return 0;
1967 }
1968
1969 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1970 {
1971 struct task_security_struct *tsec;
1972 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1973 struct inode_security_struct *isec;
1974 struct bprm_security_struct *bsec;
1975 u32 newsid;
1976 struct avc_audit_data ad;
1977 int rc;
1978
1979 rc = secondary_ops->bprm_set_security(bprm);
1980 if (rc)
1981 return rc;
1982
1983 bsec = bprm->security;
1984
1985 if (bsec->set)
1986 return 0;
1987
1988 tsec = current->security;
1989 isec = inode->i_security;
1990
1991 /* Default to the current task SID. */
1992 bsec->sid = tsec->sid;
1993
1994 /* Reset fs, key, and sock SIDs on execve. */
1995 tsec->create_sid = 0;
1996 tsec->keycreate_sid = 0;
1997 tsec->sockcreate_sid = 0;
1998
1999 if (tsec->exec_sid) {
2000 newsid = tsec->exec_sid;
2001 /* Reset exec SID on execve. */
2002 tsec->exec_sid = 0;
2003 } else {
2004 /* Check for a default transition on this program. */
2005 rc = security_transition_sid(tsec->sid, isec->sid,
2006 SECCLASS_PROCESS, &newsid);
2007 if (rc)
2008 return rc;
2009 }
2010
2011 AVC_AUDIT_DATA_INIT(&ad, FS);
2012 ad.u.fs.path = bprm->file->f_path;
2013
2014 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2015 newsid = tsec->sid;
2016
2017 if (tsec->sid == newsid) {
2018 rc = avc_has_perm(tsec->sid, isec->sid,
2019 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2020 if (rc)
2021 return rc;
2022 } else {
2023 /* Check permissions for the transition. */
2024 rc = avc_has_perm(tsec->sid, newsid,
2025 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2026 if (rc)
2027 return rc;
2028
2029 rc = avc_has_perm(newsid, isec->sid,
2030 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2031 if (rc)
2032 return rc;
2033
2034 /* Clear any possibly unsafe personality bits on exec: */
2035 current->personality &= ~PER_CLEAR_ON_SETID;
2036
2037 /* Set the security field to the new SID. */
2038 bsec->sid = newsid;
2039 }
2040
2041 bsec->set = 1;
2042 return 0;
2043 }
2044
2045 static int selinux_bprm_check_security(struct linux_binprm *bprm)
2046 {
2047 return secondary_ops->bprm_check_security(bprm);
2048 }
2049
2050
2051 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2052 {
2053 struct task_security_struct *tsec = current->security;
2054 int atsecure = 0;
2055
2056 if (tsec->osid != tsec->sid) {
2057 /* Enable secure mode for SIDs transitions unless
2058 the noatsecure permission is granted between
2059 the two SIDs, i.e. ahp returns 0. */
2060 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2061 SECCLASS_PROCESS,
2062 PROCESS__NOATSECURE, NULL);
2063 }
2064
2065 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2066 }
2067
2068 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2069 {
2070 kfree(bprm->security);
2071 bprm->security = NULL;
2072 }
2073
2074 extern struct vfsmount *selinuxfs_mount;
2075 extern struct dentry *selinux_null;
2076
2077 /* Derived from fs/exec.c:flush_old_files. */
2078 static inline void flush_unauthorized_files(struct files_struct *files)
2079 {
2080 struct avc_audit_data ad;
2081 struct file *file, *devnull = NULL;
2082 struct tty_struct *tty;
2083 struct fdtable *fdt;
2084 long j = -1;
2085 int drop_tty = 0;
2086
2087 mutex_lock(&tty_mutex);
2088 tty = get_current_tty();
2089 if (tty) {
2090 file_list_lock();
2091 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2092 if (file) {
2093 /* Revalidate access to controlling tty.
2094 Use inode_has_perm on the tty inode directly rather
2095 than using file_has_perm, as this particular open
2096 file may belong to another process and we are only
2097 interested in the inode-based check here. */
2098 struct inode *inode = file->f_path.dentry->d_inode;
2099 if (inode_has_perm(current, inode,
2100 FILE__READ | FILE__WRITE, NULL)) {
2101 drop_tty = 1;
2102 }
2103 }
2104 file_list_unlock();
2105 }
2106 mutex_unlock(&tty_mutex);
2107 /* Reset controlling tty. */
2108 if (drop_tty)
2109 no_tty();
2110
2111 /* Revalidate access to inherited open files. */
2112
2113 AVC_AUDIT_DATA_INIT(&ad, FS);
2114
2115 spin_lock(&files->file_lock);
2116 for (;;) {
2117 unsigned long set, i;
2118 int fd;
2119
2120 j++;
2121 i = j * __NFDBITS;
2122 fdt = files_fdtable(files);
2123 if (i >= fdt->max_fds)
2124 break;
2125 set = fdt->open_fds->fds_bits[j];
2126 if (!set)
2127 continue;
2128 spin_unlock(&files->file_lock);
2129 for ( ; set ; i++, set >>= 1) {
2130 if (set & 1) {
2131 file = fget(i);
2132 if (!file)
2133 continue;
2134 if (file_has_perm(current,
2135 file,
2136 file_to_av(file))) {
2137 sys_close(i);
2138 fd = get_unused_fd();
2139 if (fd != i) {
2140 if (fd >= 0)
2141 put_unused_fd(fd);
2142 fput(file);
2143 continue;
2144 }
2145 if (devnull) {
2146 get_file(devnull);
2147 } else {
2148 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2149 if (IS_ERR(devnull)) {
2150 devnull = NULL;
2151 put_unused_fd(fd);
2152 fput(file);
2153 continue;
2154 }
2155 }
2156 fd_install(fd, devnull);
2157 }
2158 fput(file);
2159 }
2160 }
2161 spin_lock(&files->file_lock);
2162
2163 }
2164 spin_unlock(&files->file_lock);
2165 }
2166
2167 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2168 {
2169 struct task_security_struct *tsec;
2170 struct bprm_security_struct *bsec;
2171 u32 sid;
2172 int rc;
2173
2174 secondary_ops->bprm_apply_creds(bprm, unsafe);
2175
2176 tsec = current->security;
2177
2178 bsec = bprm->security;
2179 sid = bsec->sid;
2180
2181 tsec->osid = tsec->sid;
2182 bsec->unsafe = 0;
2183 if (tsec->sid != sid) {
2184 /* Check for shared state. If not ok, leave SID
2185 unchanged and kill. */
2186 if (unsafe & LSM_UNSAFE_SHARE) {
2187 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2188 PROCESS__SHARE, NULL);
2189 if (rc) {
2190 bsec->unsafe = 1;
2191 return;
2192 }
2193 }
2194
2195 /* Check for ptracing, and update the task SID if ok.
2196 Otherwise, leave SID unchanged and kill. */
2197 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2198 struct task_struct *tracer;
2199 struct task_security_struct *sec;
2200 u32 ptsid = 0;
2201
2202 rcu_read_lock();
2203 tracer = task_tracer_task(current);
2204 if (likely(tracer != NULL)) {
2205 sec = tracer->security;
2206 ptsid = sec->sid;
2207 }
2208 rcu_read_unlock();
2209
2210 if (ptsid != 0) {
2211 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2212 PROCESS__PTRACE, NULL);
2213 if (rc) {
2214 bsec->unsafe = 1;
2215 return;
2216 }
2217 }
2218 }
2219 tsec->sid = sid;
2220 }
2221 }
2222
2223 /*
2224 * called after apply_creds without the task lock held
2225 */
2226 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2227 {
2228 struct task_security_struct *tsec;
2229 struct rlimit *rlim, *initrlim;
2230 struct itimerval itimer;
2231 struct bprm_security_struct *bsec;
2232 int rc, i;
2233
2234 tsec = current->security;
2235 bsec = bprm->security;
2236
2237 if (bsec->unsafe) {
2238 force_sig_specific(SIGKILL, current);
2239 return;
2240 }
2241 if (tsec->osid == tsec->sid)
2242 return;
2243
2244 /* Close files for which the new task SID is not authorized. */
2245 flush_unauthorized_files(current->files);
2246
2247 /* Check whether the new SID can inherit signal state
2248 from the old SID. If not, clear itimers to avoid
2249 subsequent signal generation and flush and unblock
2250 signals. This must occur _after_ the task SID has
2251 been updated so that any kill done after the flush
2252 will be checked against the new SID. */
2253 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2254 PROCESS__SIGINH, NULL);
2255 if (rc) {
2256 memset(&itimer, 0, sizeof itimer);
2257 for (i = 0; i < 3; i++)
2258 do_setitimer(i, &itimer, NULL);
2259 flush_signals(current);
2260 spin_lock_irq(&current->sighand->siglock);
2261 flush_signal_handlers(current, 1);
2262 sigemptyset(&current->blocked);
2263 recalc_sigpending();
2264 spin_unlock_irq(&current->sighand->siglock);
2265 }
2266
2267 /* Always clear parent death signal on SID transitions. */
2268 current->pdeath_signal = 0;
2269
2270 /* Check whether the new SID can inherit resource limits
2271 from the old SID. If not, reset all soft limits to
2272 the lower of the current task's hard limit and the init
2273 task's soft limit. Note that the setting of hard limits
2274 (even to lower them) can be controlled by the setrlimit
2275 check. The inclusion of the init task's soft limit into
2276 the computation is to avoid resetting soft limits higher
2277 than the default soft limit for cases where the default
2278 is lower than the hard limit, e.g. RLIMIT_CORE or
2279 RLIMIT_STACK.*/
2280 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2281 PROCESS__RLIMITINH, NULL);
2282 if (rc) {
2283 for (i = 0; i < RLIM_NLIMITS; i++) {
2284 rlim = current->signal->rlim + i;
2285 initrlim = init_task.signal->rlim+i;
2286 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2287 }
2288 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2289 /*
2290 * This will cause RLIMIT_CPU calculations
2291 * to be refigured.
2292 */
2293 current->it_prof_expires = jiffies_to_cputime(1);
2294 }
2295 }
2296
2297 /* Wake up the parent if it is waiting so that it can
2298 recheck wait permission to the new task SID. */
2299 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2300 }
2301
2302 /* superblock security operations */
2303
2304 static int selinux_sb_alloc_security(struct super_block *sb)
2305 {
2306 return superblock_alloc_security(sb);
2307 }
2308
2309 static void selinux_sb_free_security(struct super_block *sb)
2310 {
2311 superblock_free_security(sb);
2312 }
2313
2314 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2315 {
2316 if (plen > olen)
2317 return 0;
2318
2319 return !memcmp(prefix, option, plen);
2320 }
2321
2322 static inline int selinux_option(char *option, int len)
2323 {
2324 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2325 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2326 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2327 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2328 }
2329
2330 static inline void take_option(char **to, char *from, int *first, int len)
2331 {
2332 if (!*first) {
2333 **to = ',';
2334 *to += 1;
2335 } else
2336 *first = 0;
2337 memcpy(*to, from, len);
2338 *to += len;
2339 }
2340
2341 static inline void take_selinux_option(char **to, char *from, int *first,
2342 int len)
2343 {
2344 int current_size = 0;
2345
2346 if (!*first) {
2347 **to = '|';
2348 *to += 1;
2349 } else
2350 *first = 0;
2351
2352 while (current_size < len) {
2353 if (*from != '"') {
2354 **to = *from;
2355 *to += 1;
2356 }
2357 from += 1;
2358 current_size += 1;
2359 }
2360 }
2361
2362 static int selinux_sb_copy_data(char *orig, char *copy)
2363 {
2364 int fnosec, fsec, rc = 0;
2365 char *in_save, *in_curr, *in_end;
2366 char *sec_curr, *nosec_save, *nosec;
2367 int open_quote = 0;
2368
2369 in_curr = orig;
2370 sec_curr = copy;
2371
2372 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2373 if (!nosec) {
2374 rc = -ENOMEM;
2375 goto out;
2376 }
2377
2378 nosec_save = nosec;
2379 fnosec = fsec = 1;
2380 in_save = in_end = orig;
2381
2382 do {
2383 if (*in_end == '"')
2384 open_quote = !open_quote;
2385 if ((*in_end == ',' && open_quote == 0) ||
2386 *in_end == '\0') {
2387 int len = in_end - in_curr;
2388
2389 if (selinux_option(in_curr, len))
2390 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2391 else
2392 take_option(&nosec, in_curr, &fnosec, len);
2393
2394 in_curr = in_end + 1;
2395 }
2396 } while (*in_end++);
2397
2398 strcpy(in_save, nosec_save);
2399 free_page((unsigned long)nosec_save);
2400 out:
2401 return rc;
2402 }
2403
2404 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2405 {
2406 struct avc_audit_data ad;
2407 int rc;
2408
2409 rc = superblock_doinit(sb, data);
2410 if (rc)
2411 return rc;
2412
2413 AVC_AUDIT_DATA_INIT(&ad, FS);
2414 ad.u.fs.path.dentry = sb->s_root;
2415 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2416 }
2417
2418 static int selinux_sb_statfs(struct dentry *dentry)
2419 {
2420 struct avc_audit_data ad;
2421
2422 AVC_AUDIT_DATA_INIT(&ad, FS);
2423 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2424 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2425 }
2426
2427 static int selinux_mount(char *dev_name,
2428 struct path *path,
2429 char *type,
2430 unsigned long flags,
2431 void *data)
2432 {
2433 int rc;
2434
2435 rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
2436 if (rc)
2437 return rc;
2438
2439 if (flags & MS_REMOUNT)
2440 return superblock_has_perm(current, path->mnt->mnt_sb,
2441 FILESYSTEM__REMOUNT, NULL);
2442 else
2443 return dentry_has_perm(current, path->mnt, path->dentry,
2444 FILE__MOUNTON);
2445 }
2446
2447 static int selinux_umount(struct vfsmount *mnt, int flags)
2448 {
2449 int rc;
2450
2451 rc = secondary_ops->sb_umount(mnt, flags);
2452 if (rc)
2453 return rc;
2454
2455 return superblock_has_perm(current, mnt->mnt_sb,
2456 FILESYSTEM__UNMOUNT, NULL);
2457 }
2458
2459 /* inode security operations */
2460
2461 static int selinux_inode_alloc_security(struct inode *inode)
2462 {
2463 return inode_alloc_security(inode);
2464 }
2465
2466 static void selinux_inode_free_security(struct inode *inode)
2467 {
2468 inode_free_security(inode);
2469 }
2470
2471 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2472 char **name, void **value,
2473 size_t *len)
2474 {
2475 struct task_security_struct *tsec;
2476 struct inode_security_struct *dsec;
2477 struct superblock_security_struct *sbsec;
2478 u32 newsid, clen;
2479 int rc;
2480 char *namep = NULL, *context;
2481
2482 tsec = current->security;
2483 dsec = dir->i_security;
2484 sbsec = dir->i_sb->s_security;
2485
2486 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2487 newsid = tsec->create_sid;
2488 } else {
2489 rc = security_transition_sid(tsec->sid, dsec->sid,
2490 inode_mode_to_security_class(inode->i_mode),
2491 &newsid);
2492 if (rc) {
2493 printk(KERN_WARNING "%s: "
2494 "security_transition_sid failed, rc=%d (dev=%s "
2495 "ino=%ld)\n",
2496 __func__,
2497 -rc, inode->i_sb->s_id, inode->i_ino);
2498 return rc;
2499 }
2500 }
2501
2502 /* Possibly defer initialization to selinux_complete_init. */
2503 if (sbsec->initialized) {
2504 struct inode_security_struct *isec = inode->i_security;
2505 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2506 isec->sid = newsid;
2507 isec->initialized = 1;
2508 }
2509
2510 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2511 return -EOPNOTSUPP;
2512
2513 if (name) {
2514 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2515 if (!namep)
2516 return -ENOMEM;
2517 *name = namep;
2518 }
2519
2520 if (value && len) {
2521 rc = security_sid_to_context_force(newsid, &context, &clen);
2522 if (rc) {
2523 kfree(namep);
2524 return rc;
2525 }
2526 *value = context;
2527 *len = clen;
2528 }
2529
2530 return 0;
2531 }
2532
2533 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2534 {
2535 return may_create(dir, dentry, SECCLASS_FILE);
2536 }
2537
2538 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2539 {
2540 int rc;
2541
2542 rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
2543 if (rc)
2544 return rc;
2545 return may_link(dir, old_dentry, MAY_LINK);
2546 }
2547
2548 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2549 {
2550 int rc;
2551
2552 rc = secondary_ops->inode_unlink(dir, dentry);
2553 if (rc)
2554 return rc;
2555 return may_link(dir, dentry, MAY_UNLINK);
2556 }
2557
2558 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2559 {
2560 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2561 }
2562
2563 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2564 {
2565 return may_create(dir, dentry, SECCLASS_DIR);
2566 }
2567
2568 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2569 {
2570 return may_link(dir, dentry, MAY_RMDIR);
2571 }
2572
2573 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2574 {
2575 int rc;
2576
2577 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2578 if (rc)
2579 return rc;
2580
2581 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2582 }
2583
2584 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2585 struct inode *new_inode, struct dentry *new_dentry)
2586 {
2587 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2588 }
2589
2590 static int selinux_inode_readlink(struct dentry *dentry)
2591 {
2592 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2593 }
2594
2595 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2596 {
2597 int rc;
2598
2599 rc = secondary_ops->inode_follow_link(dentry, nameidata);
2600 if (rc)
2601 return rc;
2602 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2603 }
2604
2605 static int selinux_inode_permission(struct inode *inode, int mask,
2606 struct nameidata *nd)
2607 {
2608 int rc;
2609
2610 rc = secondary_ops->inode_permission(inode, mask, nd);
2611 if (rc)
2612 return rc;
2613
2614 if (!mask) {
2615 /* No permission to check. Existence test. */
2616 return 0;
2617 }
2618
2619 return inode_has_perm(current, inode,
2620 open_file_mask_to_av(inode->i_mode, mask), NULL);
2621 }
2622
2623 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2624 {
2625 int rc;
2626
2627 rc = secondary_ops->inode_setattr(dentry, iattr);
2628 if (rc)
2629 return rc;
2630
2631 if (iattr->ia_valid & ATTR_FORCE)
2632 return 0;
2633
2634 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2635 ATTR_ATIME_SET | ATTR_MTIME_SET))
2636 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2637
2638 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2639 }
2640
2641 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2642 {
2643 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2644 }
2645
2646 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2647 {
2648 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2649 sizeof XATTR_SECURITY_PREFIX - 1)) {
2650 if (!strcmp(name, XATTR_NAME_CAPS)) {
2651 if (!capable(CAP_SETFCAP))
2652 return -EPERM;
2653 } else if (!capable(CAP_SYS_ADMIN)) {
2654 /* A different attribute in the security namespace.
2655 Restrict to administrator. */
2656 return -EPERM;
2657 }
2658 }
2659
2660 /* Not an attribute we recognize, so just check the
2661 ordinary setattr permission. */
2662 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2663 }
2664
2665 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2666 const void *value, size_t size, int flags)
2667 {
2668 struct task_security_struct *tsec = current->security;
2669 struct inode *inode = dentry->d_inode;
2670 struct inode_security_struct *isec = inode->i_security;
2671 struct superblock_security_struct *sbsec;
2672 struct avc_audit_data ad;
2673 u32 newsid;
2674 int rc = 0;
2675
2676 if (strcmp(name, XATTR_NAME_SELINUX))
2677 return selinux_inode_setotherxattr(dentry, name);
2678
2679 sbsec = inode->i_sb->s_security;
2680 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2681 return -EOPNOTSUPP;
2682
2683 if (!is_owner_or_cap(inode))
2684 return -EPERM;
2685
2686 AVC_AUDIT_DATA_INIT(&ad, FS);
2687 ad.u.fs.path.dentry = dentry;
2688
2689 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2690 FILE__RELABELFROM, &ad);
2691 if (rc)
2692 return rc;
2693
2694 rc = security_context_to_sid(value, size, &newsid);
2695 if (rc == -EINVAL) {
2696 if (!capable(CAP_MAC_ADMIN))
2697 return rc;
2698 rc = security_context_to_sid_force(value, size, &newsid);
2699 }
2700 if (rc)
2701 return rc;
2702
2703 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2704 FILE__RELABELTO, &ad);
2705 if (rc)
2706 return rc;
2707
2708 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2709 isec->sclass);
2710 if (rc)
2711 return rc;
2712
2713 return avc_has_perm(newsid,
2714 sbsec->sid,
2715 SECCLASS_FILESYSTEM,
2716 FILESYSTEM__ASSOCIATE,
2717 &ad);
2718 }
2719
2720 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2721 const void *value, size_t size,
2722 int flags)
2723 {
2724 struct inode *inode = dentry->d_inode;
2725 struct inode_security_struct *isec = inode->i_security;
2726 u32 newsid;
2727 int rc;
2728
2729 if (strcmp(name, XATTR_NAME_SELINUX)) {
2730 /* Not an attribute we recognize, so nothing to do. */
2731 return;
2732 }
2733
2734 rc = security_context_to_sid_force(value, size, &newsid);
2735 if (rc) {
2736 printk(KERN_ERR "SELinux: unable to map context to SID"
2737 "for (%s, %lu), rc=%d\n",
2738 inode->i_sb->s_id, inode->i_ino, -rc);
2739 return;
2740 }
2741
2742 isec->sid = newsid;
2743 return;
2744 }
2745
2746 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2747 {
2748 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2749 }
2750
2751 static int selinux_inode_listxattr(struct dentry *dentry)
2752 {
2753 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2754 }
2755
2756 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2757 {
2758 if (strcmp(name, XATTR_NAME_SELINUX))
2759 return selinux_inode_setotherxattr(dentry, name);
2760
2761 /* No one is allowed to remove a SELinux security label.
2762 You can change the label, but all data must be labeled. */
2763 return -EACCES;
2764 }
2765
2766 /*
2767 * Copy the inode security context value to the user.
2768 *
2769 * Permission check is handled by selinux_inode_getxattr hook.
2770 */
2771 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2772 {
2773 u32 size;
2774 int error;
2775 char *context = NULL;
2776 struct task_security_struct *tsec = current->security;
2777 struct inode_security_struct *isec = inode->i_security;
2778
2779 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2780 return -EOPNOTSUPP;
2781
2782 /*
2783 * If the caller has CAP_MAC_ADMIN, then get the raw context
2784 * value even if it is not defined by current policy; otherwise,
2785 * use the in-core value under current policy.
2786 * Use the non-auditing forms of the permission checks since
2787 * getxattr may be called by unprivileged processes commonly
2788 * and lack of permission just means that we fall back to the
2789 * in-core context value, not a denial.
2790 */
2791 error = secondary_ops->capable(current, CAP_MAC_ADMIN);
2792 if (!error)
2793 error = avc_has_perm_noaudit(tsec->sid, tsec->sid,
2794 SECCLASS_CAPABILITY2,
2795 CAPABILITY2__MAC_ADMIN,
2796 0,
2797 NULL);
2798 if (!error)
2799 error = security_sid_to_context_force(isec->sid, &context,
2800 &size);
2801 else
2802 error = security_sid_to_context(isec->sid, &context, &size);
2803 if (error)
2804 return error;
2805 error = size;
2806 if (alloc) {
2807 *buffer = context;
2808 goto out_nofree;
2809 }
2810 kfree(context);
2811 out_nofree:
2812 return error;
2813 }
2814
2815 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2816 const void *value, size_t size, int flags)
2817 {
2818 struct inode_security_struct *isec = inode->i_security;
2819 u32 newsid;
2820 int rc;
2821
2822 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2823 return -EOPNOTSUPP;
2824
2825 if (!value || !size)
2826 return -EACCES;
2827
2828 rc = security_context_to_sid((void *)value, size, &newsid);
2829 if (rc)
2830 return rc;
2831
2832 isec->sid = newsid;
2833 return 0;
2834 }
2835
2836 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2837 {
2838 const int len = sizeof(XATTR_NAME_SELINUX);
2839 if (buffer && len <= buffer_size)
2840 memcpy(buffer, XATTR_NAME_SELINUX, len);
2841 return len;
2842 }
2843
2844 static int selinux_inode_need_killpriv(struct dentry *dentry)
2845 {
2846 return secondary_ops->inode_need_killpriv(dentry);
2847 }
2848
2849 static int selinux_inode_killpriv(struct dentry *dentry)
2850 {
2851 return secondary_ops->inode_killpriv(dentry);
2852 }
2853
2854 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2855 {
2856 struct inode_security_struct *isec = inode->i_security;
2857 *secid = isec->sid;
2858 }
2859
2860 /* file security operations */
2861
2862 static int selinux_revalidate_file_permission(struct file *file, int mask)
2863 {
2864 int rc;
2865 struct inode *inode = file->f_path.dentry->d_inode;
2866
2867 if (!mask) {
2868 /* No permission to check. Existence test. */
2869 return 0;
2870 }
2871
2872 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2873 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2874 mask |= MAY_APPEND;
2875
2876 rc = file_has_perm(current, file,
2877 file_mask_to_av(inode->i_mode, mask));
2878 if (rc)
2879 return rc;
2880
2881 return selinux_netlbl_inode_permission(inode, mask);
2882 }
2883
2884 static int selinux_file_permission(struct file *file, int mask)
2885 {
2886 struct inode *inode = file->f_path.dentry->d_inode;
2887 struct task_security_struct *tsec = current->security;
2888 struct file_security_struct *fsec = file->f_security;
2889 struct inode_security_struct *isec = inode->i_security;
2890
2891 if (!mask) {
2892 /* No permission to check. Existence test. */
2893 return 0;
2894 }
2895
2896 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2897 && fsec->pseqno == avc_policy_seqno())
2898 return selinux_netlbl_inode_permission(inode, mask);
2899
2900 return selinux_revalidate_file_permission(file, mask);
2901 }
2902
2903 static int selinux_file_alloc_security(struct file *file)
2904 {
2905 return file_alloc_security(file);
2906 }
2907
2908 static void selinux_file_free_security(struct file *file)
2909 {
2910 file_free_security(file);
2911 }
2912
2913 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2914 unsigned long arg)
2915 {
2916 u32 av = 0;
2917
2918 if (_IOC_DIR(cmd) & _IOC_WRITE)
2919 av |= FILE__WRITE;
2920 if (_IOC_DIR(cmd) & _IOC_READ)
2921 av |= FILE__READ;
2922 if (!av)
2923 av = FILE__IOCTL;
2924
2925 return file_has_perm(current, file, av);
2926 }
2927
2928 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2929 {
2930 #ifndef CONFIG_PPC32
2931 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2932 /*
2933 * We are making executable an anonymous mapping or a
2934 * private file mapping that will also be writable.
2935 * This has an additional check.
2936 */
2937 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2938 if (rc)
2939 return rc;
2940 }
2941 #endif
2942
2943 if (file) {
2944 /* read access is always possible with a mapping */
2945 u32 av = FILE__READ;
2946
2947 /* write access only matters if the mapping is shared */
2948 if (shared && (prot & PROT_WRITE))
2949 av |= FILE__WRITE;
2950
2951 if (prot & PROT_EXEC)
2952 av |= FILE__EXECUTE;
2953
2954 return file_has_perm(current, file, av);
2955 }
2956 return 0;
2957 }
2958
2959 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2960 unsigned long prot, unsigned long flags,
2961 unsigned long addr, unsigned long addr_only)
2962 {
2963 int rc = 0;
2964 u32 sid = ((struct task_security_struct *)(current->security))->sid;
2965
2966 if (addr < mmap_min_addr)
2967 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2968 MEMPROTECT__MMAP_ZERO, NULL);
2969 if (rc || addr_only)
2970 return rc;
2971
2972 if (selinux_checkreqprot)
2973 prot = reqprot;
2974
2975 return file_map_prot_check(file, prot,
2976 (flags & MAP_TYPE) == MAP_SHARED);
2977 }
2978
2979 static int selinux_file_mprotect(struct vm_area_struct *vma,
2980 unsigned long reqprot,
2981 unsigned long prot)
2982 {
2983 int rc;
2984
2985 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2986 if (rc)
2987 return rc;
2988
2989 if (selinux_checkreqprot)
2990 prot = reqprot;
2991
2992 #ifndef CONFIG_PPC32
2993 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2994 rc = 0;
2995 if (vma->vm_start >= vma->vm_mm->start_brk &&
2996 vma->vm_end <= vma->vm_mm->brk) {
2997 rc = task_has_perm(current, current,
2998 PROCESS__EXECHEAP);
2999 } else if (!vma->vm_file &&
3000 vma->vm_start <= vma->vm_mm->start_stack &&
3001 vma->vm_end >= vma->vm_mm->start_stack) {
3002 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
3003 } else if (vma->vm_file && vma->anon_vma) {
3004 /*
3005 * We are making executable a file mapping that has
3006 * had some COW done. Since pages might have been
3007 * written, check ability to execute the possibly
3008 * modified content. This typically should only
3009 * occur for text relocations.
3010 */
3011 rc = file_has_perm(current, vma->vm_file,
3012 FILE__EXECMOD);
3013 }
3014 if (rc)
3015 return rc;
3016 }
3017 #endif
3018
3019 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3020 }
3021
3022 static int selinux_file_lock(struct file *file, unsigned int cmd)
3023 {
3024 return file_has_perm(current, file, FILE__LOCK);
3025 }
3026
3027 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3028 unsigned long arg)
3029 {
3030 int err = 0;
3031
3032 switch (cmd) {
3033 case F_SETFL:
3034 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3035 err = -EINVAL;
3036 break;
3037 }
3038
3039 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3040 err = file_has_perm(current, file, FILE__WRITE);
3041 break;
3042 }
3043 /* fall through */
3044 case F_SETOWN:
3045 case F_SETSIG:
3046 case F_GETFL:
3047 case F_GETOWN:
3048 case F_GETSIG:
3049 /* Just check FD__USE permission */
3050 err = file_has_perm(current, file, 0);
3051 break;
3052 case F_GETLK:
3053 case F_SETLK:
3054 case F_SETLKW:
3055 #if BITS_PER_LONG == 32
3056 case F_GETLK64:
3057 case F_SETLK64:
3058 case F_SETLKW64:
3059 #endif
3060 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3061 err = -EINVAL;
3062 break;
3063 }
3064 err = file_has_perm(current, file, FILE__LOCK);
3065 break;
3066 }
3067
3068 return err;
3069 }
3070
3071 static int selinux_file_set_fowner(struct file *file)
3072 {
3073 struct task_security_struct *tsec;
3074 struct file_security_struct *fsec;
3075
3076 tsec = current->security;
3077 fsec = file->f_security;
3078 fsec->fown_sid = tsec->sid;
3079
3080 return 0;
3081 }
3082
3083 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3084 struct fown_struct *fown, int signum)
3085 {
3086 struct file *file;
3087 u32 perm;
3088 struct task_security_struct *tsec;
3089 struct file_security_struct *fsec;
3090
3091 /* struct fown_struct is never outside the context of a struct file */
3092 file = container_of(fown, struct file, f_owner);
3093
3094 tsec = tsk->security;
3095 fsec = file->f_security;
3096
3097 if (!signum)
3098 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3099 else
3100 perm = signal_to_av(signum);
3101
3102 return avc_has_perm(fsec->fown_sid, tsec->sid,
3103 SECCLASS_PROCESS, perm, NULL);
3104 }
3105
3106 static int selinux_file_receive(struct file *file)
3107 {
3108 return file_has_perm(current, file, file_to_av(file));
3109 }
3110
3111 static int selinux_dentry_open(struct file *file)
3112 {
3113 struct file_security_struct *fsec;
3114 struct inode *inode;
3115 struct inode_security_struct *isec;
3116 inode = file->f_path.dentry->d_inode;
3117 fsec = file->f_security;
3118 isec = inode->i_security;
3119 /*
3120 * Save inode label and policy sequence number
3121 * at open-time so that selinux_file_permission
3122 * can determine whether revalidation is necessary.
3123 * Task label is already saved in the file security
3124 * struct as its SID.
3125 */
3126 fsec->isid = isec->sid;
3127 fsec->pseqno = avc_policy_seqno();
3128 /*
3129 * Since the inode label or policy seqno may have changed
3130 * between the selinux_inode_permission check and the saving
3131 * of state above, recheck that access is still permitted.
3132 * Otherwise, access might never be revalidated against the
3133 * new inode label or new policy.
3134 * This check is not redundant - do not remove.
3135 */
3136 return inode_has_perm(current, inode, file_to_av(file), NULL);
3137 }
3138
3139 /* task security operations */
3140
3141 static int selinux_task_create(unsigned long clone_flags)
3142 {
3143 int rc;
3144
3145 rc = secondary_ops->task_create(clone_flags);
3146 if (rc)
3147 return rc;
3148
3149 return task_has_perm(current, current, PROCESS__FORK);
3150 }
3151
3152 static int selinux_task_alloc_security(struct task_struct *tsk)
3153 {
3154 struct task_security_struct *tsec1, *tsec2;
3155 int rc;
3156
3157 tsec1 = current->security;
3158
3159 rc = task_alloc_security(tsk);
3160 if (rc)
3161 return rc;
3162 tsec2 = tsk->security;
3163
3164 tsec2->osid = tsec1->osid;
3165 tsec2->sid = tsec1->sid;
3166
3167 /* Retain the exec, fs, key, and sock SIDs across fork */
3168 tsec2->exec_sid = tsec1->exec_sid;
3169 tsec2->create_sid = tsec1->create_sid;
3170 tsec2->keycreate_sid = tsec1->keycreate_sid;
3171 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3172
3173 return 0;
3174 }
3175
3176 static void selinux_task_free_security(struct task_struct *tsk)
3177 {
3178 task_free_security(tsk);
3179 }
3180
3181 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3182 {
3183 /* Since setuid only affects the current process, and
3184 since the SELinux controls are not based on the Linux
3185 identity attributes, SELinux does not need to control
3186 this operation. However, SELinux does control the use
3187 of the CAP_SETUID and CAP_SETGID capabilities using the
3188 capable hook. */
3189 return 0;
3190 }
3191
3192 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3193 {
3194 return secondary_ops->task_post_setuid(id0, id1, id2, flags);
3195 }
3196
3197 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3198 {
3199 /* See the comment for setuid above. */
3200 return 0;
3201 }
3202
3203 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3204 {
3205 return task_has_perm(current, p, PROCESS__SETPGID);
3206 }
3207
3208 static int selinux_task_getpgid(struct task_struct *p)
3209 {
3210 return task_has_perm(current, p, PROCESS__GETPGID);
3211 }
3212
3213 static int selinux_task_getsid(struct task_struct *p)
3214 {
3215 return task_has_perm(current, p, PROCESS__GETSESSION);
3216 }
3217
3218 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3219 {
3220 struct task_security_struct *tsec = p->security;
3221 *secid = tsec->sid;
3222 }
3223
3224 static int selinux_task_setgroups(struct group_info *group_info)
3225 {
3226 /* See the comment for setuid above. */
3227 return 0;
3228 }
3229
3230 static int selinux_task_setnice(struct task_struct *p, int nice)
3231 {
3232 int rc;
3233
3234 rc = secondary_ops->task_setnice(p, nice);
3235 if (rc)
3236 return rc;
3237
3238 return task_has_perm(current, p, PROCESS__SETSCHED);
3239 }
3240
3241 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3242 {
3243 int rc;
3244
3245 rc = secondary_ops->task_setioprio(p, ioprio);
3246 if (rc)
3247 return rc;
3248
3249 return task_has_perm(current, p, PROCESS__SETSCHED);
3250 }
3251
3252 static int selinux_task_getioprio(struct task_struct *p)
3253 {
3254 return task_has_perm(current, p, PROCESS__GETSCHED);
3255 }
3256
3257 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3258 {
3259 struct rlimit *old_rlim = current->signal->rlim + resource;
3260 int rc;
3261
3262 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3263 if (rc)
3264 return rc;
3265
3266 /* Control the ability to change the hard limit (whether
3267 lowering or raising it), so that the hard limit can
3268 later be used as a safe reset point for the soft limit
3269 upon context transitions. See selinux_bprm_apply_creds. */
3270 if (old_rlim->rlim_max != new_rlim->rlim_max)
3271 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3272
3273 return 0;
3274 }
3275
3276 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3277 {
3278 int rc;
3279
3280 rc = secondary_ops->task_setscheduler(p, policy, lp);
3281 if (rc)
3282 return rc;
3283
3284 return task_has_perm(current, p, PROCESS__SETSCHED);
3285 }
3286
3287 static int selinux_task_getscheduler(struct task_struct *p)
3288 {
3289 return task_has_perm(current, p, PROCESS__GETSCHED);
3290 }
3291
3292 static int selinux_task_movememory(struct task_struct *p)
3293 {
3294 return task_has_perm(current, p, PROCESS__SETSCHED);
3295 }
3296
3297 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3298 int sig, u32 secid)
3299 {
3300 u32 perm;
3301 int rc;
3302 struct task_security_struct *tsec;
3303
3304 rc = secondary_ops->task_kill(p, info, sig, secid);
3305 if (rc)
3306 return rc;
3307
3308 if (!sig)
3309 perm = PROCESS__SIGNULL; /* null signal; existence test */
3310 else
3311 perm = signal_to_av(sig);
3312 tsec = p->security;
3313 if (secid)
3314 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3315 else
3316 rc = task_has_perm(current, p, perm);
3317 return rc;
3318 }
3319
3320 static int selinux_task_prctl(int option,
3321 unsigned long arg2,
3322 unsigned long arg3,
3323 unsigned long arg4,
3324 unsigned long arg5,
3325 long *rc_p)
3326 {
3327 /* The current prctl operations do not appear to require
3328 any SELinux controls since they merely observe or modify
3329 the state of the current process. */
3330 return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
3331 }
3332
3333 static int selinux_task_wait(struct task_struct *p)
3334 {
3335 return task_has_perm(p, current, PROCESS__SIGCHLD);
3336 }
3337
3338 static void selinux_task_reparent_to_init(struct task_struct *p)
3339 {
3340 struct task_security_struct *tsec;
3341
3342 secondary_ops->task_reparent_to_init(p);
3343
3344 tsec = p->security;
3345 tsec->osid = tsec->sid;
3346 tsec->sid = SECINITSID_KERNEL;
3347 return;
3348 }
3349
3350 static void selinux_task_to_inode(struct task_struct *p,
3351 struct inode *inode)
3352 {
3353 struct task_security_struct *tsec = p->security;
3354 struct inode_security_struct *isec = inode->i_security;
3355
3356 isec->sid = tsec->sid;
3357 isec->initialized = 1;
3358 return;
3359 }
3360
3361 /* Returns error only if unable to parse addresses */
3362 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3363 struct avc_audit_data *ad, u8 *proto)
3364 {
3365 int offset, ihlen, ret = -EINVAL;
3366 struct iphdr _iph, *ih;
3367
3368 offset = skb_network_offset(skb);
3369 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3370 if (ih == NULL)
3371 goto out;
3372
3373 ihlen = ih->ihl * 4;
3374 if (ihlen < sizeof(_iph))
3375 goto out;
3376
3377 ad->u.net.v4info.saddr = ih->saddr;
3378 ad->u.net.v4info.daddr = ih->daddr;
3379 ret = 0;
3380
3381 if (proto)
3382 *proto = ih->protocol;
3383
3384 switch (ih->protocol) {
3385 case IPPROTO_TCP: {
3386 struct tcphdr _tcph, *th;
3387
3388 if (ntohs(ih->frag_off) & IP_OFFSET)
3389 break;
3390
3391 offset += ihlen;
3392 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3393 if (th == NULL)
3394 break;
3395
3396 ad->u.net.sport = th->source;
3397 ad->u.net.dport = th->dest;
3398 break;
3399 }
3400
3401 case IPPROTO_UDP: {
3402 struct udphdr _udph, *uh;
3403
3404 if (ntohs(ih->frag_off) & IP_OFFSET)
3405 break;
3406
3407 offset += ihlen;
3408 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3409 if (uh == NULL)
3410 break;
3411
3412 ad->u.net.sport = uh->source;
3413 ad->u.net.dport = uh->dest;
3414 break;
3415 }
3416
3417 case IPPROTO_DCCP: {
3418 struct dccp_hdr _dccph, *dh;
3419
3420 if (ntohs(ih->frag_off) & IP_OFFSET)
3421 break;
3422
3423 offset += ihlen;
3424 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3425 if (dh == NULL)
3426 break;
3427
3428 ad->u.net.sport = dh->dccph_sport;
3429 ad->u.net.dport = dh->dccph_dport;
3430 break;
3431 }
3432
3433 default:
3434 break;
3435 }
3436 out:
3437 return ret;
3438 }
3439
3440 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3441
3442 /* Returns error only if unable to parse addresses */
3443 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3444 struct avc_audit_data *ad, u8 *proto)
3445 {
3446 u8 nexthdr;
3447 int ret = -EINVAL, offset;
3448 struct ipv6hdr _ipv6h, *ip6;
3449
3450 offset = skb_network_offset(skb);
3451 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3452 if (ip6 == NULL)
3453 goto out;
3454
3455 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3456 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3457 ret = 0;
3458
3459 nexthdr = ip6->nexthdr;
3460 offset += sizeof(_ipv6h);
3461 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3462 if (offset < 0)
3463 goto out;
3464
3465 if (proto)
3466 *proto = nexthdr;
3467
3468 switch (nexthdr) {
3469 case IPPROTO_TCP: {
3470 struct tcphdr _tcph, *th;
3471
3472 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3473 if (th == NULL)
3474 break;
3475
3476 ad->u.net.sport = th->source;
3477 ad->u.net.dport = th->dest;
3478 break;
3479 }
3480
3481 case IPPROTO_UDP: {
3482 struct udphdr _udph, *uh;
3483
3484 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3485 if (uh == NULL)
3486 break;
3487
3488 ad->u.net.sport = uh->source;
3489 ad->u.net.dport = uh->dest;
3490 break;
3491 }
3492
3493 case IPPROTO_DCCP: {
3494 struct dccp_hdr _dccph, *dh;
3495
3496 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3497 if (dh == NULL)
3498 break;
3499
3500 ad->u.net.sport = dh->dccph_sport;
3501 ad->u.net.dport = dh->dccph_dport;
3502 break;
3503 }
3504
3505 /* includes fragments */
3506 default:
3507 break;
3508 }
3509 out:
3510 return ret;
3511 }
3512
3513 #endif /* IPV6 */
3514
3515 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3516 char **addrp, int src, u8 *proto)
3517 {
3518 int ret = 0;
3519
3520 switch (ad->u.net.family) {
3521 case PF_INET:
3522 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3523 if (ret || !addrp)
3524 break;
3525 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3526 &ad->u.net.v4info.daddr);
3527 break;
3528
3529 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3530 case PF_INET6:
3531 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3532 if (ret || !addrp)
3533 break;
3534 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3535 &ad->u.net.v6info.daddr);
3536 break;
3537 #endif /* IPV6 */
3538 default:
3539 break;
3540 }
3541
3542 if (unlikely(ret))
3543 printk(KERN_WARNING
3544 "SELinux: failure in selinux_parse_skb(),"
3545 " unable to parse packet\n");
3546
3547 return ret;
3548 }
3549
3550 /**
3551 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3552 * @skb: the packet
3553 * @family: protocol family
3554 * @sid: the packet's peer label SID
3555 *
3556 * Description:
3557 * Check the various different forms of network peer labeling and determine
3558 * the peer label/SID for the packet; most of the magic actually occurs in
3559 * the security server function security_net_peersid_cmp(). The function
3560 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3561 * or -EACCES if @sid is invalid due to inconsistencies with the different
3562 * peer labels.
3563 *
3564 */
3565 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3566 {
3567 int err;
3568 u32 xfrm_sid;
3569 u32 nlbl_sid;
3570 u32 nlbl_type;
3571
3572 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3573 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3574
3575 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3576 if (unlikely(err)) {
3577 printk(KERN_WARNING
3578 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3579 " unable to determine packet's peer label\n");
3580 return -EACCES;
3581 }
3582
3583 return 0;
3584 }
3585
3586 /* socket security operations */
3587 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3588 u32 perms)
3589 {
3590 struct inode_security_struct *isec;
3591 struct task_security_struct *tsec;
3592 struct avc_audit_data ad;
3593 int err = 0;
3594
3595 tsec = task->security;
3596 isec = SOCK_INODE(sock)->i_security;
3597
3598 if (isec->sid == SECINITSID_KERNEL)
3599 goto out;
3600
3601 AVC_AUDIT_DATA_INIT(&ad, NET);
3602 ad.u.net.sk = sock->sk;
3603 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3604
3605 out:
3606 return err;
3607 }
3608
3609 static int selinux_socket_create(int family, int type,
3610 int protocol, int kern)
3611 {
3612 int err = 0;
3613 struct task_security_struct *tsec;
3614 u32 newsid;
3615
3616 if (kern)
3617 goto out;
3618
3619 tsec = current->security;
3620 newsid = tsec->sockcreate_sid ? : tsec->sid;
3621 err = avc_has_perm(tsec->sid, newsid,
3622 socket_type_to_security_class(family, type,
3623 protocol), SOCKET__CREATE, NULL);
3624
3625 out:
3626 return err;
3627 }
3628
3629 static int selinux_socket_post_create(struct socket *sock, int family,
3630 int type, int protocol, int kern)
3631 {
3632 int err = 0;
3633 struct inode_security_struct *isec;
3634 struct task_security_struct *tsec;
3635 struct sk_security_struct *sksec;
3636 u32 newsid;
3637
3638 isec = SOCK_INODE(sock)->i_security;
3639
3640 tsec = current->security;
3641 newsid = tsec->sockcreate_sid ? : tsec->sid;
3642 isec->sclass = socket_type_to_security_class(family, type, protocol);
3643 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3644 isec->initialized = 1;
3645
3646 if (sock->sk) {
3647 sksec = sock->sk->sk_security;
3648 sksec->sid = isec->sid;
3649 sksec->sclass = isec->sclass;
3650 err = selinux_netlbl_socket_post_create(sock);
3651 }
3652
3653 return err;
3654 }
3655
3656 /* Range of port numbers used to automatically bind.
3657 Need to determine whether we should perform a name_bind
3658 permission check between the socket and the port number. */
3659
3660 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3661 {
3662 u16 family;
3663 int err;
3664
3665 err = socket_has_perm(current, sock, SOCKET__BIND);
3666 if (err)
3667 goto out;
3668
3669 /*
3670 * If PF_INET or PF_INET6, check name_bind permission for the port.
3671 * Multiple address binding for SCTP is not supported yet: we just
3672 * check the first address now.
3673 */
3674 family = sock->sk->sk_family;
3675 if (family == PF_INET || family == PF_INET6) {
3676 char *addrp;
3677 struct inode_security_struct *isec;
3678 struct task_security_struct *tsec;
3679 struct avc_audit_data ad;
3680 struct sockaddr_in *addr4 = NULL;
3681 struct sockaddr_in6 *addr6 = NULL;
3682 unsigned short snum;
3683 struct sock *sk = sock->sk;
3684 u32 sid, node_perm;
3685
3686 tsec = current->security;
3687 isec = SOCK_INODE(sock)->i_security;
3688
3689 if (family == PF_INET) {
3690 addr4 = (struct sockaddr_in *)address;
3691 snum = ntohs(addr4->sin_port);
3692 addrp = (char *)&addr4->sin_addr.s_addr;
3693 } else {
3694 addr6 = (struct sockaddr_in6 *)address;
3695 snum = ntohs(addr6->sin6_port);
3696 addrp = (char *)&addr6->sin6_addr.s6_addr;
3697 }
3698
3699 if (snum) {
3700 int low, high;
3701
3702 inet_get_local_port_range(&low, &high);
3703
3704 if (snum < max(PROT_SOCK, low) || snum > high) {
3705 err = sel_netport_sid(sk->sk_protocol,
3706 snum, &sid);
3707 if (err)
3708 goto out;
3709 AVC_AUDIT_DATA_INIT(&ad, NET);
3710 ad.u.net.sport = htons(snum);
3711 ad.u.net.family = family;
3712 err = avc_has_perm(isec->sid, sid,
3713 isec->sclass,
3714 SOCKET__NAME_BIND, &ad);
3715 if (err)
3716 goto out;
3717 }
3718 }
3719
3720 switch (isec->sclass) {
3721 case SECCLASS_TCP_SOCKET:
3722 node_perm = TCP_SOCKET__NODE_BIND;
3723 break;
3724
3725 case SECCLASS_UDP_SOCKET:
3726 node_perm = UDP_SOCKET__NODE_BIND;
3727 break;
3728
3729 case SECCLASS_DCCP_SOCKET:
3730 node_perm = DCCP_SOCKET__NODE_BIND;
3731 break;
3732
3733 default:
3734 node_perm = RAWIP_SOCKET__NODE_BIND;
3735 break;
3736 }
3737
3738 err = sel_netnode_sid(addrp, family, &sid);
3739 if (err)
3740 goto out;
3741
3742 AVC_AUDIT_DATA_INIT(&ad, NET);
3743 ad.u.net.sport = htons(snum);
3744 ad.u.net.family = family;
3745
3746 if (family == PF_INET)
3747 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3748 else
3749 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3750
3751 err = avc_has_perm(isec->sid, sid,
3752 isec->sclass, node_perm, &ad);
3753 if (err)
3754 goto out;
3755 }
3756 out:
3757 return err;
3758 }
3759
3760 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3761 {
3762 struct inode_security_struct *isec;
3763 int err;
3764
3765 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3766 if (err)
3767 return err;
3768
3769 /*
3770 * If a TCP or DCCP socket, check name_connect permission for the port.
3771 */
3772 isec = SOCK_INODE(sock)->i_security;
3773 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3774 isec->sclass == SECCLASS_DCCP_SOCKET) {
3775 struct sock *sk = sock->sk;
3776 struct avc_audit_data ad;
3777 struct sockaddr_in *addr4 = NULL;
3778 struct sockaddr_in6 *addr6 = NULL;
3779 unsigned short snum;
3780 u32 sid, perm;
3781
3782 if (sk->sk_family == PF_INET) {
3783 addr4 = (struct sockaddr_in *)address;
3784 if (addrlen < sizeof(struct sockaddr_in))
3785 return -EINVAL;
3786 snum = ntohs(addr4->sin_port);
3787 } else {
3788 addr6 = (struct sockaddr_in6 *)address;
3789 if (addrlen < SIN6_LEN_RFC2133)
3790 return -EINVAL;
3791 snum = ntohs(addr6->sin6_port);
3792 }
3793
3794 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3795 if (err)
3796 goto out;
3797
3798 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3799 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3800
3801 AVC_AUDIT_DATA_INIT(&ad, NET);
3802 ad.u.net.dport = htons(snum);
3803 ad.u.net.family = sk->sk_family;
3804 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3805 if (err)
3806 goto out;
3807 }
3808
3809 out:
3810 return err;
3811 }
3812
3813 static int selinux_socket_listen(struct socket *sock, int backlog)
3814 {
3815 return socket_has_perm(current, sock, SOCKET__LISTEN);
3816 }
3817
3818 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3819 {
3820 int err;
3821 struct inode_security_struct *isec;
3822 struct inode_security_struct *newisec;
3823
3824 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3825 if (err)
3826 return err;
3827
3828 newisec = SOCK_INODE(newsock)->i_security;
3829
3830 isec = SOCK_INODE(sock)->i_security;
3831 newisec->sclass = isec->sclass;
3832 newisec->sid = isec->sid;
3833 newisec->initialized = 1;
3834
3835 return 0;
3836 }
3837
3838 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3839 int size)
3840 {
3841 int rc;
3842
3843 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3844 if (rc)
3845 return rc;
3846
3847 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3848 }
3849
3850 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3851 int size, int flags)
3852 {
3853 return socket_has_perm(current, sock, SOCKET__READ);
3854 }
3855
3856 static int selinux_socket_getsockname(struct socket *sock)
3857 {
3858 return socket_has_perm(current, sock, SOCKET__GETATTR);
3859 }
3860
3861 static int selinux_socket_getpeername(struct socket *sock)
3862 {
3863 return socket_has_perm(current, sock, SOCKET__GETATTR);
3864 }
3865
3866 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3867 {
3868 int err;
3869
3870 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3871 if (err)
3872 return err;
3873
3874 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3875 }
3876
3877 static int selinux_socket_getsockopt(struct socket *sock, int level,
3878 int optname)
3879 {
3880 return socket_has_perm(current, sock, SOCKET__GETOPT);
3881 }
3882
3883 static int selinux_socket_shutdown(struct socket *sock, int how)
3884 {
3885 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3886 }
3887
3888 static int selinux_socket_unix_stream_connect(struct socket *sock,
3889 struct socket *other,
3890 struct sock *newsk)
3891 {
3892 struct sk_security_struct *ssec;
3893 struct inode_security_struct *isec;
3894 struct inode_security_struct *other_isec;
3895 struct avc_audit_data ad;
3896 int err;
3897
3898 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3899 if (err)
3900 return err;
3901
3902 isec = SOCK_INODE(sock)->i_security;
3903 other_isec = SOCK_INODE(other)->i_security;
3904
3905 AVC_AUDIT_DATA_INIT(&ad, NET);
3906 ad.u.net.sk = other->sk;
3907
3908 err = avc_has_perm(isec->sid, other_isec->sid,
3909 isec->sclass,
3910 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3911 if (err)
3912 return err;
3913
3914 /* connecting socket */
3915 ssec = sock->sk->sk_security;
3916 ssec->peer_sid = other_isec->sid;
3917
3918 /* server child socket */
3919 ssec = newsk->sk_security;
3920 ssec->peer_sid = isec->sid;
3921 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3922
3923 return err;
3924 }
3925
3926 static int selinux_socket_unix_may_send(struct socket *sock,
3927 struct socket *other)
3928 {
3929 struct inode_security_struct *isec;
3930 struct inode_security_struct *other_isec;
3931 struct avc_audit_data ad;
3932 int err;
3933
3934 isec = SOCK_INODE(sock)->i_security;
3935 other_isec = SOCK_INODE(other)->i_security;
3936
3937 AVC_AUDIT_DATA_INIT(&ad, NET);
3938 ad.u.net.sk = other->sk;
3939
3940 err = avc_has_perm(isec->sid, other_isec->sid,
3941 isec->sclass, SOCKET__SENDTO, &ad);
3942 if (err)
3943 return err;
3944
3945 return 0;
3946 }
3947
3948 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3949 u32 peer_sid,
3950 struct avc_audit_data *ad)
3951 {
3952 int err;
3953 u32 if_sid;
3954 u32 node_sid;
3955
3956 err = sel_netif_sid(ifindex, &if_sid);
3957 if (err)
3958 return err;
3959 err = avc_has_perm(peer_sid, if_sid,
3960 SECCLASS_NETIF, NETIF__INGRESS, ad);
3961 if (err)
3962 return err;
3963
3964 err = sel_netnode_sid(addrp, family, &node_sid);
3965 if (err)
3966 return err;
3967 return avc_has_perm(peer_sid, node_sid,
3968 SECCLASS_NODE, NODE__RECVFROM, ad);
3969 }
3970
3971 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3972 struct sk_buff *skb,
3973 struct avc_audit_data *ad,
3974 u16 family,
3975 char *addrp)
3976 {
3977 int err;
3978 struct sk_security_struct *sksec = sk->sk_security;
3979 u16 sk_class;
3980 u32 netif_perm, node_perm, recv_perm;
3981 u32 port_sid, node_sid, if_sid, sk_sid;
3982
3983 sk_sid = sksec->sid;
3984 sk_class = sksec->sclass;
3985
3986 switch (sk_class) {
3987 case SECCLASS_UDP_SOCKET:
3988 netif_perm = NETIF__UDP_RECV;
3989 node_perm = NODE__UDP_RECV;
3990 recv_perm = UDP_SOCKET__RECV_MSG;
3991 break;
3992 case SECCLASS_TCP_SOCKET:
3993 netif_perm = NETIF__TCP_RECV;
3994 node_perm = NODE__TCP_RECV;
3995 recv_perm = TCP_SOCKET__RECV_MSG;
3996 break;
3997 case SECCLASS_DCCP_SOCKET:
3998 netif_perm = NETIF__DCCP_RECV;
3999 node_perm = NODE__DCCP_RECV;
4000 recv_perm = DCCP_SOCKET__RECV_MSG;
4001 break;
4002 default:
4003 netif_perm = NETIF__RAWIP_RECV;
4004 node_perm = NODE__RAWIP_RECV;
4005 recv_perm = 0;
4006 break;
4007 }
4008
4009 err = sel_netif_sid(skb->iif, &if_sid);
4010 if (err)
4011 return err;
4012 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4013 if (err)
4014 return err;
4015
4016 err = sel_netnode_sid(addrp, family, &node_sid);
4017 if (err)
4018 return err;
4019 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4020 if (err)
4021 return err;
4022
4023 if (!recv_perm)
4024 return 0;
4025 err = sel_netport_sid(sk->sk_protocol,
4026 ntohs(ad->u.net.sport), &port_sid);
4027 if (unlikely(err)) {
4028 printk(KERN_WARNING
4029 "SELinux: failure in"
4030 " selinux_sock_rcv_skb_iptables_compat(),"
4031 " network port label not found\n");
4032 return err;
4033 }
4034 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4035 }
4036
4037 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4038 struct avc_audit_data *ad,
4039 u16 family, char *addrp)
4040 {
4041 int err;
4042 struct sk_security_struct *sksec = sk->sk_security;
4043 u32 peer_sid;
4044 u32 sk_sid = sksec->sid;
4045
4046 if (selinux_compat_net)
4047 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4048 family, addrp);
4049 else
4050 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4051 PACKET__RECV, ad);
4052 if (err)
4053 return err;
4054
4055 if (selinux_policycap_netpeer) {
4056 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4057 if (err)
4058 return err;
4059 err = avc_has_perm(sk_sid, peer_sid,
4060 SECCLASS_PEER, PEER__RECV, ad);
4061 } else {
4062 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4063 if (err)
4064 return err;
4065 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4066 }
4067
4068 return err;
4069 }
4070
4071 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4072 {
4073 int err;
4074 struct sk_security_struct *sksec = sk->sk_security;
4075 u16 family = sk->sk_family;
4076 u32 sk_sid = sksec->sid;
4077 struct avc_audit_data ad;
4078 char *addrp;
4079
4080 if (family != PF_INET && family != PF_INET6)
4081 return 0;
4082
4083 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4084 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4085 family = PF_INET;
4086
4087 AVC_AUDIT_DATA_INIT(&ad, NET);
4088 ad.u.net.netif = skb->iif;
4089 ad.u.net.family = family;
4090 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4091 if (err)
4092 return err;
4093
4094 /* If any sort of compatibility mode is enabled then handoff processing
4095 * to the selinux_sock_rcv_skb_compat() function to deal with the
4096 * special handling. We do this in an attempt to keep this function
4097 * as fast and as clean as possible. */
4098 if (selinux_compat_net || !selinux_policycap_netpeer)
4099 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4100 family, addrp);
4101
4102 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4103 u32 peer_sid;
4104
4105 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4106 if (err)
4107 return err;
4108 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4109 peer_sid, &ad);
4110 if (err)
4111 return err;
4112 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4113 PEER__RECV, &ad);
4114 }
4115
4116 if (selinux_secmark_enabled()) {
4117 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4118 PACKET__RECV, &ad);
4119 if (err)
4120 return err;
4121 }
4122
4123 return err;
4124 }
4125
4126 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4127 int __user *optlen, unsigned len)
4128 {
4129 int err = 0;
4130 char *scontext;
4131 u32 scontext_len;
4132 struct sk_security_struct *ssec;
4133 struct inode_security_struct *isec;
4134 u32 peer_sid = SECSID_NULL;
4135
4136 isec = SOCK_INODE(sock)->i_security;
4137
4138 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4139 isec->sclass == SECCLASS_TCP_SOCKET) {
4140 ssec = sock->sk->sk_security;
4141 peer_sid = ssec->peer_sid;
4142 }
4143 if (peer_sid == SECSID_NULL) {
4144 err = -ENOPROTOOPT;
4145 goto out;
4146 }
4147
4148 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4149
4150 if (err)
4151 goto out;
4152
4153 if (scontext_len > len) {
4154 err = -ERANGE;
4155 goto out_len;
4156 }
4157
4158 if (copy_to_user(optval, scontext, scontext_len))
4159 err = -EFAULT;
4160
4161 out_len:
4162 if (put_user(scontext_len, optlen))
4163 err = -EFAULT;
4164
4165 kfree(scontext);
4166 out:
4167 return err;
4168 }
4169
4170 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4171 {
4172 u32 peer_secid = SECSID_NULL;
4173 u16 family;
4174
4175 if (sock)
4176 family = sock->sk->sk_family;
4177 else if (skb && skb->sk)
4178 family = skb->sk->sk_family;
4179 else
4180 goto out;
4181
4182 if (sock && family == PF_UNIX)
4183 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4184 else if (skb)
4185 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4186
4187 out:
4188 *secid = peer_secid;
4189 if (peer_secid == SECSID_NULL)
4190 return -EINVAL;
4191 return 0;
4192 }
4193
4194 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4195 {
4196 return sk_alloc_security(sk, family, priority);
4197 }
4198
4199 static void selinux_sk_free_security(struct sock *sk)
4200 {
4201 sk_free_security(sk);
4202 }
4203
4204 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4205 {
4206 struct sk_security_struct *ssec = sk->sk_security;
4207 struct sk_security_struct *newssec = newsk->sk_security;
4208
4209 newssec->sid = ssec->sid;
4210 newssec->peer_sid = ssec->peer_sid;
4211 newssec->sclass = ssec->sclass;
4212
4213 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4214 }
4215
4216 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4217 {
4218 if (!sk)
4219 *secid = SECINITSID_ANY_SOCKET;
4220 else {
4221 struct sk_security_struct *sksec = sk->sk_security;
4222
4223 *secid = sksec->sid;
4224 }
4225 }
4226
4227 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4228 {
4229 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4230 struct sk_security_struct *sksec = sk->sk_security;
4231
4232 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4233 sk->sk_family == PF_UNIX)
4234 isec->sid = sksec->sid;
4235 sksec->sclass = isec->sclass;
4236
4237 selinux_netlbl_sock_graft(sk, parent);
4238 }
4239
4240 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4241 struct request_sock *req)
4242 {
4243 struct sk_security_struct *sksec = sk->sk_security;
4244 int err;
4245 u32 newsid;
4246 u32 peersid;
4247
4248 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4249 if (err)
4250 return err;
4251 if (peersid == SECSID_NULL) {
4252 req->secid = sksec->sid;
4253 req->peer_secid = SECSID_NULL;
4254 return 0;
4255 }
4256
4257 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4258 if (err)
4259 return err;
4260
4261 req->secid = newsid;
4262 req->peer_secid = peersid;
4263 return 0;
4264 }
4265
4266 static void selinux_inet_csk_clone(struct sock *newsk,
4267 const struct request_sock *req)
4268 {
4269 struct sk_security_struct *newsksec = newsk->sk_security;
4270
4271 newsksec->sid = req->secid;
4272 newsksec->peer_sid = req->peer_secid;
4273 /* NOTE: Ideally, we should also get the isec->sid for the
4274 new socket in sync, but we don't have the isec available yet.
4275 So we will wait until sock_graft to do it, by which
4276 time it will have been created and available. */
4277
4278 /* We don't need to take any sort of lock here as we are the only
4279 * thread with access to newsksec */
4280 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4281 }
4282
4283 static void selinux_inet_conn_established(struct sock *sk,
4284 struct sk_buff *skb)
4285 {
4286 struct sk_security_struct *sksec = sk->sk_security;
4287
4288 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4289 }
4290
4291 static void selinux_req_classify_flow(const struct request_sock *req,
4292 struct flowi *fl)
4293 {
4294 fl->secid = req->secid;
4295 }
4296
4297 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4298 {
4299 int err = 0;
4300 u32 perm;
4301 struct nlmsghdr *nlh;
4302 struct socket *sock = sk->sk_socket;
4303 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4304
4305 if (skb->len < NLMSG_SPACE(0)) {
4306 err = -EINVAL;
4307 goto out;
4308 }
4309 nlh = nlmsg_hdr(skb);
4310
4311 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4312 if (err) {
4313 if (err == -EINVAL) {
4314 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4315 "SELinux: unrecognized netlink message"
4316 " type=%hu for sclass=%hu\n",
4317 nlh->nlmsg_type, isec->sclass);
4318 if (!selinux_enforcing)
4319 err = 0;
4320 }
4321
4322 /* Ignore */
4323 if (err == -ENOENT)
4324 err = 0;
4325 goto out;
4326 }
4327
4328 err = socket_has_perm(current, sock, perm);
4329 out:
4330 return err;
4331 }
4332
4333 #ifdef CONFIG_NETFILTER
4334
4335 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4336 u16 family)
4337 {
4338 char *addrp;
4339 u32 peer_sid;
4340 struct avc_audit_data ad;
4341 u8 secmark_active;
4342 u8 peerlbl_active;
4343
4344 if (!selinux_policycap_netpeer)
4345 return NF_ACCEPT;
4346
4347 secmark_active = selinux_secmark_enabled();
4348 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4349 if (!secmark_active && !peerlbl_active)
4350 return NF_ACCEPT;
4351
4352 AVC_AUDIT_DATA_INIT(&ad, NET);
4353 ad.u.net.netif = ifindex;
4354 ad.u.net.family = family;
4355 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4356 return NF_DROP;
4357
4358 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4359 return NF_DROP;
4360
4361 if (peerlbl_active)
4362 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4363 peer_sid, &ad) != 0)
4364 return NF_DROP;
4365
4366 if (secmark_active)
4367 if (avc_has_perm(peer_sid, skb->secmark,
4368 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4369 return NF_DROP;
4370
4371 return NF_ACCEPT;
4372 }
4373
4374 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4375 struct sk_buff *skb,
4376 const struct net_device *in,
4377 const struct net_device *out,
4378 int (*okfn)(struct sk_buff *))
4379 {
4380 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4381 }
4382
4383 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4384 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4385 struct sk_buff *skb,
4386 const struct net_device *in,
4387 const struct net_device *out,
4388 int (*okfn)(struct sk_buff *))
4389 {
4390 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4391 }
4392 #endif /* IPV6 */
4393
4394 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4395 int ifindex,
4396 struct avc_audit_data *ad,
4397 u16 family, char *addrp)
4398 {
4399 int err;
4400 struct sk_security_struct *sksec = sk->sk_security;
4401 u16 sk_class;
4402 u32 netif_perm, node_perm, send_perm;
4403 u32 port_sid, node_sid, if_sid, sk_sid;
4404
4405 sk_sid = sksec->sid;
4406 sk_class = sksec->sclass;
4407
4408 switch (sk_class) {
4409 case SECCLASS_UDP_SOCKET:
4410 netif_perm = NETIF__UDP_SEND;
4411 node_perm = NODE__UDP_SEND;
4412 send_perm = UDP_SOCKET__SEND_MSG;
4413 break;
4414 case SECCLASS_TCP_SOCKET:
4415 netif_perm = NETIF__TCP_SEND;
4416 node_perm = NODE__TCP_SEND;
4417 send_perm = TCP_SOCKET__SEND_MSG;
4418 break;
4419 case SECCLASS_DCCP_SOCKET:
4420 netif_perm = NETIF__DCCP_SEND;
4421 node_perm = NODE__DCCP_SEND;
4422 send_perm = DCCP_SOCKET__SEND_MSG;
4423 break;
4424 default:
4425 netif_perm = NETIF__RAWIP_SEND;
4426 node_perm = NODE__RAWIP_SEND;
4427 send_perm = 0;
4428 break;
4429 }
4430
4431 err = sel_netif_sid(ifindex, &if_sid);
4432 if (err)
4433 return err;
4434 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4435 return err;
4436
4437 err = sel_netnode_sid(addrp, family, &node_sid);
4438 if (err)
4439 return err;
4440 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4441 if (err)
4442 return err;
4443
4444 if (send_perm != 0)
4445 return 0;
4446
4447 err = sel_netport_sid(sk->sk_protocol,
4448 ntohs(ad->u.net.dport), &port_sid);
4449 if (unlikely(err)) {
4450 printk(KERN_WARNING
4451 "SELinux: failure in"
4452 " selinux_ip_postroute_iptables_compat(),"
4453 " network port label not found\n");
4454 return err;
4455 }
4456 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4457 }
4458
4459 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4460 int ifindex,
4461 struct avc_audit_data *ad,
4462 u16 family,
4463 char *addrp,
4464 u8 proto)
4465 {
4466 struct sock *sk = skb->sk;
4467 struct sk_security_struct *sksec;
4468
4469 if (sk == NULL)
4470 return NF_ACCEPT;
4471 sksec = sk->sk_security;
4472
4473 if (selinux_compat_net) {
4474 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4475 ad, family, addrp))
4476 return NF_DROP;
4477 } else {
4478 if (avc_has_perm(sksec->sid, skb->secmark,
4479 SECCLASS_PACKET, PACKET__SEND, ad))
4480 return NF_DROP;
4481 }
4482
4483 if (selinux_policycap_netpeer)
4484 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4485 return NF_DROP;
4486
4487 return NF_ACCEPT;
4488 }
4489
4490 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4491 u16 family)
4492 {
4493 u32 secmark_perm;
4494 u32 peer_sid;
4495 struct sock *sk;
4496 struct avc_audit_data ad;
4497 char *addrp;
4498 u8 proto;
4499 u8 secmark_active;
4500 u8 peerlbl_active;
4501
4502 AVC_AUDIT_DATA_INIT(&ad, NET);
4503 ad.u.net.netif = ifindex;
4504 ad.u.net.family = family;
4505 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4506 return NF_DROP;
4507
4508 /* If any sort of compatibility mode is enabled then handoff processing
4509 * to the selinux_ip_postroute_compat() function to deal with the
4510 * special handling. We do this in an attempt to keep this function
4511 * as fast and as clean as possible. */
4512 if (selinux_compat_net || !selinux_policycap_netpeer)
4513 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4514 family, addrp, proto);
4515
4516 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4517 * packet transformation so allow the packet to pass without any checks
4518 * since we'll have another chance to perform access control checks
4519 * when the packet is on it's final way out.
4520 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4521 * is NULL, in this case go ahead and apply access control. */
4522 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4523 return NF_ACCEPT;
4524
4525 secmark_active = selinux_secmark_enabled();
4526 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4527 if (!secmark_active && !peerlbl_active)
4528 return NF_ACCEPT;
4529
4530 /* if the packet is locally generated (skb->sk != NULL) then use the
4531 * socket's label as the peer label, otherwise the packet is being
4532 * forwarded through this system and we need to fetch the peer label
4533 * directly from the packet */
4534 sk = skb->sk;
4535 if (sk) {
4536 struct sk_security_struct *sksec = sk->sk_security;
4537 peer_sid = sksec->sid;
4538 secmark_perm = PACKET__SEND;
4539 } else {
4540 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4541 return NF_DROP;
4542 secmark_perm = PACKET__FORWARD_OUT;
4543 }
4544
4545 if (secmark_active)
4546 if (avc_has_perm(peer_sid, skb->secmark,
4547 SECCLASS_PACKET, secmark_perm, &ad))
4548 return NF_DROP;
4549
4550 if (peerlbl_active) {
4551 u32 if_sid;
4552 u32 node_sid;
4553
4554 if (sel_netif_sid(ifindex, &if_sid))
4555 return NF_DROP;
4556 if (avc_has_perm(peer_sid, if_sid,
4557 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4558 return NF_DROP;
4559
4560 if (sel_netnode_sid(addrp, family, &node_sid))
4561 return NF_DROP;
4562 if (avc_has_perm(peer_sid, node_sid,
4563 SECCLASS_NODE, NODE__SENDTO, &ad))
4564 return NF_DROP;
4565 }
4566
4567 return NF_ACCEPT;
4568 }
4569
4570 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4571 struct sk_buff *skb,
4572 const struct net_device *in,
4573 const struct net_device *out,
4574 int (*okfn)(struct sk_buff *))
4575 {
4576 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4577 }
4578
4579 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4580 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4581 struct sk_buff *skb,
4582 const struct net_device *in,
4583 const struct net_device *out,
4584 int (*okfn)(struct sk_buff *))
4585 {
4586 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4587 }
4588 #endif /* IPV6 */
4589
4590 #endif /* CONFIG_NETFILTER */
4591
4592 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4593 {
4594 int err;
4595
4596 err = secondary_ops->netlink_send(sk, skb);
4597 if (err)
4598 return err;
4599
4600 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4601 err = selinux_nlmsg_perm(sk, skb);
4602
4603 return err;
4604 }
4605
4606 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4607 {
4608 int err;
4609 struct avc_audit_data ad;
4610
4611 err = secondary_ops->netlink_recv(skb, capability);
4612 if (err)
4613 return err;
4614
4615 AVC_AUDIT_DATA_INIT(&ad, CAP);
4616 ad.u.cap = capability;
4617
4618 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4619 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4620 }
4621
4622 static int ipc_alloc_security(struct task_struct *task,
4623 struct kern_ipc_perm *perm,
4624 u16 sclass)
4625 {
4626 struct task_security_struct *tsec = task->security;
4627 struct ipc_security_struct *isec;
4628
4629 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4630 if (!isec)
4631 return -ENOMEM;
4632
4633 isec->sclass = sclass;
4634 isec->sid = tsec->sid;
4635 perm->security = isec;
4636
4637 return 0;
4638 }
4639
4640 static void ipc_free_security(struct kern_ipc_perm *perm)
4641 {
4642 struct ipc_security_struct *isec = perm->security;
4643 perm->security = NULL;
4644 kfree(isec);
4645 }
4646
4647 static int msg_msg_alloc_security(struct msg_msg *msg)
4648 {
4649 struct msg_security_struct *msec;
4650
4651 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4652 if (!msec)
4653 return -ENOMEM;
4654
4655 msec->sid = SECINITSID_UNLABELED;
4656 msg->security = msec;
4657
4658 return 0;
4659 }
4660
4661 static void msg_msg_free_security(struct msg_msg *msg)
4662 {
4663 struct msg_security_struct *msec = msg->security;
4664
4665 msg->security = NULL;
4666 kfree(msec);
4667 }
4668
4669 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4670 u32 perms)
4671 {
4672 struct task_security_struct *tsec;
4673 struct ipc_security_struct *isec;
4674 struct avc_audit_data ad;
4675
4676 tsec = current->security;
4677 isec = ipc_perms->security;
4678
4679 AVC_AUDIT_DATA_INIT(&ad, IPC);
4680 ad.u.ipc_id = ipc_perms->key;
4681
4682 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4683 }
4684
4685 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4686 {
4687 return msg_msg_alloc_security(msg);
4688 }
4689
4690 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4691 {
4692 msg_msg_free_security(msg);
4693 }
4694
4695 /* message queue security operations */
4696 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4697 {
4698 struct task_security_struct *tsec;
4699 struct ipc_security_struct *isec;
4700 struct avc_audit_data ad;
4701 int rc;
4702
4703 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4704 if (rc)
4705 return rc;
4706
4707 tsec = current->security;
4708 isec = msq->q_perm.security;
4709
4710 AVC_AUDIT_DATA_INIT(&ad, IPC);
4711 ad.u.ipc_id = msq->q_perm.key;
4712
4713 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4714 MSGQ__CREATE, &ad);
4715 if (rc) {
4716 ipc_free_security(&msq->q_perm);
4717 return rc;
4718 }
4719 return 0;
4720 }
4721
4722 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4723 {
4724 ipc_free_security(&msq->q_perm);
4725 }
4726
4727 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4728 {
4729 struct task_security_struct *tsec;
4730 struct ipc_security_struct *isec;
4731 struct avc_audit_data ad;
4732
4733 tsec = current->security;
4734 isec = msq->q_perm.security;
4735
4736 AVC_AUDIT_DATA_INIT(&ad, IPC);
4737 ad.u.ipc_id = msq->q_perm.key;
4738
4739 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4740 MSGQ__ASSOCIATE, &ad);
4741 }
4742
4743 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4744 {
4745 int err;
4746 int perms;
4747
4748 switch (cmd) {
4749 case IPC_INFO:
4750 case MSG_INFO:
4751 /* No specific object, just general system-wide information. */
4752 return task_has_system(current, SYSTEM__IPC_INFO);
4753 case IPC_STAT:
4754 case MSG_STAT:
4755 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4756 break;
4757 case IPC_SET:
4758 perms = MSGQ__SETATTR;
4759 break;
4760 case IPC_RMID:
4761 perms = MSGQ__DESTROY;
4762 break;
4763 default:
4764 return 0;
4765 }
4766
4767 err = ipc_has_perm(&msq->q_perm, perms);
4768 return err;
4769 }
4770
4771 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4772 {
4773 struct task_security_struct *tsec;
4774 struct ipc_security_struct *isec;
4775 struct msg_security_struct *msec;
4776 struct avc_audit_data ad;
4777 int rc;
4778
4779 tsec = current->security;
4780 isec = msq->q_perm.security;
4781 msec = msg->security;
4782
4783 /*
4784 * First time through, need to assign label to the message
4785 */
4786 if (msec->sid == SECINITSID_UNLABELED) {
4787 /*
4788 * Compute new sid based on current process and
4789 * message queue this message will be stored in
4790 */
4791 rc = security_transition_sid(tsec->sid,
4792 isec->sid,
4793 SECCLASS_MSG,
4794 &msec->sid);
4795 if (rc)
4796 return rc;
4797 }
4798
4799 AVC_AUDIT_DATA_INIT(&ad, IPC);
4800 ad.u.ipc_id = msq->q_perm.key;
4801
4802 /* Can this process write to the queue? */
4803 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4804 MSGQ__WRITE, &ad);
4805 if (!rc)
4806 /* Can this process send the message */
4807 rc = avc_has_perm(tsec->sid, msec->sid,
4808 SECCLASS_MSG, MSG__SEND, &ad);
4809 if (!rc)
4810 /* Can the message be put in the queue? */
4811 rc = avc_has_perm(msec->sid, isec->sid,
4812 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4813
4814 return rc;
4815 }
4816
4817 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4818 struct task_struct *target,
4819 long type, int mode)
4820 {
4821 struct task_security_struct *tsec;
4822 struct ipc_security_struct *isec;
4823 struct msg_security_struct *msec;
4824 struct avc_audit_data ad;
4825 int rc;
4826
4827 tsec = target->security;
4828 isec = msq->q_perm.security;
4829 msec = msg->security;
4830
4831 AVC_AUDIT_DATA_INIT(&ad, IPC);
4832 ad.u.ipc_id = msq->q_perm.key;
4833
4834 rc = avc_has_perm(tsec->sid, isec->sid,
4835 SECCLASS_MSGQ, MSGQ__READ, &ad);
4836 if (!rc)
4837 rc = avc_has_perm(tsec->sid, msec->sid,
4838 SECCLASS_MSG, MSG__RECEIVE, &ad);
4839 return rc;
4840 }
4841
4842 /* Shared Memory security operations */
4843 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4844 {
4845 struct task_security_struct *tsec;
4846 struct ipc_security_struct *isec;
4847 struct avc_audit_data ad;
4848 int rc;
4849
4850 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4851 if (rc)
4852 return rc;
4853
4854 tsec = current->security;
4855 isec = shp->shm_perm.security;
4856
4857 AVC_AUDIT_DATA_INIT(&ad, IPC);
4858 ad.u.ipc_id = shp->shm_perm.key;
4859
4860 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4861 SHM__CREATE, &ad);
4862 if (rc) {
4863 ipc_free_security(&shp->shm_perm);
4864 return rc;
4865 }
4866 return 0;
4867 }
4868
4869 static void selinux_shm_free_security(struct shmid_kernel *shp)
4870 {
4871 ipc_free_security(&shp->shm_perm);
4872 }
4873
4874 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4875 {
4876 struct task_security_struct *tsec;
4877 struct ipc_security_struct *isec;
4878 struct avc_audit_data ad;
4879
4880 tsec = current->security;
4881 isec = shp->shm_perm.security;
4882
4883 AVC_AUDIT_DATA_INIT(&ad, IPC);
4884 ad.u.ipc_id = shp->shm_perm.key;
4885
4886 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4887 SHM__ASSOCIATE, &ad);
4888 }
4889
4890 /* Note, at this point, shp is locked down */
4891 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4892 {
4893 int perms;
4894 int err;
4895
4896 switch (cmd) {
4897 case IPC_INFO:
4898 case SHM_INFO:
4899 /* No specific object, just general system-wide information. */
4900 return task_has_system(current, SYSTEM__IPC_INFO);
4901 case IPC_STAT:
4902 case SHM_STAT:
4903 perms = SHM__GETATTR | SHM__ASSOCIATE;
4904 break;
4905 case IPC_SET:
4906 perms = SHM__SETATTR;
4907 break;
4908 case SHM_LOCK:
4909 case SHM_UNLOCK:
4910 perms = SHM__LOCK;
4911 break;
4912 case IPC_RMID:
4913 perms = SHM__DESTROY;
4914 break;
4915 default:
4916 return 0;
4917 }
4918
4919 err = ipc_has_perm(&shp->shm_perm, perms);
4920 return err;
4921 }
4922
4923 static int selinux_shm_shmat(struct shmid_kernel *shp,
4924 char __user *shmaddr, int shmflg)
4925 {
4926 u32 perms;
4927 int rc;
4928
4929 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4930 if (rc)
4931 return rc;
4932
4933 if (shmflg & SHM_RDONLY)
4934 perms = SHM__READ;
4935 else
4936 perms = SHM__READ | SHM__WRITE;
4937
4938 return ipc_has_perm(&shp->shm_perm, perms);
4939 }
4940
4941 /* Semaphore security operations */
4942 static int selinux_sem_alloc_security(struct sem_array *sma)
4943 {
4944 struct task_security_struct *tsec;
4945 struct ipc_security_struct *isec;
4946 struct avc_audit_data ad;
4947 int rc;
4948
4949 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4950 if (rc)
4951 return rc;
4952
4953 tsec = current->security;
4954 isec = sma->sem_perm.security;
4955
4956 AVC_AUDIT_DATA_INIT(&ad, IPC);
4957 ad.u.ipc_id = sma->sem_perm.key;
4958
4959 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4960 SEM__CREATE, &ad);
4961 if (rc) {
4962 ipc_free_security(&sma->sem_perm);
4963 return rc;
4964 }
4965 return 0;
4966 }
4967
4968 static void selinux_sem_free_security(struct sem_array *sma)
4969 {
4970 ipc_free_security(&sma->sem_perm);
4971 }
4972
4973 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4974 {
4975 struct task_security_struct *tsec;
4976 struct ipc_security_struct *isec;
4977 struct avc_audit_data ad;
4978
4979 tsec = current->security;
4980 isec = sma->sem_perm.security;
4981
4982 AVC_AUDIT_DATA_INIT(&ad, IPC);
4983 ad.u.ipc_id = sma->sem_perm.key;
4984
4985 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4986 SEM__ASSOCIATE, &ad);
4987 }
4988
4989 /* Note, at this point, sma is locked down */
4990 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4991 {
4992 int err;
4993 u32 perms;
4994
4995 switch (cmd) {
4996 case IPC_INFO:
4997 case SEM_INFO:
4998 /* No specific object, just general system-wide information. */
4999 return task_has_system(current, SYSTEM__IPC_INFO);
5000 case GETPID:
5001 case GETNCNT:
5002 case GETZCNT:
5003 perms = SEM__GETATTR;
5004 break;
5005 case GETVAL:
5006 case GETALL:
5007 perms = SEM__READ;
5008 break;
5009 case SETVAL:
5010 case SETALL:
5011 perms = SEM__WRITE;
5012 break;
5013 case IPC_RMID:
5014 perms = SEM__DESTROY;
5015 break;
5016 case IPC_SET:
5017 perms = SEM__SETATTR;
5018 break;
5019 case IPC_STAT:
5020 case SEM_STAT:
5021 perms = SEM__GETATTR | SEM__ASSOCIATE;
5022 break;
5023 default:
5024 return 0;
5025 }
5026
5027 err = ipc_has_perm(&sma->sem_perm, perms);
5028 return err;
5029 }
5030
5031 static int selinux_sem_semop(struct sem_array *sma,
5032 struct sembuf *sops, unsigned nsops, int alter)
5033 {
5034 u32 perms;
5035
5036 if (alter)
5037 perms = SEM__READ | SEM__WRITE;
5038 else
5039 perms = SEM__READ;
5040
5041 return ipc_has_perm(&sma->sem_perm, perms);
5042 }
5043
5044 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5045 {
5046 u32 av = 0;
5047
5048 av = 0;
5049 if (flag & S_IRUGO)
5050 av |= IPC__UNIX_READ;
5051 if (flag & S_IWUGO)
5052 av |= IPC__UNIX_WRITE;
5053
5054 if (av == 0)
5055 return 0;
5056
5057 return ipc_has_perm(ipcp, av);
5058 }
5059
5060 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5061 {
5062 struct ipc_security_struct *isec = ipcp->security;
5063 *secid = isec->sid;
5064 }
5065
5066 /* module stacking operations */
5067 static int selinux_register_security(const char *name, struct security_operations *ops)
5068 {
5069 if (secondary_ops != original_ops) {
5070 printk(KERN_ERR "%s: There is already a secondary security "
5071 "module registered.\n", __func__);
5072 return -EINVAL;
5073 }
5074
5075 secondary_ops = ops;
5076
5077 printk(KERN_INFO "%s: Registering secondary module %s\n",
5078 __func__,
5079 name);
5080
5081 return 0;
5082 }
5083
5084 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5085 {
5086 if (inode)
5087 inode_doinit_with_dentry(inode, dentry);
5088 }
5089
5090 static int selinux_getprocattr(struct task_struct *p,
5091 char *name, char **value)
5092 {
5093 struct task_security_struct *tsec;
5094 u32 sid;
5095 int error;
5096 unsigned len;
5097
5098 if (current != p) {
5099 error = task_has_perm(current, p, PROCESS__GETATTR);
5100 if (error)
5101 return error;
5102 }
5103
5104 tsec = p->security;
5105
5106 if (!strcmp(name, "current"))
5107 sid = tsec->sid;
5108 else if (!strcmp(name, "prev"))
5109 sid = tsec->osid;
5110 else if (!strcmp(name, "exec"))
5111 sid = tsec->exec_sid;
5112 else if (!strcmp(name, "fscreate"))
5113 sid = tsec->create_sid;
5114 else if (!strcmp(name, "keycreate"))
5115 sid = tsec->keycreate_sid;
5116 else if (!strcmp(name, "sockcreate"))
5117 sid = tsec->sockcreate_sid;
5118 else
5119 return -EINVAL;
5120
5121 if (!sid)
5122 return 0;
5123
5124 error = security_sid_to_context(sid, value, &len);
5125 if (error)
5126 return error;
5127 return len;
5128 }
5129
5130 static int selinux_setprocattr(struct task_struct *p,
5131 char *name, void *value, size_t size)
5132 {
5133 struct task_security_struct *tsec;
5134 struct task_struct *tracer;
5135 u32 sid = 0;
5136 int error;
5137 char *str = value;
5138
5139 if (current != p) {
5140 /* SELinux only allows a process to change its own
5141 security attributes. */
5142 return -EACCES;
5143 }
5144
5145 /*
5146 * Basic control over ability to set these attributes at all.
5147 * current == p, but we'll pass them separately in case the
5148 * above restriction is ever removed.
5149 */
5150 if (!strcmp(name, "exec"))
5151 error = task_has_perm(current, p, PROCESS__SETEXEC);
5152 else if (!strcmp(name, "fscreate"))
5153 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5154 else if (!strcmp(name, "keycreate"))
5155 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5156 else if (!strcmp(name, "sockcreate"))
5157 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5158 else if (!strcmp(name, "current"))
5159 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5160 else
5161 error = -EINVAL;
5162 if (error)
5163 return error;
5164
5165 /* Obtain a SID for the context, if one was specified. */
5166 if (size && str[1] && str[1] != '\n') {
5167 if (str[size-1] == '\n') {
5168 str[size-1] = 0;
5169 size--;
5170 }
5171 error = security_context_to_sid(value, size, &sid);
5172 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5173 if (!capable(CAP_MAC_ADMIN))
5174 return error;
5175 error = security_context_to_sid_force(value, size,
5176 &sid);
5177 }
5178 if (error)
5179 return error;
5180 }
5181
5182 /* Permission checking based on the specified context is
5183 performed during the actual operation (execve,
5184 open/mkdir/...), when we know the full context of the
5185 operation. See selinux_bprm_set_security for the execve
5186 checks and may_create for the file creation checks. The
5187 operation will then fail if the context is not permitted. */
5188 tsec = p->security;
5189 if (!strcmp(name, "exec"))
5190 tsec->exec_sid = sid;
5191 else if (!strcmp(name, "fscreate"))
5192 tsec->create_sid = sid;
5193 else if (!strcmp(name, "keycreate")) {
5194 error = may_create_key(sid, p);
5195 if (error)
5196 return error;
5197 tsec->keycreate_sid = sid;
5198 } else if (!strcmp(name, "sockcreate"))
5199 tsec->sockcreate_sid = sid;
5200 else if (!strcmp(name, "current")) {
5201 struct av_decision avd;
5202
5203 if (sid == 0)
5204 return -EINVAL;
5205
5206 /* Only allow single threaded processes to change context */
5207 if (atomic_read(&p->mm->mm_users) != 1) {
5208 struct task_struct *g, *t;
5209 struct mm_struct *mm = p->mm;
5210 read_lock(&tasklist_lock);
5211 do_each_thread(g, t) {
5212 if (t->mm == mm && t != p) {
5213 read_unlock(&tasklist_lock);
5214 return -EPERM;
5215 }
5216 } while_each_thread(g, t);
5217 read_unlock(&tasklist_lock);
5218 }
5219
5220 /* Check permissions for the transition. */
5221 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5222 PROCESS__DYNTRANSITION, NULL);
5223 if (error)
5224 return error;
5225
5226 /* Check for ptracing, and update the task SID if ok.
5227 Otherwise, leave SID unchanged and fail. */
5228 task_lock(p);
5229 rcu_read_lock();
5230 tracer = task_tracer_task(p);
5231 if (tracer != NULL) {
5232 struct task_security_struct *ptsec = tracer->security;
5233 u32 ptsid = ptsec->sid;
5234 rcu_read_unlock();
5235 error = avc_has_perm_noaudit(ptsid, sid,
5236 SECCLASS_PROCESS,
5237 PROCESS__PTRACE, 0, &avd);
5238 if (!error)
5239 tsec->sid = sid;
5240 task_unlock(p);
5241 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5242 PROCESS__PTRACE, &avd, error, NULL);
5243 if (error)
5244 return error;
5245 } else {
5246 rcu_read_unlock();
5247 tsec->sid = sid;
5248 task_unlock(p);
5249 }
5250 } else
5251 return -EINVAL;
5252
5253 return size;
5254 }
5255
5256 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5257 {
5258 return security_sid_to_context(secid, secdata, seclen);
5259 }
5260
5261 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5262 {
5263 return security_context_to_sid(secdata, seclen, secid);
5264 }
5265
5266 static void selinux_release_secctx(char *secdata, u32 seclen)
5267 {
5268 kfree(secdata);
5269 }
5270
5271 #ifdef CONFIG_KEYS
5272
5273 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5274 unsigned long flags)
5275 {
5276 struct task_security_struct *tsec = tsk->security;
5277 struct key_security_struct *ksec;
5278
5279 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5280 if (!ksec)
5281 return -ENOMEM;
5282
5283 if (tsec->keycreate_sid)
5284 ksec->sid = tsec->keycreate_sid;
5285 else
5286 ksec->sid = tsec->sid;
5287 k->security = ksec;
5288
5289 return 0;
5290 }
5291
5292 static void selinux_key_free(struct key *k)
5293 {
5294 struct key_security_struct *ksec = k->security;
5295
5296 k->security = NULL;
5297 kfree(ksec);
5298 }
5299
5300 static int selinux_key_permission(key_ref_t key_ref,
5301 struct task_struct *ctx,
5302 key_perm_t perm)
5303 {
5304 struct key *key;
5305 struct task_security_struct *tsec;
5306 struct key_security_struct *ksec;
5307
5308 key = key_ref_to_ptr(key_ref);
5309
5310 tsec = ctx->security;
5311 ksec = key->security;
5312
5313 /* if no specific permissions are requested, we skip the
5314 permission check. No serious, additional covert channels
5315 appear to be created. */
5316 if (perm == 0)
5317 return 0;
5318
5319 return avc_has_perm(tsec->sid, ksec->sid,
5320 SECCLASS_KEY, perm, NULL);
5321 }
5322
5323 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5324 {
5325 struct key_security_struct *ksec = key->security;
5326 char *context = NULL;
5327 unsigned len;
5328 int rc;
5329
5330 rc = security_sid_to_context(ksec->sid, &context, &len);
5331 if (!rc)
5332 rc = len;
5333 *_buffer = context;
5334 return rc;
5335 }
5336
5337 #endif
5338
5339 static struct security_operations selinux_ops = {
5340 .name = "selinux",
5341
5342 .ptrace = selinux_ptrace,
5343 .capget = selinux_capget,
5344 .capset_check = selinux_capset_check,
5345 .capset_set = selinux_capset_set,
5346 .sysctl = selinux_sysctl,
5347 .capable = selinux_capable,
5348 .quotactl = selinux_quotactl,
5349 .quota_on = selinux_quota_on,
5350 .syslog = selinux_syslog,
5351 .vm_enough_memory = selinux_vm_enough_memory,
5352
5353 .netlink_send = selinux_netlink_send,
5354 .netlink_recv = selinux_netlink_recv,
5355
5356 .bprm_alloc_security = selinux_bprm_alloc_security,
5357 .bprm_free_security = selinux_bprm_free_security,
5358 .bprm_apply_creds = selinux_bprm_apply_creds,
5359 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5360 .bprm_set_security = selinux_bprm_set_security,
5361 .bprm_check_security = selinux_bprm_check_security,
5362 .bprm_secureexec = selinux_bprm_secureexec,
5363
5364 .sb_alloc_security = selinux_sb_alloc_security,
5365 .sb_free_security = selinux_sb_free_security,
5366 .sb_copy_data = selinux_sb_copy_data,
5367 .sb_kern_mount = selinux_sb_kern_mount,
5368 .sb_statfs = selinux_sb_statfs,
5369 .sb_mount = selinux_mount,
5370 .sb_umount = selinux_umount,
5371 .sb_get_mnt_opts = selinux_get_mnt_opts,
5372 .sb_set_mnt_opts = selinux_set_mnt_opts,
5373 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5374 .sb_parse_opts_str = selinux_parse_opts_str,
5375
5376
5377 .inode_alloc_security = selinux_inode_alloc_security,
5378 .inode_free_security = selinux_inode_free_security,
5379 .inode_init_security = selinux_inode_init_security,
5380 .inode_create = selinux_inode_create,
5381 .inode_link = selinux_inode_link,
5382 .inode_unlink = selinux_inode_unlink,
5383 .inode_symlink = selinux_inode_symlink,
5384 .inode_mkdir = selinux_inode_mkdir,
5385 .inode_rmdir = selinux_inode_rmdir,
5386 .inode_mknod = selinux_inode_mknod,
5387 .inode_rename = selinux_inode_rename,
5388 .inode_readlink = selinux_inode_readlink,
5389 .inode_follow_link = selinux_inode_follow_link,
5390 .inode_permission = selinux_inode_permission,
5391 .inode_setattr = selinux_inode_setattr,
5392 .inode_getattr = selinux_inode_getattr,
5393 .inode_setxattr = selinux_inode_setxattr,
5394 .inode_post_setxattr = selinux_inode_post_setxattr,
5395 .inode_getxattr = selinux_inode_getxattr,
5396 .inode_listxattr = selinux_inode_listxattr,
5397 .inode_removexattr = selinux_inode_removexattr,
5398 .inode_getsecurity = selinux_inode_getsecurity,
5399 .inode_setsecurity = selinux_inode_setsecurity,
5400 .inode_listsecurity = selinux_inode_listsecurity,
5401 .inode_need_killpriv = selinux_inode_need_killpriv,
5402 .inode_killpriv = selinux_inode_killpriv,
5403 .inode_getsecid = selinux_inode_getsecid,
5404
5405 .file_permission = selinux_file_permission,
5406 .file_alloc_security = selinux_file_alloc_security,
5407 .file_free_security = selinux_file_free_security,
5408 .file_ioctl = selinux_file_ioctl,
5409 .file_mmap = selinux_file_mmap,
5410 .file_mprotect = selinux_file_mprotect,
5411 .file_lock = selinux_file_lock,
5412 .file_fcntl = selinux_file_fcntl,
5413 .file_set_fowner = selinux_file_set_fowner,
5414 .file_send_sigiotask = selinux_file_send_sigiotask,
5415 .file_receive = selinux_file_receive,
5416
5417 .dentry_open = selinux_dentry_open,
5418
5419 .task_create = selinux_task_create,
5420 .task_alloc_security = selinux_task_alloc_security,
5421 .task_free_security = selinux_task_free_security,
5422 .task_setuid = selinux_task_setuid,
5423 .task_post_setuid = selinux_task_post_setuid,
5424 .task_setgid = selinux_task_setgid,
5425 .task_setpgid = selinux_task_setpgid,
5426 .task_getpgid = selinux_task_getpgid,
5427 .task_getsid = selinux_task_getsid,
5428 .task_getsecid = selinux_task_getsecid,
5429 .task_setgroups = selinux_task_setgroups,
5430 .task_setnice = selinux_task_setnice,
5431 .task_setioprio = selinux_task_setioprio,
5432 .task_getioprio = selinux_task_getioprio,
5433 .task_setrlimit = selinux_task_setrlimit,
5434 .task_setscheduler = selinux_task_setscheduler,
5435 .task_getscheduler = selinux_task_getscheduler,
5436 .task_movememory = selinux_task_movememory,
5437 .task_kill = selinux_task_kill,
5438 .task_wait = selinux_task_wait,
5439 .task_prctl = selinux_task_prctl,
5440 .task_reparent_to_init = selinux_task_reparent_to_init,
5441 .task_to_inode = selinux_task_to_inode,
5442
5443 .ipc_permission = selinux_ipc_permission,
5444 .ipc_getsecid = selinux_ipc_getsecid,
5445
5446 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5447 .msg_msg_free_security = selinux_msg_msg_free_security,
5448
5449 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5450 .msg_queue_free_security = selinux_msg_queue_free_security,
5451 .msg_queue_associate = selinux_msg_queue_associate,
5452 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5453 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5454 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5455
5456 .shm_alloc_security = selinux_shm_alloc_security,
5457 .shm_free_security = selinux_shm_free_security,
5458 .shm_associate = selinux_shm_associate,
5459 .shm_shmctl = selinux_shm_shmctl,
5460 .shm_shmat = selinux_shm_shmat,
5461
5462 .sem_alloc_security = selinux_sem_alloc_security,
5463 .sem_free_security = selinux_sem_free_security,
5464 .sem_associate = selinux_sem_associate,
5465 .sem_semctl = selinux_sem_semctl,
5466 .sem_semop = selinux_sem_semop,
5467
5468 .register_security = selinux_register_security,
5469
5470 .d_instantiate = selinux_d_instantiate,
5471
5472 .getprocattr = selinux_getprocattr,
5473 .setprocattr = selinux_setprocattr,
5474
5475 .secid_to_secctx = selinux_secid_to_secctx,
5476 .secctx_to_secid = selinux_secctx_to_secid,
5477 .release_secctx = selinux_release_secctx,
5478
5479 .unix_stream_connect = selinux_socket_unix_stream_connect,
5480 .unix_may_send = selinux_socket_unix_may_send,
5481
5482 .socket_create = selinux_socket_create,
5483 .socket_post_create = selinux_socket_post_create,
5484 .socket_bind = selinux_socket_bind,
5485 .socket_connect = selinux_socket_connect,
5486 .socket_listen = selinux_socket_listen,
5487 .socket_accept = selinux_socket_accept,
5488 .socket_sendmsg = selinux_socket_sendmsg,
5489 .socket_recvmsg = selinux_socket_recvmsg,
5490 .socket_getsockname = selinux_socket_getsockname,
5491 .socket_getpeername = selinux_socket_getpeername,
5492 .socket_getsockopt = selinux_socket_getsockopt,
5493 .socket_setsockopt = selinux_socket_setsockopt,
5494 .socket_shutdown = selinux_socket_shutdown,
5495 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5496 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5497 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5498 .sk_alloc_security = selinux_sk_alloc_security,
5499 .sk_free_security = selinux_sk_free_security,
5500 .sk_clone_security = selinux_sk_clone_security,
5501 .sk_getsecid = selinux_sk_getsecid,
5502 .sock_graft = selinux_sock_graft,
5503 .inet_conn_request = selinux_inet_conn_request,
5504 .inet_csk_clone = selinux_inet_csk_clone,
5505 .inet_conn_established = selinux_inet_conn_established,
5506 .req_classify_flow = selinux_req_classify_flow,
5507
5508 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5509 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5510 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5511 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5512 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5513 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5514 .xfrm_state_free_security = selinux_xfrm_state_free,
5515 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5516 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5517 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5518 .xfrm_decode_session = selinux_xfrm_decode_session,
5519 #endif
5520
5521 #ifdef CONFIG_KEYS
5522 .key_alloc = selinux_key_alloc,
5523 .key_free = selinux_key_free,
5524 .key_permission = selinux_key_permission,
5525 .key_getsecurity = selinux_key_getsecurity,
5526 #endif
5527
5528 #ifdef CONFIG_AUDIT
5529 .audit_rule_init = selinux_audit_rule_init,
5530 .audit_rule_known = selinux_audit_rule_known,
5531 .audit_rule_match = selinux_audit_rule_match,
5532 .audit_rule_free = selinux_audit_rule_free,
5533 #endif
5534 };
5535
5536 static __init int selinux_init(void)
5537 {
5538 struct task_security_struct *tsec;
5539
5540 if (!security_module_enable(&selinux_ops)) {
5541 selinux_enabled = 0;
5542 return 0;
5543 }
5544
5545 if (!selinux_enabled) {
5546 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5547 return 0;
5548 }
5549
5550 printk(KERN_INFO "SELinux: Initializing.\n");
5551
5552 /* Set the security state for the initial task. */
5553 if (task_alloc_security(current))
5554 panic("SELinux: Failed to initialize initial task.\n");
5555 tsec = current->security;
5556 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5557
5558 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5559 sizeof(struct inode_security_struct),
5560 0, SLAB_PANIC, NULL);
5561 avc_init();
5562
5563 original_ops = secondary_ops = security_ops;
5564 if (!secondary_ops)
5565 panic("SELinux: No initial security operations\n");
5566 if (register_security(&selinux_ops))
5567 panic("SELinux: Unable to register with kernel.\n");
5568
5569 if (selinux_enforcing)
5570 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5571 else
5572 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5573
5574 return 0;
5575 }
5576
5577 void selinux_complete_init(void)
5578 {
5579 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5580
5581 /* Set up any superblocks initialized prior to the policy load. */
5582 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5583 spin_lock(&sb_lock);
5584 spin_lock(&sb_security_lock);
5585 next_sb:
5586 if (!list_empty(&superblock_security_head)) {
5587 struct superblock_security_struct *sbsec =
5588 list_entry(superblock_security_head.next,
5589 struct superblock_security_struct,
5590 list);
5591 struct super_block *sb = sbsec->sb;
5592 sb->s_count++;
5593 spin_unlock(&sb_security_lock);
5594 spin_unlock(&sb_lock);
5595 down_read(&sb->s_umount);
5596 if (sb->s_root)
5597 superblock_doinit(sb, NULL);
5598 drop_super(sb);
5599 spin_lock(&sb_lock);
5600 spin_lock(&sb_security_lock);
5601 list_del_init(&sbsec->list);
5602 goto next_sb;
5603 }
5604 spin_unlock(&sb_security_lock);
5605 spin_unlock(&sb_lock);
5606 }
5607
5608 /* SELinux requires early initialization in order to label
5609 all processes and objects when they are created. */
5610 security_initcall(selinux_init);
5611
5612 #if defined(CONFIG_NETFILTER)
5613
5614 static struct nf_hook_ops selinux_ipv4_ops[] = {
5615 {
5616 .hook = selinux_ipv4_postroute,
5617 .owner = THIS_MODULE,
5618 .pf = PF_INET,
5619 .hooknum = NF_INET_POST_ROUTING,
5620 .priority = NF_IP_PRI_SELINUX_LAST,
5621 },
5622 {
5623 .hook = selinux_ipv4_forward,
5624 .owner = THIS_MODULE,
5625 .pf = PF_INET,
5626 .hooknum = NF_INET_FORWARD,
5627 .priority = NF_IP_PRI_SELINUX_FIRST,
5628 }
5629 };
5630
5631 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5632
5633 static struct nf_hook_ops selinux_ipv6_ops[] = {
5634 {
5635 .hook = selinux_ipv6_postroute,
5636 .owner = THIS_MODULE,
5637 .pf = PF_INET6,
5638 .hooknum = NF_INET_POST_ROUTING,
5639 .priority = NF_IP6_PRI_SELINUX_LAST,
5640 },
5641 {
5642 .hook = selinux_ipv6_forward,
5643 .owner = THIS_MODULE,
5644 .pf = PF_INET6,
5645 .hooknum = NF_INET_FORWARD,
5646 .priority = NF_IP6_PRI_SELINUX_FIRST,
5647 }
5648 };
5649
5650 #endif /* IPV6 */
5651
5652 static int __init selinux_nf_ip_init(void)
5653 {
5654 int err = 0;
5655 u32 iter;
5656
5657 if (!selinux_enabled)
5658 goto out;
5659
5660 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5661
5662 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5663 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5664 if (err)
5665 panic("SELinux: nf_register_hook for IPv4: error %d\n",
5666 err);
5667 }
5668
5669 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5670 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5671 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5672 if (err)
5673 panic("SELinux: nf_register_hook for IPv6: error %d\n",
5674 err);
5675 }
5676 #endif /* IPV6 */
5677
5678 out:
5679 return err;
5680 }
5681
5682 __initcall(selinux_nf_ip_init);
5683
5684 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5685 static void selinux_nf_ip_exit(void)
5686 {
5687 u32 iter;
5688
5689 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5690
5691 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5692 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5693 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5694 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5695 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5696 #endif /* IPV6 */
5697 }
5698 #endif
5699
5700 #else /* CONFIG_NETFILTER */
5701
5702 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5703 #define selinux_nf_ip_exit()
5704 #endif
5705
5706 #endif /* CONFIG_NETFILTER */
5707
5708 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5709 static int selinux_disabled;
5710
5711 int selinux_disable(void)
5712 {
5713 extern void exit_sel_fs(void);
5714
5715 if (ss_initialized) {
5716 /* Not permitted after initial policy load. */
5717 return -EINVAL;
5718 }
5719
5720 if (selinux_disabled) {
5721 /* Only do this once. */
5722 return -EINVAL;
5723 }
5724
5725 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5726
5727 selinux_disabled = 1;
5728 selinux_enabled = 0;
5729
5730 /* Reset security_ops to the secondary module, dummy or capability. */
5731 security_ops = secondary_ops;
5732
5733 /* Unregister netfilter hooks. */
5734 selinux_nf_ip_exit();
5735
5736 /* Unregister selinuxfs. */
5737 exit_sel_fs();
5738
5739 return 0;
5740 }
5741 #endif
Support for the Chinese Samsung S3C2440 based development boards