?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
PM: Convert wakeup flag accessors to inline functions
[linux-2.6/mini2440.git] / security / selinux / hooks.c
blobf9927f02bc3d07d70c352d3669dababde1fd2536
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
16 * Paul Moore <paul.moore@hp.com>
17 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
18 * Yuichi Nakamura <ynakam@hitachisoft.jp>
19 *
20 * This program is free software; you can redistribute it and/or modify
21 * it under the terms of the GNU General Public License version 2,
22 * as published by the Free Software Foundation.
23 */
24
25 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/ptrace.h>
28 #include <linux/errno.h>
29 #include <linux/sched.h>
30 #include <linux/security.h>
31 #include <linux/xattr.h>
32 #include <linux/capability.h>
33 #include <linux/unistd.h>
34 #include <linux/mm.h>
35 #include <linux/mman.h>
36 #include <linux/slab.h>
37 #include <linux/pagemap.h>
38 #include <linux/swap.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <asm/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78
79 #include "avc.h"
80 #include "objsec.h"
81 #include "netif.h"
82 #include "netnode.h"
83 #include "netport.h"
84 #include "xfrm.h"
85 #include "netlabel.h"
86 #include "audit.h"
87
88 #define XATTR_SELINUX_SUFFIX "selinux"
89 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
90
91 #define NUM_SEL_MNT_OPTS 4
92
93 extern unsigned int policydb_loaded_version;
94 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
95 extern int selinux_compat_net;
96 extern struct security_operations *security_ops;
97
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing = 0;
103
104 static int __init enforcing_setup(char *str)
105 {
106 selinux_enforcing = simple_strtol(str,NULL,0);
107 return 1;
108 }
109 __setup("enforcing=", enforcing_setup);
110 #endif
111
112 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
113 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
114
115 static int __init selinux_enabled_setup(char *str)
116 {
117 selinux_enabled = simple_strtol(str, NULL, 0);
118 return 1;
119 }
120 __setup("selinux=", selinux_enabled_setup);
121 #else
122 int selinux_enabled = 1;
123 #endif
124
125 /* Original (dummy) security module. */
126 static struct security_operations *original_ops = NULL;
127
128 /* Minimal support for a secondary security module,
129 just to allow the use of the dummy or capability modules.
130 The owlsm module can alternatively be used as a secondary
131 module as long as CONFIG_OWLSM_FD is not enabled. */
132 static struct security_operations *secondary_ops = NULL;
133
134 /* Lists of inode and superblock security structures initialized
135 before the policy was loaded. */
136 static LIST_HEAD(superblock_security_head);
137 static DEFINE_SPINLOCK(sb_security_lock);
138
139 static struct kmem_cache *sel_inode_cache;
140
141 /**
142 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
143 *
144 * Description:
145 * This function checks the SECMARK reference counter to see if any SECMARK
146 * targets are currently configured, if the reference counter is greater than
147 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
148 * enabled, false (0) if SECMARK is disabled.
149 *
150 */
151 static int selinux_secmark_enabled(void)
152 {
153 return (atomic_read(&selinux_secmark_refcount) > 0);
154 }
155
156 /* Allocate and free functions for each kind of security blob. */
157
158 static int task_alloc_security(struct task_struct *task)
159 {
160 struct task_security_struct *tsec;
161
162 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
163 if (!tsec)
164 return -ENOMEM;
165
166 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
167 task->security = tsec;
168
169 return 0;
170 }
171
172 static void task_free_security(struct task_struct *task)
173 {
174 struct task_security_struct *tsec = task->security;
175 task->security = NULL;
176 kfree(tsec);
177 }
178
179 static int inode_alloc_security(struct inode *inode)
180 {
181 struct task_security_struct *tsec = current->security;
182 struct inode_security_struct *isec;
183
184 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
185 if (!isec)
186 return -ENOMEM;
187
188 mutex_init(&isec->lock);
189 INIT_LIST_HEAD(&isec->list);
190 isec->inode = inode;
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
193 isec->task_sid = tsec->sid;
194 inode->i_security = isec;
195
196 return 0;
197 }
198
199 static void inode_free_security(struct inode *inode)
200 {
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
203
204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
208
209 inode->i_security = NULL;
210 kmem_cache_free(sel_inode_cache, isec);
211 }
212
213 static int file_alloc_security(struct file *file)
214 {
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
217
218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219 if (!fsec)
220 return -ENOMEM;
221
222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
224 file->f_security = fsec;
225
226 return 0;
227 }
228
229 static void file_free_security(struct file *file)
230 {
231 struct file_security_struct *fsec = file->f_security;
232 file->f_security = NULL;
233 kfree(fsec);
234 }
235
236 static int superblock_alloc_security(struct super_block *sb)
237 {
238 struct superblock_security_struct *sbsec;
239
240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
241 if (!sbsec)
242 return -ENOMEM;
243
244 mutex_init(&sbsec->lock);
245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
252 sb->s_security = sbsec;
253
254 return 0;
255 }
256
257 static void superblock_free_security(struct super_block *sb)
258 {
259 struct superblock_security_struct *sbsec = sb->s_security;
260
261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268 }
269
270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
271 {
272 struct sk_security_struct *ssec;
273
274 ssec = kzalloc(sizeof(*ssec), priority);
275 if (!ssec)
276 return -ENOMEM;
277
278 ssec->peer_sid = SECINITSID_UNLABELED;
279 ssec->sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
281
282 selinux_netlbl_sk_security_reset(ssec, family);
283
284 return 0;
285 }
286
287 static void sk_free_security(struct sock *sk)
288 {
289 struct sk_security_struct *ssec = sk->sk_security;
290
291 sk->sk_security = NULL;
292 kfree(ssec);
293 }
294
295 /* The security server must be initialized before
296 any labeling or access decisions can be provided. */
297 extern int ss_initialized;
298
299 /* The file system's label must be initialized prior to use. */
300
301 static char *labeling_behaviors[6] = {
302 "uses xattr",
303 "uses transition SIDs",
304 "uses task SIDs",
305 "uses genfs_contexts",
306 "not configured for labeling",
307 "uses mountpoint labeling",
308 };
309
310 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
311
312 static inline int inode_doinit(struct inode *inode)
313 {
314 return inode_doinit_with_dentry(inode, NULL);
315 }
316
317 enum {
318 Opt_error = -1,
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 3,
322 Opt_rootcontext = 4,
323 };
324
325 static match_table_t tokens = {
326 {Opt_context, CONTEXT_STR "%s"},
327 {Opt_fscontext, FSCONTEXT_STR "%s"},
328 {Opt_defcontext, DEFCONTEXT_STR "%s"},
329 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
330 {Opt_error, NULL},
331 };
332
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
334
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
338 {
339 int rc;
340
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
343 if (rc)
344 return rc;
345
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
348 return rc;
349 }
350
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
354 {
355 int rc;
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
358 if (rc)
359 return rc;
360
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
363 return rc;
364 }
365
366 static int sb_finish_set_opts(struct super_block *sb)
367 {
368 struct superblock_security_struct *sbsec = sb->s_security;
369 struct dentry *root = sb->s_root;
370 struct inode *root_inode = root->d_inode;
371 int rc = 0;
372
373 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
374 /* Make sure that the xattr handler exists and that no
375 error other than -ENODATA is returned by getxattr on
376 the root directory. -ENODATA is ok, as this may be
377 the first boot of the SELinux kernel before we have
378 assigned xattr values to the filesystem. */
379 if (!root_inode->i_op->getxattr) {
380 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
381 "xattr support\n", sb->s_id, sb->s_type->name);
382 rc = -EOPNOTSUPP;
383 goto out;
384 }
385 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
386 if (rc < 0 && rc != -ENODATA) {
387 if (rc == -EOPNOTSUPP)
388 printk(KERN_WARNING "SELinux: (dev %s, type "
389 "%s) has no security xattr handler\n",
390 sb->s_id, sb->s_type->name);
391 else
392 printk(KERN_WARNING "SELinux: (dev %s, type "
393 "%s) getxattr errno %d\n", sb->s_id,
394 sb->s_type->name, -rc);
395 goto out;
396 }
397 }
398
399 sbsec->initialized = 1;
400
401 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
402 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
403 sb->s_id, sb->s_type->name);
404 else
405 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
406 sb->s_id, sb->s_type->name,
407 labeling_behaviors[sbsec->behavior-1]);
408
409 /* Initialize the root inode. */
410 rc = inode_doinit_with_dentry(root_inode, root);
411
412 /* Initialize any other inodes associated with the superblock, e.g.
413 inodes created prior to initial policy load or inodes created
414 during get_sb by a pseudo filesystem that directly
415 populates itself. */
416 spin_lock(&sbsec->isec_lock);
417 next_inode:
418 if (!list_empty(&sbsec->isec_head)) {
419 struct inode_security_struct *isec =
420 list_entry(sbsec->isec_head.next,
421 struct inode_security_struct, list);
422 struct inode *inode = isec->inode;
423 spin_unlock(&sbsec->isec_lock);
424 inode = igrab(inode);
425 if (inode) {
426 if (!IS_PRIVATE(inode))
427 inode_doinit(inode);
428 iput(inode);
429 }
430 spin_lock(&sbsec->isec_lock);
431 list_del_init(&isec->list);
432 goto next_inode;
433 }
434 spin_unlock(&sbsec->isec_lock);
435 out:
436 return rc;
437 }
438
439 /*
440 * This function should allow an FS to ask what it's mount security
441 * options were so it can use those later for submounts, displaying
442 * mount options, or whatever.
443 */
444 static int selinux_get_mnt_opts(const struct super_block *sb,
445 struct security_mnt_opts *opts)
446 {
447 int rc = 0, i;
448 struct superblock_security_struct *sbsec = sb->s_security;
449 char *context = NULL;
450 u32 len;
451 char tmp;
452
453 security_init_mnt_opts(opts);
454
455 if (!sbsec->initialized)
456 return -EINVAL;
457
458 if (!ss_initialized)
459 return -EINVAL;
460
461 /*
462 * if we ever use sbsec flags for anything other than tracking mount
463 * settings this is going to need a mask
464 */
465 tmp = sbsec->flags;
466 /* count the number of mount options for this sb */
467 for (i = 0; i < 8; i++) {
468 if (tmp & 0x01)
469 opts->num_mnt_opts++;
470 tmp >>= 1;
471 }
472
473 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
474 if (!opts->mnt_opts) {
475 rc = -ENOMEM;
476 goto out_free;
477 }
478
479 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
480 if (!opts->mnt_opts_flags) {
481 rc = -ENOMEM;
482 goto out_free;
483 }
484
485 i = 0;
486 if (sbsec->flags & FSCONTEXT_MNT) {
487 rc = security_sid_to_context(sbsec->sid, &context, &len);
488 if (rc)
489 goto out_free;
490 opts->mnt_opts[i] = context;
491 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
492 }
493 if (sbsec->flags & CONTEXT_MNT) {
494 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
495 if (rc)
496 goto out_free;
497 opts->mnt_opts[i] = context;
498 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
499 }
500 if (sbsec->flags & DEFCONTEXT_MNT) {
501 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
502 if (rc)
503 goto out_free;
504 opts->mnt_opts[i] = context;
505 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
506 }
507 if (sbsec->flags & ROOTCONTEXT_MNT) {
508 struct inode *root = sbsec->sb->s_root->d_inode;
509 struct inode_security_struct *isec = root->i_security;
510
511 rc = security_sid_to_context(isec->sid, &context, &len);
512 if (rc)
513 goto out_free;
514 opts->mnt_opts[i] = context;
515 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
516 }
517
518 BUG_ON(i != opts->num_mnt_opts);
519
520 return 0;
521
522 out_free:
523 security_free_mnt_opts(opts);
524 return rc;
525 }
526
527 static int bad_option(struct superblock_security_struct *sbsec, char flag,
528 u32 old_sid, u32 new_sid)
529 {
530 /* check if the old mount command had the same options */
531 if (sbsec->initialized)
532 if (!(sbsec->flags & flag) ||
533 (old_sid != new_sid))
534 return 1;
535
536 /* check if we were passed the same options twice,
537 * aka someone passed context=a,context=b
538 */
539 if (!sbsec->initialized)
540 if (sbsec->flags & flag)
541 return 1;
542 return 0;
543 }
544
545 /*
546 * Allow filesystems with binary mount data to explicitly set mount point
547 * labeling information.
548 */
549 static int selinux_set_mnt_opts(struct super_block *sb,
550 struct security_mnt_opts *opts)
551 {
552 int rc = 0, i;
553 struct task_security_struct *tsec = current->security;
554 struct superblock_security_struct *sbsec = sb->s_security;
555 const char *name = sb->s_type->name;
556 struct inode *inode = sbsec->sb->s_root->d_inode;
557 struct inode_security_struct *root_isec = inode->i_security;
558 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
559 u32 defcontext_sid = 0;
560 char **mount_options = opts->mnt_opts;
561 int *flags = opts->mnt_opts_flags;
562 int num_opts = opts->num_mnt_opts;
563
564 mutex_lock(&sbsec->lock);
565
566 if (!ss_initialized) {
567 if (!num_opts) {
568 /* Defer initialization until selinux_complete_init,
569 after the initial policy is loaded and the security
570 server is ready to handle calls. */
571 spin_lock(&sb_security_lock);
572 if (list_empty(&sbsec->list))
573 list_add(&sbsec->list, &superblock_security_head);
574 spin_unlock(&sb_security_lock);
575 goto out;
576 }
577 rc = -EINVAL;
578 printk(KERN_WARNING "Unable to set superblock options before "
579 "the security server is initialized\n");
580 goto out;
581 }
582
583 /*
584 * Binary mount data FS will come through this function twice. Once
585 * from an explicit call and once from the generic calls from the vfs.
586 * Since the generic VFS calls will not contain any security mount data
587 * we need to skip the double mount verification.
588 *
589 * This does open a hole in which we will not notice if the first
590 * mount using this sb set explict options and a second mount using
591 * this sb does not set any security options. (The first options
592 * will be used for both mounts)
593 */
594 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
595 && (num_opts == 0))
596 goto out;
597
598 /*
599 * parse the mount options, check if they are valid sids.
600 * also check if someone is trying to mount the same sb more
601 * than once with different security options.
602 */
603 for (i = 0; i < num_opts; i++) {
604 u32 sid;
605 rc = security_context_to_sid(mount_options[i],
606 strlen(mount_options[i]), &sid);
607 if (rc) {
608 printk(KERN_WARNING "SELinux: security_context_to_sid"
609 "(%s) failed for (dev %s, type %s) errno=%d\n",
610 mount_options[i], sb->s_id, name, rc);
611 goto out;
612 }
613 switch (flags[i]) {
614 case FSCONTEXT_MNT:
615 fscontext_sid = sid;
616
617 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
618 fscontext_sid))
619 goto out_double_mount;
620
621 sbsec->flags |= FSCONTEXT_MNT;
622 break;
623 case CONTEXT_MNT:
624 context_sid = sid;
625
626 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
627 context_sid))
628 goto out_double_mount;
629
630 sbsec->flags |= CONTEXT_MNT;
631 break;
632 case ROOTCONTEXT_MNT:
633 rootcontext_sid = sid;
634
635 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
636 rootcontext_sid))
637 goto out_double_mount;
638
639 sbsec->flags |= ROOTCONTEXT_MNT;
640
641 break;
642 case DEFCONTEXT_MNT:
643 defcontext_sid = sid;
644
645 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
646 defcontext_sid))
647 goto out_double_mount;
648
649 sbsec->flags |= DEFCONTEXT_MNT;
650
651 break;
652 default:
653 rc = -EINVAL;
654 goto out;
655 }
656 }
657
658 if (sbsec->initialized) {
659 /* previously mounted with options, but not on this attempt? */
660 if (sbsec->flags && !num_opts)
661 goto out_double_mount;
662 rc = 0;
663 goto out;
664 }
665
666 if (strcmp(sb->s_type->name, "proc") == 0)
667 sbsec->proc = 1;
668
669 /* Determine the labeling behavior to use for this filesystem type. */
670 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
671 if (rc) {
672 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
673 __func__, sb->s_type->name, rc);
674 goto out;
675 }
676
677 /* sets the context of the superblock for the fs being mounted. */
678 if (fscontext_sid) {
679
680 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
681 if (rc)
682 goto out;
683
684 sbsec->sid = fscontext_sid;
685 }
686
687 /*
688 * Switch to using mount point labeling behavior.
689 * sets the label used on all file below the mountpoint, and will set
690 * the superblock context if not already set.
691 */
692 if (context_sid) {
693 if (!fscontext_sid) {
694 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
695 if (rc)
696 goto out;
697 sbsec->sid = context_sid;
698 } else {
699 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
700 if (rc)
701 goto out;
702 }
703 if (!rootcontext_sid)
704 rootcontext_sid = context_sid;
705
706 sbsec->mntpoint_sid = context_sid;
707 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
708 }
709
710 if (rootcontext_sid) {
711 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
712 if (rc)
713 goto out;
714
715 root_isec->sid = rootcontext_sid;
716 root_isec->initialized = 1;
717 }
718
719 if (defcontext_sid) {
720 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
721 rc = -EINVAL;
722 printk(KERN_WARNING "SELinux: defcontext option is "
723 "invalid for this filesystem type\n");
724 goto out;
725 }
726
727 if (defcontext_sid != sbsec->def_sid) {
728 rc = may_context_mount_inode_relabel(defcontext_sid,
729 sbsec, tsec);
730 if (rc)
731 goto out;
732 }
733
734 sbsec->def_sid = defcontext_sid;
735 }
736
737 rc = sb_finish_set_opts(sb);
738 out:
739 mutex_unlock(&sbsec->lock);
740 return rc;
741 out_double_mount:
742 rc = -EINVAL;
743 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
744 "security settings for (dev %s, type %s)\n", sb->s_id, name);
745 goto out;
746 }
747
748 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
749 struct super_block *newsb)
750 {
751 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
752 struct superblock_security_struct *newsbsec = newsb->s_security;
753
754 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
755 int set_context = (oldsbsec->flags & CONTEXT_MNT);
756 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
757
758 /* we can't error, we can't save the info, this shouldn't get called
759 * this early in the boot process. */
760 BUG_ON(!ss_initialized);
761
762 /* how can we clone if the old one wasn't set up?? */
763 BUG_ON(!oldsbsec->initialized);
764
765 /* if fs is reusing a sb, just let its options stand... */
766 if (newsbsec->initialized)
767 return;
768
769 mutex_lock(&newsbsec->lock);
770
771 newsbsec->flags = oldsbsec->flags;
772
773 newsbsec->sid = oldsbsec->sid;
774 newsbsec->def_sid = oldsbsec->def_sid;
775 newsbsec->behavior = oldsbsec->behavior;
776
777 if (set_context) {
778 u32 sid = oldsbsec->mntpoint_sid;
779
780 if (!set_fscontext)
781 newsbsec->sid = sid;
782 if (!set_rootcontext) {
783 struct inode *newinode = newsb->s_root->d_inode;
784 struct inode_security_struct *newisec = newinode->i_security;
785 newisec->sid = sid;
786 }
787 newsbsec->mntpoint_sid = sid;
788 }
789 if (set_rootcontext) {
790 const struct inode *oldinode = oldsb->s_root->d_inode;
791 const struct inode_security_struct *oldisec = oldinode->i_security;
792 struct inode *newinode = newsb->s_root->d_inode;
793 struct inode_security_struct *newisec = newinode->i_security;
794
795 newisec->sid = oldisec->sid;
796 }
797
798 sb_finish_set_opts(newsb);
799 mutex_unlock(&newsbsec->lock);
800 }
801
802 static int selinux_parse_opts_str(char *options,
803 struct security_mnt_opts *opts)
804 {
805 char *p;
806 char *context = NULL, *defcontext = NULL;
807 char *fscontext = NULL, *rootcontext = NULL;
808 int rc, num_mnt_opts = 0;
809
810 opts->num_mnt_opts = 0;
811
812 /* Standard string-based options. */
813 while ((p = strsep(&options, "|")) != NULL) {
814 int token;
815 substring_t args[MAX_OPT_ARGS];
816
817 if (!*p)
818 continue;
819
820 token = match_token(p, tokens, args);
821
822 switch (token) {
823 case Opt_context:
824 if (context || defcontext) {
825 rc = -EINVAL;
826 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
827 goto out_err;
828 }
829 context = match_strdup(&args[0]);
830 if (!context) {
831 rc = -ENOMEM;
832 goto out_err;
833 }
834 break;
835
836 case Opt_fscontext:
837 if (fscontext) {
838 rc = -EINVAL;
839 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
840 goto out_err;
841 }
842 fscontext = match_strdup(&args[0]);
843 if (!fscontext) {
844 rc = -ENOMEM;
845 goto out_err;
846 }
847 break;
848
849 case Opt_rootcontext:
850 if (rootcontext) {
851 rc = -EINVAL;
852 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
853 goto out_err;
854 }
855 rootcontext = match_strdup(&args[0]);
856 if (!rootcontext) {
857 rc = -ENOMEM;
858 goto out_err;
859 }
860 break;
861
862 case Opt_defcontext:
863 if (context || defcontext) {
864 rc = -EINVAL;
865 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
866 goto out_err;
867 }
868 defcontext = match_strdup(&args[0]);
869 if (!defcontext) {
870 rc = -ENOMEM;
871 goto out_err;
872 }
873 break;
874
875 default:
876 rc = -EINVAL;
877 printk(KERN_WARNING "SELinux: unknown mount option\n");
878 goto out_err;
879
880 }
881 }
882
883 rc = -ENOMEM;
884 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
885 if (!opts->mnt_opts)
886 goto out_err;
887
888 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
889 if (!opts->mnt_opts_flags) {
890 kfree(opts->mnt_opts);
891 goto out_err;
892 }
893
894 if (fscontext) {
895 opts->mnt_opts[num_mnt_opts] = fscontext;
896 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
897 }
898 if (context) {
899 opts->mnt_opts[num_mnt_opts] = context;
900 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
901 }
902 if (rootcontext) {
903 opts->mnt_opts[num_mnt_opts] = rootcontext;
904 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
905 }
906 if (defcontext) {
907 opts->mnt_opts[num_mnt_opts] = defcontext;
908 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
909 }
910
911 opts->num_mnt_opts = num_mnt_opts;
912 return 0;
913
914 out_err:
915 kfree(context);
916 kfree(defcontext);
917 kfree(fscontext);
918 kfree(rootcontext);
919 return rc;
920 }
921 /*
922 * string mount options parsing and call set the sbsec
923 */
924 static int superblock_doinit(struct super_block *sb, void *data)
925 {
926 int rc = 0;
927 char *options = data;
928 struct security_mnt_opts opts;
929
930 security_init_mnt_opts(&opts);
931
932 if (!data)
933 goto out;
934
935 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
936
937 rc = selinux_parse_opts_str(options, &opts);
938 if (rc)
939 goto out_err;
940
941 out:
942 rc = selinux_set_mnt_opts(sb, &opts);
943
944 out_err:
945 security_free_mnt_opts(&opts);
946 return rc;
947 }
948
949 static inline u16 inode_mode_to_security_class(umode_t mode)
950 {
951 switch (mode & S_IFMT) {
952 case S_IFSOCK:
953 return SECCLASS_SOCK_FILE;
954 case S_IFLNK:
955 return SECCLASS_LNK_FILE;
956 case S_IFREG:
957 return SECCLASS_FILE;
958 case S_IFBLK:
959 return SECCLASS_BLK_FILE;
960 case S_IFDIR:
961 return SECCLASS_DIR;
962 case S_IFCHR:
963 return SECCLASS_CHR_FILE;
964 case S_IFIFO:
965 return SECCLASS_FIFO_FILE;
966
967 }
968
969 return SECCLASS_FILE;
970 }
971
972 static inline int default_protocol_stream(int protocol)
973 {
974 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
975 }
976
977 static inline int default_protocol_dgram(int protocol)
978 {
979 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
980 }
981
982 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
983 {
984 switch (family) {
985 case PF_UNIX:
986 switch (type) {
987 case SOCK_STREAM:
988 case SOCK_SEQPACKET:
989 return SECCLASS_UNIX_STREAM_SOCKET;
990 case SOCK_DGRAM:
991 return SECCLASS_UNIX_DGRAM_SOCKET;
992 }
993 break;
994 case PF_INET:
995 case PF_INET6:
996 switch (type) {
997 case SOCK_STREAM:
998 if (default_protocol_stream(protocol))
999 return SECCLASS_TCP_SOCKET;
1000 else
1001 return SECCLASS_RAWIP_SOCKET;
1002 case SOCK_DGRAM:
1003 if (default_protocol_dgram(protocol))
1004 return SECCLASS_UDP_SOCKET;
1005 else
1006 return SECCLASS_RAWIP_SOCKET;
1007 case SOCK_DCCP:
1008 return SECCLASS_DCCP_SOCKET;
1009 default:
1010 return SECCLASS_RAWIP_SOCKET;
1011 }
1012 break;
1013 case PF_NETLINK:
1014 switch (protocol) {
1015 case NETLINK_ROUTE:
1016 return SECCLASS_NETLINK_ROUTE_SOCKET;
1017 case NETLINK_FIREWALL:
1018 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1019 case NETLINK_INET_DIAG:
1020 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1021 case NETLINK_NFLOG:
1022 return SECCLASS_NETLINK_NFLOG_SOCKET;
1023 case NETLINK_XFRM:
1024 return SECCLASS_NETLINK_XFRM_SOCKET;
1025 case NETLINK_SELINUX:
1026 return SECCLASS_NETLINK_SELINUX_SOCKET;
1027 case NETLINK_AUDIT:
1028 return SECCLASS_NETLINK_AUDIT_SOCKET;
1029 case NETLINK_IP6_FW:
1030 return SECCLASS_NETLINK_IP6FW_SOCKET;
1031 case NETLINK_DNRTMSG:
1032 return SECCLASS_NETLINK_DNRT_SOCKET;
1033 case NETLINK_KOBJECT_UEVENT:
1034 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1035 default:
1036 return SECCLASS_NETLINK_SOCKET;
1037 }
1038 case PF_PACKET:
1039 return SECCLASS_PACKET_SOCKET;
1040 case PF_KEY:
1041 return SECCLASS_KEY_SOCKET;
1042 case PF_APPLETALK:
1043 return SECCLASS_APPLETALK_SOCKET;
1044 }
1045
1046 return SECCLASS_SOCKET;
1047 }
1048
1049 #ifdef CONFIG_PROC_FS
1050 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1051 u16 tclass,
1052 u32 *sid)
1053 {
1054 int buflen, rc;
1055 char *buffer, *path, *end;
1056
1057 buffer = (char*)__get_free_page(GFP_KERNEL);
1058 if (!buffer)
1059 return -ENOMEM;
1060
1061 buflen = PAGE_SIZE;
1062 end = buffer+buflen;
1063 *--end = '\0';
1064 buflen--;
1065 path = end-1;
1066 *path = '/';
1067 while (de && de != de->parent) {
1068 buflen -= de->namelen + 1;
1069 if (buflen < 0)
1070 break;
1071 end -= de->namelen;
1072 memcpy(end, de->name, de->namelen);
1073 *--end = '/';
1074 path = end;
1075 de = de->parent;
1076 }
1077 rc = security_genfs_sid("proc", path, tclass, sid);
1078 free_page((unsigned long)buffer);
1079 return rc;
1080 }
1081 #else
1082 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1083 u16 tclass,
1084 u32 *sid)
1085 {
1086 return -EINVAL;
1087 }
1088 #endif
1089
1090 /* The inode's security attributes must be initialized before first use. */
1091 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1092 {
1093 struct superblock_security_struct *sbsec = NULL;
1094 struct inode_security_struct *isec = inode->i_security;
1095 u32 sid;
1096 struct dentry *dentry;
1097 #define INITCONTEXTLEN 255
1098 char *context = NULL;
1099 unsigned len = 0;
1100 int rc = 0;
1101
1102 if (isec->initialized)
1103 goto out;
1104
1105 mutex_lock(&isec->lock);
1106 if (isec->initialized)
1107 goto out_unlock;
1108
1109 sbsec = inode->i_sb->s_security;
1110 if (!sbsec->initialized) {
1111 /* Defer initialization until selinux_complete_init,
1112 after the initial policy is loaded and the security
1113 server is ready to handle calls. */
1114 spin_lock(&sbsec->isec_lock);
1115 if (list_empty(&isec->list))
1116 list_add(&isec->list, &sbsec->isec_head);
1117 spin_unlock(&sbsec->isec_lock);
1118 goto out_unlock;
1119 }
1120
1121 switch (sbsec->behavior) {
1122 case SECURITY_FS_USE_XATTR:
1123 if (!inode->i_op->getxattr) {
1124 isec->sid = sbsec->def_sid;
1125 break;
1126 }
1127
1128 /* Need a dentry, since the xattr API requires one.
1129 Life would be simpler if we could just pass the inode. */
1130 if (opt_dentry) {
1131 /* Called from d_instantiate or d_splice_alias. */
1132 dentry = dget(opt_dentry);
1133 } else {
1134 /* Called from selinux_complete_init, try to find a dentry. */
1135 dentry = d_find_alias(inode);
1136 }
1137 if (!dentry) {
1138 printk(KERN_WARNING "%s: no dentry for dev=%s "
1139 "ino=%ld\n", __func__, inode->i_sb->s_id,
1140 inode->i_ino);
1141 goto out_unlock;
1142 }
1143
1144 len = INITCONTEXTLEN;
1145 context = kmalloc(len, GFP_NOFS);
1146 if (!context) {
1147 rc = -ENOMEM;
1148 dput(dentry);
1149 goto out_unlock;
1150 }
1151 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1152 context, len);
1153 if (rc == -ERANGE) {
1154 /* Need a larger buffer. Query for the right size. */
1155 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1156 NULL, 0);
1157 if (rc < 0) {
1158 dput(dentry);
1159 goto out_unlock;
1160 }
1161 kfree(context);
1162 len = rc;
1163 context = kmalloc(len, GFP_NOFS);
1164 if (!context) {
1165 rc = -ENOMEM;
1166 dput(dentry);
1167 goto out_unlock;
1168 }
1169 rc = inode->i_op->getxattr(dentry,
1170 XATTR_NAME_SELINUX,
1171 context, len);
1172 }
1173 dput(dentry);
1174 if (rc < 0) {
1175 if (rc != -ENODATA) {
1176 printk(KERN_WARNING "%s: getxattr returned "
1177 "%d for dev=%s ino=%ld\n", __func__,
1178 -rc, inode->i_sb->s_id, inode->i_ino);
1179 kfree(context);
1180 goto out_unlock;
1181 }
1182 /* Map ENODATA to the default file SID */
1183 sid = sbsec->def_sid;
1184 rc = 0;
1185 } else {
1186 rc = security_context_to_sid_default(context, rc, &sid,
1187 sbsec->def_sid,
1188 GFP_NOFS);
1189 if (rc) {
1190 printk(KERN_WARNING "%s: context_to_sid(%s) "
1191 "returned %d for dev=%s ino=%ld\n",
1192 __func__, context, -rc,
1193 inode->i_sb->s_id, inode->i_ino);
1194 kfree(context);
1195 /* Leave with the unlabeled SID */
1196 rc = 0;
1197 break;
1198 }
1199 }
1200 kfree(context);
1201 isec->sid = sid;
1202 break;
1203 case SECURITY_FS_USE_TASK:
1204 isec->sid = isec->task_sid;
1205 break;
1206 case SECURITY_FS_USE_TRANS:
1207 /* Default to the fs SID. */
1208 isec->sid = sbsec->sid;
1209
1210 /* Try to obtain a transition SID. */
1211 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1212 rc = security_transition_sid(isec->task_sid,
1213 sbsec->sid,
1214 isec->sclass,
1215 &sid);
1216 if (rc)
1217 goto out_unlock;
1218 isec->sid = sid;
1219 break;
1220 case SECURITY_FS_USE_MNTPOINT:
1221 isec->sid = sbsec->mntpoint_sid;
1222 break;
1223 default:
1224 /* Default to the fs superblock SID. */
1225 isec->sid = sbsec->sid;
1226
1227 if (sbsec->proc) {
1228 struct proc_inode *proci = PROC_I(inode);
1229 if (proci->pde) {
1230 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1231 rc = selinux_proc_get_sid(proci->pde,
1232 isec->sclass,
1233 &sid);
1234 if (rc)
1235 goto out_unlock;
1236 isec->sid = sid;
1237 }
1238 }
1239 break;
1240 }
1241
1242 isec->initialized = 1;
1243
1244 out_unlock:
1245 mutex_unlock(&isec->lock);
1246 out:
1247 if (isec->sclass == SECCLASS_FILE)
1248 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1249 return rc;
1250 }
1251
1252 /* Convert a Linux signal to an access vector. */
1253 static inline u32 signal_to_av(int sig)
1254 {
1255 u32 perm = 0;
1256
1257 switch (sig) {
1258 case SIGCHLD:
1259 /* Commonly granted from child to parent. */
1260 perm = PROCESS__SIGCHLD;
1261 break;
1262 case SIGKILL:
1263 /* Cannot be caught or ignored */
1264 perm = PROCESS__SIGKILL;
1265 break;
1266 case SIGSTOP:
1267 /* Cannot be caught or ignored */
1268 perm = PROCESS__SIGSTOP;
1269 break;
1270 default:
1271 /* All other signals. */
1272 perm = PROCESS__SIGNAL;
1273 break;
1274 }
1275
1276 return perm;
1277 }
1278
1279 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1280 fork check, ptrace check, etc. */
1281 static int task_has_perm(struct task_struct *tsk1,
1282 struct task_struct *tsk2,
1283 u32 perms)
1284 {
1285 struct task_security_struct *tsec1, *tsec2;
1286
1287 tsec1 = tsk1->security;
1288 tsec2 = tsk2->security;
1289 return avc_has_perm(tsec1->sid, tsec2->sid,
1290 SECCLASS_PROCESS, perms, NULL);
1291 }
1292
1293 #if CAP_LAST_CAP > 63
1294 #error Fix SELinux to handle capabilities > 63.
1295 #endif
1296
1297 /* Check whether a task is allowed to use a capability. */
1298 static int task_has_capability(struct task_struct *tsk,
1299 int cap)
1300 {
1301 struct task_security_struct *tsec;
1302 struct avc_audit_data ad;
1303 u16 sclass;
1304 u32 av = CAP_TO_MASK(cap);
1305
1306 tsec = tsk->security;
1307
1308 AVC_AUDIT_DATA_INIT(&ad,CAP);
1309 ad.tsk = tsk;
1310 ad.u.cap = cap;
1311
1312 switch (CAP_TO_INDEX(cap)) {
1313 case 0:
1314 sclass = SECCLASS_CAPABILITY;
1315 break;
1316 case 1:
1317 sclass = SECCLASS_CAPABILITY2;
1318 break;
1319 default:
1320 printk(KERN_ERR
1321 "SELinux: out of range capability %d\n", cap);
1322 BUG();
1323 }
1324 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1325 }
1326
1327 /* Check whether a task is allowed to use a system operation. */
1328 static int task_has_system(struct task_struct *tsk,
1329 u32 perms)
1330 {
1331 struct task_security_struct *tsec;
1332
1333 tsec = tsk->security;
1334
1335 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1336 SECCLASS_SYSTEM, perms, NULL);
1337 }
1338
1339 /* Check whether a task has a particular permission to an inode.
1340 The 'adp' parameter is optional and allows other audit
1341 data to be passed (e.g. the dentry). */
1342 static int inode_has_perm(struct task_struct *tsk,
1343 struct inode *inode,
1344 u32 perms,
1345 struct avc_audit_data *adp)
1346 {
1347 struct task_security_struct *tsec;
1348 struct inode_security_struct *isec;
1349 struct avc_audit_data ad;
1350
1351 if (unlikely (IS_PRIVATE (inode)))
1352 return 0;
1353
1354 tsec = tsk->security;
1355 isec = inode->i_security;
1356
1357 if (!adp) {
1358 adp = &ad;
1359 AVC_AUDIT_DATA_INIT(&ad, FS);
1360 ad.u.fs.inode = inode;
1361 }
1362
1363 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1364 }
1365
1366 /* Same as inode_has_perm, but pass explicit audit data containing
1367 the dentry to help the auditing code to more easily generate the
1368 pathname if needed. */
1369 static inline int dentry_has_perm(struct task_struct *tsk,
1370 struct vfsmount *mnt,
1371 struct dentry *dentry,
1372 u32 av)
1373 {
1374 struct inode *inode = dentry->d_inode;
1375 struct avc_audit_data ad;
1376 AVC_AUDIT_DATA_INIT(&ad,FS);
1377 ad.u.fs.path.mnt = mnt;
1378 ad.u.fs.path.dentry = dentry;
1379 return inode_has_perm(tsk, inode, av, &ad);
1380 }
1381
1382 /* Check whether a task can use an open file descriptor to
1383 access an inode in a given way. Check access to the
1384 descriptor itself, and then use dentry_has_perm to
1385 check a particular permission to the file.
1386 Access to the descriptor is implicitly granted if it
1387 has the same SID as the process. If av is zero, then
1388 access to the file is not checked, e.g. for cases
1389 where only the descriptor is affected like seek. */
1390 static int file_has_perm(struct task_struct *tsk,
1391 struct file *file,
1392 u32 av)
1393 {
1394 struct task_security_struct *tsec = tsk->security;
1395 struct file_security_struct *fsec = file->f_security;
1396 struct inode *inode = file->f_path.dentry->d_inode;
1397 struct avc_audit_data ad;
1398 int rc;
1399
1400 AVC_AUDIT_DATA_INIT(&ad, FS);
1401 ad.u.fs.path = file->f_path;
1402
1403 if (tsec->sid != fsec->sid) {
1404 rc = avc_has_perm(tsec->sid, fsec->sid,
1405 SECCLASS_FD,
1406 FD__USE,
1407 &ad);
1408 if (rc)
1409 return rc;
1410 }
1411
1412 /* av is zero if only checking access to the descriptor. */
1413 if (av)
1414 return inode_has_perm(tsk, inode, av, &ad);
1415
1416 return 0;
1417 }
1418
1419 /* Check whether a task can create a file. */
1420 static int may_create(struct inode *dir,
1421 struct dentry *dentry,
1422 u16 tclass)
1423 {
1424 struct task_security_struct *tsec;
1425 struct inode_security_struct *dsec;
1426 struct superblock_security_struct *sbsec;
1427 u32 newsid;
1428 struct avc_audit_data ad;
1429 int rc;
1430
1431 tsec = current->security;
1432 dsec = dir->i_security;
1433 sbsec = dir->i_sb->s_security;
1434
1435 AVC_AUDIT_DATA_INIT(&ad, FS);
1436 ad.u.fs.path.dentry = dentry;
1437
1438 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1439 DIR__ADD_NAME | DIR__SEARCH,
1440 &ad);
1441 if (rc)
1442 return rc;
1443
1444 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1445 newsid = tsec->create_sid;
1446 } else {
1447 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1448 &newsid);
1449 if (rc)
1450 return rc;
1451 }
1452
1453 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1454 if (rc)
1455 return rc;
1456
1457 return avc_has_perm(newsid, sbsec->sid,
1458 SECCLASS_FILESYSTEM,
1459 FILESYSTEM__ASSOCIATE, &ad);
1460 }
1461
1462 /* Check whether a task can create a key. */
1463 static int may_create_key(u32 ksid,
1464 struct task_struct *ctx)
1465 {
1466 struct task_security_struct *tsec;
1467
1468 tsec = ctx->security;
1469
1470 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1471 }
1472
1473 #define MAY_LINK 0
1474 #define MAY_UNLINK 1
1475 #define MAY_RMDIR 2
1476
1477 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1478 static int may_link(struct inode *dir,
1479 struct dentry *dentry,
1480 int kind)
1481
1482 {
1483 struct task_security_struct *tsec;
1484 struct inode_security_struct *dsec, *isec;
1485 struct avc_audit_data ad;
1486 u32 av;
1487 int rc;
1488
1489 tsec = current->security;
1490 dsec = dir->i_security;
1491 isec = dentry->d_inode->i_security;
1492
1493 AVC_AUDIT_DATA_INIT(&ad, FS);
1494 ad.u.fs.path.dentry = dentry;
1495
1496 av = DIR__SEARCH;
1497 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1498 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1499 if (rc)
1500 return rc;
1501
1502 switch (kind) {
1503 case MAY_LINK:
1504 av = FILE__LINK;
1505 break;
1506 case MAY_UNLINK:
1507 av = FILE__UNLINK;
1508 break;
1509 case MAY_RMDIR:
1510 av = DIR__RMDIR;
1511 break;
1512 default:
1513 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1514 return 0;
1515 }
1516
1517 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1518 return rc;
1519 }
1520
1521 static inline int may_rename(struct inode *old_dir,
1522 struct dentry *old_dentry,
1523 struct inode *new_dir,
1524 struct dentry *new_dentry)
1525 {
1526 struct task_security_struct *tsec;
1527 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1528 struct avc_audit_data ad;
1529 u32 av;
1530 int old_is_dir, new_is_dir;
1531 int rc;
1532
1533 tsec = current->security;
1534 old_dsec = old_dir->i_security;
1535 old_isec = old_dentry->d_inode->i_security;
1536 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1537 new_dsec = new_dir->i_security;
1538
1539 AVC_AUDIT_DATA_INIT(&ad, FS);
1540
1541 ad.u.fs.path.dentry = old_dentry;
1542 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1543 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1544 if (rc)
1545 return rc;
1546 rc = avc_has_perm(tsec->sid, old_isec->sid,
1547 old_isec->sclass, FILE__RENAME, &ad);
1548 if (rc)
1549 return rc;
1550 if (old_is_dir && new_dir != old_dir) {
1551 rc = avc_has_perm(tsec->sid, old_isec->sid,
1552 old_isec->sclass, DIR__REPARENT, &ad);
1553 if (rc)
1554 return rc;
1555 }
1556
1557 ad.u.fs.path.dentry = new_dentry;
1558 av = DIR__ADD_NAME | DIR__SEARCH;
1559 if (new_dentry->d_inode)
1560 av |= DIR__REMOVE_NAME;
1561 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1562 if (rc)
1563 return rc;
1564 if (new_dentry->d_inode) {
1565 new_isec = new_dentry->d_inode->i_security;
1566 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1567 rc = avc_has_perm(tsec->sid, new_isec->sid,
1568 new_isec->sclass,
1569 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1570 if (rc)
1571 return rc;
1572 }
1573
1574 return 0;
1575 }
1576
1577 /* Check whether a task can perform a filesystem operation. */
1578 static int superblock_has_perm(struct task_struct *tsk,
1579 struct super_block *sb,
1580 u32 perms,
1581 struct avc_audit_data *ad)
1582 {
1583 struct task_security_struct *tsec;
1584 struct superblock_security_struct *sbsec;
1585
1586 tsec = tsk->security;
1587 sbsec = sb->s_security;
1588 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1589 perms, ad);
1590 }
1591
1592 /* Convert a Linux mode and permission mask to an access vector. */
1593 static inline u32 file_mask_to_av(int mode, int mask)
1594 {
1595 u32 av = 0;
1596
1597 if ((mode & S_IFMT) != S_IFDIR) {
1598 if (mask & MAY_EXEC)
1599 av |= FILE__EXECUTE;
1600 if (mask & MAY_READ)
1601 av |= FILE__READ;
1602
1603 if (mask & MAY_APPEND)
1604 av |= FILE__APPEND;
1605 else if (mask & MAY_WRITE)
1606 av |= FILE__WRITE;
1607
1608 } else {
1609 if (mask & MAY_EXEC)
1610 av |= DIR__SEARCH;
1611 if (mask & MAY_WRITE)
1612 av |= DIR__WRITE;
1613 if (mask & MAY_READ)
1614 av |= DIR__READ;
1615 }
1616
1617 return av;
1618 }
1619
1620 /*
1621 * Convert a file mask to an access vector and include the correct open
1622 * open permission.
1623 */
1624 static inline u32 open_file_mask_to_av(int mode, int mask)
1625 {
1626 u32 av = file_mask_to_av(mode, mask);
1627
1628 if (selinux_policycap_openperm) {
1629 /*
1630 * lnk files and socks do not really have an 'open'
1631 */
1632 if (S_ISREG(mode))
1633 av |= FILE__OPEN;
1634 else if (S_ISCHR(mode))
1635 av |= CHR_FILE__OPEN;
1636 else if (S_ISBLK(mode))
1637 av |= BLK_FILE__OPEN;
1638 else if (S_ISFIFO(mode))
1639 av |= FIFO_FILE__OPEN;
1640 else if (S_ISDIR(mode))
1641 av |= DIR__OPEN;
1642 else
1643 printk(KERN_ERR "SELinux: WARNING: inside open_file_to_av "
1644 "with unknown mode:%x\n", mode);
1645 }
1646 return av;
1647 }
1648
1649 /* Convert a Linux file to an access vector. */
1650 static inline u32 file_to_av(struct file *file)
1651 {
1652 u32 av = 0;
1653
1654 if (file->f_mode & FMODE_READ)
1655 av |= FILE__READ;
1656 if (file->f_mode & FMODE_WRITE) {
1657 if (file->f_flags & O_APPEND)
1658 av |= FILE__APPEND;
1659 else
1660 av |= FILE__WRITE;
1661 }
1662 if (!av) {
1663 /*
1664 * Special file opened with flags 3 for ioctl-only use.
1665 */
1666 av = FILE__IOCTL;
1667 }
1668
1669 return av;
1670 }
1671
1672 /* Hook functions begin here. */
1673
1674 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1675 {
1676 int rc;
1677
1678 rc = secondary_ops->ptrace(parent,child);
1679 if (rc)
1680 return rc;
1681
1682 return task_has_perm(parent, child, PROCESS__PTRACE);
1683 }
1684
1685 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1686 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1687 {
1688 int error;
1689
1690 error = task_has_perm(current, target, PROCESS__GETCAP);
1691 if (error)
1692 return error;
1693
1694 return secondary_ops->capget(target, effective, inheritable, permitted);
1695 }
1696
1697 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1698 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1699 {
1700 int error;
1701
1702 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1703 if (error)
1704 return error;
1705
1706 return task_has_perm(current, target, PROCESS__SETCAP);
1707 }
1708
1709 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1710 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1711 {
1712 secondary_ops->capset_set(target, effective, inheritable, permitted);
1713 }
1714
1715 static int selinux_capable(struct task_struct *tsk, int cap)
1716 {
1717 int rc;
1718
1719 rc = secondary_ops->capable(tsk, cap);
1720 if (rc)
1721 return rc;
1722
1723 return task_has_capability(tsk,cap);
1724 }
1725
1726 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1727 {
1728 int buflen, rc;
1729 char *buffer, *path, *end;
1730
1731 rc = -ENOMEM;
1732 buffer = (char*)__get_free_page(GFP_KERNEL);
1733 if (!buffer)
1734 goto out;
1735
1736 buflen = PAGE_SIZE;
1737 end = buffer+buflen;
1738 *--end = '\0';
1739 buflen--;
1740 path = end-1;
1741 *path = '/';
1742 while (table) {
1743 const char *name = table->procname;
1744 size_t namelen = strlen(name);
1745 buflen -= namelen + 1;
1746 if (buflen < 0)
1747 goto out_free;
1748 end -= namelen;
1749 memcpy(end, name, namelen);
1750 *--end = '/';
1751 path = end;
1752 table = table->parent;
1753 }
1754 buflen -= 4;
1755 if (buflen < 0)
1756 goto out_free;
1757 end -= 4;
1758 memcpy(end, "/sys", 4);
1759 path = end;
1760 rc = security_genfs_sid("proc", path, tclass, sid);
1761 out_free:
1762 free_page((unsigned long)buffer);
1763 out:
1764 return rc;
1765 }
1766
1767 static int selinux_sysctl(ctl_table *table, int op)
1768 {
1769 int error = 0;
1770 u32 av;
1771 struct task_security_struct *tsec;
1772 u32 tsid;
1773 int rc;
1774
1775 rc = secondary_ops->sysctl(table, op);
1776 if (rc)
1777 return rc;
1778
1779 tsec = current->security;
1780
1781 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1782 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1783 if (rc) {
1784 /* Default to the well-defined sysctl SID. */
1785 tsid = SECINITSID_SYSCTL;
1786 }
1787
1788 /* The op values are "defined" in sysctl.c, thereby creating
1789 * a bad coupling between this module and sysctl.c */
1790 if(op == 001) {
1791 error = avc_has_perm(tsec->sid, tsid,
1792 SECCLASS_DIR, DIR__SEARCH, NULL);
1793 } else {
1794 av = 0;
1795 if (op & 004)
1796 av |= FILE__READ;
1797 if (op & 002)
1798 av |= FILE__WRITE;
1799 if (av)
1800 error = avc_has_perm(tsec->sid, tsid,
1801 SECCLASS_FILE, av, NULL);
1802 }
1803
1804 return error;
1805 }
1806
1807 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1808 {
1809 int rc = 0;
1810
1811 if (!sb)
1812 return 0;
1813
1814 switch (cmds) {
1815 case Q_SYNC:
1816 case Q_QUOTAON:
1817 case Q_QUOTAOFF:
1818 case Q_SETINFO:
1819 case Q_SETQUOTA:
1820 rc = superblock_has_perm(current,
1821 sb,
1822 FILESYSTEM__QUOTAMOD, NULL);
1823 break;
1824 case Q_GETFMT:
1825 case Q_GETINFO:
1826 case Q_GETQUOTA:
1827 rc = superblock_has_perm(current,
1828 sb,
1829 FILESYSTEM__QUOTAGET, NULL);
1830 break;
1831 default:
1832 rc = 0; /* let the kernel handle invalid cmds */
1833 break;
1834 }
1835 return rc;
1836 }
1837
1838 static int selinux_quota_on(struct dentry *dentry)
1839 {
1840 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1841 }
1842
1843 static int selinux_syslog(int type)
1844 {
1845 int rc;
1846
1847 rc = secondary_ops->syslog(type);
1848 if (rc)
1849 return rc;
1850
1851 switch (type) {
1852 case 3: /* Read last kernel messages */
1853 case 10: /* Return size of the log buffer */
1854 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1855 break;
1856 case 6: /* Disable logging to console */
1857 case 7: /* Enable logging to console */
1858 case 8: /* Set level of messages printed to console */
1859 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1860 break;
1861 case 0: /* Close log */
1862 case 1: /* Open log */
1863 case 2: /* Read from log */
1864 case 4: /* Read/clear last kernel messages */
1865 case 5: /* Clear ring buffer */
1866 default:
1867 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1868 break;
1869 }
1870 return rc;
1871 }
1872
1873 /*
1874 * Check that a process has enough memory to allocate a new virtual
1875 * mapping. 0 means there is enough memory for the allocation to
1876 * succeed and -ENOMEM implies there is not.
1877 *
1878 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1879 * if the capability is granted, but __vm_enough_memory requires 1 if
1880 * the capability is granted.
1881 *
1882 * Do not audit the selinux permission check, as this is applied to all
1883 * processes that allocate mappings.
1884 */
1885 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1886 {
1887 int rc, cap_sys_admin = 0;
1888 struct task_security_struct *tsec = current->security;
1889
1890 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1891 if (rc == 0)
1892 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1893 SECCLASS_CAPABILITY,
1894 CAP_TO_MASK(CAP_SYS_ADMIN),
1895 0,
1896 NULL);
1897
1898 if (rc == 0)
1899 cap_sys_admin = 1;
1900
1901 return __vm_enough_memory(mm, pages, cap_sys_admin);
1902 }
1903
1904 /**
1905 * task_tracer_task - return the task that is tracing the given task
1906 * @task: task to consider
1907 *
1908 * Returns NULL if noone is tracing @task, or the &struct task_struct
1909 * pointer to its tracer.
1910 *
1911 * Must be called under rcu_read_lock().
1912 */
1913 static struct task_struct *task_tracer_task(struct task_struct *task)
1914 {
1915 if (task->ptrace & PT_PTRACED)
1916 return rcu_dereference(task->parent);
1917 return NULL;
1918 }
1919
1920 /* binprm security operations */
1921
1922 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1923 {
1924 struct bprm_security_struct *bsec;
1925
1926 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1927 if (!bsec)
1928 return -ENOMEM;
1929
1930 bsec->sid = SECINITSID_UNLABELED;
1931 bsec->set = 0;
1932
1933 bprm->security = bsec;
1934 return 0;
1935 }
1936
1937 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1938 {
1939 struct task_security_struct *tsec;
1940 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1941 struct inode_security_struct *isec;
1942 struct bprm_security_struct *bsec;
1943 u32 newsid;
1944 struct avc_audit_data ad;
1945 int rc;
1946
1947 rc = secondary_ops->bprm_set_security(bprm);
1948 if (rc)
1949 return rc;
1950
1951 bsec = bprm->security;
1952
1953 if (bsec->set)
1954 return 0;
1955
1956 tsec = current->security;
1957 isec = inode->i_security;
1958
1959 /* Default to the current task SID. */
1960 bsec->sid = tsec->sid;
1961
1962 /* Reset fs, key, and sock SIDs on execve. */
1963 tsec->create_sid = 0;
1964 tsec->keycreate_sid = 0;
1965 tsec->sockcreate_sid = 0;
1966
1967 if (tsec->exec_sid) {
1968 newsid = tsec->exec_sid;
1969 /* Reset exec SID on execve. */
1970 tsec->exec_sid = 0;
1971 } else {
1972 /* Check for a default transition on this program. */
1973 rc = security_transition_sid(tsec->sid, isec->sid,
1974 SECCLASS_PROCESS, &newsid);
1975 if (rc)
1976 return rc;
1977 }
1978
1979 AVC_AUDIT_DATA_INIT(&ad, FS);
1980 ad.u.fs.path = bprm->file->f_path;
1981
1982 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1983 newsid = tsec->sid;
1984
1985 if (tsec->sid == newsid) {
1986 rc = avc_has_perm(tsec->sid, isec->sid,
1987 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1988 if (rc)
1989 return rc;
1990 } else {
1991 /* Check permissions for the transition. */
1992 rc = avc_has_perm(tsec->sid, newsid,
1993 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1994 if (rc)
1995 return rc;
1996
1997 rc = avc_has_perm(newsid, isec->sid,
1998 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1999 if (rc)
2000 return rc;
2001
2002 /* Clear any possibly unsafe personality bits on exec: */
2003 current->personality &= ~PER_CLEAR_ON_SETID;
2004
2005 /* Set the security field to the new SID. */
2006 bsec->sid = newsid;
2007 }
2008
2009 bsec->set = 1;
2010 return 0;
2011 }
2012
2013 static int selinux_bprm_check_security (struct linux_binprm *bprm)
2014 {
2015 return secondary_ops->bprm_check_security(bprm);
2016 }
2017
2018
2019 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
2020 {
2021 struct task_security_struct *tsec = current->security;
2022 int atsecure = 0;
2023
2024 if (tsec->osid != tsec->sid) {
2025 /* Enable secure mode for SIDs transitions unless
2026 the noatsecure permission is granted between
2027 the two SIDs, i.e. ahp returns 0. */
2028 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2029 SECCLASS_PROCESS,
2030 PROCESS__NOATSECURE, NULL);
2031 }
2032
2033 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2034 }
2035
2036 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2037 {
2038 kfree(bprm->security);
2039 bprm->security = NULL;
2040 }
2041
2042 extern struct vfsmount *selinuxfs_mount;
2043 extern struct dentry *selinux_null;
2044
2045 /* Derived from fs/exec.c:flush_old_files. */
2046 static inline void flush_unauthorized_files(struct files_struct * files)
2047 {
2048 struct avc_audit_data ad;
2049 struct file *file, *devnull = NULL;
2050 struct tty_struct *tty;
2051 struct fdtable *fdt;
2052 long j = -1;
2053 int drop_tty = 0;
2054
2055 mutex_lock(&tty_mutex);
2056 tty = get_current_tty();
2057 if (tty) {
2058 file_list_lock();
2059 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2060 if (file) {
2061 /* Revalidate access to controlling tty.
2062 Use inode_has_perm on the tty inode directly rather
2063 than using file_has_perm, as this particular open
2064 file may belong to another process and we are only
2065 interested in the inode-based check here. */
2066 struct inode *inode = file->f_path.dentry->d_inode;
2067 if (inode_has_perm(current, inode,
2068 FILE__READ | FILE__WRITE, NULL)) {
2069 drop_tty = 1;
2070 }
2071 }
2072 file_list_unlock();
2073 }
2074 mutex_unlock(&tty_mutex);
2075 /* Reset controlling tty. */
2076 if (drop_tty)
2077 no_tty();
2078
2079 /* Revalidate access to inherited open files. */
2080
2081 AVC_AUDIT_DATA_INIT(&ad,FS);
2082
2083 spin_lock(&files->file_lock);
2084 for (;;) {
2085 unsigned long set, i;
2086 int fd;
2087
2088 j++;
2089 i = j * __NFDBITS;
2090 fdt = files_fdtable(files);
2091 if (i >= fdt->max_fds)
2092 break;
2093 set = fdt->open_fds->fds_bits[j];
2094 if (!set)
2095 continue;
2096 spin_unlock(&files->file_lock);
2097 for ( ; set ; i++,set >>= 1) {
2098 if (set & 1) {
2099 file = fget(i);
2100 if (!file)
2101 continue;
2102 if (file_has_perm(current,
2103 file,
2104 file_to_av(file))) {
2105 sys_close(i);
2106 fd = get_unused_fd();
2107 if (fd != i) {
2108 if (fd >= 0)
2109 put_unused_fd(fd);
2110 fput(file);
2111 continue;
2112 }
2113 if (devnull) {
2114 get_file(devnull);
2115 } else {
2116 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2117 if (IS_ERR(devnull)) {
2118 devnull = NULL;
2119 put_unused_fd(fd);
2120 fput(file);
2121 continue;
2122 }
2123 }
2124 fd_install(fd, devnull);
2125 }
2126 fput(file);
2127 }
2128 }
2129 spin_lock(&files->file_lock);
2130
2131 }
2132 spin_unlock(&files->file_lock);
2133 }
2134
2135 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2136 {
2137 struct task_security_struct *tsec;
2138 struct bprm_security_struct *bsec;
2139 u32 sid;
2140 int rc;
2141
2142 secondary_ops->bprm_apply_creds(bprm, unsafe);
2143
2144 tsec = current->security;
2145
2146 bsec = bprm->security;
2147 sid = bsec->sid;
2148
2149 tsec->osid = tsec->sid;
2150 bsec->unsafe = 0;
2151 if (tsec->sid != sid) {
2152 /* Check for shared state. If not ok, leave SID
2153 unchanged and kill. */
2154 if (unsafe & LSM_UNSAFE_SHARE) {
2155 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2156 PROCESS__SHARE, NULL);
2157 if (rc) {
2158 bsec->unsafe = 1;
2159 return;
2160 }
2161 }
2162
2163 /* Check for ptracing, and update the task SID if ok.
2164 Otherwise, leave SID unchanged and kill. */
2165 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2166 struct task_struct *tracer;
2167 struct task_security_struct *sec;
2168 u32 ptsid = 0;
2169
2170 rcu_read_lock();
2171 tracer = task_tracer_task(current);
2172 if (likely(tracer != NULL)) {
2173 sec = tracer->security;
2174 ptsid = sec->sid;
2175 }
2176 rcu_read_unlock();
2177
2178 if (ptsid != 0) {
2179 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2180 PROCESS__PTRACE, NULL);
2181 if (rc) {
2182 bsec->unsafe = 1;
2183 return;
2184 }
2185 }
2186 }
2187 tsec->sid = sid;
2188 }
2189 }
2190
2191 /*
2192 * called after apply_creds without the task lock held
2193 */
2194 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2195 {
2196 struct task_security_struct *tsec;
2197 struct rlimit *rlim, *initrlim;
2198 struct itimerval itimer;
2199 struct bprm_security_struct *bsec;
2200 int rc, i;
2201
2202 tsec = current->security;
2203 bsec = bprm->security;
2204
2205 if (bsec->unsafe) {
2206 force_sig_specific(SIGKILL, current);
2207 return;
2208 }
2209 if (tsec->osid == tsec->sid)
2210 return;
2211
2212 /* Close files for which the new task SID is not authorized. */
2213 flush_unauthorized_files(current->files);
2214
2215 /* Check whether the new SID can inherit signal state
2216 from the old SID. If not, clear itimers to avoid
2217 subsequent signal generation and flush and unblock
2218 signals. This must occur _after_ the task SID has
2219 been updated so that any kill done after the flush
2220 will be checked against the new SID. */
2221 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2222 PROCESS__SIGINH, NULL);
2223 if (rc) {
2224 memset(&itimer, 0, sizeof itimer);
2225 for (i = 0; i < 3; i++)
2226 do_setitimer(i, &itimer, NULL);
2227 flush_signals(current);
2228 spin_lock_irq(&current->sighand->siglock);
2229 flush_signal_handlers(current, 1);
2230 sigemptyset(&current->blocked);
2231 recalc_sigpending();
2232 spin_unlock_irq(&current->sighand->siglock);
2233 }
2234
2235 /* Always clear parent death signal on SID transitions. */
2236 current->pdeath_signal = 0;
2237
2238 /* Check whether the new SID can inherit resource limits
2239 from the old SID. If not, reset all soft limits to
2240 the lower of the current task's hard limit and the init
2241 task's soft limit. Note that the setting of hard limits
2242 (even to lower them) can be controlled by the setrlimit
2243 check. The inclusion of the init task's soft limit into
2244 the computation is to avoid resetting soft limits higher
2245 than the default soft limit for cases where the default
2246 is lower than the hard limit, e.g. RLIMIT_CORE or
2247 RLIMIT_STACK.*/
2248 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2249 PROCESS__RLIMITINH, NULL);
2250 if (rc) {
2251 for (i = 0; i < RLIM_NLIMITS; i++) {
2252 rlim = current->signal->rlim + i;
2253 initrlim = init_task.signal->rlim+i;
2254 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2255 }
2256 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2257 /*
2258 * This will cause RLIMIT_CPU calculations
2259 * to be refigured.
2260 */
2261 current->it_prof_expires = jiffies_to_cputime(1);
2262 }
2263 }
2264
2265 /* Wake up the parent if it is waiting so that it can
2266 recheck wait permission to the new task SID. */
2267 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2268 }
2269
2270 /* superblock security operations */
2271
2272 static int selinux_sb_alloc_security(struct super_block *sb)
2273 {
2274 return superblock_alloc_security(sb);
2275 }
2276
2277 static void selinux_sb_free_security(struct super_block *sb)
2278 {
2279 superblock_free_security(sb);
2280 }
2281
2282 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2283 {
2284 if (plen > olen)
2285 return 0;
2286
2287 return !memcmp(prefix, option, plen);
2288 }
2289
2290 static inline int selinux_option(char *option, int len)
2291 {
2292 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2293 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2294 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2295 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2296 }
2297
2298 static inline void take_option(char **to, char *from, int *first, int len)
2299 {
2300 if (!*first) {
2301 **to = ',';
2302 *to += 1;
2303 } else
2304 *first = 0;
2305 memcpy(*to, from, len);
2306 *to += len;
2307 }
2308
2309 static inline void take_selinux_option(char **to, char *from, int *first,
2310 int len)
2311 {
2312 int current_size = 0;
2313
2314 if (!*first) {
2315 **to = '|';
2316 *to += 1;
2317 }
2318 else
2319 *first = 0;
2320
2321 while (current_size < len) {
2322 if (*from != '"') {
2323 **to = *from;
2324 *to += 1;
2325 }
2326 from += 1;
2327 current_size += 1;
2328 }
2329 }
2330
2331 static int selinux_sb_copy_data(char *orig, char *copy)
2332 {
2333 int fnosec, fsec, rc = 0;
2334 char *in_save, *in_curr, *in_end;
2335 char *sec_curr, *nosec_save, *nosec;
2336 int open_quote = 0;
2337
2338 in_curr = orig;
2339 sec_curr = copy;
2340
2341 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2342 if (!nosec) {
2343 rc = -ENOMEM;
2344 goto out;
2345 }
2346
2347 nosec_save = nosec;
2348 fnosec = fsec = 1;
2349 in_save = in_end = orig;
2350
2351 do {
2352 if (*in_end == '"')
2353 open_quote = !open_quote;
2354 if ((*in_end == ',' && open_quote == 0) ||
2355 *in_end == '\0') {
2356 int len = in_end - in_curr;
2357
2358 if (selinux_option(in_curr, len))
2359 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2360 else
2361 take_option(&nosec, in_curr, &fnosec, len);
2362
2363 in_curr = in_end + 1;
2364 }
2365 } while (*in_end++);
2366
2367 strcpy(in_save, nosec_save);
2368 free_page((unsigned long)nosec_save);
2369 out:
2370 return rc;
2371 }
2372
2373 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2374 {
2375 struct avc_audit_data ad;
2376 int rc;
2377
2378 rc = superblock_doinit(sb, data);
2379 if (rc)
2380 return rc;
2381
2382 AVC_AUDIT_DATA_INIT(&ad,FS);
2383 ad.u.fs.path.dentry = sb->s_root;
2384 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2385 }
2386
2387 static int selinux_sb_statfs(struct dentry *dentry)
2388 {
2389 struct avc_audit_data ad;
2390
2391 AVC_AUDIT_DATA_INIT(&ad,FS);
2392 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2393 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2394 }
2395
2396 static int selinux_mount(char * dev_name,
2397 struct nameidata *nd,
2398 char * type,
2399 unsigned long flags,
2400 void * data)
2401 {
2402 int rc;
2403
2404 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2405 if (rc)
2406 return rc;
2407
2408 if (flags & MS_REMOUNT)
2409 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2410 FILESYSTEM__REMOUNT, NULL);
2411 else
2412 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2413 FILE__MOUNTON);
2414 }
2415
2416 static int selinux_umount(struct vfsmount *mnt, int flags)
2417 {
2418 int rc;
2419
2420 rc = secondary_ops->sb_umount(mnt, flags);
2421 if (rc)
2422 return rc;
2423
2424 return superblock_has_perm(current,mnt->mnt_sb,
2425 FILESYSTEM__UNMOUNT,NULL);
2426 }
2427
2428 /* inode security operations */
2429
2430 static int selinux_inode_alloc_security(struct inode *inode)
2431 {
2432 return inode_alloc_security(inode);
2433 }
2434
2435 static void selinux_inode_free_security(struct inode *inode)
2436 {
2437 inode_free_security(inode);
2438 }
2439
2440 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2441 char **name, void **value,
2442 size_t *len)
2443 {
2444 struct task_security_struct *tsec;
2445 struct inode_security_struct *dsec;
2446 struct superblock_security_struct *sbsec;
2447 u32 newsid, clen;
2448 int rc;
2449 char *namep = NULL, *context;
2450
2451 tsec = current->security;
2452 dsec = dir->i_security;
2453 sbsec = dir->i_sb->s_security;
2454
2455 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2456 newsid = tsec->create_sid;
2457 } else {
2458 rc = security_transition_sid(tsec->sid, dsec->sid,
2459 inode_mode_to_security_class(inode->i_mode),
2460 &newsid);
2461 if (rc) {
2462 printk(KERN_WARNING "%s: "
2463 "security_transition_sid failed, rc=%d (dev=%s "
2464 "ino=%ld)\n",
2465 __func__,
2466 -rc, inode->i_sb->s_id, inode->i_ino);
2467 return rc;
2468 }
2469 }
2470
2471 /* Possibly defer initialization to selinux_complete_init. */
2472 if (sbsec->initialized) {
2473 struct inode_security_struct *isec = inode->i_security;
2474 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2475 isec->sid = newsid;
2476 isec->initialized = 1;
2477 }
2478
2479 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2480 return -EOPNOTSUPP;
2481
2482 if (name) {
2483 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2484 if (!namep)
2485 return -ENOMEM;
2486 *name = namep;
2487 }
2488
2489 if (value && len) {
2490 rc = security_sid_to_context(newsid, &context, &clen);
2491 if (rc) {
2492 kfree(namep);
2493 return rc;
2494 }
2495 *value = context;
2496 *len = clen;
2497 }
2498
2499 return 0;
2500 }
2501
2502 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2503 {
2504 return may_create(dir, dentry, SECCLASS_FILE);
2505 }
2506
2507 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2508 {
2509 int rc;
2510
2511 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2512 if (rc)
2513 return rc;
2514 return may_link(dir, old_dentry, MAY_LINK);
2515 }
2516
2517 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2518 {
2519 int rc;
2520
2521 rc = secondary_ops->inode_unlink(dir, dentry);
2522 if (rc)
2523 return rc;
2524 return may_link(dir, dentry, MAY_UNLINK);
2525 }
2526
2527 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2528 {
2529 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2530 }
2531
2532 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2533 {
2534 return may_create(dir, dentry, SECCLASS_DIR);
2535 }
2536
2537 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2538 {
2539 return may_link(dir, dentry, MAY_RMDIR);
2540 }
2541
2542 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2543 {
2544 int rc;
2545
2546 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2547 if (rc)
2548 return rc;
2549
2550 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2551 }
2552
2553 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2554 struct inode *new_inode, struct dentry *new_dentry)
2555 {
2556 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2557 }
2558
2559 static int selinux_inode_readlink(struct dentry *dentry)
2560 {
2561 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2562 }
2563
2564 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2565 {
2566 int rc;
2567
2568 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2569 if (rc)
2570 return rc;
2571 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2572 }
2573
2574 static int selinux_inode_permission(struct inode *inode, int mask,
2575 struct nameidata *nd)
2576 {
2577 int rc;
2578
2579 rc = secondary_ops->inode_permission(inode, mask, nd);
2580 if (rc)
2581 return rc;
2582
2583 if (!mask) {
2584 /* No permission to check. Existence test. */
2585 return 0;
2586 }
2587
2588 return inode_has_perm(current, inode,
2589 open_file_mask_to_av(inode->i_mode, mask), NULL);
2590 }
2591
2592 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2593 {
2594 int rc;
2595
2596 rc = secondary_ops->inode_setattr(dentry, iattr);
2597 if (rc)
2598 return rc;
2599
2600 if (iattr->ia_valid & ATTR_FORCE)
2601 return 0;
2602
2603 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2604 ATTR_ATIME_SET | ATTR_MTIME_SET))
2605 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2606
2607 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2608 }
2609
2610 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2611 {
2612 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2613 }
2614
2615 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2616 {
2617 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2618 sizeof XATTR_SECURITY_PREFIX - 1)) {
2619 if (!strcmp(name, XATTR_NAME_CAPS)) {
2620 if (!capable(CAP_SETFCAP))
2621 return -EPERM;
2622 } else if (!capable(CAP_SYS_ADMIN)) {
2623 /* A different attribute in the security namespace.
2624 Restrict to administrator. */
2625 return -EPERM;
2626 }
2627 }
2628
2629 /* Not an attribute we recognize, so just check the
2630 ordinary setattr permission. */
2631 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2632 }
2633
2634 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2635 {
2636 struct task_security_struct *tsec = current->security;
2637 struct inode *inode = dentry->d_inode;
2638 struct inode_security_struct *isec = inode->i_security;
2639 struct superblock_security_struct *sbsec;
2640 struct avc_audit_data ad;
2641 u32 newsid;
2642 int rc = 0;
2643
2644 if (strcmp(name, XATTR_NAME_SELINUX))
2645 return selinux_inode_setotherxattr(dentry, name);
2646
2647 sbsec = inode->i_sb->s_security;
2648 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2649 return -EOPNOTSUPP;
2650
2651 if (!is_owner_or_cap(inode))
2652 return -EPERM;
2653
2654 AVC_AUDIT_DATA_INIT(&ad,FS);
2655 ad.u.fs.path.dentry = dentry;
2656
2657 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2658 FILE__RELABELFROM, &ad);
2659 if (rc)
2660 return rc;
2661
2662 rc = security_context_to_sid(value, size, &newsid);
2663 if (rc)
2664 return rc;
2665
2666 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2667 FILE__RELABELTO, &ad);
2668 if (rc)
2669 return rc;
2670
2671 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2672 isec->sclass);
2673 if (rc)
2674 return rc;
2675
2676 return avc_has_perm(newsid,
2677 sbsec->sid,
2678 SECCLASS_FILESYSTEM,
2679 FILESYSTEM__ASSOCIATE,
2680 &ad);
2681 }
2682
2683 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2684 void *value, size_t size, int flags)
2685 {
2686 struct inode *inode = dentry->d_inode;
2687 struct inode_security_struct *isec = inode->i_security;
2688 u32 newsid;
2689 int rc;
2690
2691 if (strcmp(name, XATTR_NAME_SELINUX)) {
2692 /* Not an attribute we recognize, so nothing to do. */
2693 return;
2694 }
2695
2696 rc = security_context_to_sid(value, size, &newsid);
2697 if (rc) {
2698 printk(KERN_WARNING "%s: unable to obtain SID for context "
2699 "%s, rc=%d\n", __func__, (char *)value, -rc);
2700 return;
2701 }
2702
2703 isec->sid = newsid;
2704 return;
2705 }
2706
2707 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2708 {
2709 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2710 }
2711
2712 static int selinux_inode_listxattr (struct dentry *dentry)
2713 {
2714 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2715 }
2716
2717 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2718 {
2719 if (strcmp(name, XATTR_NAME_SELINUX))
2720 return selinux_inode_setotherxattr(dentry, name);
2721
2722 /* No one is allowed to remove a SELinux security label.
2723 You can change the label, but all data must be labeled. */
2724 return -EACCES;
2725 }
2726
2727 /*
2728 * Copy the in-core inode security context value to the user. If the
2729 * getxattr() prior to this succeeded, check to see if we need to
2730 * canonicalize the value to be finally returned to the user.
2731 *
2732 * Permission check is handled by selinux_inode_getxattr hook.
2733 */
2734 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2735 {
2736 u32 size;
2737 int error;
2738 char *context = NULL;
2739 struct inode_security_struct *isec = inode->i_security;
2740
2741 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2742 return -EOPNOTSUPP;
2743
2744 error = security_sid_to_context(isec->sid, &context, &size);
2745 if (error)
2746 return error;
2747 error = size;
2748 if (alloc) {
2749 *buffer = context;
2750 goto out_nofree;
2751 }
2752 kfree(context);
2753 out_nofree:
2754 return error;
2755 }
2756
2757 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2758 const void *value, size_t size, int flags)
2759 {
2760 struct inode_security_struct *isec = inode->i_security;
2761 u32 newsid;
2762 int rc;
2763
2764 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2765 return -EOPNOTSUPP;
2766
2767 if (!value || !size)
2768 return -EACCES;
2769
2770 rc = security_context_to_sid((void*)value, size, &newsid);
2771 if (rc)
2772 return rc;
2773
2774 isec->sid = newsid;
2775 return 0;
2776 }
2777
2778 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2779 {
2780 const int len = sizeof(XATTR_NAME_SELINUX);
2781 if (buffer && len <= buffer_size)
2782 memcpy(buffer, XATTR_NAME_SELINUX, len);
2783 return len;
2784 }
2785
2786 static int selinux_inode_need_killpriv(struct dentry *dentry)
2787 {
2788 return secondary_ops->inode_need_killpriv(dentry);
2789 }
2790
2791 static int selinux_inode_killpriv(struct dentry *dentry)
2792 {
2793 return secondary_ops->inode_killpriv(dentry);
2794 }
2795
2796 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2797 {
2798 struct inode_security_struct *isec = inode->i_security;
2799 *secid = isec->sid;
2800 }
2801
2802 /* file security operations */
2803
2804 static int selinux_revalidate_file_permission(struct file *file, int mask)
2805 {
2806 int rc;
2807 struct inode *inode = file->f_path.dentry->d_inode;
2808
2809 if (!mask) {
2810 /* No permission to check. Existence test. */
2811 return 0;
2812 }
2813
2814 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2815 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2816 mask |= MAY_APPEND;
2817
2818 rc = file_has_perm(current, file,
2819 file_mask_to_av(inode->i_mode, mask));
2820 if (rc)
2821 return rc;
2822
2823 return selinux_netlbl_inode_permission(inode, mask);
2824 }
2825
2826 static int selinux_file_permission(struct file *file, int mask)
2827 {
2828 struct inode *inode = file->f_path.dentry->d_inode;
2829 struct task_security_struct *tsec = current->security;
2830 struct file_security_struct *fsec = file->f_security;
2831 struct inode_security_struct *isec = inode->i_security;
2832
2833 if (!mask) {
2834 /* No permission to check. Existence test. */
2835 return 0;
2836 }
2837
2838 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2839 && fsec->pseqno == avc_policy_seqno())
2840 return selinux_netlbl_inode_permission(inode, mask);
2841
2842 return selinux_revalidate_file_permission(file, mask);
2843 }
2844
2845 static int selinux_file_alloc_security(struct file *file)
2846 {
2847 return file_alloc_security(file);
2848 }
2849
2850 static void selinux_file_free_security(struct file *file)
2851 {
2852 file_free_security(file);
2853 }
2854
2855 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2856 unsigned long arg)
2857 {
2858 int error = 0;
2859
2860 switch (cmd) {
2861 case FIONREAD:
2862 /* fall through */
2863 case FIBMAP:
2864 /* fall through */
2865 case FIGETBSZ:
2866 /* fall through */
2867 case EXT2_IOC_GETFLAGS:
2868 /* fall through */
2869 case EXT2_IOC_GETVERSION:
2870 error = file_has_perm(current, file, FILE__GETATTR);
2871 break;
2872
2873 case EXT2_IOC_SETFLAGS:
2874 /* fall through */
2875 case EXT2_IOC_SETVERSION:
2876 error = file_has_perm(current, file, FILE__SETATTR);
2877 break;
2878
2879 /* sys_ioctl() checks */
2880 case FIONBIO:
2881 /* fall through */
2882 case FIOASYNC:
2883 error = file_has_perm(current, file, 0);
2884 break;
2885
2886 case KDSKBENT:
2887 case KDSKBSENT:
2888 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2889 break;
2890
2891 /* default case assumes that the command will go
2892 * to the file's ioctl() function.
2893 */
2894 default:
2895 error = file_has_perm(current, file, FILE__IOCTL);
2896
2897 }
2898 return error;
2899 }
2900
2901 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2902 {
2903 #ifndef CONFIG_PPC32
2904 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2905 /*
2906 * We are making executable an anonymous mapping or a
2907 * private file mapping that will also be writable.
2908 * This has an additional check.
2909 */
2910 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2911 if (rc)
2912 return rc;
2913 }
2914 #endif
2915
2916 if (file) {
2917 /* read access is always possible with a mapping */
2918 u32 av = FILE__READ;
2919
2920 /* write access only matters if the mapping is shared */
2921 if (shared && (prot & PROT_WRITE))
2922 av |= FILE__WRITE;
2923
2924 if (prot & PROT_EXEC)
2925 av |= FILE__EXECUTE;
2926
2927 return file_has_perm(current, file, av);
2928 }
2929 return 0;
2930 }
2931
2932 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2933 unsigned long prot, unsigned long flags,
2934 unsigned long addr, unsigned long addr_only)
2935 {
2936 int rc = 0;
2937 u32 sid = ((struct task_security_struct*)(current->security))->sid;
2938
2939 if (addr < mmap_min_addr)
2940 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2941 MEMPROTECT__MMAP_ZERO, NULL);
2942 if (rc || addr_only)
2943 return rc;
2944
2945 if (selinux_checkreqprot)
2946 prot = reqprot;
2947
2948 return file_map_prot_check(file, prot,
2949 (flags & MAP_TYPE) == MAP_SHARED);
2950 }
2951
2952 static int selinux_file_mprotect(struct vm_area_struct *vma,
2953 unsigned long reqprot,
2954 unsigned long prot)
2955 {
2956 int rc;
2957
2958 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2959 if (rc)
2960 return rc;
2961
2962 if (selinux_checkreqprot)
2963 prot = reqprot;
2964
2965 #ifndef CONFIG_PPC32
2966 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2967 rc = 0;
2968 if (vma->vm_start >= vma->vm_mm->start_brk &&
2969 vma->vm_end <= vma->vm_mm->brk) {
2970 rc = task_has_perm(current, current,
2971 PROCESS__EXECHEAP);
2972 } else if (!vma->vm_file &&
2973 vma->vm_start <= vma->vm_mm->start_stack &&
2974 vma->vm_end >= vma->vm_mm->start_stack) {
2975 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2976 } else if (vma->vm_file && vma->anon_vma) {
2977 /*
2978 * We are making executable a file mapping that has
2979 * had some COW done. Since pages might have been
2980 * written, check ability to execute the possibly
2981 * modified content. This typically should only
2982 * occur for text relocations.
2983 */
2984 rc = file_has_perm(current, vma->vm_file,
2985 FILE__EXECMOD);
2986 }
2987 if (rc)
2988 return rc;
2989 }
2990 #endif
2991
2992 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2993 }
2994
2995 static int selinux_file_lock(struct file *file, unsigned int cmd)
2996 {
2997 return file_has_perm(current, file, FILE__LOCK);
2998 }
2999
3000 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3001 unsigned long arg)
3002 {
3003 int err = 0;
3004
3005 switch (cmd) {
3006 case F_SETFL:
3007 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3008 err = -EINVAL;
3009 break;
3010 }
3011
3012 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3013 err = file_has_perm(current, file,FILE__WRITE);
3014 break;
3015 }
3016 /* fall through */
3017 case F_SETOWN:
3018 case F_SETSIG:
3019 case F_GETFL:
3020 case F_GETOWN:
3021 case F_GETSIG:
3022 /* Just check FD__USE permission */
3023 err = file_has_perm(current, file, 0);
3024 break;
3025 case F_GETLK:
3026 case F_SETLK:
3027 case F_SETLKW:
3028 #if BITS_PER_LONG == 32
3029 case F_GETLK64:
3030 case F_SETLK64:
3031 case F_SETLKW64:
3032 #endif
3033 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3034 err = -EINVAL;
3035 break;
3036 }
3037 err = file_has_perm(current, file, FILE__LOCK);
3038 break;
3039 }
3040
3041 return err;
3042 }
3043
3044 static int selinux_file_set_fowner(struct file *file)
3045 {
3046 struct task_security_struct *tsec;
3047 struct file_security_struct *fsec;
3048
3049 tsec = current->security;
3050 fsec = file->f_security;
3051 fsec->fown_sid = tsec->sid;
3052
3053 return 0;
3054 }
3055
3056 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3057 struct fown_struct *fown, int signum)
3058 {
3059 struct file *file;
3060 u32 perm;
3061 struct task_security_struct *tsec;
3062 struct file_security_struct *fsec;
3063
3064 /* struct fown_struct is never outside the context of a struct file */
3065 file = container_of(fown, struct file, f_owner);
3066
3067 tsec = tsk->security;
3068 fsec = file->f_security;
3069
3070 if (!signum)
3071 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3072 else
3073 perm = signal_to_av(signum);
3074
3075 return avc_has_perm(fsec->fown_sid, tsec->sid,
3076 SECCLASS_PROCESS, perm, NULL);
3077 }
3078
3079 static int selinux_file_receive(struct file *file)
3080 {
3081 return file_has_perm(current, file, file_to_av(file));
3082 }
3083
3084 static int selinux_dentry_open(struct file *file)
3085 {
3086 struct file_security_struct *fsec;
3087 struct inode *inode;
3088 struct inode_security_struct *isec;
3089 inode = file->f_path.dentry->d_inode;
3090 fsec = file->f_security;
3091 isec = inode->i_security;
3092 /*
3093 * Save inode label and policy sequence number
3094 * at open-time so that selinux_file_permission
3095 * can determine whether revalidation is necessary.
3096 * Task label is already saved in the file security
3097 * struct as its SID.
3098 */
3099 fsec->isid = isec->sid;
3100 fsec->pseqno = avc_policy_seqno();
3101 /*
3102 * Since the inode label or policy seqno may have changed
3103 * between the selinux_inode_permission check and the saving
3104 * of state above, recheck that access is still permitted.
3105 * Otherwise, access might never be revalidated against the
3106 * new inode label or new policy.
3107 * This check is not redundant - do not remove.
3108 */
3109 return inode_has_perm(current, inode, file_to_av(file), NULL);
3110 }
3111
3112 /* task security operations */
3113
3114 static int selinux_task_create(unsigned long clone_flags)
3115 {
3116 int rc;
3117
3118 rc = secondary_ops->task_create(clone_flags);
3119 if (rc)
3120 return rc;
3121
3122 return task_has_perm(current, current, PROCESS__FORK);
3123 }
3124
3125 static int selinux_task_alloc_security(struct task_struct *tsk)
3126 {
3127 struct task_security_struct *tsec1, *tsec2;
3128 int rc;
3129
3130 tsec1 = current->security;
3131
3132 rc = task_alloc_security(tsk);
3133 if (rc)
3134 return rc;
3135 tsec2 = tsk->security;
3136
3137 tsec2->osid = tsec1->osid;
3138 tsec2->sid = tsec1->sid;
3139
3140 /* Retain the exec, fs, key, and sock SIDs across fork */
3141 tsec2->exec_sid = tsec1->exec_sid;
3142 tsec2->create_sid = tsec1->create_sid;
3143 tsec2->keycreate_sid = tsec1->keycreate_sid;
3144 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3145
3146 return 0;
3147 }
3148
3149 static void selinux_task_free_security(struct task_struct *tsk)
3150 {
3151 task_free_security(tsk);
3152 }
3153
3154 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3155 {
3156 /* Since setuid only affects the current process, and
3157 since the SELinux controls are not based on the Linux
3158 identity attributes, SELinux does not need to control
3159 this operation. However, SELinux does control the use
3160 of the CAP_SETUID and CAP_SETGID capabilities using the
3161 capable hook. */
3162 return 0;
3163 }
3164
3165 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3166 {
3167 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3168 }
3169
3170 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3171 {
3172 /* See the comment for setuid above. */
3173 return 0;
3174 }
3175
3176 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3177 {
3178 return task_has_perm(current, p, PROCESS__SETPGID);
3179 }
3180
3181 static int selinux_task_getpgid(struct task_struct *p)
3182 {
3183 return task_has_perm(current, p, PROCESS__GETPGID);
3184 }
3185
3186 static int selinux_task_getsid(struct task_struct *p)
3187 {
3188 return task_has_perm(current, p, PROCESS__GETSESSION);
3189 }
3190
3191 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3192 {
3193 struct task_security_struct *tsec = p->security;
3194 *secid = tsec->sid;
3195 }
3196
3197 static int selinux_task_setgroups(struct group_info *group_info)
3198 {
3199 /* See the comment for setuid above. */
3200 return 0;
3201 }
3202
3203 static int selinux_task_setnice(struct task_struct *p, int nice)
3204 {
3205 int rc;
3206
3207 rc = secondary_ops->task_setnice(p, nice);
3208 if (rc)
3209 return rc;
3210
3211 return task_has_perm(current,p, PROCESS__SETSCHED);
3212 }
3213
3214 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3215 {
3216 int rc;
3217
3218 rc = secondary_ops->task_setioprio(p, ioprio);
3219 if (rc)
3220 return rc;
3221
3222 return task_has_perm(current, p, PROCESS__SETSCHED);
3223 }
3224
3225 static int selinux_task_getioprio(struct task_struct *p)
3226 {
3227 return task_has_perm(current, p, PROCESS__GETSCHED);
3228 }
3229
3230 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3231 {
3232 struct rlimit *old_rlim = current->signal->rlim + resource;
3233 int rc;
3234
3235 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3236 if (rc)
3237 return rc;
3238
3239 /* Control the ability to change the hard limit (whether
3240 lowering or raising it), so that the hard limit can
3241 later be used as a safe reset point for the soft limit
3242 upon context transitions. See selinux_bprm_apply_creds. */
3243 if (old_rlim->rlim_max != new_rlim->rlim_max)
3244 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3245
3246 return 0;
3247 }
3248
3249 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3250 {
3251 int rc;
3252
3253 rc = secondary_ops->task_setscheduler(p, policy, lp);
3254 if (rc)
3255 return rc;
3256
3257 return task_has_perm(current, p, PROCESS__SETSCHED);
3258 }
3259
3260 static int selinux_task_getscheduler(struct task_struct *p)
3261 {
3262 return task_has_perm(current, p, PROCESS__GETSCHED);
3263 }
3264
3265 static int selinux_task_movememory(struct task_struct *p)
3266 {
3267 return task_has_perm(current, p, PROCESS__SETSCHED);
3268 }
3269
3270 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3271 int sig, u32 secid)
3272 {
3273 u32 perm;
3274 int rc;
3275 struct task_security_struct *tsec;
3276
3277 rc = secondary_ops->task_kill(p, info, sig, secid);
3278 if (rc)
3279 return rc;
3280
3281 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3282 return 0;
3283
3284 if (!sig)
3285 perm = PROCESS__SIGNULL; /* null signal; existence test */
3286 else
3287 perm = signal_to_av(sig);
3288 tsec = p->security;
3289 if (secid)
3290 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3291 else
3292 rc = task_has_perm(current, p, perm);
3293 return rc;
3294 }
3295
3296 static int selinux_task_prctl(int option,
3297 unsigned long arg2,
3298 unsigned long arg3,
3299 unsigned long arg4,
3300 unsigned long arg5)
3301 {
3302 /* The current prctl operations do not appear to require
3303 any SELinux controls since they merely observe or modify
3304 the state of the current process. */
3305 return 0;
3306 }
3307
3308 static int selinux_task_wait(struct task_struct *p)
3309 {
3310 return task_has_perm(p, current, PROCESS__SIGCHLD);
3311 }
3312
3313 static void selinux_task_reparent_to_init(struct task_struct *p)
3314 {
3315 struct task_security_struct *tsec;
3316
3317 secondary_ops->task_reparent_to_init(p);
3318
3319 tsec = p->security;
3320 tsec->osid = tsec->sid;
3321 tsec->sid = SECINITSID_KERNEL;
3322 return;
3323 }
3324
3325 static void selinux_task_to_inode(struct task_struct *p,
3326 struct inode *inode)
3327 {
3328 struct task_security_struct *tsec = p->security;
3329 struct inode_security_struct *isec = inode->i_security;
3330
3331 isec->sid = tsec->sid;
3332 isec->initialized = 1;
3333 return;
3334 }
3335
3336 /* Returns error only if unable to parse addresses */
3337 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3338 struct avc_audit_data *ad, u8 *proto)
3339 {
3340 int offset, ihlen, ret = -EINVAL;
3341 struct iphdr _iph, *ih;
3342
3343 offset = skb_network_offset(skb);
3344 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3345 if (ih == NULL)
3346 goto out;
3347
3348 ihlen = ih->ihl * 4;
3349 if (ihlen < sizeof(_iph))
3350 goto out;
3351
3352 ad->u.net.v4info.saddr = ih->saddr;
3353 ad->u.net.v4info.daddr = ih->daddr;
3354 ret = 0;
3355
3356 if (proto)
3357 *proto = ih->protocol;
3358
3359 switch (ih->protocol) {
3360 case IPPROTO_TCP: {
3361 struct tcphdr _tcph, *th;
3362
3363 if (ntohs(ih->frag_off) & IP_OFFSET)
3364 break;
3365
3366 offset += ihlen;
3367 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3368 if (th == NULL)
3369 break;
3370
3371 ad->u.net.sport = th->source;
3372 ad->u.net.dport = th->dest;
3373 break;
3374 }
3375
3376 case IPPROTO_UDP: {
3377 struct udphdr _udph, *uh;
3378
3379 if (ntohs(ih->frag_off) & IP_OFFSET)
3380 break;
3381
3382 offset += ihlen;
3383 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3384 if (uh == NULL)
3385 break;
3386
3387 ad->u.net.sport = uh->source;
3388 ad->u.net.dport = uh->dest;
3389 break;
3390 }
3391
3392 case IPPROTO_DCCP: {
3393 struct dccp_hdr _dccph, *dh;
3394
3395 if (ntohs(ih->frag_off) & IP_OFFSET)
3396 break;
3397
3398 offset += ihlen;
3399 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3400 if (dh == NULL)
3401 break;
3402
3403 ad->u.net.sport = dh->dccph_sport;
3404 ad->u.net.dport = dh->dccph_dport;
3405 break;
3406 }
3407
3408 default:
3409 break;
3410 }
3411 out:
3412 return ret;
3413 }
3414
3415 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3416
3417 /* Returns error only if unable to parse addresses */
3418 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3419 struct avc_audit_data *ad, u8 *proto)
3420 {
3421 u8 nexthdr;
3422 int ret = -EINVAL, offset;
3423 struct ipv6hdr _ipv6h, *ip6;
3424
3425 offset = skb_network_offset(skb);
3426 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3427 if (ip6 == NULL)
3428 goto out;
3429
3430 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3431 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3432 ret = 0;
3433
3434 nexthdr = ip6->nexthdr;
3435 offset += sizeof(_ipv6h);
3436 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3437 if (offset < 0)
3438 goto out;
3439
3440 if (proto)
3441 *proto = nexthdr;
3442
3443 switch (nexthdr) {
3444 case IPPROTO_TCP: {
3445 struct tcphdr _tcph, *th;
3446
3447 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3448 if (th == NULL)
3449 break;
3450
3451 ad->u.net.sport = th->source;
3452 ad->u.net.dport = th->dest;
3453 break;
3454 }
3455
3456 case IPPROTO_UDP: {
3457 struct udphdr _udph, *uh;
3458
3459 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3460 if (uh == NULL)
3461 break;
3462
3463 ad->u.net.sport = uh->source;
3464 ad->u.net.dport = uh->dest;
3465 break;
3466 }
3467
3468 case IPPROTO_DCCP: {
3469 struct dccp_hdr _dccph, *dh;
3470
3471 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3472 if (dh == NULL)
3473 break;
3474
3475 ad->u.net.sport = dh->dccph_sport;
3476 ad->u.net.dport = dh->dccph_dport;
3477 break;
3478 }
3479
3480 /* includes fragments */
3481 default:
3482 break;
3483 }
3484 out:
3485 return ret;
3486 }
3487
3488 #endif /* IPV6 */
3489
3490 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3491 char **addrp, int src, u8 *proto)
3492 {
3493 int ret = 0;
3494
3495 switch (ad->u.net.family) {
3496 case PF_INET:
3497 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3498 if (ret || !addrp)
3499 break;
3500 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3501 &ad->u.net.v4info.daddr);
3502 break;
3503
3504 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3505 case PF_INET6:
3506 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3507 if (ret || !addrp)
3508 break;
3509 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3510 &ad->u.net.v6info.daddr);
3511 break;
3512 #endif /* IPV6 */
3513 default:
3514 break;
3515 }
3516
3517 if (unlikely(ret))
3518 printk(KERN_WARNING
3519 "SELinux: failure in selinux_parse_skb(),"
3520 " unable to parse packet\n");
3521
3522 return ret;
3523 }
3524
3525 /**
3526 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3527 * @skb: the packet
3528 * @family: protocol family
3529 * @sid: the packet's peer label SID
3530 *
3531 * Description:
3532 * Check the various different forms of network peer labeling and determine
3533 * the peer label/SID for the packet; most of the magic actually occurs in
3534 * the security server function security_net_peersid_cmp(). The function
3535 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3536 * or -EACCES if @sid is invalid due to inconsistencies with the different
3537 * peer labels.
3538 *
3539 */
3540 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3541 {
3542 int err;
3543 u32 xfrm_sid;
3544 u32 nlbl_sid;
3545 u32 nlbl_type;
3546
3547 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3548 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3549
3550 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3551 if (unlikely(err)) {
3552 printk(KERN_WARNING
3553 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3554 " unable to determine packet's peer label\n");
3555 return -EACCES;
3556 }
3557
3558 return 0;
3559 }
3560
3561 /* socket security operations */
3562 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3563 u32 perms)
3564 {
3565 struct inode_security_struct *isec;
3566 struct task_security_struct *tsec;
3567 struct avc_audit_data ad;
3568 int err = 0;
3569
3570 tsec = task->security;
3571 isec = SOCK_INODE(sock)->i_security;
3572
3573 if (isec->sid == SECINITSID_KERNEL)
3574 goto out;
3575
3576 AVC_AUDIT_DATA_INIT(&ad,NET);
3577 ad.u.net.sk = sock->sk;
3578 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3579
3580 out:
3581 return err;
3582 }
3583
3584 static int selinux_socket_create(int family, int type,
3585 int protocol, int kern)
3586 {
3587 int err = 0;
3588 struct task_security_struct *tsec;
3589 u32 newsid;
3590
3591 if (kern)
3592 goto out;
3593
3594 tsec = current->security;
3595 newsid = tsec->sockcreate_sid ? : tsec->sid;
3596 err = avc_has_perm(tsec->sid, newsid,
3597 socket_type_to_security_class(family, type,
3598 protocol), SOCKET__CREATE, NULL);
3599
3600 out:
3601 return err;
3602 }
3603
3604 static int selinux_socket_post_create(struct socket *sock, int family,
3605 int type, int protocol, int kern)
3606 {
3607 int err = 0;
3608 struct inode_security_struct *isec;
3609 struct task_security_struct *tsec;
3610 struct sk_security_struct *sksec;
3611 u32 newsid;
3612
3613 isec = SOCK_INODE(sock)->i_security;
3614
3615 tsec = current->security;
3616 newsid = tsec->sockcreate_sid ? : tsec->sid;
3617 isec->sclass = socket_type_to_security_class(family, type, protocol);
3618 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3619 isec->initialized = 1;
3620
3621 if (sock->sk) {
3622 sksec = sock->sk->sk_security;
3623 sksec->sid = isec->sid;
3624 sksec->sclass = isec->sclass;
3625 err = selinux_netlbl_socket_post_create(sock);
3626 }
3627
3628 return err;
3629 }
3630
3631 /* Range of port numbers used to automatically bind.
3632 Need to determine whether we should perform a name_bind
3633 permission check between the socket and the port number. */
3634
3635 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3636 {
3637 u16 family;
3638 int err;
3639
3640 err = socket_has_perm(current, sock, SOCKET__BIND);
3641 if (err)
3642 goto out;
3643
3644 /*
3645 * If PF_INET or PF_INET6, check name_bind permission for the port.
3646 * Multiple address binding for SCTP is not supported yet: we just
3647 * check the first address now.
3648 */
3649 family = sock->sk->sk_family;
3650 if (family == PF_INET || family == PF_INET6) {
3651 char *addrp;
3652 struct inode_security_struct *isec;
3653 struct task_security_struct *tsec;
3654 struct avc_audit_data ad;
3655 struct sockaddr_in *addr4 = NULL;
3656 struct sockaddr_in6 *addr6 = NULL;
3657 unsigned short snum;
3658 struct sock *sk = sock->sk;
3659 u32 sid, node_perm, addrlen;
3660
3661 tsec = current->security;
3662 isec = SOCK_INODE(sock)->i_security;
3663
3664 if (family == PF_INET) {
3665 addr4 = (struct sockaddr_in *)address;
3666 snum = ntohs(addr4->sin_port);
3667 addrlen = sizeof(addr4->sin_addr.s_addr);
3668 addrp = (char *)&addr4->sin_addr.s_addr;
3669 } else {
3670 addr6 = (struct sockaddr_in6 *)address;
3671 snum = ntohs(addr6->sin6_port);
3672 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3673 addrp = (char *)&addr6->sin6_addr.s6_addr;
3674 }
3675
3676 if (snum) {
3677 int low, high;
3678
3679 inet_get_local_port_range(&low, &high);
3680
3681 if (snum < max(PROT_SOCK, low) || snum > high) {
3682 err = sel_netport_sid(sk->sk_protocol,
3683 snum, &sid);
3684 if (err)
3685 goto out;
3686 AVC_AUDIT_DATA_INIT(&ad,NET);
3687 ad.u.net.sport = htons(snum);
3688 ad.u.net.family = family;
3689 err = avc_has_perm(isec->sid, sid,
3690 isec->sclass,
3691 SOCKET__NAME_BIND, &ad);
3692 if (err)
3693 goto out;
3694 }
3695 }
3696
3697 switch(isec->sclass) {
3698 case SECCLASS_TCP_SOCKET:
3699 node_perm = TCP_SOCKET__NODE_BIND;
3700 break;
3701
3702 case SECCLASS_UDP_SOCKET:
3703 node_perm = UDP_SOCKET__NODE_BIND;
3704 break;
3705
3706 case SECCLASS_DCCP_SOCKET:
3707 node_perm = DCCP_SOCKET__NODE_BIND;
3708 break;
3709
3710 default:
3711 node_perm = RAWIP_SOCKET__NODE_BIND;
3712 break;
3713 }
3714
3715 err = sel_netnode_sid(addrp, family, &sid);
3716 if (err)
3717 goto out;
3718
3719 AVC_AUDIT_DATA_INIT(&ad,NET);
3720 ad.u.net.sport = htons(snum);
3721 ad.u.net.family = family;
3722
3723 if (family == PF_INET)
3724 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3725 else
3726 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3727
3728 err = avc_has_perm(isec->sid, sid,
3729 isec->sclass, node_perm, &ad);
3730 if (err)
3731 goto out;
3732 }
3733 out:
3734 return err;
3735 }
3736
3737 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3738 {
3739 struct inode_security_struct *isec;
3740 int err;
3741
3742 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3743 if (err)
3744 return err;
3745
3746 /*
3747 * If a TCP or DCCP socket, check name_connect permission for the port.
3748 */
3749 isec = SOCK_INODE(sock)->i_security;
3750 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3751 isec->sclass == SECCLASS_DCCP_SOCKET) {
3752 struct sock *sk = sock->sk;
3753 struct avc_audit_data ad;
3754 struct sockaddr_in *addr4 = NULL;
3755 struct sockaddr_in6 *addr6 = NULL;
3756 unsigned short snum;
3757 u32 sid, perm;
3758
3759 if (sk->sk_family == PF_INET) {
3760 addr4 = (struct sockaddr_in *)address;
3761 if (addrlen < sizeof(struct sockaddr_in))
3762 return -EINVAL;
3763 snum = ntohs(addr4->sin_port);
3764 } else {
3765 addr6 = (struct sockaddr_in6 *)address;
3766 if (addrlen < SIN6_LEN_RFC2133)
3767 return -EINVAL;
3768 snum = ntohs(addr6->sin6_port);
3769 }
3770
3771 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3772 if (err)
3773 goto out;
3774
3775 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3776 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3777
3778 AVC_AUDIT_DATA_INIT(&ad,NET);
3779 ad.u.net.dport = htons(snum);
3780 ad.u.net.family = sk->sk_family;
3781 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3782 if (err)
3783 goto out;
3784 }
3785
3786 out:
3787 return err;
3788 }
3789
3790 static int selinux_socket_listen(struct socket *sock, int backlog)
3791 {
3792 return socket_has_perm(current, sock, SOCKET__LISTEN);
3793 }
3794
3795 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3796 {
3797 int err;
3798 struct inode_security_struct *isec;
3799 struct inode_security_struct *newisec;
3800
3801 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3802 if (err)
3803 return err;
3804
3805 newisec = SOCK_INODE(newsock)->i_security;
3806
3807 isec = SOCK_INODE(sock)->i_security;
3808 newisec->sclass = isec->sclass;
3809 newisec->sid = isec->sid;
3810 newisec->initialized = 1;
3811
3812 return 0;
3813 }
3814
3815 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3816 int size)
3817 {
3818 int rc;
3819
3820 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3821 if (rc)
3822 return rc;
3823
3824 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3825 }
3826
3827 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3828 int size, int flags)
3829 {
3830 return socket_has_perm(current, sock, SOCKET__READ);
3831 }
3832
3833 static int selinux_socket_getsockname(struct socket *sock)
3834 {
3835 return socket_has_perm(current, sock, SOCKET__GETATTR);
3836 }
3837
3838 static int selinux_socket_getpeername(struct socket *sock)
3839 {
3840 return socket_has_perm(current, sock, SOCKET__GETATTR);
3841 }
3842
3843 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3844 {
3845 int err;
3846
3847 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3848 if (err)
3849 return err;
3850
3851 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3852 }
3853
3854 static int selinux_socket_getsockopt(struct socket *sock, int level,
3855 int optname)
3856 {
3857 return socket_has_perm(current, sock, SOCKET__GETOPT);
3858 }
3859
3860 static int selinux_socket_shutdown(struct socket *sock, int how)
3861 {
3862 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3863 }
3864
3865 static int selinux_socket_unix_stream_connect(struct socket *sock,
3866 struct socket *other,
3867 struct sock *newsk)
3868 {
3869 struct sk_security_struct *ssec;
3870 struct inode_security_struct *isec;
3871 struct inode_security_struct *other_isec;
3872 struct avc_audit_data ad;
3873 int err;
3874
3875 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3876 if (err)
3877 return err;
3878
3879 isec = SOCK_INODE(sock)->i_security;
3880 other_isec = SOCK_INODE(other)->i_security;
3881
3882 AVC_AUDIT_DATA_INIT(&ad,NET);
3883 ad.u.net.sk = other->sk;
3884
3885 err = avc_has_perm(isec->sid, other_isec->sid,
3886 isec->sclass,
3887 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3888 if (err)
3889 return err;
3890
3891 /* connecting socket */
3892 ssec = sock->sk->sk_security;
3893 ssec->peer_sid = other_isec->sid;
3894
3895 /* server child socket */
3896 ssec = newsk->sk_security;
3897 ssec->peer_sid = isec->sid;
3898 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3899
3900 return err;
3901 }
3902
3903 static int selinux_socket_unix_may_send(struct socket *sock,
3904 struct socket *other)
3905 {
3906 struct inode_security_struct *isec;
3907 struct inode_security_struct *other_isec;
3908 struct avc_audit_data ad;
3909 int err;
3910
3911 isec = SOCK_INODE(sock)->i_security;
3912 other_isec = SOCK_INODE(other)->i_security;
3913
3914 AVC_AUDIT_DATA_INIT(&ad,NET);
3915 ad.u.net.sk = other->sk;
3916
3917 err = avc_has_perm(isec->sid, other_isec->sid,
3918 isec->sclass, SOCKET__SENDTO, &ad);
3919 if (err)
3920 return err;
3921
3922 return 0;
3923 }
3924
3925 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3926 u32 peer_sid,
3927 struct avc_audit_data *ad)
3928 {
3929 int err;
3930 u32 if_sid;
3931 u32 node_sid;
3932
3933 err = sel_netif_sid(ifindex, &if_sid);
3934 if (err)
3935 return err;
3936 err = avc_has_perm(peer_sid, if_sid,
3937 SECCLASS_NETIF, NETIF__INGRESS, ad);
3938 if (err)
3939 return err;
3940
3941 err = sel_netnode_sid(addrp, family, &node_sid);
3942 if (err)
3943 return err;
3944 return avc_has_perm(peer_sid, node_sid,
3945 SECCLASS_NODE, NODE__RECVFROM, ad);
3946 }
3947
3948 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3949 struct sk_buff *skb,
3950 struct avc_audit_data *ad,
3951 u16 family,
3952 char *addrp)
3953 {
3954 int err;
3955 struct sk_security_struct *sksec = sk->sk_security;
3956 u16 sk_class;
3957 u32 netif_perm, node_perm, recv_perm;
3958 u32 port_sid, node_sid, if_sid, sk_sid;
3959
3960 sk_sid = sksec->sid;
3961 sk_class = sksec->sclass;
3962
3963 switch (sk_class) {
3964 case SECCLASS_UDP_SOCKET:
3965 netif_perm = NETIF__UDP_RECV;
3966 node_perm = NODE__UDP_RECV;
3967 recv_perm = UDP_SOCKET__RECV_MSG;
3968 break;
3969 case SECCLASS_TCP_SOCKET:
3970 netif_perm = NETIF__TCP_RECV;
3971 node_perm = NODE__TCP_RECV;
3972 recv_perm = TCP_SOCKET__RECV_MSG;
3973 break;
3974 case SECCLASS_DCCP_SOCKET:
3975 netif_perm = NETIF__DCCP_RECV;
3976 node_perm = NODE__DCCP_RECV;
3977 recv_perm = DCCP_SOCKET__RECV_MSG;
3978 break;
3979 default:
3980 netif_perm = NETIF__RAWIP_RECV;
3981 node_perm = NODE__RAWIP_RECV;
3982 recv_perm = 0;
3983 break;
3984 }
3985
3986 err = sel_netif_sid(skb->iif, &if_sid);
3987 if (err)
3988 return err;
3989 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3990 if (err)
3991 return err;
3992
3993 err = sel_netnode_sid(addrp, family, &node_sid);
3994 if (err)
3995 return err;
3996 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3997 if (err)
3998 return err;
3999
4000 if (!recv_perm)
4001 return 0;
4002 err = sel_netport_sid(sk->sk_protocol,
4003 ntohs(ad->u.net.sport), &port_sid);
4004 if (unlikely(err)) {
4005 printk(KERN_WARNING
4006 "SELinux: failure in"
4007 " selinux_sock_rcv_skb_iptables_compat(),"
4008 " network port label not found\n");
4009 return err;
4010 }
4011 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4012 }
4013
4014 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4015 struct avc_audit_data *ad,
4016 u16 family, char *addrp)
4017 {
4018 int err;
4019 struct sk_security_struct *sksec = sk->sk_security;
4020 u32 peer_sid;
4021 u32 sk_sid = sksec->sid;
4022
4023 if (selinux_compat_net)
4024 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4025 family, addrp);
4026 else
4027 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4028 PACKET__RECV, ad);
4029 if (err)
4030 return err;
4031
4032 if (selinux_policycap_netpeer) {
4033 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4034 if (err)
4035 return err;
4036 err = avc_has_perm(sk_sid, peer_sid,
4037 SECCLASS_PEER, PEER__RECV, ad);
4038 } else {
4039 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4040 if (err)
4041 return err;
4042 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4043 }
4044
4045 return err;
4046 }
4047
4048 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4049 {
4050 int err;
4051 struct sk_security_struct *sksec = sk->sk_security;
4052 u16 family = sk->sk_family;
4053 u32 sk_sid = sksec->sid;
4054 struct avc_audit_data ad;
4055 char *addrp;
4056
4057 if (family != PF_INET && family != PF_INET6)
4058 return 0;
4059
4060 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4061 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4062 family = PF_INET;
4063
4064 AVC_AUDIT_DATA_INIT(&ad, NET);
4065 ad.u.net.netif = skb->iif;
4066 ad.u.net.family = family;
4067 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4068 if (err)
4069 return err;
4070
4071 /* If any sort of compatibility mode is enabled then handoff processing
4072 * to the selinux_sock_rcv_skb_compat() function to deal with the
4073 * special handling. We do this in an attempt to keep this function
4074 * as fast and as clean as possible. */
4075 if (selinux_compat_net || !selinux_policycap_netpeer)
4076 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4077 family, addrp);
4078
4079 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4080 u32 peer_sid;
4081
4082 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4083 if (err)
4084 return err;
4085 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4086 peer_sid, &ad);
4087 if (err)
4088 return err;
4089 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4090 PEER__RECV, &ad);
4091 }
4092
4093 if (selinux_secmark_enabled()) {
4094 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4095 PACKET__RECV, &ad);
4096 if (err)
4097 return err;
4098 }
4099
4100 return err;
4101 }
4102
4103 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4104 int __user *optlen, unsigned len)
4105 {
4106 int err = 0;
4107 char *scontext;
4108 u32 scontext_len;
4109 struct sk_security_struct *ssec;
4110 struct inode_security_struct *isec;
4111 u32 peer_sid = SECSID_NULL;
4112
4113 isec = SOCK_INODE(sock)->i_security;
4114
4115 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4116 isec->sclass == SECCLASS_TCP_SOCKET) {
4117 ssec = sock->sk->sk_security;
4118 peer_sid = ssec->peer_sid;
4119 }
4120 if (peer_sid == SECSID_NULL) {
4121 err = -ENOPROTOOPT;
4122 goto out;
4123 }
4124
4125 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4126
4127 if (err)
4128 goto out;
4129
4130 if (scontext_len > len) {
4131 err = -ERANGE;
4132 goto out_len;
4133 }
4134
4135 if (copy_to_user(optval, scontext, scontext_len))
4136 err = -EFAULT;
4137
4138 out_len:
4139 if (put_user(scontext_len, optlen))
4140 err = -EFAULT;
4141
4142 kfree(scontext);
4143 out:
4144 return err;
4145 }
4146
4147 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4148 {
4149 u32 peer_secid = SECSID_NULL;
4150 u16 family;
4151
4152 if (sock)
4153 family = sock->sk->sk_family;
4154 else if (skb && skb->sk)
4155 family = skb->sk->sk_family;
4156 else
4157 goto out;
4158
4159 if (sock && family == PF_UNIX)
4160 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4161 else if (skb)
4162 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4163
4164 out:
4165 *secid = peer_secid;
4166 if (peer_secid == SECSID_NULL)
4167 return -EINVAL;
4168 return 0;
4169 }
4170
4171 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4172 {
4173 return sk_alloc_security(sk, family, priority);
4174 }
4175
4176 static void selinux_sk_free_security(struct sock *sk)
4177 {
4178 sk_free_security(sk);
4179 }
4180
4181 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4182 {
4183 struct sk_security_struct *ssec = sk->sk_security;
4184 struct sk_security_struct *newssec = newsk->sk_security;
4185
4186 newssec->sid = ssec->sid;
4187 newssec->peer_sid = ssec->peer_sid;
4188 newssec->sclass = ssec->sclass;
4189
4190 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4191 }
4192
4193 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4194 {
4195 if (!sk)
4196 *secid = SECINITSID_ANY_SOCKET;
4197 else {
4198 struct sk_security_struct *sksec = sk->sk_security;
4199
4200 *secid = sksec->sid;
4201 }
4202 }
4203
4204 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4205 {
4206 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4207 struct sk_security_struct *sksec = sk->sk_security;
4208
4209 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4210 sk->sk_family == PF_UNIX)
4211 isec->sid = sksec->sid;
4212 sksec->sclass = isec->sclass;
4213
4214 selinux_netlbl_sock_graft(sk, parent);
4215 }
4216
4217 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4218 struct request_sock *req)
4219 {
4220 struct sk_security_struct *sksec = sk->sk_security;
4221 int err;
4222 u32 newsid;
4223 u32 peersid;
4224
4225 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4226 if (err)
4227 return err;
4228 if (peersid == SECSID_NULL) {
4229 req->secid = sksec->sid;
4230 req->peer_secid = SECSID_NULL;
4231 return 0;
4232 }
4233
4234 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4235 if (err)
4236 return err;
4237
4238 req->secid = newsid;
4239 req->peer_secid = peersid;
4240 return 0;
4241 }
4242
4243 static void selinux_inet_csk_clone(struct sock *newsk,
4244 const struct request_sock *req)
4245 {
4246 struct sk_security_struct *newsksec = newsk->sk_security;
4247
4248 newsksec->sid = req->secid;
4249 newsksec->peer_sid = req->peer_secid;
4250 /* NOTE: Ideally, we should also get the isec->sid for the
4251 new socket in sync, but we don't have the isec available yet.
4252 So we will wait until sock_graft to do it, by which
4253 time it will have been created and available. */
4254
4255 /* We don't need to take any sort of lock here as we are the only
4256 * thread with access to newsksec */
4257 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4258 }
4259
4260 static void selinux_inet_conn_established(struct sock *sk,
4261 struct sk_buff *skb)
4262 {
4263 struct sk_security_struct *sksec = sk->sk_security;
4264
4265 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4266 }
4267
4268 static void selinux_req_classify_flow(const struct request_sock *req,
4269 struct flowi *fl)
4270 {
4271 fl->secid = req->secid;
4272 }
4273
4274 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4275 {
4276 int err = 0;
4277 u32 perm;
4278 struct nlmsghdr *nlh;
4279 struct socket *sock = sk->sk_socket;
4280 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4281
4282 if (skb->len < NLMSG_SPACE(0)) {
4283 err = -EINVAL;
4284 goto out;
4285 }
4286 nlh = nlmsg_hdr(skb);
4287
4288 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4289 if (err) {
4290 if (err == -EINVAL) {
4291 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4292 "SELinux: unrecognized netlink message"
4293 " type=%hu for sclass=%hu\n",
4294 nlh->nlmsg_type, isec->sclass);
4295 if (!selinux_enforcing)
4296 err = 0;
4297 }
4298
4299 /* Ignore */
4300 if (err == -ENOENT)
4301 err = 0;
4302 goto out;
4303 }
4304
4305 err = socket_has_perm(current, sock, perm);
4306 out:
4307 return err;
4308 }
4309
4310 #ifdef CONFIG_NETFILTER
4311
4312 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4313 u16 family)
4314 {
4315 char *addrp;
4316 u32 peer_sid;
4317 struct avc_audit_data ad;
4318 u8 secmark_active;
4319 u8 peerlbl_active;
4320
4321 if (!selinux_policycap_netpeer)
4322 return NF_ACCEPT;
4323
4324 secmark_active = selinux_secmark_enabled();
4325 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4326 if (!secmark_active && !peerlbl_active)
4327 return NF_ACCEPT;
4328
4329 AVC_AUDIT_DATA_INIT(&ad, NET);
4330 ad.u.net.netif = ifindex;
4331 ad.u.net.family = family;
4332 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4333 return NF_DROP;
4334
4335 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4336 return NF_DROP;
4337
4338 if (peerlbl_active)
4339 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4340 peer_sid, &ad) != 0)
4341 return NF_DROP;
4342
4343 if (secmark_active)
4344 if (avc_has_perm(peer_sid, skb->secmark,
4345 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4346 return NF_DROP;
4347
4348 return NF_ACCEPT;
4349 }
4350
4351 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4352 struct sk_buff *skb,
4353 const struct net_device *in,
4354 const struct net_device *out,
4355 int (*okfn)(struct sk_buff *))
4356 {
4357 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4358 }
4359
4360 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4361 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4362 struct sk_buff *skb,
4363 const struct net_device *in,
4364 const struct net_device *out,
4365 int (*okfn)(struct sk_buff *))
4366 {
4367 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4368 }
4369 #endif /* IPV6 */
4370
4371 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4372 int ifindex,
4373 struct avc_audit_data *ad,
4374 u16 family, char *addrp)
4375 {
4376 int err;
4377 struct sk_security_struct *sksec = sk->sk_security;
4378 u16 sk_class;
4379 u32 netif_perm, node_perm, send_perm;
4380 u32 port_sid, node_sid, if_sid, sk_sid;
4381
4382 sk_sid = sksec->sid;
4383 sk_class = sksec->sclass;
4384
4385 switch (sk_class) {
4386 case SECCLASS_UDP_SOCKET:
4387 netif_perm = NETIF__UDP_SEND;
4388 node_perm = NODE__UDP_SEND;
4389 send_perm = UDP_SOCKET__SEND_MSG;
4390 break;
4391 case SECCLASS_TCP_SOCKET:
4392 netif_perm = NETIF__TCP_SEND;
4393 node_perm = NODE__TCP_SEND;
4394 send_perm = TCP_SOCKET__SEND_MSG;
4395 break;
4396 case SECCLASS_DCCP_SOCKET:
4397 netif_perm = NETIF__DCCP_SEND;
4398 node_perm = NODE__DCCP_SEND;
4399 send_perm = DCCP_SOCKET__SEND_MSG;
4400 break;
4401 default:
4402 netif_perm = NETIF__RAWIP_SEND;
4403 node_perm = NODE__RAWIP_SEND;
4404 send_perm = 0;
4405 break;
4406 }
4407
4408 err = sel_netif_sid(ifindex, &if_sid);
4409 if (err)
4410 return err;
4411 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4412 return err;
4413
4414 err = sel_netnode_sid(addrp, family, &node_sid);
4415 if (err)
4416 return err;
4417 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4418 if (err)
4419 return err;
4420
4421 if (send_perm != 0)
4422 return 0;
4423
4424 err = sel_netport_sid(sk->sk_protocol,
4425 ntohs(ad->u.net.dport), &port_sid);
4426 if (unlikely(err)) {
4427 printk(KERN_WARNING
4428 "SELinux: failure in"
4429 " selinux_ip_postroute_iptables_compat(),"
4430 " network port label not found\n");
4431 return err;
4432 }
4433 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4434 }
4435
4436 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4437 int ifindex,
4438 struct avc_audit_data *ad,
4439 u16 family,
4440 char *addrp,
4441 u8 proto)
4442 {
4443 struct sock *sk = skb->sk;
4444 struct sk_security_struct *sksec;
4445
4446 if (sk == NULL)
4447 return NF_ACCEPT;
4448 sksec = sk->sk_security;
4449
4450 if (selinux_compat_net) {
4451 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4452 ad, family, addrp))
4453 return NF_DROP;
4454 } else {
4455 if (avc_has_perm(sksec->sid, skb->secmark,
4456 SECCLASS_PACKET, PACKET__SEND, ad))
4457 return NF_DROP;
4458 }
4459
4460 if (selinux_policycap_netpeer)
4461 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4462 return NF_DROP;
4463
4464 return NF_ACCEPT;
4465 }
4466
4467 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4468 u16 family)
4469 {
4470 u32 secmark_perm;
4471 u32 peer_sid;
4472 struct sock *sk;
4473 struct avc_audit_data ad;
4474 char *addrp;
4475 u8 proto;
4476 u8 secmark_active;
4477 u8 peerlbl_active;
4478
4479 AVC_AUDIT_DATA_INIT(&ad, NET);
4480 ad.u.net.netif = ifindex;
4481 ad.u.net.family = family;
4482 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4483 return NF_DROP;
4484
4485 /* If any sort of compatibility mode is enabled then handoff processing
4486 * to the selinux_ip_postroute_compat() function to deal with the
4487 * special handling. We do this in an attempt to keep this function
4488 * as fast and as clean as possible. */
4489 if (selinux_compat_net || !selinux_policycap_netpeer)
4490 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4491 family, addrp, proto);
4492
4493 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4494 * packet transformation so allow the packet to pass without any checks
4495 * since we'll have another chance to perform access control checks
4496 * when the packet is on it's final way out.
4497 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4498 * is NULL, in this case go ahead and apply access control. */
4499 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4500 return NF_ACCEPT;
4501
4502 secmark_active = selinux_secmark_enabled();
4503 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4504 if (!secmark_active && !peerlbl_active)
4505 return NF_ACCEPT;
4506
4507 /* if the packet is locally generated (skb->sk != NULL) then use the
4508 * socket's label as the peer label, otherwise the packet is being
4509 * forwarded through this system and we need to fetch the peer label
4510 * directly from the packet */
4511 sk = skb->sk;
4512 if (sk) {
4513 struct sk_security_struct *sksec = sk->sk_security;
4514 peer_sid = sksec->sid;
4515 secmark_perm = PACKET__SEND;
4516 } else {
4517 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4518 return NF_DROP;
4519 secmark_perm = PACKET__FORWARD_OUT;
4520 }
4521
4522 if (secmark_active)
4523 if (avc_has_perm(peer_sid, skb->secmark,
4524 SECCLASS_PACKET, secmark_perm, &ad))
4525 return NF_DROP;
4526
4527 if (peerlbl_active) {
4528 u32 if_sid;
4529 u32 node_sid;
4530
4531 if (sel_netif_sid(ifindex, &if_sid))
4532 return NF_DROP;
4533 if (avc_has_perm(peer_sid, if_sid,
4534 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4535 return NF_DROP;
4536
4537 if (sel_netnode_sid(addrp, family, &node_sid))
4538 return NF_DROP;
4539 if (avc_has_perm(peer_sid, node_sid,
4540 SECCLASS_NODE, NODE__SENDTO, &ad))
4541 return NF_DROP;
4542 }
4543
4544 return NF_ACCEPT;
4545 }
4546
4547 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4548 struct sk_buff *skb,
4549 const struct net_device *in,
4550 const struct net_device *out,
4551 int (*okfn)(struct sk_buff *))
4552 {
4553 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4554 }
4555
4556 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4557 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4558 struct sk_buff *skb,
4559 const struct net_device *in,
4560 const struct net_device *out,
4561 int (*okfn)(struct sk_buff *))
4562 {
4563 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4564 }
4565 #endif /* IPV6 */
4566
4567 #endif /* CONFIG_NETFILTER */
4568
4569 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4570 {
4571 int err;
4572
4573 err = secondary_ops->netlink_send(sk, skb);
4574 if (err)
4575 return err;
4576
4577 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4578 err = selinux_nlmsg_perm(sk, skb);
4579
4580 return err;
4581 }
4582
4583 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4584 {
4585 int err;
4586 struct avc_audit_data ad;
4587
4588 err = secondary_ops->netlink_recv(skb, capability);
4589 if (err)
4590 return err;
4591
4592 AVC_AUDIT_DATA_INIT(&ad, CAP);
4593 ad.u.cap = capability;
4594
4595 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4596 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4597 }
4598
4599 static int ipc_alloc_security(struct task_struct *task,
4600 struct kern_ipc_perm *perm,
4601 u16 sclass)
4602 {
4603 struct task_security_struct *tsec = task->security;
4604 struct ipc_security_struct *isec;
4605
4606 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4607 if (!isec)
4608 return -ENOMEM;
4609
4610 isec->sclass = sclass;
4611 isec->sid = tsec->sid;
4612 perm->security = isec;
4613
4614 return 0;
4615 }
4616
4617 static void ipc_free_security(struct kern_ipc_perm *perm)
4618 {
4619 struct ipc_security_struct *isec = perm->security;
4620 perm->security = NULL;
4621 kfree(isec);
4622 }
4623
4624 static int msg_msg_alloc_security(struct msg_msg *msg)
4625 {
4626 struct msg_security_struct *msec;
4627
4628 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4629 if (!msec)
4630 return -ENOMEM;
4631
4632 msec->sid = SECINITSID_UNLABELED;
4633 msg->security = msec;
4634
4635 return 0;
4636 }
4637
4638 static void msg_msg_free_security(struct msg_msg *msg)
4639 {
4640 struct msg_security_struct *msec = msg->security;
4641
4642 msg->security = NULL;
4643 kfree(msec);
4644 }
4645
4646 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4647 u32 perms)
4648 {
4649 struct task_security_struct *tsec;
4650 struct ipc_security_struct *isec;
4651 struct avc_audit_data ad;
4652
4653 tsec = current->security;
4654 isec = ipc_perms->security;
4655
4656 AVC_AUDIT_DATA_INIT(&ad, IPC);
4657 ad.u.ipc_id = ipc_perms->key;
4658
4659 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4660 }
4661
4662 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4663 {
4664 return msg_msg_alloc_security(msg);
4665 }
4666
4667 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4668 {
4669 msg_msg_free_security(msg);
4670 }
4671
4672 /* message queue security operations */
4673 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4674 {
4675 struct task_security_struct *tsec;
4676 struct ipc_security_struct *isec;
4677 struct avc_audit_data ad;
4678 int rc;
4679
4680 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4681 if (rc)
4682 return rc;
4683
4684 tsec = current->security;
4685 isec = msq->q_perm.security;
4686
4687 AVC_AUDIT_DATA_INIT(&ad, IPC);
4688 ad.u.ipc_id = msq->q_perm.key;
4689
4690 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4691 MSGQ__CREATE, &ad);
4692 if (rc) {
4693 ipc_free_security(&msq->q_perm);
4694 return rc;
4695 }
4696 return 0;
4697 }
4698
4699 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4700 {
4701 ipc_free_security(&msq->q_perm);
4702 }
4703
4704 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4705 {
4706 struct task_security_struct *tsec;
4707 struct ipc_security_struct *isec;
4708 struct avc_audit_data ad;
4709
4710 tsec = current->security;
4711 isec = msq->q_perm.security;
4712
4713 AVC_AUDIT_DATA_INIT(&ad, IPC);
4714 ad.u.ipc_id = msq->q_perm.key;
4715
4716 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4717 MSGQ__ASSOCIATE, &ad);
4718 }
4719
4720 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4721 {
4722 int err;
4723 int perms;
4724
4725 switch(cmd) {
4726 case IPC_INFO:
4727 case MSG_INFO:
4728 /* No specific object, just general system-wide information. */
4729 return task_has_system(current, SYSTEM__IPC_INFO);
4730 case IPC_STAT:
4731 case MSG_STAT:
4732 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4733 break;
4734 case IPC_SET:
4735 perms = MSGQ__SETATTR;
4736 break;
4737 case IPC_RMID:
4738 perms = MSGQ__DESTROY;
4739 break;
4740 default:
4741 return 0;
4742 }
4743
4744 err = ipc_has_perm(&msq->q_perm, perms);
4745 return err;
4746 }
4747
4748 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4749 {
4750 struct task_security_struct *tsec;
4751 struct ipc_security_struct *isec;
4752 struct msg_security_struct *msec;
4753 struct avc_audit_data ad;
4754 int rc;
4755
4756 tsec = current->security;
4757 isec = msq->q_perm.security;
4758 msec = msg->security;
4759
4760 /*
4761 * First time through, need to assign label to the message
4762 */
4763 if (msec->sid == SECINITSID_UNLABELED) {
4764 /*
4765 * Compute new sid based on current process and
4766 * message queue this message will be stored in
4767 */
4768 rc = security_transition_sid(tsec->sid,
4769 isec->sid,
4770 SECCLASS_MSG,
4771 &msec->sid);
4772 if (rc)
4773 return rc;
4774 }
4775
4776 AVC_AUDIT_DATA_INIT(&ad, IPC);
4777 ad.u.ipc_id = msq->q_perm.key;
4778
4779 /* Can this process write to the queue? */
4780 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4781 MSGQ__WRITE, &ad);
4782 if (!rc)
4783 /* Can this process send the message */
4784 rc = avc_has_perm(tsec->sid, msec->sid,
4785 SECCLASS_MSG, MSG__SEND, &ad);
4786 if (!rc)
4787 /* Can the message be put in the queue? */
4788 rc = avc_has_perm(msec->sid, isec->sid,
4789 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4790
4791 return rc;
4792 }
4793
4794 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4795 struct task_struct *target,
4796 long type, int mode)
4797 {
4798 struct task_security_struct *tsec;
4799 struct ipc_security_struct *isec;
4800 struct msg_security_struct *msec;
4801 struct avc_audit_data ad;
4802 int rc;
4803
4804 tsec = target->security;
4805 isec = msq->q_perm.security;
4806 msec = msg->security;
4807
4808 AVC_AUDIT_DATA_INIT(&ad, IPC);
4809 ad.u.ipc_id = msq->q_perm.key;
4810
4811 rc = avc_has_perm(tsec->sid, isec->sid,
4812 SECCLASS_MSGQ, MSGQ__READ, &ad);
4813 if (!rc)
4814 rc = avc_has_perm(tsec->sid, msec->sid,
4815 SECCLASS_MSG, MSG__RECEIVE, &ad);
4816 return rc;
4817 }
4818
4819 /* Shared Memory security operations */
4820 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4821 {
4822 struct task_security_struct *tsec;
4823 struct ipc_security_struct *isec;
4824 struct avc_audit_data ad;
4825 int rc;
4826
4827 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4828 if (rc)
4829 return rc;
4830
4831 tsec = current->security;
4832 isec = shp->shm_perm.security;
4833
4834 AVC_AUDIT_DATA_INIT(&ad, IPC);
4835 ad.u.ipc_id = shp->shm_perm.key;
4836
4837 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4838 SHM__CREATE, &ad);
4839 if (rc) {
4840 ipc_free_security(&shp->shm_perm);
4841 return rc;
4842 }
4843 return 0;
4844 }
4845
4846 static void selinux_shm_free_security(struct shmid_kernel *shp)
4847 {
4848 ipc_free_security(&shp->shm_perm);
4849 }
4850
4851 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4852 {
4853 struct task_security_struct *tsec;
4854 struct ipc_security_struct *isec;
4855 struct avc_audit_data ad;
4856
4857 tsec = current->security;
4858 isec = shp->shm_perm.security;
4859
4860 AVC_AUDIT_DATA_INIT(&ad, IPC);
4861 ad.u.ipc_id = shp->shm_perm.key;
4862
4863 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4864 SHM__ASSOCIATE, &ad);
4865 }
4866
4867 /* Note, at this point, shp is locked down */
4868 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4869 {
4870 int perms;
4871 int err;
4872
4873 switch(cmd) {
4874 case IPC_INFO:
4875 case SHM_INFO:
4876 /* No specific object, just general system-wide information. */
4877 return task_has_system(current, SYSTEM__IPC_INFO);
4878 case IPC_STAT:
4879 case SHM_STAT:
4880 perms = SHM__GETATTR | SHM__ASSOCIATE;
4881 break;
4882 case IPC_SET:
4883 perms = SHM__SETATTR;
4884 break;
4885 case SHM_LOCK:
4886 case SHM_UNLOCK:
4887 perms = SHM__LOCK;
4888 break;
4889 case IPC_RMID:
4890 perms = SHM__DESTROY;
4891 break;
4892 default:
4893 return 0;
4894 }
4895
4896 err = ipc_has_perm(&shp->shm_perm, perms);
4897 return err;
4898 }
4899
4900 static int selinux_shm_shmat(struct shmid_kernel *shp,
4901 char __user *shmaddr, int shmflg)
4902 {
4903 u32 perms;
4904 int rc;
4905
4906 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4907 if (rc)
4908 return rc;
4909
4910 if (shmflg & SHM_RDONLY)
4911 perms = SHM__READ;
4912 else
4913 perms = SHM__READ | SHM__WRITE;
4914
4915 return ipc_has_perm(&shp->shm_perm, perms);
4916 }
4917
4918 /* Semaphore security operations */
4919 static int selinux_sem_alloc_security(struct sem_array *sma)
4920 {
4921 struct task_security_struct *tsec;
4922 struct ipc_security_struct *isec;
4923 struct avc_audit_data ad;
4924 int rc;
4925
4926 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4927 if (rc)
4928 return rc;
4929
4930 tsec = current->security;
4931 isec = sma->sem_perm.security;
4932
4933 AVC_AUDIT_DATA_INIT(&ad, IPC);
4934 ad.u.ipc_id = sma->sem_perm.key;
4935
4936 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4937 SEM__CREATE, &ad);
4938 if (rc) {
4939 ipc_free_security(&sma->sem_perm);
4940 return rc;
4941 }
4942 return 0;
4943 }
4944
4945 static void selinux_sem_free_security(struct sem_array *sma)
4946 {
4947 ipc_free_security(&sma->sem_perm);
4948 }
4949
4950 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4951 {
4952 struct task_security_struct *tsec;
4953 struct ipc_security_struct *isec;
4954 struct avc_audit_data ad;
4955
4956 tsec = current->security;
4957 isec = sma->sem_perm.security;
4958
4959 AVC_AUDIT_DATA_INIT(&ad, IPC);
4960 ad.u.ipc_id = sma->sem_perm.key;
4961
4962 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4963 SEM__ASSOCIATE, &ad);
4964 }
4965
4966 /* Note, at this point, sma is locked down */
4967 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4968 {
4969 int err;
4970 u32 perms;
4971
4972 switch(cmd) {
4973 case IPC_INFO:
4974 case SEM_INFO:
4975 /* No specific object, just general system-wide information. */
4976 return task_has_system(current, SYSTEM__IPC_INFO);
4977 case GETPID:
4978 case GETNCNT:
4979 case GETZCNT:
4980 perms = SEM__GETATTR;
4981 break;
4982 case GETVAL:
4983 case GETALL:
4984 perms = SEM__READ;
4985 break;
4986 case SETVAL:
4987 case SETALL:
4988 perms = SEM__WRITE;
4989 break;
4990 case IPC_RMID:
4991 perms = SEM__DESTROY;
4992 break;
4993 case IPC_SET:
4994 perms = SEM__SETATTR;
4995 break;
4996 case IPC_STAT:
4997 case SEM_STAT:
4998 perms = SEM__GETATTR | SEM__ASSOCIATE;
4999 break;
5000 default:
5001 return 0;
5002 }
5003
5004 err = ipc_has_perm(&sma->sem_perm, perms);
5005 return err;
5006 }
5007
5008 static int selinux_sem_semop(struct sem_array *sma,
5009 struct sembuf *sops, unsigned nsops, int alter)
5010 {
5011 u32 perms;
5012
5013 if (alter)
5014 perms = SEM__READ | SEM__WRITE;
5015 else
5016 perms = SEM__READ;
5017
5018 return ipc_has_perm(&sma->sem_perm, perms);
5019 }
5020
5021 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5022 {
5023 u32 av = 0;
5024
5025 av = 0;
5026 if (flag & S_IRUGO)
5027 av |= IPC__UNIX_READ;
5028 if (flag & S_IWUGO)
5029 av |= IPC__UNIX_WRITE;
5030
5031 if (av == 0)
5032 return 0;
5033
5034 return ipc_has_perm(ipcp, av);
5035 }
5036
5037 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5038 {
5039 struct ipc_security_struct *isec = ipcp->security;
5040 *secid = isec->sid;
5041 }
5042
5043 /* module stacking operations */
5044 static int selinux_register_security (const char *name, struct security_operations *ops)
5045 {
5046 if (secondary_ops != original_ops) {
5047 printk(KERN_ERR "%s: There is already a secondary security "
5048 "module registered.\n", __func__);
5049 return -EINVAL;
5050 }
5051
5052 secondary_ops = ops;
5053
5054 printk(KERN_INFO "%s: Registering secondary module %s\n",
5055 __func__,
5056 name);
5057
5058 return 0;
5059 }
5060
5061 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5062 {
5063 if (inode)
5064 inode_doinit_with_dentry(inode, dentry);
5065 }
5066
5067 static int selinux_getprocattr(struct task_struct *p,
5068 char *name, char **value)
5069 {
5070 struct task_security_struct *tsec;
5071 u32 sid;
5072 int error;
5073 unsigned len;
5074
5075 if (current != p) {
5076 error = task_has_perm(current, p, PROCESS__GETATTR);
5077 if (error)
5078 return error;
5079 }
5080
5081 tsec = p->security;
5082
5083 if (!strcmp(name, "current"))
5084 sid = tsec->sid;
5085 else if (!strcmp(name, "prev"))
5086 sid = tsec->osid;
5087 else if (!strcmp(name, "exec"))
5088 sid = tsec->exec_sid;
5089 else if (!strcmp(name, "fscreate"))
5090 sid = tsec->create_sid;
5091 else if (!strcmp(name, "keycreate"))
5092 sid = tsec->keycreate_sid;
5093 else if (!strcmp(name, "sockcreate"))
5094 sid = tsec->sockcreate_sid;
5095 else
5096 return -EINVAL;
5097
5098 if (!sid)
5099 return 0;
5100
5101 error = security_sid_to_context(sid, value, &len);
5102 if (error)
5103 return error;
5104 return len;
5105 }
5106
5107 static int selinux_setprocattr(struct task_struct *p,
5108 char *name, void *value, size_t size)
5109 {
5110 struct task_security_struct *tsec;
5111 struct task_struct *tracer;
5112 u32 sid = 0;
5113 int error;
5114 char *str = value;
5115
5116 if (current != p) {
5117 /* SELinux only allows a process to change its own
5118 security attributes. */
5119 return -EACCES;
5120 }
5121
5122 /*
5123 * Basic control over ability to set these attributes at all.
5124 * current == p, but we'll pass them separately in case the
5125 * above restriction is ever removed.
5126 */
5127 if (!strcmp(name, "exec"))
5128 error = task_has_perm(current, p, PROCESS__SETEXEC);
5129 else if (!strcmp(name, "fscreate"))
5130 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5131 else if (!strcmp(name, "keycreate"))
5132 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5133 else if (!strcmp(name, "sockcreate"))
5134 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5135 else if (!strcmp(name, "current"))
5136 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5137 else
5138 error = -EINVAL;
5139 if (error)
5140 return error;
5141
5142 /* Obtain a SID for the context, if one was specified. */
5143 if (size && str[1] && str[1] != '\n') {
5144 if (str[size-1] == '\n') {
5145 str[size-1] = 0;
5146 size--;
5147 }
5148 error = security_context_to_sid(value, size, &sid);
5149 if (error)
5150 return error;
5151 }
5152
5153 /* Permission checking based on the specified context is
5154 performed during the actual operation (execve,
5155 open/mkdir/...), when we know the full context of the
5156 operation. See selinux_bprm_set_security for the execve
5157 checks and may_create for the file creation checks. The
5158 operation will then fail if the context is not permitted. */
5159 tsec = p->security;
5160 if (!strcmp(name, "exec"))
5161 tsec->exec_sid = sid;
5162 else if (!strcmp(name, "fscreate"))
5163 tsec->create_sid = sid;
5164 else if (!strcmp(name, "keycreate")) {
5165 error = may_create_key(sid, p);
5166 if (error)
5167 return error;
5168 tsec->keycreate_sid = sid;
5169 } else if (!strcmp(name, "sockcreate"))
5170 tsec->sockcreate_sid = sid;
5171 else if (!strcmp(name, "current")) {
5172 struct av_decision avd;
5173
5174 if (sid == 0)
5175 return -EINVAL;
5176
5177 /* Only allow single threaded processes to change context */
5178 if (atomic_read(&p->mm->mm_users) != 1) {
5179 struct task_struct *g, *t;
5180 struct mm_struct *mm = p->mm;
5181 read_lock(&tasklist_lock);
5182 do_each_thread(g, t)
5183 if (t->mm == mm && t != p) {
5184 read_unlock(&tasklist_lock);
5185 return -EPERM;
5186 }
5187 while_each_thread(g, t);
5188 read_unlock(&tasklist_lock);
5189 }
5190
5191 /* Check permissions for the transition. */
5192 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5193 PROCESS__DYNTRANSITION, NULL);
5194 if (error)
5195 return error;
5196
5197 /* Check for ptracing, and update the task SID if ok.
5198 Otherwise, leave SID unchanged and fail. */
5199 task_lock(p);
5200 rcu_read_lock();
5201 tracer = task_tracer_task(p);
5202 if (tracer != NULL) {
5203 struct task_security_struct *ptsec = tracer->security;
5204 u32 ptsid = ptsec->sid;
5205 rcu_read_unlock();
5206 error = avc_has_perm_noaudit(ptsid, sid,
5207 SECCLASS_PROCESS,
5208 PROCESS__PTRACE, 0, &avd);
5209 if (!error)
5210 tsec->sid = sid;
5211 task_unlock(p);
5212 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5213 PROCESS__PTRACE, &avd, error, NULL);
5214 if (error)
5215 return error;
5216 } else {
5217 rcu_read_unlock();
5218 tsec->sid = sid;
5219 task_unlock(p);
5220 }
5221 }
5222 else
5223 return -EINVAL;
5224
5225 return size;
5226 }
5227
5228 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5229 {
5230 return security_sid_to_context(secid, secdata, seclen);
5231 }
5232
5233 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5234 {
5235 return security_context_to_sid(secdata, seclen, secid);
5236 }
5237
5238 static void selinux_release_secctx(char *secdata, u32 seclen)
5239 {
5240 kfree(secdata);
5241 }
5242
5243 #ifdef CONFIG_KEYS
5244
5245 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5246 unsigned long flags)
5247 {
5248 struct task_security_struct *tsec = tsk->security;
5249 struct key_security_struct *ksec;
5250
5251 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5252 if (!ksec)
5253 return -ENOMEM;
5254
5255 if (tsec->keycreate_sid)
5256 ksec->sid = tsec->keycreate_sid;
5257 else
5258 ksec->sid = tsec->sid;
5259 k->security = ksec;
5260
5261 return 0;
5262 }
5263
5264 static void selinux_key_free(struct key *k)
5265 {
5266 struct key_security_struct *ksec = k->security;
5267
5268 k->security = NULL;
5269 kfree(ksec);
5270 }
5271
5272 static int selinux_key_permission(key_ref_t key_ref,
5273 struct task_struct *ctx,
5274 key_perm_t perm)
5275 {
5276 struct key *key;
5277 struct task_security_struct *tsec;
5278 struct key_security_struct *ksec;
5279
5280 key = key_ref_to_ptr(key_ref);
5281
5282 tsec = ctx->security;
5283 ksec = key->security;
5284
5285 /* if no specific permissions are requested, we skip the
5286 permission check. No serious, additional covert channels
5287 appear to be created. */
5288 if (perm == 0)
5289 return 0;
5290
5291 return avc_has_perm(tsec->sid, ksec->sid,
5292 SECCLASS_KEY, perm, NULL);
5293 }
5294
5295 #endif
5296
5297 static struct security_operations selinux_ops = {
5298 .name = "selinux",
5299
5300 .ptrace = selinux_ptrace,
5301 .capget = selinux_capget,
5302 .capset_check = selinux_capset_check,
5303 .capset_set = selinux_capset_set,
5304 .sysctl = selinux_sysctl,
5305 .capable = selinux_capable,
5306 .quotactl = selinux_quotactl,
5307 .quota_on = selinux_quota_on,
5308 .syslog = selinux_syslog,
5309 .vm_enough_memory = selinux_vm_enough_memory,
5310
5311 .netlink_send = selinux_netlink_send,
5312 .netlink_recv = selinux_netlink_recv,
5313
5314 .bprm_alloc_security = selinux_bprm_alloc_security,
5315 .bprm_free_security = selinux_bprm_free_security,
5316 .bprm_apply_creds = selinux_bprm_apply_creds,
5317 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5318 .bprm_set_security = selinux_bprm_set_security,
5319 .bprm_check_security = selinux_bprm_check_security,
5320 .bprm_secureexec = selinux_bprm_secureexec,
5321
5322 .sb_alloc_security = selinux_sb_alloc_security,
5323 .sb_free_security = selinux_sb_free_security,
5324 .sb_copy_data = selinux_sb_copy_data,
5325 .sb_kern_mount = selinux_sb_kern_mount,
5326 .sb_statfs = selinux_sb_statfs,
5327 .sb_mount = selinux_mount,
5328 .sb_umount = selinux_umount,
5329 .sb_get_mnt_opts = selinux_get_mnt_opts,
5330 .sb_set_mnt_opts = selinux_set_mnt_opts,
5331 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5332 .sb_parse_opts_str = selinux_parse_opts_str,
5333
5334
5335 .inode_alloc_security = selinux_inode_alloc_security,
5336 .inode_free_security = selinux_inode_free_security,
5337 .inode_init_security = selinux_inode_init_security,
5338 .inode_create = selinux_inode_create,
5339 .inode_link = selinux_inode_link,
5340 .inode_unlink = selinux_inode_unlink,
5341 .inode_symlink = selinux_inode_symlink,
5342 .inode_mkdir = selinux_inode_mkdir,
5343 .inode_rmdir = selinux_inode_rmdir,
5344 .inode_mknod = selinux_inode_mknod,
5345 .inode_rename = selinux_inode_rename,
5346 .inode_readlink = selinux_inode_readlink,
5347 .inode_follow_link = selinux_inode_follow_link,
5348 .inode_permission = selinux_inode_permission,
5349 .inode_setattr = selinux_inode_setattr,
5350 .inode_getattr = selinux_inode_getattr,
5351 .inode_setxattr = selinux_inode_setxattr,
5352 .inode_post_setxattr = selinux_inode_post_setxattr,
5353 .inode_getxattr = selinux_inode_getxattr,
5354 .inode_listxattr = selinux_inode_listxattr,
5355 .inode_removexattr = selinux_inode_removexattr,
5356 .inode_getsecurity = selinux_inode_getsecurity,
5357 .inode_setsecurity = selinux_inode_setsecurity,
5358 .inode_listsecurity = selinux_inode_listsecurity,
5359 .inode_need_killpriv = selinux_inode_need_killpriv,
5360 .inode_killpriv = selinux_inode_killpriv,
5361 .inode_getsecid = selinux_inode_getsecid,
5362
5363 .file_permission = selinux_file_permission,
5364 .file_alloc_security = selinux_file_alloc_security,
5365 .file_free_security = selinux_file_free_security,
5366 .file_ioctl = selinux_file_ioctl,
5367 .file_mmap = selinux_file_mmap,
5368 .file_mprotect = selinux_file_mprotect,
5369 .file_lock = selinux_file_lock,
5370 .file_fcntl = selinux_file_fcntl,
5371 .file_set_fowner = selinux_file_set_fowner,
5372 .file_send_sigiotask = selinux_file_send_sigiotask,
5373 .file_receive = selinux_file_receive,
5374
5375 .dentry_open = selinux_dentry_open,
5376
5377 .task_create = selinux_task_create,
5378 .task_alloc_security = selinux_task_alloc_security,
5379 .task_free_security = selinux_task_free_security,
5380 .task_setuid = selinux_task_setuid,
5381 .task_post_setuid = selinux_task_post_setuid,
5382 .task_setgid = selinux_task_setgid,
5383 .task_setpgid = selinux_task_setpgid,
5384 .task_getpgid = selinux_task_getpgid,
5385 .task_getsid = selinux_task_getsid,
5386 .task_getsecid = selinux_task_getsecid,
5387 .task_setgroups = selinux_task_setgroups,
5388 .task_setnice = selinux_task_setnice,
5389 .task_setioprio = selinux_task_setioprio,
5390 .task_getioprio = selinux_task_getioprio,
5391 .task_setrlimit = selinux_task_setrlimit,
5392 .task_setscheduler = selinux_task_setscheduler,
5393 .task_getscheduler = selinux_task_getscheduler,
5394 .task_movememory = selinux_task_movememory,
5395 .task_kill = selinux_task_kill,
5396 .task_wait = selinux_task_wait,
5397 .task_prctl = selinux_task_prctl,
5398 .task_reparent_to_init = selinux_task_reparent_to_init,
5399 .task_to_inode = selinux_task_to_inode,
5400
5401 .ipc_permission = selinux_ipc_permission,
5402 .ipc_getsecid = selinux_ipc_getsecid,
5403
5404 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5405 .msg_msg_free_security = selinux_msg_msg_free_security,
5406
5407 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5408 .msg_queue_free_security = selinux_msg_queue_free_security,
5409 .msg_queue_associate = selinux_msg_queue_associate,
5410 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5411 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5412 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5413
5414 .shm_alloc_security = selinux_shm_alloc_security,
5415 .shm_free_security = selinux_shm_free_security,
5416 .shm_associate = selinux_shm_associate,
5417 .shm_shmctl = selinux_shm_shmctl,
5418 .shm_shmat = selinux_shm_shmat,
5419
5420 .sem_alloc_security = selinux_sem_alloc_security,
5421 .sem_free_security = selinux_sem_free_security,
5422 .sem_associate = selinux_sem_associate,
5423 .sem_semctl = selinux_sem_semctl,
5424 .sem_semop = selinux_sem_semop,
5425
5426 .register_security = selinux_register_security,
5427
5428 .d_instantiate = selinux_d_instantiate,
5429
5430 .getprocattr = selinux_getprocattr,
5431 .setprocattr = selinux_setprocattr,
5432
5433 .secid_to_secctx = selinux_secid_to_secctx,
5434 .secctx_to_secid = selinux_secctx_to_secid,
5435 .release_secctx = selinux_release_secctx,
5436
5437 .unix_stream_connect = selinux_socket_unix_stream_connect,
5438 .unix_may_send = selinux_socket_unix_may_send,
5439
5440 .socket_create = selinux_socket_create,
5441 .socket_post_create = selinux_socket_post_create,
5442 .socket_bind = selinux_socket_bind,
5443 .socket_connect = selinux_socket_connect,
5444 .socket_listen = selinux_socket_listen,
5445 .socket_accept = selinux_socket_accept,
5446 .socket_sendmsg = selinux_socket_sendmsg,
5447 .socket_recvmsg = selinux_socket_recvmsg,
5448 .socket_getsockname = selinux_socket_getsockname,
5449 .socket_getpeername = selinux_socket_getpeername,
5450 .socket_getsockopt = selinux_socket_getsockopt,
5451 .socket_setsockopt = selinux_socket_setsockopt,
5452 .socket_shutdown = selinux_socket_shutdown,
5453 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5454 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5455 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5456 .sk_alloc_security = selinux_sk_alloc_security,
5457 .sk_free_security = selinux_sk_free_security,
5458 .sk_clone_security = selinux_sk_clone_security,
5459 .sk_getsecid = selinux_sk_getsecid,
5460 .sock_graft = selinux_sock_graft,
5461 .inet_conn_request = selinux_inet_conn_request,
5462 .inet_csk_clone = selinux_inet_csk_clone,
5463 .inet_conn_established = selinux_inet_conn_established,
5464 .req_classify_flow = selinux_req_classify_flow,
5465
5466 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5467 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5468 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5469 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5470 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5471 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5472 .xfrm_state_free_security = selinux_xfrm_state_free,
5473 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5474 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5475 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5476 .xfrm_decode_session = selinux_xfrm_decode_session,
5477 #endif
5478
5479 #ifdef CONFIG_KEYS
5480 .key_alloc = selinux_key_alloc,
5481 .key_free = selinux_key_free,
5482 .key_permission = selinux_key_permission,
5483 #endif
5484
5485 #ifdef CONFIG_AUDIT
5486 .audit_rule_init = selinux_audit_rule_init,
5487 .audit_rule_known = selinux_audit_rule_known,
5488 .audit_rule_match = selinux_audit_rule_match,
5489 .audit_rule_free = selinux_audit_rule_free,
5490 #endif
5491 };
5492
5493 static __init int selinux_init(void)
5494 {
5495 struct task_security_struct *tsec;
5496
5497 if (!security_module_enable(&selinux_ops)) {
5498 selinux_enabled = 0;
5499 return 0;
5500 }
5501
5502 if (!selinux_enabled) {
5503 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5504 return 0;
5505 }
5506
5507 printk(KERN_INFO "SELinux: Initializing.\n");
5508
5509 /* Set the security state for the initial task. */
5510 if (task_alloc_security(current))
5511 panic("SELinux: Failed to initialize initial task.\n");
5512 tsec = current->security;
5513 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5514
5515 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5516 sizeof(struct inode_security_struct),
5517 0, SLAB_PANIC, NULL);
5518 avc_init();
5519
5520 original_ops = secondary_ops = security_ops;
5521 if (!secondary_ops)
5522 panic ("SELinux: No initial security operations\n");
5523 if (register_security (&selinux_ops))
5524 panic("SELinux: Unable to register with kernel.\n");
5525
5526 if (selinux_enforcing) {
5527 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5528 } else {
5529 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5530 }
5531
5532 #ifdef CONFIG_KEYS
5533 /* Add security information to initial keyrings */
5534 selinux_key_alloc(&root_user_keyring, current,
5535 KEY_ALLOC_NOT_IN_QUOTA);
5536 selinux_key_alloc(&root_session_keyring, current,
5537 KEY_ALLOC_NOT_IN_QUOTA);
5538 #endif
5539
5540 return 0;
5541 }
5542
5543 void selinux_complete_init(void)
5544 {
5545 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5546
5547 /* Set up any superblocks initialized prior to the policy load. */
5548 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5549 spin_lock(&sb_lock);
5550 spin_lock(&sb_security_lock);
5551 next_sb:
5552 if (!list_empty(&superblock_security_head)) {
5553 struct superblock_security_struct *sbsec =
5554 list_entry(superblock_security_head.next,
5555 struct superblock_security_struct,
5556 list);
5557 struct super_block *sb = sbsec->sb;
5558 sb->s_count++;
5559 spin_unlock(&sb_security_lock);
5560 spin_unlock(&sb_lock);
5561 down_read(&sb->s_umount);
5562 if (sb->s_root)
5563 superblock_doinit(sb, NULL);
5564 drop_super(sb);
5565 spin_lock(&sb_lock);
5566 spin_lock(&sb_security_lock);
5567 list_del_init(&sbsec->list);
5568 goto next_sb;
5569 }
5570 spin_unlock(&sb_security_lock);
5571 spin_unlock(&sb_lock);
5572 }
5573
5574 /* SELinux requires early initialization in order to label
5575 all processes and objects when they are created. */
5576 security_initcall(selinux_init);
5577
5578 #if defined(CONFIG_NETFILTER)
5579
5580 static struct nf_hook_ops selinux_ipv4_ops[] = {
5581 {
5582 .hook = selinux_ipv4_postroute,
5583 .owner = THIS_MODULE,
5584 .pf = PF_INET,
5585 .hooknum = NF_INET_POST_ROUTING,
5586 .priority = NF_IP_PRI_SELINUX_LAST,
5587 },
5588 {
5589 .hook = selinux_ipv4_forward,
5590 .owner = THIS_MODULE,
5591 .pf = PF_INET,
5592 .hooknum = NF_INET_FORWARD,
5593 .priority = NF_IP_PRI_SELINUX_FIRST,
5594 }
5595 };
5596
5597 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5598
5599 static struct nf_hook_ops selinux_ipv6_ops[] = {
5600 {
5601 .hook = selinux_ipv6_postroute,
5602 .owner = THIS_MODULE,
5603 .pf = PF_INET6,
5604 .hooknum = NF_INET_POST_ROUTING,
5605 .priority = NF_IP6_PRI_SELINUX_LAST,
5606 },
5607 {
5608 .hook = selinux_ipv6_forward,
5609 .owner = THIS_MODULE,
5610 .pf = PF_INET6,
5611 .hooknum = NF_INET_FORWARD,
5612 .priority = NF_IP6_PRI_SELINUX_FIRST,
5613 }
5614 };
5615
5616 #endif /* IPV6 */
5617
5618 static int __init selinux_nf_ip_init(void)
5619 {
5620 int err = 0;
5621 u32 iter;
5622
5623 if (!selinux_enabled)
5624 goto out;
5625
5626 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5627
5628 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5629 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5630 if (err)
5631 panic("SELinux: nf_register_hook for IPv4: error %d\n",
5632 err);
5633 }
5634
5635 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5636 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5637 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5638 if (err)
5639 panic("SELinux: nf_register_hook for IPv6: error %d\n",
5640 err);
5641 }
5642 #endif /* IPV6 */
5643
5644 out:
5645 return err;
5646 }
5647
5648 __initcall(selinux_nf_ip_init);
5649
5650 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5651 static void selinux_nf_ip_exit(void)
5652 {
5653 u32 iter;
5654
5655 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5656
5657 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5658 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5659 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5660 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5661 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5662 #endif /* IPV6 */
5663 }
5664 #endif
5665
5666 #else /* CONFIG_NETFILTER */
5667
5668 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5669 #define selinux_nf_ip_exit()
5670 #endif
5671
5672 #endif /* CONFIG_NETFILTER */
5673
5674 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5675 int selinux_disable(void)
5676 {
5677 extern void exit_sel_fs(void);
5678 static int selinux_disabled = 0;
5679
5680 if (ss_initialized) {
5681 /* Not permitted after initial policy load. */
5682 return -EINVAL;
5683 }
5684
5685 if (selinux_disabled) {
5686 /* Only do this once. */
5687 return -EINVAL;
5688 }
5689
5690 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5691
5692 selinux_disabled = 1;
5693 selinux_enabled = 0;
5694
5695 /* Reset security_ops to the secondary module, dummy or capability. */
5696 security_ops = secondary_ops;
5697
5698 /* Unregister netfilter hooks. */
5699 selinux_nf_ip_exit();
5700
5701 /* Unregister selinuxfs. */
5702 exit_sel_fs();
5703
5704 return 0;
5705 }
5706 #endif
Support for the Chinese Samsung S3C2440 based development boards