?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[SCSI] hide EH backup data outside the scsi_cmnd
[linux-2.6/openmoko-kernel/knife-kernel.git] / security / selinux / hooks.c
blob24caaeec88941004c5acc65d63224ab3b207ab9f
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
19 */
20
21 #include <linux/module.h>
22 #include <linux/init.h>
23 #include <linux/kernel.h>
24 #include <linux/ptrace.h>
25 #include <linux/errno.h>
26 #include <linux/sched.h>
27 #include <linux/security.h>
28 #include <linux/xattr.h>
29 #include <linux/capability.h>
30 #include <linux/unistd.h>
31 #include <linux/mm.h>
32 #include <linux/mman.h>
33 #include <linux/slab.h>
34 #include <linux/pagemap.h>
35 #include <linux/swap.h>
36 #include <linux/smp_lock.h>
37 #include <linux/spinlock.h>
38 #include <linux/syscalls.h>
39 #include <linux/file.h>
40 #include <linux/namei.h>
41 #include <linux/mount.h>
42 #include <linux/ext2_fs.h>
43 #include <linux/proc_fs.h>
44 #include <linux/kd.h>
45 #include <linux/netfilter_ipv4.h>
46 #include <linux/netfilter_ipv6.h>
47 #include <linux/tty.h>
48 #include <net/icmp.h>
49 #include <net/ip.h> /* for sysctl_local_port_range[] */
50 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
51 #include <asm/uaccess.h>
52 #include <asm/semaphore.h>
53 #include <asm/ioctls.h>
54 #include <linux/bitops.h>
55 #include <linux/interrupt.h>
56 #include <linux/netdevice.h> /* for network interface checks */
57 #include <linux/netlink.h>
58 #include <linux/tcp.h>
59 #include <linux/udp.h>
60 #include <linux/quota.h>
61 #include <linux/un.h> /* for Unix socket types */
62 #include <net/af_unix.h> /* for Unix socket types */
63 #include <linux/parser.h>
64 #include <linux/nfs_mount.h>
65 #include <net/ipv6.h>
66 #include <linux/hugetlb.h>
67 #include <linux/personality.h>
68 #include <linux/sysctl.h>
69 #include <linux/audit.h>
70 #include <linux/string.h>
71 #include <linux/selinux.h>
72
73 #include "avc.h"
74 #include "objsec.h"
75 #include "netif.h"
76 #include "xfrm.h"
77
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
80
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
84
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
87
88 static int __init enforcing_setup(char *str)
89 {
90 selinux_enforcing = simple_strtol(str,NULL,0);
91 return 1;
92 }
93 __setup("enforcing=", enforcing_setup);
94 #endif
95
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
98
99 static int __init selinux_enabled_setup(char *str)
100 {
101 selinux_enabled = simple_strtol(str, NULL, 0);
102 return 1;
103 }
104 __setup("selinux=", selinux_enabled_setup);
105 #else
106 int selinux_enabled = 1;
107 #endif
108
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
111
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
117
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
122
123 static kmem_cache_t *sel_inode_cache;
124
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
128 {
129 char *context;
130 unsigned len;
131 int rc;
132
133 rc = security_sid_to_context(sid, &context, &len);
134 if (rc)
135 return rc;
136
137 if (!buffer || !size)
138 goto getsecurity_exit;
139
140 if (size < len) {
141 len = -ERANGE;
142 goto getsecurity_exit;
143 }
144 memcpy(buffer, context, len);
145
146 getsecurity_exit:
147 kfree(context);
148 return len;
149 }
150
151 /* Allocate and free functions for each kind of security blob. */
152
153 static int task_alloc_security(struct task_struct *task)
154 {
155 struct task_security_struct *tsec;
156
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
158 if (!tsec)
159 return -ENOMEM;
160
161 tsec->task = task;
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
164
165 return 0;
166 }
167
168 static void task_free_security(struct task_struct *task)
169 {
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
172 kfree(tsec);
173 }
174
175 static int inode_alloc_security(struct inode *inode)
176 {
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
179
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
181 if (!isec)
182 return -ENOMEM;
183
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
187 isec->inode = inode;
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
192
193 return 0;
194 }
195
196 static void inode_free_security(struct inode *inode)
197 {
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
200
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
205
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
208 }
209
210 static int file_alloc_security(struct file *file)
211 {
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
214
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
216 if (!fsec)
217 return -ENOMEM;
218
219 fsec->file = file;
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
223
224 return 0;
225 }
226
227 static void file_free_security(struct file *file)
228 {
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
231 kfree(fsec);
232 }
233
234 static int superblock_alloc_security(struct super_block *sb)
235 {
236 struct superblock_security_struct *sbsec;
237
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
239 if (!sbsec)
240 return -ENOMEM;
241
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
246 sbsec->sb = sb;
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sb->s_security = sbsec;
250
251 return 0;
252 }
253
254 static void superblock_free_security(struct super_block *sb)
255 {
256 struct superblock_security_struct *sbsec = sb->s_security;
257
258 spin_lock(&sb_security_lock);
259 if (!list_empty(&sbsec->list))
260 list_del_init(&sbsec->list);
261 spin_unlock(&sb_security_lock);
262
263 sb->s_security = NULL;
264 kfree(sbsec);
265 }
266
267 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
268 {
269 struct sk_security_struct *ssec;
270
271 if (family != PF_UNIX)
272 return 0;
273
274 ssec = kzalloc(sizeof(*ssec), priority);
275 if (!ssec)
276 return -ENOMEM;
277
278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
281
282 return 0;
283 }
284
285 static void sk_free_security(struct sock *sk)
286 {
287 struct sk_security_struct *ssec = sk->sk_security;
288
289 if (sk->sk_family != PF_UNIX)
290 return;
291
292 sk->sk_security = NULL;
293 kfree(ssec);
294 }
295
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
299
300 /* The file system's label must be initialized prior to use. */
301
302 static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309 };
310
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313 static inline int inode_doinit(struct inode *inode)
314 {
315 return inode_doinit_with_dentry(inode, NULL);
316 }
317
318 enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
322 };
323
324 static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
328 };
329
330 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
331
332 static int try_context_mount(struct super_block *sb, void *data)
333 {
334 char *context = NULL, *defcontext = NULL;
335 const char *name;
336 u32 sid;
337 int alloc = 0, rc = 0, seen = 0;
338 struct task_security_struct *tsec = current->security;
339 struct superblock_security_struct *sbsec = sb->s_security;
340
341 if (!data)
342 goto out;
343
344 name = sb->s_type->name;
345
346 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
347
348 /* NFS we understand. */
349 if (!strcmp(name, "nfs")) {
350 struct nfs_mount_data *d = data;
351
352 if (d->version < NFS_MOUNT_VERSION)
353 goto out;
354
355 if (d->context[0]) {
356 context = d->context;
357 seen |= Opt_context;
358 }
359 } else
360 goto out;
361
362 } else {
363 /* Standard string-based options. */
364 char *p, *options = data;
365
366 while ((p = strsep(&options, ",")) != NULL) {
367 int token;
368 substring_t args[MAX_OPT_ARGS];
369
370 if (!*p)
371 continue;
372
373 token = match_token(p, tokens, args);
374
375 switch (token) {
376 case Opt_context:
377 if (seen) {
378 rc = -EINVAL;
379 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
380 goto out_free;
381 }
382 context = match_strdup(&args[0]);
383 if (!context) {
384 rc = -ENOMEM;
385 goto out_free;
386 }
387 if (!alloc)
388 alloc = 1;
389 seen |= Opt_context;
390 break;
391
392 case Opt_fscontext:
393 if (seen & (Opt_context|Opt_fscontext)) {
394 rc = -EINVAL;
395 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
396 goto out_free;
397 }
398 context = match_strdup(&args[0]);
399 if (!context) {
400 rc = -ENOMEM;
401 goto out_free;
402 }
403 if (!alloc)
404 alloc = 1;
405 seen |= Opt_fscontext;
406 break;
407
408 case Opt_defcontext:
409 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
410 rc = -EINVAL;
411 printk(KERN_WARNING "SELinux: "
412 "defcontext option is invalid "
413 "for this filesystem type\n");
414 goto out_free;
415 }
416 if (seen & (Opt_context|Opt_defcontext)) {
417 rc = -EINVAL;
418 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
419 goto out_free;
420 }
421 defcontext = match_strdup(&args[0]);
422 if (!defcontext) {
423 rc = -ENOMEM;
424 goto out_free;
425 }
426 if (!alloc)
427 alloc = 1;
428 seen |= Opt_defcontext;
429 break;
430
431 default:
432 rc = -EINVAL;
433 printk(KERN_WARNING "SELinux: unknown mount "
434 "option\n");
435 goto out_free;
436
437 }
438 }
439 }
440
441 if (!seen)
442 goto out;
443
444 if (context) {
445 rc = security_context_to_sid(context, strlen(context), &sid);
446 if (rc) {
447 printk(KERN_WARNING "SELinux: security_context_to_sid"
448 "(%s) failed for (dev %s, type %s) errno=%d\n",
449 context, sb->s_id, name, rc);
450 goto out_free;
451 }
452
453 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELFROM, NULL);
455 if (rc)
456 goto out_free;
457
458 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
459 FILESYSTEM__RELABELTO, NULL);
460 if (rc)
461 goto out_free;
462
463 sbsec->sid = sid;
464
465 if (seen & Opt_context)
466 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
467 }
468
469 if (defcontext) {
470 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
471 if (rc) {
472 printk(KERN_WARNING "SELinux: security_context_to_sid"
473 "(%s) failed for (dev %s, type %s) errno=%d\n",
474 defcontext, sb->s_id, name, rc);
475 goto out_free;
476 }
477
478 if (sid == sbsec->def_sid)
479 goto out_free;
480
481 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
482 FILESYSTEM__RELABELFROM, NULL);
483 if (rc)
484 goto out_free;
485
486 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__ASSOCIATE, NULL);
488 if (rc)
489 goto out_free;
490
491 sbsec->def_sid = sid;
492 }
493
494 out_free:
495 if (alloc) {
496 kfree(context);
497 kfree(defcontext);
498 }
499 out:
500 return rc;
501 }
502
503 static int superblock_doinit(struct super_block *sb, void *data)
504 {
505 struct superblock_security_struct *sbsec = sb->s_security;
506 struct dentry *root = sb->s_root;
507 struct inode *inode = root->d_inode;
508 int rc = 0;
509
510 down(&sbsec->sem);
511 if (sbsec->initialized)
512 goto out;
513
514 if (!ss_initialized) {
515 /* Defer initialization until selinux_complete_init,
516 after the initial policy is loaded and the security
517 server is ready to handle calls. */
518 spin_lock(&sb_security_lock);
519 if (list_empty(&sbsec->list))
520 list_add(&sbsec->list, &superblock_security_head);
521 spin_unlock(&sb_security_lock);
522 goto out;
523 }
524
525 /* Determine the labeling behavior to use for this filesystem type. */
526 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
527 if (rc) {
528 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
529 __FUNCTION__, sb->s_type->name, rc);
530 goto out;
531 }
532
533 rc = try_context_mount(sb, data);
534 if (rc)
535 goto out;
536
537 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
538 /* Make sure that the xattr handler exists and that no
539 error other than -ENODATA is returned by getxattr on
540 the root directory. -ENODATA is ok, as this may be
541 the first boot of the SELinux kernel before we have
542 assigned xattr values to the filesystem. */
543 if (!inode->i_op->getxattr) {
544 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
545 "xattr support\n", sb->s_id, sb->s_type->name);
546 rc = -EOPNOTSUPP;
547 goto out;
548 }
549 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
550 if (rc < 0 && rc != -ENODATA) {
551 if (rc == -EOPNOTSUPP)
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) has no security xattr handler\n",
554 sb->s_id, sb->s_type->name);
555 else
556 printk(KERN_WARNING "SELinux: (dev %s, type "
557 "%s) getxattr errno %d\n", sb->s_id,
558 sb->s_type->name, -rc);
559 goto out;
560 }
561 }
562
563 if (strcmp(sb->s_type->name, "proc") == 0)
564 sbsec->proc = 1;
565
566 sbsec->initialized = 1;
567
568 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
570 sb->s_id, sb->s_type->name);
571 }
572 else {
573 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
574 sb->s_id, sb->s_type->name,
575 labeling_behaviors[sbsec->behavior-1]);
576 }
577
578 /* Initialize the root inode. */
579 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
580
581 /* Initialize any other inodes associated with the superblock, e.g.
582 inodes created prior to initial policy load or inodes created
583 during get_sb by a pseudo filesystem that directly
584 populates itself. */
585 spin_lock(&sbsec->isec_lock);
586 next_inode:
587 if (!list_empty(&sbsec->isec_head)) {
588 struct inode_security_struct *isec =
589 list_entry(sbsec->isec_head.next,
590 struct inode_security_struct, list);
591 struct inode *inode = isec->inode;
592 spin_unlock(&sbsec->isec_lock);
593 inode = igrab(inode);
594 if (inode) {
595 if (!IS_PRIVATE (inode))
596 inode_doinit(inode);
597 iput(inode);
598 }
599 spin_lock(&sbsec->isec_lock);
600 list_del_init(&isec->list);
601 goto next_inode;
602 }
603 spin_unlock(&sbsec->isec_lock);
604 out:
605 up(&sbsec->sem);
606 return rc;
607 }
608
609 static inline u16 inode_mode_to_security_class(umode_t mode)
610 {
611 switch (mode & S_IFMT) {
612 case S_IFSOCK:
613 return SECCLASS_SOCK_FILE;
614 case S_IFLNK:
615 return SECCLASS_LNK_FILE;
616 case S_IFREG:
617 return SECCLASS_FILE;
618 case S_IFBLK:
619 return SECCLASS_BLK_FILE;
620 case S_IFDIR:
621 return SECCLASS_DIR;
622 case S_IFCHR:
623 return SECCLASS_CHR_FILE;
624 case S_IFIFO:
625 return SECCLASS_FIFO_FILE;
626
627 }
628
629 return SECCLASS_FILE;
630 }
631
632 static inline int default_protocol_stream(int protocol)
633 {
634 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
635 }
636
637 static inline int default_protocol_dgram(int protocol)
638 {
639 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
640 }
641
642 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
643 {
644 switch (family) {
645 case PF_UNIX:
646 switch (type) {
647 case SOCK_STREAM:
648 case SOCK_SEQPACKET:
649 return SECCLASS_UNIX_STREAM_SOCKET;
650 case SOCK_DGRAM:
651 return SECCLASS_UNIX_DGRAM_SOCKET;
652 }
653 break;
654 case PF_INET:
655 case PF_INET6:
656 switch (type) {
657 case SOCK_STREAM:
658 if (default_protocol_stream(protocol))
659 return SECCLASS_TCP_SOCKET;
660 else
661 return SECCLASS_RAWIP_SOCKET;
662 case SOCK_DGRAM:
663 if (default_protocol_dgram(protocol))
664 return SECCLASS_UDP_SOCKET;
665 else
666 return SECCLASS_RAWIP_SOCKET;
667 default:
668 return SECCLASS_RAWIP_SOCKET;
669 }
670 break;
671 case PF_NETLINK:
672 switch (protocol) {
673 case NETLINK_ROUTE:
674 return SECCLASS_NETLINK_ROUTE_SOCKET;
675 case NETLINK_FIREWALL:
676 return SECCLASS_NETLINK_FIREWALL_SOCKET;
677 case NETLINK_INET_DIAG:
678 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
679 case NETLINK_NFLOG:
680 return SECCLASS_NETLINK_NFLOG_SOCKET;
681 case NETLINK_XFRM:
682 return SECCLASS_NETLINK_XFRM_SOCKET;
683 case NETLINK_SELINUX:
684 return SECCLASS_NETLINK_SELINUX_SOCKET;
685 case NETLINK_AUDIT:
686 return SECCLASS_NETLINK_AUDIT_SOCKET;
687 case NETLINK_IP6_FW:
688 return SECCLASS_NETLINK_IP6FW_SOCKET;
689 case NETLINK_DNRTMSG:
690 return SECCLASS_NETLINK_DNRT_SOCKET;
691 case NETLINK_KOBJECT_UEVENT:
692 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
693 default:
694 return SECCLASS_NETLINK_SOCKET;
695 }
696 case PF_PACKET:
697 return SECCLASS_PACKET_SOCKET;
698 case PF_KEY:
699 return SECCLASS_KEY_SOCKET;
700 case PF_APPLETALK:
701 return SECCLASS_APPLETALK_SOCKET;
702 }
703
704 return SECCLASS_SOCKET;
705 }
706
707 #ifdef CONFIG_PROC_FS
708 static int selinux_proc_get_sid(struct proc_dir_entry *de,
709 u16 tclass,
710 u32 *sid)
711 {
712 int buflen, rc;
713 char *buffer, *path, *end;
714
715 buffer = (char*)__get_free_page(GFP_KERNEL);
716 if (!buffer)
717 return -ENOMEM;
718
719 buflen = PAGE_SIZE;
720 end = buffer+buflen;
721 *--end = '\0';
722 buflen--;
723 path = end-1;
724 *path = '/';
725 while (de && de != de->parent) {
726 buflen -= de->namelen + 1;
727 if (buflen < 0)
728 break;
729 end -= de->namelen;
730 memcpy(end, de->name, de->namelen);
731 *--end = '/';
732 path = end;
733 de = de->parent;
734 }
735 rc = security_genfs_sid("proc", path, tclass, sid);
736 free_page((unsigned long)buffer);
737 return rc;
738 }
739 #else
740 static int selinux_proc_get_sid(struct proc_dir_entry *de,
741 u16 tclass,
742 u32 *sid)
743 {
744 return -EINVAL;
745 }
746 #endif
747
748 /* The inode's security attributes must be initialized before first use. */
749 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
750 {
751 struct superblock_security_struct *sbsec = NULL;
752 struct inode_security_struct *isec = inode->i_security;
753 u32 sid;
754 struct dentry *dentry;
755 #define INITCONTEXTLEN 255
756 char *context = NULL;
757 unsigned len = 0;
758 int rc = 0;
759 int hold_sem = 0;
760
761 if (isec->initialized)
762 goto out;
763
764 down(&isec->sem);
765 hold_sem = 1;
766 if (isec->initialized)
767 goto out;
768
769 sbsec = inode->i_sb->s_security;
770 if (!sbsec->initialized) {
771 /* Defer initialization until selinux_complete_init,
772 after the initial policy is loaded and the security
773 server is ready to handle calls. */
774 spin_lock(&sbsec->isec_lock);
775 if (list_empty(&isec->list))
776 list_add(&isec->list, &sbsec->isec_head);
777 spin_unlock(&sbsec->isec_lock);
778 goto out;
779 }
780
781 switch (sbsec->behavior) {
782 case SECURITY_FS_USE_XATTR:
783 if (!inode->i_op->getxattr) {
784 isec->sid = sbsec->def_sid;
785 break;
786 }
787
788 /* Need a dentry, since the xattr API requires one.
789 Life would be simpler if we could just pass the inode. */
790 if (opt_dentry) {
791 /* Called from d_instantiate or d_splice_alias. */
792 dentry = dget(opt_dentry);
793 } else {
794 /* Called from selinux_complete_init, try to find a dentry. */
795 dentry = d_find_alias(inode);
796 }
797 if (!dentry) {
798 printk(KERN_WARNING "%s: no dentry for dev=%s "
799 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
800 inode->i_ino);
801 goto out;
802 }
803
804 len = INITCONTEXTLEN;
805 context = kmalloc(len, GFP_KERNEL);
806 if (!context) {
807 rc = -ENOMEM;
808 dput(dentry);
809 goto out;
810 }
811 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
812 context, len);
813 if (rc == -ERANGE) {
814 /* Need a larger buffer. Query for the right size. */
815 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
816 NULL, 0);
817 if (rc < 0) {
818 dput(dentry);
819 goto out;
820 }
821 kfree(context);
822 len = rc;
823 context = kmalloc(len, GFP_KERNEL);
824 if (!context) {
825 rc = -ENOMEM;
826 dput(dentry);
827 goto out;
828 }
829 rc = inode->i_op->getxattr(dentry,
830 XATTR_NAME_SELINUX,
831 context, len);
832 }
833 dput(dentry);
834 if (rc < 0) {
835 if (rc != -ENODATA) {
836 printk(KERN_WARNING "%s: getxattr returned "
837 "%d for dev=%s ino=%ld\n", __FUNCTION__,
838 -rc, inode->i_sb->s_id, inode->i_ino);
839 kfree(context);
840 goto out;
841 }
842 /* Map ENODATA to the default file SID */
843 sid = sbsec->def_sid;
844 rc = 0;
845 } else {
846 rc = security_context_to_sid_default(context, rc, &sid,
847 sbsec->def_sid);
848 if (rc) {
849 printk(KERN_WARNING "%s: context_to_sid(%s) "
850 "returned %d for dev=%s ino=%ld\n",
851 __FUNCTION__, context, -rc,
852 inode->i_sb->s_id, inode->i_ino);
853 kfree(context);
854 /* Leave with the unlabeled SID */
855 rc = 0;
856 break;
857 }
858 }
859 kfree(context);
860 isec->sid = sid;
861 break;
862 case SECURITY_FS_USE_TASK:
863 isec->sid = isec->task_sid;
864 break;
865 case SECURITY_FS_USE_TRANS:
866 /* Default to the fs SID. */
867 isec->sid = sbsec->sid;
868
869 /* Try to obtain a transition SID. */
870 isec->sclass = inode_mode_to_security_class(inode->i_mode);
871 rc = security_transition_sid(isec->task_sid,
872 sbsec->sid,
873 isec->sclass,
874 &sid);
875 if (rc)
876 goto out;
877 isec->sid = sid;
878 break;
879 default:
880 /* Default to the fs SID. */
881 isec->sid = sbsec->sid;
882
883 if (sbsec->proc) {
884 struct proc_inode *proci = PROC_I(inode);
885 if (proci->pde) {
886 isec->sclass = inode_mode_to_security_class(inode->i_mode);
887 rc = selinux_proc_get_sid(proci->pde,
888 isec->sclass,
889 &sid);
890 if (rc)
891 goto out;
892 isec->sid = sid;
893 }
894 }
895 break;
896 }
897
898 isec->initialized = 1;
899
900 out:
901 if (isec->sclass == SECCLASS_FILE)
902 isec->sclass = inode_mode_to_security_class(inode->i_mode);
903
904 if (hold_sem)
905 up(&isec->sem);
906 return rc;
907 }
908
909 /* Convert a Linux signal to an access vector. */
910 static inline u32 signal_to_av(int sig)
911 {
912 u32 perm = 0;
913
914 switch (sig) {
915 case SIGCHLD:
916 /* Commonly granted from child to parent. */
917 perm = PROCESS__SIGCHLD;
918 break;
919 case SIGKILL:
920 /* Cannot be caught or ignored */
921 perm = PROCESS__SIGKILL;
922 break;
923 case SIGSTOP:
924 /* Cannot be caught or ignored */
925 perm = PROCESS__SIGSTOP;
926 break;
927 default:
928 /* All other signals. */
929 perm = PROCESS__SIGNAL;
930 break;
931 }
932
933 return perm;
934 }
935
936 /* Check permission betweeen a pair of tasks, e.g. signal checks,
937 fork check, ptrace check, etc. */
938 static int task_has_perm(struct task_struct *tsk1,
939 struct task_struct *tsk2,
940 u32 perms)
941 {
942 struct task_security_struct *tsec1, *tsec2;
943
944 tsec1 = tsk1->security;
945 tsec2 = tsk2->security;
946 return avc_has_perm(tsec1->sid, tsec2->sid,
947 SECCLASS_PROCESS, perms, NULL);
948 }
949
950 /* Check whether a task is allowed to use a capability. */
951 static int task_has_capability(struct task_struct *tsk,
952 int cap)
953 {
954 struct task_security_struct *tsec;
955 struct avc_audit_data ad;
956
957 tsec = tsk->security;
958
959 AVC_AUDIT_DATA_INIT(&ad,CAP);
960 ad.tsk = tsk;
961 ad.u.cap = cap;
962
963 return avc_has_perm(tsec->sid, tsec->sid,
964 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
965 }
966
967 /* Check whether a task is allowed to use a system operation. */
968 static int task_has_system(struct task_struct *tsk,
969 u32 perms)
970 {
971 struct task_security_struct *tsec;
972
973 tsec = tsk->security;
974
975 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
976 SECCLASS_SYSTEM, perms, NULL);
977 }
978
979 /* Check whether a task has a particular permission to an inode.
980 The 'adp' parameter is optional and allows other audit
981 data to be passed (e.g. the dentry). */
982 static int inode_has_perm(struct task_struct *tsk,
983 struct inode *inode,
984 u32 perms,
985 struct avc_audit_data *adp)
986 {
987 struct task_security_struct *tsec;
988 struct inode_security_struct *isec;
989 struct avc_audit_data ad;
990
991 tsec = tsk->security;
992 isec = inode->i_security;
993
994 if (!adp) {
995 adp = &ad;
996 AVC_AUDIT_DATA_INIT(&ad, FS);
997 ad.u.fs.inode = inode;
998 }
999
1000 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1001 }
1002
1003 /* Same as inode_has_perm, but pass explicit audit data containing
1004 the dentry to help the auditing code to more easily generate the
1005 pathname if needed. */
1006 static inline int dentry_has_perm(struct task_struct *tsk,
1007 struct vfsmount *mnt,
1008 struct dentry *dentry,
1009 u32 av)
1010 {
1011 struct inode *inode = dentry->d_inode;
1012 struct avc_audit_data ad;
1013 AVC_AUDIT_DATA_INIT(&ad,FS);
1014 ad.u.fs.mnt = mnt;
1015 ad.u.fs.dentry = dentry;
1016 return inode_has_perm(tsk, inode, av, &ad);
1017 }
1018
1019 /* Check whether a task can use an open file descriptor to
1020 access an inode in a given way. Check access to the
1021 descriptor itself, and then use dentry_has_perm to
1022 check a particular permission to the file.
1023 Access to the descriptor is implicitly granted if it
1024 has the same SID as the process. If av is zero, then
1025 access to the file is not checked, e.g. for cases
1026 where only the descriptor is affected like seek. */
1027 static int file_has_perm(struct task_struct *tsk,
1028 struct file *file,
1029 u32 av)
1030 {
1031 struct task_security_struct *tsec = tsk->security;
1032 struct file_security_struct *fsec = file->f_security;
1033 struct vfsmount *mnt = file->f_vfsmnt;
1034 struct dentry *dentry = file->f_dentry;
1035 struct inode *inode = dentry->d_inode;
1036 struct avc_audit_data ad;
1037 int rc;
1038
1039 AVC_AUDIT_DATA_INIT(&ad, FS);
1040 ad.u.fs.mnt = mnt;
1041 ad.u.fs.dentry = dentry;
1042
1043 if (tsec->sid != fsec->sid) {
1044 rc = avc_has_perm(tsec->sid, fsec->sid,
1045 SECCLASS_FD,
1046 FD__USE,
1047 &ad);
1048 if (rc)
1049 return rc;
1050 }
1051
1052 /* av is zero if only checking access to the descriptor. */
1053 if (av)
1054 return inode_has_perm(tsk, inode, av, &ad);
1055
1056 return 0;
1057 }
1058
1059 /* Check whether a task can create a file. */
1060 static int may_create(struct inode *dir,
1061 struct dentry *dentry,
1062 u16 tclass)
1063 {
1064 struct task_security_struct *tsec;
1065 struct inode_security_struct *dsec;
1066 struct superblock_security_struct *sbsec;
1067 u32 newsid;
1068 struct avc_audit_data ad;
1069 int rc;
1070
1071 tsec = current->security;
1072 dsec = dir->i_security;
1073 sbsec = dir->i_sb->s_security;
1074
1075 AVC_AUDIT_DATA_INIT(&ad, FS);
1076 ad.u.fs.dentry = dentry;
1077
1078 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1079 DIR__ADD_NAME | DIR__SEARCH,
1080 &ad);
1081 if (rc)
1082 return rc;
1083
1084 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1085 newsid = tsec->create_sid;
1086 } else {
1087 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1088 &newsid);
1089 if (rc)
1090 return rc;
1091 }
1092
1093 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1094 if (rc)
1095 return rc;
1096
1097 return avc_has_perm(newsid, sbsec->sid,
1098 SECCLASS_FILESYSTEM,
1099 FILESYSTEM__ASSOCIATE, &ad);
1100 }
1101
1102 /* Check whether a task can create a key. */
1103 static int may_create_key(u32 ksid,
1104 struct task_struct *ctx)
1105 {
1106 struct task_security_struct *tsec;
1107
1108 tsec = ctx->security;
1109
1110 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1111 }
1112
1113 #define MAY_LINK 0
1114 #define MAY_UNLINK 1
1115 #define MAY_RMDIR 2
1116
1117 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1118 static int may_link(struct inode *dir,
1119 struct dentry *dentry,
1120 int kind)
1121
1122 {
1123 struct task_security_struct *tsec;
1124 struct inode_security_struct *dsec, *isec;
1125 struct avc_audit_data ad;
1126 u32 av;
1127 int rc;
1128
1129 tsec = current->security;
1130 dsec = dir->i_security;
1131 isec = dentry->d_inode->i_security;
1132
1133 AVC_AUDIT_DATA_INIT(&ad, FS);
1134 ad.u.fs.dentry = dentry;
1135
1136 av = DIR__SEARCH;
1137 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1138 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1139 if (rc)
1140 return rc;
1141
1142 switch (kind) {
1143 case MAY_LINK:
1144 av = FILE__LINK;
1145 break;
1146 case MAY_UNLINK:
1147 av = FILE__UNLINK;
1148 break;
1149 case MAY_RMDIR:
1150 av = DIR__RMDIR;
1151 break;
1152 default:
1153 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1154 return 0;
1155 }
1156
1157 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1158 return rc;
1159 }
1160
1161 static inline int may_rename(struct inode *old_dir,
1162 struct dentry *old_dentry,
1163 struct inode *new_dir,
1164 struct dentry *new_dentry)
1165 {
1166 struct task_security_struct *tsec;
1167 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1168 struct avc_audit_data ad;
1169 u32 av;
1170 int old_is_dir, new_is_dir;
1171 int rc;
1172
1173 tsec = current->security;
1174 old_dsec = old_dir->i_security;
1175 old_isec = old_dentry->d_inode->i_security;
1176 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1177 new_dsec = new_dir->i_security;
1178
1179 AVC_AUDIT_DATA_INIT(&ad, FS);
1180
1181 ad.u.fs.dentry = old_dentry;
1182 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1183 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1184 if (rc)
1185 return rc;
1186 rc = avc_has_perm(tsec->sid, old_isec->sid,
1187 old_isec->sclass, FILE__RENAME, &ad);
1188 if (rc)
1189 return rc;
1190 if (old_is_dir && new_dir != old_dir) {
1191 rc = avc_has_perm(tsec->sid, old_isec->sid,
1192 old_isec->sclass, DIR__REPARENT, &ad);
1193 if (rc)
1194 return rc;
1195 }
1196
1197 ad.u.fs.dentry = new_dentry;
1198 av = DIR__ADD_NAME | DIR__SEARCH;
1199 if (new_dentry->d_inode)
1200 av |= DIR__REMOVE_NAME;
1201 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1202 if (rc)
1203 return rc;
1204 if (new_dentry->d_inode) {
1205 new_isec = new_dentry->d_inode->i_security;
1206 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1207 rc = avc_has_perm(tsec->sid, new_isec->sid,
1208 new_isec->sclass,
1209 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1210 if (rc)
1211 return rc;
1212 }
1213
1214 return 0;
1215 }
1216
1217 /* Check whether a task can perform a filesystem operation. */
1218 static int superblock_has_perm(struct task_struct *tsk,
1219 struct super_block *sb,
1220 u32 perms,
1221 struct avc_audit_data *ad)
1222 {
1223 struct task_security_struct *tsec;
1224 struct superblock_security_struct *sbsec;
1225
1226 tsec = tsk->security;
1227 sbsec = sb->s_security;
1228 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1229 perms, ad);
1230 }
1231
1232 /* Convert a Linux mode and permission mask to an access vector. */
1233 static inline u32 file_mask_to_av(int mode, int mask)
1234 {
1235 u32 av = 0;
1236
1237 if ((mode & S_IFMT) != S_IFDIR) {
1238 if (mask & MAY_EXEC)
1239 av |= FILE__EXECUTE;
1240 if (mask & MAY_READ)
1241 av |= FILE__READ;
1242
1243 if (mask & MAY_APPEND)
1244 av |= FILE__APPEND;
1245 else if (mask & MAY_WRITE)
1246 av |= FILE__WRITE;
1247
1248 } else {
1249 if (mask & MAY_EXEC)
1250 av |= DIR__SEARCH;
1251 if (mask & MAY_WRITE)
1252 av |= DIR__WRITE;
1253 if (mask & MAY_READ)
1254 av |= DIR__READ;
1255 }
1256
1257 return av;
1258 }
1259
1260 /* Convert a Linux file to an access vector. */
1261 static inline u32 file_to_av(struct file *file)
1262 {
1263 u32 av = 0;
1264
1265 if (file->f_mode & FMODE_READ)
1266 av |= FILE__READ;
1267 if (file->f_mode & FMODE_WRITE) {
1268 if (file->f_flags & O_APPEND)
1269 av |= FILE__APPEND;
1270 else
1271 av |= FILE__WRITE;
1272 }
1273
1274 return av;
1275 }
1276
1277 /* Set an inode's SID to a specified value. */
1278 static int inode_security_set_sid(struct inode *inode, u32 sid)
1279 {
1280 struct inode_security_struct *isec = inode->i_security;
1281 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1282
1283 if (!sbsec->initialized) {
1284 /* Defer initialization to selinux_complete_init. */
1285 return 0;
1286 }
1287
1288 down(&isec->sem);
1289 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1290 isec->sid = sid;
1291 isec->initialized = 1;
1292 up(&isec->sem);
1293 return 0;
1294 }
1295
1296 /* Hook functions begin here. */
1297
1298 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1299 {
1300 struct task_security_struct *psec = parent->security;
1301 struct task_security_struct *csec = child->security;
1302 int rc;
1303
1304 rc = secondary_ops->ptrace(parent,child);
1305 if (rc)
1306 return rc;
1307
1308 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1309 /* Save the SID of the tracing process for later use in apply_creds. */
1310 if (!(child->ptrace & PT_PTRACED) && !rc)
1311 csec->ptrace_sid = psec->sid;
1312 return rc;
1313 }
1314
1315 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1316 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1317 {
1318 int error;
1319
1320 error = task_has_perm(current, target, PROCESS__GETCAP);
1321 if (error)
1322 return error;
1323
1324 return secondary_ops->capget(target, effective, inheritable, permitted);
1325 }
1326
1327 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1328 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1329 {
1330 int error;
1331
1332 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1333 if (error)
1334 return error;
1335
1336 return task_has_perm(current, target, PROCESS__SETCAP);
1337 }
1338
1339 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1340 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1341 {
1342 secondary_ops->capset_set(target, effective, inheritable, permitted);
1343 }
1344
1345 static int selinux_capable(struct task_struct *tsk, int cap)
1346 {
1347 int rc;
1348
1349 rc = secondary_ops->capable(tsk, cap);
1350 if (rc)
1351 return rc;
1352
1353 return task_has_capability(tsk,cap);
1354 }
1355
1356 static int selinux_sysctl(ctl_table *table, int op)
1357 {
1358 int error = 0;
1359 u32 av;
1360 struct task_security_struct *tsec;
1361 u32 tsid;
1362 int rc;
1363
1364 rc = secondary_ops->sysctl(table, op);
1365 if (rc)
1366 return rc;
1367
1368 tsec = current->security;
1369
1370 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1371 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1372 if (rc) {
1373 /* Default to the well-defined sysctl SID. */
1374 tsid = SECINITSID_SYSCTL;
1375 }
1376
1377 /* The op values are "defined" in sysctl.c, thereby creating
1378 * a bad coupling between this module and sysctl.c */
1379 if(op == 001) {
1380 error = avc_has_perm(tsec->sid, tsid,
1381 SECCLASS_DIR, DIR__SEARCH, NULL);
1382 } else {
1383 av = 0;
1384 if (op & 004)
1385 av |= FILE__READ;
1386 if (op & 002)
1387 av |= FILE__WRITE;
1388 if (av)
1389 error = avc_has_perm(tsec->sid, tsid,
1390 SECCLASS_FILE, av, NULL);
1391 }
1392
1393 return error;
1394 }
1395
1396 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1397 {
1398 int rc = 0;
1399
1400 if (!sb)
1401 return 0;
1402
1403 switch (cmds) {
1404 case Q_SYNC:
1405 case Q_QUOTAON:
1406 case Q_QUOTAOFF:
1407 case Q_SETINFO:
1408 case Q_SETQUOTA:
1409 rc = superblock_has_perm(current,
1410 sb,
1411 FILESYSTEM__QUOTAMOD, NULL);
1412 break;
1413 case Q_GETFMT:
1414 case Q_GETINFO:
1415 case Q_GETQUOTA:
1416 rc = superblock_has_perm(current,
1417 sb,
1418 FILESYSTEM__QUOTAGET, NULL);
1419 break;
1420 default:
1421 rc = 0; /* let the kernel handle invalid cmds */
1422 break;
1423 }
1424 return rc;
1425 }
1426
1427 static int selinux_quota_on(struct dentry *dentry)
1428 {
1429 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1430 }
1431
1432 static int selinux_syslog(int type)
1433 {
1434 int rc;
1435
1436 rc = secondary_ops->syslog(type);
1437 if (rc)
1438 return rc;
1439
1440 switch (type) {
1441 case 3: /* Read last kernel messages */
1442 case 10: /* Return size of the log buffer */
1443 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1444 break;
1445 case 6: /* Disable logging to console */
1446 case 7: /* Enable logging to console */
1447 case 8: /* Set level of messages printed to console */
1448 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1449 break;
1450 case 0: /* Close log */
1451 case 1: /* Open log */
1452 case 2: /* Read from log */
1453 case 4: /* Read/clear last kernel messages */
1454 case 5: /* Clear ring buffer */
1455 default:
1456 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1457 break;
1458 }
1459 return rc;
1460 }
1461
1462 /*
1463 * Check that a process has enough memory to allocate a new virtual
1464 * mapping. 0 means there is enough memory for the allocation to
1465 * succeed and -ENOMEM implies there is not.
1466 *
1467 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1468 * if the capability is granted, but __vm_enough_memory requires 1 if
1469 * the capability is granted.
1470 *
1471 * Do not audit the selinux permission check, as this is applied to all
1472 * processes that allocate mappings.
1473 */
1474 static int selinux_vm_enough_memory(long pages)
1475 {
1476 int rc, cap_sys_admin = 0;
1477 struct task_security_struct *tsec = current->security;
1478
1479 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1480 if (rc == 0)
1481 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1482 SECCLASS_CAPABILITY,
1483 CAP_TO_MASK(CAP_SYS_ADMIN),
1484 NULL);
1485
1486 if (rc == 0)
1487 cap_sys_admin = 1;
1488
1489 return __vm_enough_memory(pages, cap_sys_admin);
1490 }
1491
1492 /* binprm security operations */
1493
1494 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1495 {
1496 struct bprm_security_struct *bsec;
1497
1498 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1499 if (!bsec)
1500 return -ENOMEM;
1501
1502 bsec->bprm = bprm;
1503 bsec->sid = SECINITSID_UNLABELED;
1504 bsec->set = 0;
1505
1506 bprm->security = bsec;
1507 return 0;
1508 }
1509
1510 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1511 {
1512 struct task_security_struct *tsec;
1513 struct inode *inode = bprm->file->f_dentry->d_inode;
1514 struct inode_security_struct *isec;
1515 struct bprm_security_struct *bsec;
1516 u32 newsid;
1517 struct avc_audit_data ad;
1518 int rc;
1519
1520 rc = secondary_ops->bprm_set_security(bprm);
1521 if (rc)
1522 return rc;
1523
1524 bsec = bprm->security;
1525
1526 if (bsec->set)
1527 return 0;
1528
1529 tsec = current->security;
1530 isec = inode->i_security;
1531
1532 /* Default to the current task SID. */
1533 bsec->sid = tsec->sid;
1534
1535 /* Reset fs, key, and sock SIDs on execve. */
1536 tsec->create_sid = 0;
1537 tsec->keycreate_sid = 0;
1538 tsec->sockcreate_sid = 0;
1539
1540 if (tsec->exec_sid) {
1541 newsid = tsec->exec_sid;
1542 /* Reset exec SID on execve. */
1543 tsec->exec_sid = 0;
1544 } else {
1545 /* Check for a default transition on this program. */
1546 rc = security_transition_sid(tsec->sid, isec->sid,
1547 SECCLASS_PROCESS, &newsid);
1548 if (rc)
1549 return rc;
1550 }
1551
1552 AVC_AUDIT_DATA_INIT(&ad, FS);
1553 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1554 ad.u.fs.dentry = bprm->file->f_dentry;
1555
1556 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1557 newsid = tsec->sid;
1558
1559 if (tsec->sid == newsid) {
1560 rc = avc_has_perm(tsec->sid, isec->sid,
1561 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1562 if (rc)
1563 return rc;
1564 } else {
1565 /* Check permissions for the transition. */
1566 rc = avc_has_perm(tsec->sid, newsid,
1567 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1568 if (rc)
1569 return rc;
1570
1571 rc = avc_has_perm(newsid, isec->sid,
1572 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1573 if (rc)
1574 return rc;
1575
1576 /* Clear any possibly unsafe personality bits on exec: */
1577 current->personality &= ~PER_CLEAR_ON_SETID;
1578
1579 /* Set the security field to the new SID. */
1580 bsec->sid = newsid;
1581 }
1582
1583 bsec->set = 1;
1584 return 0;
1585 }
1586
1587 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1588 {
1589 return secondary_ops->bprm_check_security(bprm);
1590 }
1591
1592
1593 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1594 {
1595 struct task_security_struct *tsec = current->security;
1596 int atsecure = 0;
1597
1598 if (tsec->osid != tsec->sid) {
1599 /* Enable secure mode for SIDs transitions unless
1600 the noatsecure permission is granted between
1601 the two SIDs, i.e. ahp returns 0. */
1602 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1603 SECCLASS_PROCESS,
1604 PROCESS__NOATSECURE, NULL);
1605 }
1606
1607 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1608 }
1609
1610 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1611 {
1612 kfree(bprm->security);
1613 bprm->security = NULL;
1614 }
1615
1616 extern struct vfsmount *selinuxfs_mount;
1617 extern struct dentry *selinux_null;
1618
1619 /* Derived from fs/exec.c:flush_old_files. */
1620 static inline void flush_unauthorized_files(struct files_struct * files)
1621 {
1622 struct avc_audit_data ad;
1623 struct file *file, *devnull = NULL;
1624 struct tty_struct *tty = current->signal->tty;
1625 struct fdtable *fdt;
1626 long j = -1;
1627
1628 if (tty) {
1629 file_list_lock();
1630 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1631 if (file) {
1632 /* Revalidate access to controlling tty.
1633 Use inode_has_perm on the tty inode directly rather
1634 than using file_has_perm, as this particular open
1635 file may belong to another process and we are only
1636 interested in the inode-based check here. */
1637 struct inode *inode = file->f_dentry->d_inode;
1638 if (inode_has_perm(current, inode,
1639 FILE__READ | FILE__WRITE, NULL)) {
1640 /* Reset controlling tty. */
1641 current->signal->tty = NULL;
1642 current->signal->tty_old_pgrp = 0;
1643 }
1644 }
1645 file_list_unlock();
1646 }
1647
1648 /* Revalidate access to inherited open files. */
1649
1650 AVC_AUDIT_DATA_INIT(&ad,FS);
1651
1652 spin_lock(&files->file_lock);
1653 for (;;) {
1654 unsigned long set, i;
1655 int fd;
1656
1657 j++;
1658 i = j * __NFDBITS;
1659 fdt = files_fdtable(files);
1660 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1661 break;
1662 set = fdt->open_fds->fds_bits[j];
1663 if (!set)
1664 continue;
1665 spin_unlock(&files->file_lock);
1666 for ( ; set ; i++,set >>= 1) {
1667 if (set & 1) {
1668 file = fget(i);
1669 if (!file)
1670 continue;
1671 if (file_has_perm(current,
1672 file,
1673 file_to_av(file))) {
1674 sys_close(i);
1675 fd = get_unused_fd();
1676 if (fd != i) {
1677 if (fd >= 0)
1678 put_unused_fd(fd);
1679 fput(file);
1680 continue;
1681 }
1682 if (devnull) {
1683 get_file(devnull);
1684 } else {
1685 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1686 if (!devnull) {
1687 put_unused_fd(fd);
1688 fput(file);
1689 continue;
1690 }
1691 }
1692 fd_install(fd, devnull);
1693 }
1694 fput(file);
1695 }
1696 }
1697 spin_lock(&files->file_lock);
1698
1699 }
1700 spin_unlock(&files->file_lock);
1701 }
1702
1703 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1704 {
1705 struct task_security_struct *tsec;
1706 struct bprm_security_struct *bsec;
1707 u32 sid;
1708 int rc;
1709
1710 secondary_ops->bprm_apply_creds(bprm, unsafe);
1711
1712 tsec = current->security;
1713
1714 bsec = bprm->security;
1715 sid = bsec->sid;
1716
1717 tsec->osid = tsec->sid;
1718 bsec->unsafe = 0;
1719 if (tsec->sid != sid) {
1720 /* Check for shared state. If not ok, leave SID
1721 unchanged and kill. */
1722 if (unsafe & LSM_UNSAFE_SHARE) {
1723 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1724 PROCESS__SHARE, NULL);
1725 if (rc) {
1726 bsec->unsafe = 1;
1727 return;
1728 }
1729 }
1730
1731 /* Check for ptracing, and update the task SID if ok.
1732 Otherwise, leave SID unchanged and kill. */
1733 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1734 rc = avc_has_perm(tsec->ptrace_sid, sid,
1735 SECCLASS_PROCESS, PROCESS__PTRACE,
1736 NULL);
1737 if (rc) {
1738 bsec->unsafe = 1;
1739 return;
1740 }
1741 }
1742 tsec->sid = sid;
1743 }
1744 }
1745
1746 /*
1747 * called after apply_creds without the task lock held
1748 */
1749 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1750 {
1751 struct task_security_struct *tsec;
1752 struct rlimit *rlim, *initrlim;
1753 struct itimerval itimer;
1754 struct bprm_security_struct *bsec;
1755 int rc, i;
1756
1757 tsec = current->security;
1758 bsec = bprm->security;
1759
1760 if (bsec->unsafe) {
1761 force_sig_specific(SIGKILL, current);
1762 return;
1763 }
1764 if (tsec->osid == tsec->sid)
1765 return;
1766
1767 /* Close files for which the new task SID is not authorized. */
1768 flush_unauthorized_files(current->files);
1769
1770 /* Check whether the new SID can inherit signal state
1771 from the old SID. If not, clear itimers to avoid
1772 subsequent signal generation and flush and unblock
1773 signals. This must occur _after_ the task SID has
1774 been updated so that any kill done after the flush
1775 will be checked against the new SID. */
1776 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1777 PROCESS__SIGINH, NULL);
1778 if (rc) {
1779 memset(&itimer, 0, sizeof itimer);
1780 for (i = 0; i < 3; i++)
1781 do_setitimer(i, &itimer, NULL);
1782 flush_signals(current);
1783 spin_lock_irq(&current->sighand->siglock);
1784 flush_signal_handlers(current, 1);
1785 sigemptyset(&current->blocked);
1786 recalc_sigpending();
1787 spin_unlock_irq(&current->sighand->siglock);
1788 }
1789
1790 /* Check whether the new SID can inherit resource limits
1791 from the old SID. If not, reset all soft limits to
1792 the lower of the current task's hard limit and the init
1793 task's soft limit. Note that the setting of hard limits
1794 (even to lower them) can be controlled by the setrlimit
1795 check. The inclusion of the init task's soft limit into
1796 the computation is to avoid resetting soft limits higher
1797 than the default soft limit for cases where the default
1798 is lower than the hard limit, e.g. RLIMIT_CORE or
1799 RLIMIT_STACK.*/
1800 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1801 PROCESS__RLIMITINH, NULL);
1802 if (rc) {
1803 for (i = 0; i < RLIM_NLIMITS; i++) {
1804 rlim = current->signal->rlim + i;
1805 initrlim = init_task.signal->rlim+i;
1806 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1807 }
1808 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1809 /*
1810 * This will cause RLIMIT_CPU calculations
1811 * to be refigured.
1812 */
1813 current->it_prof_expires = jiffies_to_cputime(1);
1814 }
1815 }
1816
1817 /* Wake up the parent if it is waiting so that it can
1818 recheck wait permission to the new task SID. */
1819 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1820 }
1821
1822 /* superblock security operations */
1823
1824 static int selinux_sb_alloc_security(struct super_block *sb)
1825 {
1826 return superblock_alloc_security(sb);
1827 }
1828
1829 static void selinux_sb_free_security(struct super_block *sb)
1830 {
1831 superblock_free_security(sb);
1832 }
1833
1834 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1835 {
1836 if (plen > olen)
1837 return 0;
1838
1839 return !memcmp(prefix, option, plen);
1840 }
1841
1842 static inline int selinux_option(char *option, int len)
1843 {
1844 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1845 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1846 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1847 }
1848
1849 static inline void take_option(char **to, char *from, int *first, int len)
1850 {
1851 if (!*first) {
1852 **to = ',';
1853 *to += 1;
1854 }
1855 else
1856 *first = 0;
1857 memcpy(*to, from, len);
1858 *to += len;
1859 }
1860
1861 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1862 {
1863 int fnosec, fsec, rc = 0;
1864 char *in_save, *in_curr, *in_end;
1865 char *sec_curr, *nosec_save, *nosec;
1866
1867 in_curr = orig;
1868 sec_curr = copy;
1869
1870 /* Binary mount data: just copy */
1871 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1872 copy_page(sec_curr, in_curr);
1873 goto out;
1874 }
1875
1876 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1877 if (!nosec) {
1878 rc = -ENOMEM;
1879 goto out;
1880 }
1881
1882 nosec_save = nosec;
1883 fnosec = fsec = 1;
1884 in_save = in_end = orig;
1885
1886 do {
1887 if (*in_end == ',' || *in_end == '\0') {
1888 int len = in_end - in_curr;
1889
1890 if (selinux_option(in_curr, len))
1891 take_option(&sec_curr, in_curr, &fsec, len);
1892 else
1893 take_option(&nosec, in_curr, &fnosec, len);
1894
1895 in_curr = in_end + 1;
1896 }
1897 } while (*in_end++);
1898
1899 strcpy(in_save, nosec_save);
1900 free_page((unsigned long)nosec_save);
1901 out:
1902 return rc;
1903 }
1904
1905 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1906 {
1907 struct avc_audit_data ad;
1908 int rc;
1909
1910 rc = superblock_doinit(sb, data);
1911 if (rc)
1912 return rc;
1913
1914 AVC_AUDIT_DATA_INIT(&ad,FS);
1915 ad.u.fs.dentry = sb->s_root;
1916 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1917 }
1918
1919 static int selinux_sb_statfs(struct dentry *dentry)
1920 {
1921 struct avc_audit_data ad;
1922
1923 AVC_AUDIT_DATA_INIT(&ad,FS);
1924 ad.u.fs.dentry = dentry->d_sb->s_root;
1925 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1926 }
1927
1928 static int selinux_mount(char * dev_name,
1929 struct nameidata *nd,
1930 char * type,
1931 unsigned long flags,
1932 void * data)
1933 {
1934 int rc;
1935
1936 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1937 if (rc)
1938 return rc;
1939
1940 if (flags & MS_REMOUNT)
1941 return superblock_has_perm(current, nd->mnt->mnt_sb,
1942 FILESYSTEM__REMOUNT, NULL);
1943 else
1944 return dentry_has_perm(current, nd->mnt, nd->dentry,
1945 FILE__MOUNTON);
1946 }
1947
1948 static int selinux_umount(struct vfsmount *mnt, int flags)
1949 {
1950 int rc;
1951
1952 rc = secondary_ops->sb_umount(mnt, flags);
1953 if (rc)
1954 return rc;
1955
1956 return superblock_has_perm(current,mnt->mnt_sb,
1957 FILESYSTEM__UNMOUNT,NULL);
1958 }
1959
1960 /* inode security operations */
1961
1962 static int selinux_inode_alloc_security(struct inode *inode)
1963 {
1964 return inode_alloc_security(inode);
1965 }
1966
1967 static void selinux_inode_free_security(struct inode *inode)
1968 {
1969 inode_free_security(inode);
1970 }
1971
1972 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1973 char **name, void **value,
1974 size_t *len)
1975 {
1976 struct task_security_struct *tsec;
1977 struct inode_security_struct *dsec;
1978 struct superblock_security_struct *sbsec;
1979 u32 newsid, clen;
1980 int rc;
1981 char *namep = NULL, *context;
1982
1983 tsec = current->security;
1984 dsec = dir->i_security;
1985 sbsec = dir->i_sb->s_security;
1986
1987 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1988 newsid = tsec->create_sid;
1989 } else {
1990 rc = security_transition_sid(tsec->sid, dsec->sid,
1991 inode_mode_to_security_class(inode->i_mode),
1992 &newsid);
1993 if (rc) {
1994 printk(KERN_WARNING "%s: "
1995 "security_transition_sid failed, rc=%d (dev=%s "
1996 "ino=%ld)\n",
1997 __FUNCTION__,
1998 -rc, inode->i_sb->s_id, inode->i_ino);
1999 return rc;
2000 }
2001 }
2002
2003 inode_security_set_sid(inode, newsid);
2004
2005 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2006 return -EOPNOTSUPP;
2007
2008 if (name) {
2009 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2010 if (!namep)
2011 return -ENOMEM;
2012 *name = namep;
2013 }
2014
2015 if (value && len) {
2016 rc = security_sid_to_context(newsid, &context, &clen);
2017 if (rc) {
2018 kfree(namep);
2019 return rc;
2020 }
2021 *value = context;
2022 *len = clen;
2023 }
2024
2025 return 0;
2026 }
2027
2028 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2029 {
2030 return may_create(dir, dentry, SECCLASS_FILE);
2031 }
2032
2033 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2034 {
2035 int rc;
2036
2037 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2038 if (rc)
2039 return rc;
2040 return may_link(dir, old_dentry, MAY_LINK);
2041 }
2042
2043 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2044 {
2045 int rc;
2046
2047 rc = secondary_ops->inode_unlink(dir, dentry);
2048 if (rc)
2049 return rc;
2050 return may_link(dir, dentry, MAY_UNLINK);
2051 }
2052
2053 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2054 {
2055 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2056 }
2057
2058 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2059 {
2060 return may_create(dir, dentry, SECCLASS_DIR);
2061 }
2062
2063 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2064 {
2065 return may_link(dir, dentry, MAY_RMDIR);
2066 }
2067
2068 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2069 {
2070 int rc;
2071
2072 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2073 if (rc)
2074 return rc;
2075
2076 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2077 }
2078
2079 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2080 struct inode *new_inode, struct dentry *new_dentry)
2081 {
2082 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2083 }
2084
2085 static int selinux_inode_readlink(struct dentry *dentry)
2086 {
2087 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2088 }
2089
2090 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2091 {
2092 int rc;
2093
2094 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2095 if (rc)
2096 return rc;
2097 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2098 }
2099
2100 static int selinux_inode_permission(struct inode *inode, int mask,
2101 struct nameidata *nd)
2102 {
2103 int rc;
2104
2105 rc = secondary_ops->inode_permission(inode, mask, nd);
2106 if (rc)
2107 return rc;
2108
2109 if (!mask) {
2110 /* No permission to check. Existence test. */
2111 return 0;
2112 }
2113
2114 return inode_has_perm(current, inode,
2115 file_mask_to_av(inode->i_mode, mask), NULL);
2116 }
2117
2118 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2119 {
2120 int rc;
2121
2122 rc = secondary_ops->inode_setattr(dentry, iattr);
2123 if (rc)
2124 return rc;
2125
2126 if (iattr->ia_valid & ATTR_FORCE)
2127 return 0;
2128
2129 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2130 ATTR_ATIME_SET | ATTR_MTIME_SET))
2131 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2132
2133 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2134 }
2135
2136 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2137 {
2138 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2139 }
2140
2141 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2142 {
2143 struct task_security_struct *tsec = current->security;
2144 struct inode *inode = dentry->d_inode;
2145 struct inode_security_struct *isec = inode->i_security;
2146 struct superblock_security_struct *sbsec;
2147 struct avc_audit_data ad;
2148 u32 newsid;
2149 int rc = 0;
2150
2151 if (strcmp(name, XATTR_NAME_SELINUX)) {
2152 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2153 sizeof XATTR_SECURITY_PREFIX - 1) &&
2154 !capable(CAP_SYS_ADMIN)) {
2155 /* A different attribute in the security namespace.
2156 Restrict to administrator. */
2157 return -EPERM;
2158 }
2159
2160 /* Not an attribute we recognize, so just check the
2161 ordinary setattr permission. */
2162 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2163 }
2164
2165 sbsec = inode->i_sb->s_security;
2166 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2167 return -EOPNOTSUPP;
2168
2169 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2170 return -EPERM;
2171
2172 AVC_AUDIT_DATA_INIT(&ad,FS);
2173 ad.u.fs.dentry = dentry;
2174
2175 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2176 FILE__RELABELFROM, &ad);
2177 if (rc)
2178 return rc;
2179
2180 rc = security_context_to_sid(value, size, &newsid);
2181 if (rc)
2182 return rc;
2183
2184 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2185 FILE__RELABELTO, &ad);
2186 if (rc)
2187 return rc;
2188
2189 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2190 isec->sclass);
2191 if (rc)
2192 return rc;
2193
2194 return avc_has_perm(newsid,
2195 sbsec->sid,
2196 SECCLASS_FILESYSTEM,
2197 FILESYSTEM__ASSOCIATE,
2198 &ad);
2199 }
2200
2201 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2202 void *value, size_t size, int flags)
2203 {
2204 struct inode *inode = dentry->d_inode;
2205 struct inode_security_struct *isec = inode->i_security;
2206 u32 newsid;
2207 int rc;
2208
2209 if (strcmp(name, XATTR_NAME_SELINUX)) {
2210 /* Not an attribute we recognize, so nothing to do. */
2211 return;
2212 }
2213
2214 rc = security_context_to_sid(value, size, &newsid);
2215 if (rc) {
2216 printk(KERN_WARNING "%s: unable to obtain SID for context "
2217 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2218 return;
2219 }
2220
2221 isec->sid = newsid;
2222 return;
2223 }
2224
2225 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2226 {
2227 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2228 }
2229
2230 static int selinux_inode_listxattr (struct dentry *dentry)
2231 {
2232 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2233 }
2234
2235 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2236 {
2237 if (strcmp(name, XATTR_NAME_SELINUX)) {
2238 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2239 sizeof XATTR_SECURITY_PREFIX - 1) &&
2240 !capable(CAP_SYS_ADMIN)) {
2241 /* A different attribute in the security namespace.
2242 Restrict to administrator. */
2243 return -EPERM;
2244 }
2245
2246 /* Not an attribute we recognize, so just check the
2247 ordinary setattr permission. Might want a separate
2248 permission for removexattr. */
2249 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2250 }
2251
2252 /* No one is allowed to remove a SELinux security label.
2253 You can change the label, but all data must be labeled. */
2254 return -EACCES;
2255 }
2256
2257 static const char *selinux_inode_xattr_getsuffix(void)
2258 {
2259 return XATTR_SELINUX_SUFFIX;
2260 }
2261
2262 /*
2263 * Copy the in-core inode security context value to the user. If the
2264 * getxattr() prior to this succeeded, check to see if we need to
2265 * canonicalize the value to be finally returned to the user.
2266 *
2267 * Permission check is handled by selinux_inode_getxattr hook.
2268 */
2269 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2270 {
2271 struct inode_security_struct *isec = inode->i_security;
2272
2273 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2274 return -EOPNOTSUPP;
2275
2276 return selinux_getsecurity(isec->sid, buffer, size);
2277 }
2278
2279 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2280 const void *value, size_t size, int flags)
2281 {
2282 struct inode_security_struct *isec = inode->i_security;
2283 u32 newsid;
2284 int rc;
2285
2286 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2287 return -EOPNOTSUPP;
2288
2289 if (!value || !size)
2290 return -EACCES;
2291
2292 rc = security_context_to_sid((void*)value, size, &newsid);
2293 if (rc)
2294 return rc;
2295
2296 isec->sid = newsid;
2297 return 0;
2298 }
2299
2300 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2301 {
2302 const int len = sizeof(XATTR_NAME_SELINUX);
2303 if (buffer && len <= buffer_size)
2304 memcpy(buffer, XATTR_NAME_SELINUX, len);
2305 return len;
2306 }
2307
2308 /* file security operations */
2309
2310 static int selinux_file_permission(struct file *file, int mask)
2311 {
2312 struct inode *inode = file->f_dentry->d_inode;
2313
2314 if (!mask) {
2315 /* No permission to check. Existence test. */
2316 return 0;
2317 }
2318
2319 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2320 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2321 mask |= MAY_APPEND;
2322
2323 return file_has_perm(current, file,
2324 file_mask_to_av(inode->i_mode, mask));
2325 }
2326
2327 static int selinux_file_alloc_security(struct file *file)
2328 {
2329 return file_alloc_security(file);
2330 }
2331
2332 static void selinux_file_free_security(struct file *file)
2333 {
2334 file_free_security(file);
2335 }
2336
2337 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2338 unsigned long arg)
2339 {
2340 int error = 0;
2341
2342 switch (cmd) {
2343 case FIONREAD:
2344 /* fall through */
2345 case FIBMAP:
2346 /* fall through */
2347 case FIGETBSZ:
2348 /* fall through */
2349 case EXT2_IOC_GETFLAGS:
2350 /* fall through */
2351 case EXT2_IOC_GETVERSION:
2352 error = file_has_perm(current, file, FILE__GETATTR);
2353 break;
2354
2355 case EXT2_IOC_SETFLAGS:
2356 /* fall through */
2357 case EXT2_IOC_SETVERSION:
2358 error = file_has_perm(current, file, FILE__SETATTR);
2359 break;
2360
2361 /* sys_ioctl() checks */
2362 case FIONBIO:
2363 /* fall through */
2364 case FIOASYNC:
2365 error = file_has_perm(current, file, 0);
2366 break;
2367
2368 case KDSKBENT:
2369 case KDSKBSENT:
2370 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2371 break;
2372
2373 /* default case assumes that the command will go
2374 * to the file's ioctl() function.
2375 */
2376 default:
2377 error = file_has_perm(current, file, FILE__IOCTL);
2378
2379 }
2380 return error;
2381 }
2382
2383 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2384 {
2385 #ifndef CONFIG_PPC32
2386 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2387 /*
2388 * We are making executable an anonymous mapping or a
2389 * private file mapping that will also be writable.
2390 * This has an additional check.
2391 */
2392 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2393 if (rc)
2394 return rc;
2395 }
2396 #endif
2397
2398 if (file) {
2399 /* read access is always possible with a mapping */
2400 u32 av = FILE__READ;
2401
2402 /* write access only matters if the mapping is shared */
2403 if (shared && (prot & PROT_WRITE))
2404 av |= FILE__WRITE;
2405
2406 if (prot & PROT_EXEC)
2407 av |= FILE__EXECUTE;
2408
2409 return file_has_perm(current, file, av);
2410 }
2411 return 0;
2412 }
2413
2414 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2415 unsigned long prot, unsigned long flags)
2416 {
2417 int rc;
2418
2419 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2420 if (rc)
2421 return rc;
2422
2423 if (selinux_checkreqprot)
2424 prot = reqprot;
2425
2426 return file_map_prot_check(file, prot,
2427 (flags & MAP_TYPE) == MAP_SHARED);
2428 }
2429
2430 static int selinux_file_mprotect(struct vm_area_struct *vma,
2431 unsigned long reqprot,
2432 unsigned long prot)
2433 {
2434 int rc;
2435
2436 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2437 if (rc)
2438 return rc;
2439
2440 if (selinux_checkreqprot)
2441 prot = reqprot;
2442
2443 #ifndef CONFIG_PPC32
2444 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2445 rc = 0;
2446 if (vma->vm_start >= vma->vm_mm->start_brk &&
2447 vma->vm_end <= vma->vm_mm->brk) {
2448 rc = task_has_perm(current, current,
2449 PROCESS__EXECHEAP);
2450 } else if (!vma->vm_file &&
2451 vma->vm_start <= vma->vm_mm->start_stack &&
2452 vma->vm_end >= vma->vm_mm->start_stack) {
2453 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2454 } else if (vma->vm_file && vma->anon_vma) {
2455 /*
2456 * We are making executable a file mapping that has
2457 * had some COW done. Since pages might have been
2458 * written, check ability to execute the possibly
2459 * modified content. This typically should only
2460 * occur for text relocations.
2461 */
2462 rc = file_has_perm(current, vma->vm_file,
2463 FILE__EXECMOD);
2464 }
2465 if (rc)
2466 return rc;
2467 }
2468 #endif
2469
2470 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2471 }
2472
2473 static int selinux_file_lock(struct file *file, unsigned int cmd)
2474 {
2475 return file_has_perm(current, file, FILE__LOCK);
2476 }
2477
2478 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2479 unsigned long arg)
2480 {
2481 int err = 0;
2482
2483 switch (cmd) {
2484 case F_SETFL:
2485 if (!file->f_dentry || !file->f_dentry->d_inode) {
2486 err = -EINVAL;
2487 break;
2488 }
2489
2490 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2491 err = file_has_perm(current, file,FILE__WRITE);
2492 break;
2493 }
2494 /* fall through */
2495 case F_SETOWN:
2496 case F_SETSIG:
2497 case F_GETFL:
2498 case F_GETOWN:
2499 case F_GETSIG:
2500 /* Just check FD__USE permission */
2501 err = file_has_perm(current, file, 0);
2502 break;
2503 case F_GETLK:
2504 case F_SETLK:
2505 case F_SETLKW:
2506 #if BITS_PER_LONG == 32
2507 case F_GETLK64:
2508 case F_SETLK64:
2509 case F_SETLKW64:
2510 #endif
2511 if (!file->f_dentry || !file->f_dentry->d_inode) {
2512 err = -EINVAL;
2513 break;
2514 }
2515 err = file_has_perm(current, file, FILE__LOCK);
2516 break;
2517 }
2518
2519 return err;
2520 }
2521
2522 static int selinux_file_set_fowner(struct file *file)
2523 {
2524 struct task_security_struct *tsec;
2525 struct file_security_struct *fsec;
2526
2527 tsec = current->security;
2528 fsec = file->f_security;
2529 fsec->fown_sid = tsec->sid;
2530
2531 return 0;
2532 }
2533
2534 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2535 struct fown_struct *fown, int signum)
2536 {
2537 struct file *file;
2538 u32 perm;
2539 struct task_security_struct *tsec;
2540 struct file_security_struct *fsec;
2541
2542 /* struct fown_struct is never outside the context of a struct file */
2543 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2544
2545 tsec = tsk->security;
2546 fsec = file->f_security;
2547
2548 if (!signum)
2549 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2550 else
2551 perm = signal_to_av(signum);
2552
2553 return avc_has_perm(fsec->fown_sid, tsec->sid,
2554 SECCLASS_PROCESS, perm, NULL);
2555 }
2556
2557 static int selinux_file_receive(struct file *file)
2558 {
2559 return file_has_perm(current, file, file_to_av(file));
2560 }
2561
2562 /* task security operations */
2563
2564 static int selinux_task_create(unsigned long clone_flags)
2565 {
2566 int rc;
2567
2568 rc = secondary_ops->task_create(clone_flags);
2569 if (rc)
2570 return rc;
2571
2572 return task_has_perm(current, current, PROCESS__FORK);
2573 }
2574
2575 static int selinux_task_alloc_security(struct task_struct *tsk)
2576 {
2577 struct task_security_struct *tsec1, *tsec2;
2578 int rc;
2579
2580 tsec1 = current->security;
2581
2582 rc = task_alloc_security(tsk);
2583 if (rc)
2584 return rc;
2585 tsec2 = tsk->security;
2586
2587 tsec2->osid = tsec1->osid;
2588 tsec2->sid = tsec1->sid;
2589
2590 /* Retain the exec, fs, key, and sock SIDs across fork */
2591 tsec2->exec_sid = tsec1->exec_sid;
2592 tsec2->create_sid = tsec1->create_sid;
2593 tsec2->keycreate_sid = tsec1->keycreate_sid;
2594 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2595
2596 /* Retain ptracer SID across fork, if any.
2597 This will be reset by the ptrace hook upon any
2598 subsequent ptrace_attach operations. */
2599 tsec2->ptrace_sid = tsec1->ptrace_sid;
2600
2601 return 0;
2602 }
2603
2604 static void selinux_task_free_security(struct task_struct *tsk)
2605 {
2606 task_free_security(tsk);
2607 }
2608
2609 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2610 {
2611 /* Since setuid only affects the current process, and
2612 since the SELinux controls are not based on the Linux
2613 identity attributes, SELinux does not need to control
2614 this operation. However, SELinux does control the use
2615 of the CAP_SETUID and CAP_SETGID capabilities using the
2616 capable hook. */
2617 return 0;
2618 }
2619
2620 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2621 {
2622 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2623 }
2624
2625 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2626 {
2627 /* See the comment for setuid above. */
2628 return 0;
2629 }
2630
2631 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2632 {
2633 return task_has_perm(current, p, PROCESS__SETPGID);
2634 }
2635
2636 static int selinux_task_getpgid(struct task_struct *p)
2637 {
2638 return task_has_perm(current, p, PROCESS__GETPGID);
2639 }
2640
2641 static int selinux_task_getsid(struct task_struct *p)
2642 {
2643 return task_has_perm(current, p, PROCESS__GETSESSION);
2644 }
2645
2646 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2647 {
2648 selinux_get_task_sid(p, secid);
2649 }
2650
2651 static int selinux_task_setgroups(struct group_info *group_info)
2652 {
2653 /* See the comment for setuid above. */
2654 return 0;
2655 }
2656
2657 static int selinux_task_setnice(struct task_struct *p, int nice)
2658 {
2659 int rc;
2660
2661 rc = secondary_ops->task_setnice(p, nice);
2662 if (rc)
2663 return rc;
2664
2665 return task_has_perm(current,p, PROCESS__SETSCHED);
2666 }
2667
2668 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2669 {
2670 return task_has_perm(current, p, PROCESS__SETSCHED);
2671 }
2672
2673 static int selinux_task_getioprio(struct task_struct *p)
2674 {
2675 return task_has_perm(current, p, PROCESS__GETSCHED);
2676 }
2677
2678 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2679 {
2680 struct rlimit *old_rlim = current->signal->rlim + resource;
2681 int rc;
2682
2683 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2684 if (rc)
2685 return rc;
2686
2687 /* Control the ability to change the hard limit (whether
2688 lowering or raising it), so that the hard limit can
2689 later be used as a safe reset point for the soft limit
2690 upon context transitions. See selinux_bprm_apply_creds. */
2691 if (old_rlim->rlim_max != new_rlim->rlim_max)
2692 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2693
2694 return 0;
2695 }
2696
2697 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2698 {
2699 return task_has_perm(current, p, PROCESS__SETSCHED);
2700 }
2701
2702 static int selinux_task_getscheduler(struct task_struct *p)
2703 {
2704 return task_has_perm(current, p, PROCESS__GETSCHED);
2705 }
2706
2707 static int selinux_task_movememory(struct task_struct *p)
2708 {
2709 return task_has_perm(current, p, PROCESS__SETSCHED);
2710 }
2711
2712 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2713 int sig, u32 secid)
2714 {
2715 u32 perm;
2716 int rc;
2717 struct task_security_struct *tsec;
2718
2719 rc = secondary_ops->task_kill(p, info, sig, secid);
2720 if (rc)
2721 return rc;
2722
2723 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2724 return 0;
2725
2726 if (!sig)
2727 perm = PROCESS__SIGNULL; /* null signal; existence test */
2728 else
2729 perm = signal_to_av(sig);
2730 tsec = p->security;
2731 if (secid)
2732 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2733 else
2734 rc = task_has_perm(current, p, perm);
2735 return rc;
2736 }
2737
2738 static int selinux_task_prctl(int option,
2739 unsigned long arg2,
2740 unsigned long arg3,
2741 unsigned long arg4,
2742 unsigned long arg5)
2743 {
2744 /* The current prctl operations do not appear to require
2745 any SELinux controls since they merely observe or modify
2746 the state of the current process. */
2747 return 0;
2748 }
2749
2750 static int selinux_task_wait(struct task_struct *p)
2751 {
2752 u32 perm;
2753
2754 perm = signal_to_av(p->exit_signal);
2755
2756 return task_has_perm(p, current, perm);
2757 }
2758
2759 static void selinux_task_reparent_to_init(struct task_struct *p)
2760 {
2761 struct task_security_struct *tsec;
2762
2763 secondary_ops->task_reparent_to_init(p);
2764
2765 tsec = p->security;
2766 tsec->osid = tsec->sid;
2767 tsec->sid = SECINITSID_KERNEL;
2768 return;
2769 }
2770
2771 static void selinux_task_to_inode(struct task_struct *p,
2772 struct inode *inode)
2773 {
2774 struct task_security_struct *tsec = p->security;
2775 struct inode_security_struct *isec = inode->i_security;
2776
2777 isec->sid = tsec->sid;
2778 isec->initialized = 1;
2779 return;
2780 }
2781
2782 /* Returns error only if unable to parse addresses */
2783 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2784 {
2785 int offset, ihlen, ret = -EINVAL;
2786 struct iphdr _iph, *ih;
2787
2788 offset = skb->nh.raw - skb->data;
2789 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2790 if (ih == NULL)
2791 goto out;
2792
2793 ihlen = ih->ihl * 4;
2794 if (ihlen < sizeof(_iph))
2795 goto out;
2796
2797 ad->u.net.v4info.saddr = ih->saddr;
2798 ad->u.net.v4info.daddr = ih->daddr;
2799 ret = 0;
2800
2801 switch (ih->protocol) {
2802 case IPPROTO_TCP: {
2803 struct tcphdr _tcph, *th;
2804
2805 if (ntohs(ih->frag_off) & IP_OFFSET)
2806 break;
2807
2808 offset += ihlen;
2809 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2810 if (th == NULL)
2811 break;
2812
2813 ad->u.net.sport = th->source;
2814 ad->u.net.dport = th->dest;
2815 break;
2816 }
2817
2818 case IPPROTO_UDP: {
2819 struct udphdr _udph, *uh;
2820
2821 if (ntohs(ih->frag_off) & IP_OFFSET)
2822 break;
2823
2824 offset += ihlen;
2825 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2826 if (uh == NULL)
2827 break;
2828
2829 ad->u.net.sport = uh->source;
2830 ad->u.net.dport = uh->dest;
2831 break;
2832 }
2833
2834 default:
2835 break;
2836 }
2837 out:
2838 return ret;
2839 }
2840
2841 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2842
2843 /* Returns error only if unable to parse addresses */
2844 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2845 {
2846 u8 nexthdr;
2847 int ret = -EINVAL, offset;
2848 struct ipv6hdr _ipv6h, *ip6;
2849
2850 offset = skb->nh.raw - skb->data;
2851 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2852 if (ip6 == NULL)
2853 goto out;
2854
2855 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2856 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2857 ret = 0;
2858
2859 nexthdr = ip6->nexthdr;
2860 offset += sizeof(_ipv6h);
2861 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2862 if (offset < 0)
2863 goto out;
2864
2865 switch (nexthdr) {
2866 case IPPROTO_TCP: {
2867 struct tcphdr _tcph, *th;
2868
2869 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2870 if (th == NULL)
2871 break;
2872
2873 ad->u.net.sport = th->source;
2874 ad->u.net.dport = th->dest;
2875 break;
2876 }
2877
2878 case IPPROTO_UDP: {
2879 struct udphdr _udph, *uh;
2880
2881 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2882 if (uh == NULL)
2883 break;
2884
2885 ad->u.net.sport = uh->source;
2886 ad->u.net.dport = uh->dest;
2887 break;
2888 }
2889
2890 /* includes fragments */
2891 default:
2892 break;
2893 }
2894 out:
2895 return ret;
2896 }
2897
2898 #endif /* IPV6 */
2899
2900 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2901 char **addrp, int *len, int src)
2902 {
2903 int ret = 0;
2904
2905 switch (ad->u.net.family) {
2906 case PF_INET:
2907 ret = selinux_parse_skb_ipv4(skb, ad);
2908 if (ret || !addrp)
2909 break;
2910 *len = 4;
2911 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2912 &ad->u.net.v4info.daddr);
2913 break;
2914
2915 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2916 case PF_INET6:
2917 ret = selinux_parse_skb_ipv6(skb, ad);
2918 if (ret || !addrp)
2919 break;
2920 *len = 16;
2921 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2922 &ad->u.net.v6info.daddr);
2923 break;
2924 #endif /* IPV6 */
2925 default:
2926 break;
2927 }
2928
2929 return ret;
2930 }
2931
2932 /* socket security operations */
2933 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2934 u32 perms)
2935 {
2936 struct inode_security_struct *isec;
2937 struct task_security_struct *tsec;
2938 struct avc_audit_data ad;
2939 int err = 0;
2940
2941 tsec = task->security;
2942 isec = SOCK_INODE(sock)->i_security;
2943
2944 if (isec->sid == SECINITSID_KERNEL)
2945 goto out;
2946
2947 AVC_AUDIT_DATA_INIT(&ad,NET);
2948 ad.u.net.sk = sock->sk;
2949 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2950
2951 out:
2952 return err;
2953 }
2954
2955 static int selinux_socket_create(int family, int type,
2956 int protocol, int kern)
2957 {
2958 int err = 0;
2959 struct task_security_struct *tsec;
2960 u32 newsid;
2961
2962 if (kern)
2963 goto out;
2964
2965 tsec = current->security;
2966 newsid = tsec->sockcreate_sid ? : tsec->sid;
2967 err = avc_has_perm(tsec->sid, newsid,
2968 socket_type_to_security_class(family, type,
2969 protocol), SOCKET__CREATE, NULL);
2970
2971 out:
2972 return err;
2973 }
2974
2975 static void selinux_socket_post_create(struct socket *sock, int family,
2976 int type, int protocol, int kern)
2977 {
2978 struct inode_security_struct *isec;
2979 struct task_security_struct *tsec;
2980 u32 newsid;
2981
2982 isec = SOCK_INODE(sock)->i_security;
2983
2984 tsec = current->security;
2985 newsid = tsec->sockcreate_sid ? : tsec->sid;
2986 isec->sclass = socket_type_to_security_class(family, type, protocol);
2987 isec->sid = kern ? SECINITSID_KERNEL : newsid;
2988 isec->initialized = 1;
2989
2990 return;
2991 }
2992
2993 /* Range of port numbers used to automatically bind.
2994 Need to determine whether we should perform a name_bind
2995 permission check between the socket and the port number. */
2996 #define ip_local_port_range_0 sysctl_local_port_range[0]
2997 #define ip_local_port_range_1 sysctl_local_port_range[1]
2998
2999 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3000 {
3001 u16 family;
3002 int err;
3003
3004 err = socket_has_perm(current, sock, SOCKET__BIND);
3005 if (err)
3006 goto out;
3007
3008 /*
3009 * If PF_INET or PF_INET6, check name_bind permission for the port.
3010 * Multiple address binding for SCTP is not supported yet: we just
3011 * check the first address now.
3012 */
3013 family = sock->sk->sk_family;
3014 if (family == PF_INET || family == PF_INET6) {
3015 char *addrp;
3016 struct inode_security_struct *isec;
3017 struct task_security_struct *tsec;
3018 struct avc_audit_data ad;
3019 struct sockaddr_in *addr4 = NULL;
3020 struct sockaddr_in6 *addr6 = NULL;
3021 unsigned short snum;
3022 struct sock *sk = sock->sk;
3023 u32 sid, node_perm, addrlen;
3024
3025 tsec = current->security;
3026 isec = SOCK_INODE(sock)->i_security;
3027
3028 if (family == PF_INET) {
3029 addr4 = (struct sockaddr_in *)address;
3030 snum = ntohs(addr4->sin_port);
3031 addrlen = sizeof(addr4->sin_addr.s_addr);
3032 addrp = (char *)&addr4->sin_addr.s_addr;
3033 } else {
3034 addr6 = (struct sockaddr_in6 *)address;
3035 snum = ntohs(addr6->sin6_port);
3036 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3037 addrp = (char *)&addr6->sin6_addr.s6_addr;
3038 }
3039
3040 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3041 snum > ip_local_port_range_1)) {
3042 err = security_port_sid(sk->sk_family, sk->sk_type,
3043 sk->sk_protocol, snum, &sid);
3044 if (err)
3045 goto out;
3046 AVC_AUDIT_DATA_INIT(&ad,NET);
3047 ad.u.net.sport = htons(snum);
3048 ad.u.net.family = family;
3049 err = avc_has_perm(isec->sid, sid,
3050 isec->sclass,
3051 SOCKET__NAME_BIND, &ad);
3052 if (err)
3053 goto out;
3054 }
3055
3056 switch(isec->sclass) {
3057 case SECCLASS_TCP_SOCKET:
3058 node_perm = TCP_SOCKET__NODE_BIND;
3059 break;
3060
3061 case SECCLASS_UDP_SOCKET:
3062 node_perm = UDP_SOCKET__NODE_BIND;
3063 break;
3064
3065 default:
3066 node_perm = RAWIP_SOCKET__NODE_BIND;
3067 break;
3068 }
3069
3070 err = security_node_sid(family, addrp, addrlen, &sid);
3071 if (err)
3072 goto out;
3073
3074 AVC_AUDIT_DATA_INIT(&ad,NET);
3075 ad.u.net.sport = htons(snum);
3076 ad.u.net.family = family;
3077
3078 if (family == PF_INET)
3079 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3080 else
3081 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3082
3083 err = avc_has_perm(isec->sid, sid,
3084 isec->sclass, node_perm, &ad);
3085 if (err)
3086 goto out;
3087 }
3088 out:
3089 return err;
3090 }
3091
3092 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3093 {
3094 struct inode_security_struct *isec;
3095 int err;
3096
3097 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3098 if (err)
3099 return err;
3100
3101 /*
3102 * If a TCP socket, check name_connect permission for the port.
3103 */
3104 isec = SOCK_INODE(sock)->i_security;
3105 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3106 struct sock *sk = sock->sk;
3107 struct avc_audit_data ad;
3108 struct sockaddr_in *addr4 = NULL;
3109 struct sockaddr_in6 *addr6 = NULL;
3110 unsigned short snum;
3111 u32 sid;
3112
3113 if (sk->sk_family == PF_INET) {
3114 addr4 = (struct sockaddr_in *)address;
3115 if (addrlen < sizeof(struct sockaddr_in))
3116 return -EINVAL;
3117 snum = ntohs(addr4->sin_port);
3118 } else {
3119 addr6 = (struct sockaddr_in6 *)address;
3120 if (addrlen < SIN6_LEN_RFC2133)
3121 return -EINVAL;
3122 snum = ntohs(addr6->sin6_port);
3123 }
3124
3125 err = security_port_sid(sk->sk_family, sk->sk_type,
3126 sk->sk_protocol, snum, &sid);
3127 if (err)
3128 goto out;
3129
3130 AVC_AUDIT_DATA_INIT(&ad,NET);
3131 ad.u.net.dport = htons(snum);
3132 ad.u.net.family = sk->sk_family;
3133 err = avc_has_perm(isec->sid, sid, isec->sclass,
3134 TCP_SOCKET__NAME_CONNECT, &ad);
3135 if (err)
3136 goto out;
3137 }
3138
3139 out:
3140 return err;
3141 }
3142
3143 static int selinux_socket_listen(struct socket *sock, int backlog)
3144 {
3145 return socket_has_perm(current, sock, SOCKET__LISTEN);
3146 }
3147
3148 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3149 {
3150 int err;
3151 struct inode_security_struct *isec;
3152 struct inode_security_struct *newisec;
3153
3154 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3155 if (err)
3156 return err;
3157
3158 newisec = SOCK_INODE(newsock)->i_security;
3159
3160 isec = SOCK_INODE(sock)->i_security;
3161 newisec->sclass = isec->sclass;
3162 newisec->sid = isec->sid;
3163 newisec->initialized = 1;
3164
3165 return 0;
3166 }
3167
3168 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3169 int size)
3170 {
3171 return socket_has_perm(current, sock, SOCKET__WRITE);
3172 }
3173
3174 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3175 int size, int flags)
3176 {
3177 return socket_has_perm(current, sock, SOCKET__READ);
3178 }
3179
3180 static int selinux_socket_getsockname(struct socket *sock)
3181 {
3182 return socket_has_perm(current, sock, SOCKET__GETATTR);
3183 }
3184
3185 static int selinux_socket_getpeername(struct socket *sock)
3186 {
3187 return socket_has_perm(current, sock, SOCKET__GETATTR);
3188 }
3189
3190 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3191 {
3192 return socket_has_perm(current, sock, SOCKET__SETOPT);
3193 }
3194
3195 static int selinux_socket_getsockopt(struct socket *sock, int level,
3196 int optname)
3197 {
3198 return socket_has_perm(current, sock, SOCKET__GETOPT);
3199 }
3200
3201 static int selinux_socket_shutdown(struct socket *sock, int how)
3202 {
3203 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3204 }
3205
3206 static int selinux_socket_unix_stream_connect(struct socket *sock,
3207 struct socket *other,
3208 struct sock *newsk)
3209 {
3210 struct sk_security_struct *ssec;
3211 struct inode_security_struct *isec;
3212 struct inode_security_struct *other_isec;
3213 struct avc_audit_data ad;
3214 int err;
3215
3216 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3217 if (err)
3218 return err;
3219
3220 isec = SOCK_INODE(sock)->i_security;
3221 other_isec = SOCK_INODE(other)->i_security;
3222
3223 AVC_AUDIT_DATA_INIT(&ad,NET);
3224 ad.u.net.sk = other->sk;
3225
3226 err = avc_has_perm(isec->sid, other_isec->sid,
3227 isec->sclass,
3228 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3229 if (err)
3230 return err;
3231
3232 /* connecting socket */
3233 ssec = sock->sk->sk_security;
3234 ssec->peer_sid = other_isec->sid;
3235
3236 /* server child socket */
3237 ssec = newsk->sk_security;
3238 ssec->peer_sid = isec->sid;
3239
3240 return 0;
3241 }
3242
3243 static int selinux_socket_unix_may_send(struct socket *sock,
3244 struct socket *other)
3245 {
3246 struct inode_security_struct *isec;
3247 struct inode_security_struct *other_isec;
3248 struct avc_audit_data ad;
3249 int err;
3250
3251 isec = SOCK_INODE(sock)->i_security;
3252 other_isec = SOCK_INODE(other)->i_security;
3253
3254 AVC_AUDIT_DATA_INIT(&ad,NET);
3255 ad.u.net.sk = other->sk;
3256
3257 err = avc_has_perm(isec->sid, other_isec->sid,
3258 isec->sclass, SOCKET__SENDTO, &ad);
3259 if (err)
3260 return err;
3261
3262 return 0;
3263 }
3264
3265 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3266 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3267 u16 family, char *addrp, int len)
3268 {
3269 int err = 0;
3270 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3271
3272 if (!skb->dev)
3273 goto out;
3274
3275 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3276 if (err)
3277 goto out;
3278
3279 switch (sock_class) {
3280 case SECCLASS_UDP_SOCKET:
3281 netif_perm = NETIF__UDP_RECV;
3282 node_perm = NODE__UDP_RECV;
3283 recv_perm = UDP_SOCKET__RECV_MSG;
3284 break;
3285
3286 case SECCLASS_TCP_SOCKET:
3287 netif_perm = NETIF__TCP_RECV;
3288 node_perm = NODE__TCP_RECV;
3289 recv_perm = TCP_SOCKET__RECV_MSG;
3290 break;
3291
3292 default:
3293 netif_perm = NETIF__RAWIP_RECV;
3294 node_perm = NODE__RAWIP_RECV;
3295 break;
3296 }
3297
3298 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3299 if (err)
3300 goto out;
3301
3302 err = security_node_sid(family, addrp, len, &node_sid);
3303 if (err)
3304 goto out;
3305
3306 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3307 if (err)
3308 goto out;
3309
3310 if (recv_perm) {
3311 u32 port_sid;
3312
3313 err = security_port_sid(sk->sk_family, sk->sk_type,
3314 sk->sk_protocol, ntohs(ad->u.net.sport),
3315 &port_sid);
3316 if (err)
3317 goto out;
3318
3319 err = avc_has_perm(sock_sid, port_sid,
3320 sock_class, recv_perm, ad);
3321 }
3322
3323 out:
3324 return err;
3325 }
3326
3327 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3328 {
3329 u16 family;
3330 u16 sock_class = 0;
3331 char *addrp;
3332 int len, err = 0;
3333 u32 sock_sid = 0;
3334 struct socket *sock;
3335 struct avc_audit_data ad;
3336
3337 family = sk->sk_family;
3338 if (family != PF_INET && family != PF_INET6)
3339 goto out;
3340
3341 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3342 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3343 family = PF_INET;
3344
3345 read_lock_bh(&sk->sk_callback_lock);
3346 sock = sk->sk_socket;
3347 if (sock) {
3348 struct inode *inode;
3349 inode = SOCK_INODE(sock);
3350 if (inode) {
3351 struct inode_security_struct *isec;
3352 isec = inode->i_security;
3353 sock_sid = isec->sid;
3354 sock_class = isec->sclass;
3355 }
3356 }
3357 read_unlock_bh(&sk->sk_callback_lock);
3358 if (!sock_sid)
3359 goto out;
3360
3361 AVC_AUDIT_DATA_INIT(&ad, NET);
3362 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3363 ad.u.net.family = family;
3364
3365 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3366 if (err)
3367 goto out;
3368
3369 if (selinux_compat_net)
3370 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3371 sock_class, family,
3372 addrp, len);
3373 else
3374 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3375 PACKET__RECV, &ad);
3376 if (err)
3377 goto out;
3378
3379 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3380 out:
3381 return err;
3382 }
3383
3384 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3385 int __user *optlen, unsigned len)
3386 {
3387 int err = 0;
3388 char *scontext;
3389 u32 scontext_len;
3390 struct sk_security_struct *ssec;
3391 struct inode_security_struct *isec;
3392 u32 peer_sid = 0;
3393
3394 isec = SOCK_INODE(sock)->i_security;
3395
3396 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3397 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3398 ssec = sock->sk->sk_security;
3399 peer_sid = ssec->peer_sid;
3400 }
3401 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3402 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3403
3404 if (peer_sid == SECSID_NULL) {
3405 err = -ENOPROTOOPT;
3406 goto out;
3407 }
3408 }
3409 else {
3410 err = -ENOPROTOOPT;
3411 goto out;
3412 }
3413
3414 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3415
3416 if (err)
3417 goto out;
3418
3419 if (scontext_len > len) {
3420 err = -ERANGE;
3421 goto out_len;
3422 }
3423
3424 if (copy_to_user(optval, scontext, scontext_len))
3425 err = -EFAULT;
3426
3427 out_len:
3428 if (put_user(scontext_len, optlen))
3429 err = -EFAULT;
3430
3431 kfree(scontext);
3432 out:
3433 return err;
3434 }
3435
3436 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3437 {
3438 int err = 0;
3439 u32 peer_sid;
3440
3441 if (skb->sk->sk_family == PF_UNIX)
3442 selinux_get_inode_sid(SOCK_INODE(skb->sk->sk_socket),
3443 &peer_sid);
3444 else
3445 peer_sid = selinux_socket_getpeer_dgram(skb);
3446
3447 if (peer_sid == SECSID_NULL)
3448 return -EINVAL;
3449
3450 err = security_sid_to_context(peer_sid, secdata, seclen);
3451 if (err)
3452 return err;
3453
3454 return 0;
3455 }
3456
3457 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3458 {
3459 return sk_alloc_security(sk, family, priority);
3460 }
3461
3462 static void selinux_sk_free_security(struct sock *sk)
3463 {
3464 sk_free_security(sk);
3465 }
3466
3467 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3468 {
3469 struct inode_security_struct *isec;
3470 u32 sock_sid = SECINITSID_ANY_SOCKET;
3471
3472 if (!sk)
3473 return selinux_no_sk_sid(fl);
3474
3475 read_lock_bh(&sk->sk_callback_lock);
3476 isec = get_sock_isec(sk);
3477
3478 if (isec)
3479 sock_sid = isec->sid;
3480
3481 read_unlock_bh(&sk->sk_callback_lock);
3482 return sock_sid;
3483 }
3484
3485 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3486 {
3487 int err = 0;
3488 u32 perm;
3489 struct nlmsghdr *nlh;
3490 struct socket *sock = sk->sk_socket;
3491 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3492
3493 if (skb->len < NLMSG_SPACE(0)) {
3494 err = -EINVAL;
3495 goto out;
3496 }
3497 nlh = (struct nlmsghdr *)skb->data;
3498
3499 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3500 if (err) {
3501 if (err == -EINVAL) {
3502 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3503 "SELinux: unrecognized netlink message"
3504 " type=%hu for sclass=%hu\n",
3505 nlh->nlmsg_type, isec->sclass);
3506 if (!selinux_enforcing)
3507 err = 0;
3508 }
3509
3510 /* Ignore */
3511 if (err == -ENOENT)
3512 err = 0;
3513 goto out;
3514 }
3515
3516 err = socket_has_perm(current, sock, perm);
3517 out:
3518 return err;
3519 }
3520
3521 #ifdef CONFIG_NETFILTER
3522
3523 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3524 struct inode_security_struct *isec,
3525 struct avc_audit_data *ad,
3526 u16 family, char *addrp, int len)
3527 {
3528 int err;
3529 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3530
3531 err = sel_netif_sids(dev, &if_sid, NULL);
3532 if (err)
3533 goto out;
3534
3535 switch (isec->sclass) {
3536 case SECCLASS_UDP_SOCKET:
3537 netif_perm = NETIF__UDP_SEND;
3538 node_perm = NODE__UDP_SEND;
3539 send_perm = UDP_SOCKET__SEND_MSG;
3540 break;
3541
3542 case SECCLASS_TCP_SOCKET:
3543 netif_perm = NETIF__TCP_SEND;
3544 node_perm = NODE__TCP_SEND;
3545 send_perm = TCP_SOCKET__SEND_MSG;
3546 break;
3547
3548 default:
3549 netif_perm = NETIF__RAWIP_SEND;
3550 node_perm = NODE__RAWIP_SEND;
3551 break;
3552 }
3553
3554 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3555 if (err)
3556 goto out;
3557
3558 err = security_node_sid(family, addrp, len, &node_sid);
3559 if (err)
3560 goto out;
3561
3562 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3563 if (err)
3564 goto out;
3565
3566 if (send_perm) {
3567 u32 port_sid;
3568
3569 err = security_port_sid(sk->sk_family,
3570 sk->sk_type,
3571 sk->sk_protocol,
3572 ntohs(ad->u.net.dport),
3573 &port_sid);
3574 if (err)
3575 goto out;
3576
3577 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3578 send_perm, ad);
3579 }
3580 out:
3581 return err;
3582 }
3583
3584 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3585 struct sk_buff **pskb,
3586 const struct net_device *in,
3587 const struct net_device *out,
3588 int (*okfn)(struct sk_buff *),
3589 u16 family)
3590 {
3591 char *addrp;
3592 int len, err = 0;
3593 struct sock *sk;
3594 struct socket *sock;
3595 struct inode *inode;
3596 struct sk_buff *skb = *pskb;
3597 struct inode_security_struct *isec;
3598 struct avc_audit_data ad;
3599 struct net_device *dev = (struct net_device *)out;
3600
3601 sk = skb->sk;
3602 if (!sk)
3603 goto out;
3604
3605 sock = sk->sk_socket;
3606 if (!sock)
3607 goto out;
3608
3609 inode = SOCK_INODE(sock);
3610 if (!inode)
3611 goto out;
3612
3613 isec = inode->i_security;
3614
3615 AVC_AUDIT_DATA_INIT(&ad, NET);
3616 ad.u.net.netif = dev->name;
3617 ad.u.net.family = family;
3618
3619 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3620 if (err)
3621 goto out;
3622
3623 if (selinux_compat_net)
3624 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3625 family, addrp, len);
3626 else
3627 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3628 PACKET__SEND, &ad);
3629
3630 if (err)
3631 goto out;
3632
3633 err = selinux_xfrm_postroute_last(isec->sid, skb);
3634 out:
3635 return err ? NF_DROP : NF_ACCEPT;
3636 }
3637
3638 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3639 struct sk_buff **pskb,
3640 const struct net_device *in,
3641 const struct net_device *out,
3642 int (*okfn)(struct sk_buff *))
3643 {
3644 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3645 }
3646
3647 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3648
3649 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3650 struct sk_buff **pskb,
3651 const struct net_device *in,
3652 const struct net_device *out,
3653 int (*okfn)(struct sk_buff *))
3654 {
3655 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3656 }
3657
3658 #endif /* IPV6 */
3659
3660 #endif /* CONFIG_NETFILTER */
3661
3662 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3663 {
3664 int err;
3665
3666 err = secondary_ops->netlink_send(sk, skb);
3667 if (err)
3668 return err;
3669
3670 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3671 err = selinux_nlmsg_perm(sk, skb);
3672
3673 return err;
3674 }
3675
3676 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3677 {
3678 int err;
3679 struct avc_audit_data ad;
3680
3681 err = secondary_ops->netlink_recv(skb, capability);
3682 if (err)
3683 return err;
3684
3685 AVC_AUDIT_DATA_INIT(&ad, CAP);
3686 ad.u.cap = capability;
3687
3688 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3689 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3690 }
3691
3692 static int ipc_alloc_security(struct task_struct *task,
3693 struct kern_ipc_perm *perm,
3694 u16 sclass)
3695 {
3696 struct task_security_struct *tsec = task->security;
3697 struct ipc_security_struct *isec;
3698
3699 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3700 if (!isec)
3701 return -ENOMEM;
3702
3703 isec->sclass = sclass;
3704 isec->ipc_perm = perm;
3705 isec->sid = tsec->sid;
3706 perm->security = isec;
3707
3708 return 0;
3709 }
3710
3711 static void ipc_free_security(struct kern_ipc_perm *perm)
3712 {
3713 struct ipc_security_struct *isec = perm->security;
3714 perm->security = NULL;
3715 kfree(isec);
3716 }
3717
3718 static int msg_msg_alloc_security(struct msg_msg *msg)
3719 {
3720 struct msg_security_struct *msec;
3721
3722 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3723 if (!msec)
3724 return -ENOMEM;
3725
3726 msec->msg = msg;
3727 msec->sid = SECINITSID_UNLABELED;
3728 msg->security = msec;
3729
3730 return 0;
3731 }
3732
3733 static void msg_msg_free_security(struct msg_msg *msg)
3734 {
3735 struct msg_security_struct *msec = msg->security;
3736
3737 msg->security = NULL;
3738 kfree(msec);
3739 }
3740
3741 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3742 u32 perms)
3743 {
3744 struct task_security_struct *tsec;
3745 struct ipc_security_struct *isec;
3746 struct avc_audit_data ad;
3747
3748 tsec = current->security;
3749 isec = ipc_perms->security;
3750
3751 AVC_AUDIT_DATA_INIT(&ad, IPC);
3752 ad.u.ipc_id = ipc_perms->key;
3753
3754 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3755 }
3756
3757 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3758 {
3759 return msg_msg_alloc_security(msg);
3760 }
3761
3762 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3763 {
3764 msg_msg_free_security(msg);
3765 }
3766
3767 /* message queue security operations */
3768 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3769 {
3770 struct task_security_struct *tsec;
3771 struct ipc_security_struct *isec;
3772 struct avc_audit_data ad;
3773 int rc;
3774
3775 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3776 if (rc)
3777 return rc;
3778
3779 tsec = current->security;
3780 isec = msq->q_perm.security;
3781
3782 AVC_AUDIT_DATA_INIT(&ad, IPC);
3783 ad.u.ipc_id = msq->q_perm.key;
3784
3785 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3786 MSGQ__CREATE, &ad);
3787 if (rc) {
3788 ipc_free_security(&msq->q_perm);
3789 return rc;
3790 }
3791 return 0;
3792 }
3793
3794 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3795 {
3796 ipc_free_security(&msq->q_perm);
3797 }
3798
3799 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3800 {
3801 struct task_security_struct *tsec;
3802 struct ipc_security_struct *isec;
3803 struct avc_audit_data ad;
3804
3805 tsec = current->security;
3806 isec = msq->q_perm.security;
3807
3808 AVC_AUDIT_DATA_INIT(&ad, IPC);
3809 ad.u.ipc_id = msq->q_perm.key;
3810
3811 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3812 MSGQ__ASSOCIATE, &ad);
3813 }
3814
3815 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3816 {
3817 int err;
3818 int perms;
3819
3820 switch(cmd) {
3821 case IPC_INFO:
3822 case MSG_INFO:
3823 /* No specific object, just general system-wide information. */
3824 return task_has_system(current, SYSTEM__IPC_INFO);
3825 case IPC_STAT:
3826 case MSG_STAT:
3827 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3828 break;
3829 case IPC_SET:
3830 perms = MSGQ__SETATTR;
3831 break;
3832 case IPC_RMID:
3833 perms = MSGQ__DESTROY;
3834 break;
3835 default:
3836 return 0;
3837 }
3838
3839 err = ipc_has_perm(&msq->q_perm, perms);
3840 return err;
3841 }
3842
3843 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3844 {
3845 struct task_security_struct *tsec;
3846 struct ipc_security_struct *isec;
3847 struct msg_security_struct *msec;
3848 struct avc_audit_data ad;
3849 int rc;
3850
3851 tsec = current->security;
3852 isec = msq->q_perm.security;
3853 msec = msg->security;
3854
3855 /*
3856 * First time through, need to assign label to the message
3857 */
3858 if (msec->sid == SECINITSID_UNLABELED) {
3859 /*
3860 * Compute new sid based on current process and
3861 * message queue this message will be stored in
3862 */
3863 rc = security_transition_sid(tsec->sid,
3864 isec->sid,
3865 SECCLASS_MSG,
3866 &msec->sid);
3867 if (rc)
3868 return rc;
3869 }
3870
3871 AVC_AUDIT_DATA_INIT(&ad, IPC);
3872 ad.u.ipc_id = msq->q_perm.key;
3873
3874 /* Can this process write to the queue? */
3875 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3876 MSGQ__WRITE, &ad);
3877 if (!rc)
3878 /* Can this process send the message */
3879 rc = avc_has_perm(tsec->sid, msec->sid,
3880 SECCLASS_MSG, MSG__SEND, &ad);
3881 if (!rc)
3882 /* Can the message be put in the queue? */
3883 rc = avc_has_perm(msec->sid, isec->sid,
3884 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3885
3886 return rc;
3887 }
3888
3889 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3890 struct task_struct *target,
3891 long type, int mode)
3892 {
3893 struct task_security_struct *tsec;
3894 struct ipc_security_struct *isec;
3895 struct msg_security_struct *msec;
3896 struct avc_audit_data ad;
3897 int rc;
3898
3899 tsec = target->security;
3900 isec = msq->q_perm.security;
3901 msec = msg->security;
3902
3903 AVC_AUDIT_DATA_INIT(&ad, IPC);
3904 ad.u.ipc_id = msq->q_perm.key;
3905
3906 rc = avc_has_perm(tsec->sid, isec->sid,
3907 SECCLASS_MSGQ, MSGQ__READ, &ad);
3908 if (!rc)
3909 rc = avc_has_perm(tsec->sid, msec->sid,
3910 SECCLASS_MSG, MSG__RECEIVE, &ad);
3911 return rc;
3912 }
3913
3914 /* Shared Memory security operations */
3915 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3916 {
3917 struct task_security_struct *tsec;
3918 struct ipc_security_struct *isec;
3919 struct avc_audit_data ad;
3920 int rc;
3921
3922 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3923 if (rc)
3924 return rc;
3925
3926 tsec = current->security;
3927 isec = shp->shm_perm.security;
3928
3929 AVC_AUDIT_DATA_INIT(&ad, IPC);
3930 ad.u.ipc_id = shp->shm_perm.key;
3931
3932 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3933 SHM__CREATE, &ad);
3934 if (rc) {
3935 ipc_free_security(&shp->shm_perm);
3936 return rc;
3937 }
3938 return 0;
3939 }
3940
3941 static void selinux_shm_free_security(struct shmid_kernel *shp)
3942 {
3943 ipc_free_security(&shp->shm_perm);
3944 }
3945
3946 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3947 {
3948 struct task_security_struct *tsec;
3949 struct ipc_security_struct *isec;
3950 struct avc_audit_data ad;
3951
3952 tsec = current->security;
3953 isec = shp->shm_perm.security;
3954
3955 AVC_AUDIT_DATA_INIT(&ad, IPC);
3956 ad.u.ipc_id = shp->shm_perm.key;
3957
3958 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3959 SHM__ASSOCIATE, &ad);
3960 }
3961
3962 /* Note, at this point, shp is locked down */
3963 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3964 {
3965 int perms;
3966 int err;
3967
3968 switch(cmd) {
3969 case IPC_INFO:
3970 case SHM_INFO:
3971 /* No specific object, just general system-wide information. */
3972 return task_has_system(current, SYSTEM__IPC_INFO);
3973 case IPC_STAT:
3974 case SHM_STAT:
3975 perms = SHM__GETATTR | SHM__ASSOCIATE;
3976 break;
3977 case IPC_SET:
3978 perms = SHM__SETATTR;
3979 break;
3980 case SHM_LOCK:
3981 case SHM_UNLOCK:
3982 perms = SHM__LOCK;
3983 break;
3984 case IPC_RMID:
3985 perms = SHM__DESTROY;
3986 break;
3987 default:
3988 return 0;
3989 }
3990
3991 err = ipc_has_perm(&shp->shm_perm, perms);
3992 return err;
3993 }
3994
3995 static int selinux_shm_shmat(struct shmid_kernel *shp,
3996 char __user *shmaddr, int shmflg)
3997 {
3998 u32 perms;
3999 int rc;
4000
4001 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4002 if (rc)
4003 return rc;
4004
4005 if (shmflg & SHM_RDONLY)
4006 perms = SHM__READ;
4007 else
4008 perms = SHM__READ | SHM__WRITE;
4009
4010 return ipc_has_perm(&shp->shm_perm, perms);
4011 }
4012
4013 /* Semaphore security operations */
4014 static int selinux_sem_alloc_security(struct sem_array *sma)
4015 {
4016 struct task_security_struct *tsec;
4017 struct ipc_security_struct *isec;
4018 struct avc_audit_data ad;
4019 int rc;
4020
4021 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4022 if (rc)
4023 return rc;
4024
4025 tsec = current->security;
4026 isec = sma->sem_perm.security;
4027
4028 AVC_AUDIT_DATA_INIT(&ad, IPC);
4029 ad.u.ipc_id = sma->sem_perm.key;
4030
4031 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4032 SEM__CREATE, &ad);
4033 if (rc) {
4034 ipc_free_security(&sma->sem_perm);
4035 return rc;
4036 }
4037 return 0;
4038 }
4039
4040 static void selinux_sem_free_security(struct sem_array *sma)
4041 {
4042 ipc_free_security(&sma->sem_perm);
4043 }
4044
4045 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4046 {
4047 struct task_security_struct *tsec;
4048 struct ipc_security_struct *isec;
4049 struct avc_audit_data ad;
4050
4051 tsec = current->security;
4052 isec = sma->sem_perm.security;
4053
4054 AVC_AUDIT_DATA_INIT(&ad, IPC);
4055 ad.u.ipc_id = sma->sem_perm.key;
4056
4057 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4058 SEM__ASSOCIATE, &ad);
4059 }
4060
4061 /* Note, at this point, sma is locked down */
4062 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4063 {
4064 int err;
4065 u32 perms;
4066
4067 switch(cmd) {
4068 case IPC_INFO:
4069 case SEM_INFO:
4070 /* No specific object, just general system-wide information. */
4071 return task_has_system(current, SYSTEM__IPC_INFO);
4072 case GETPID:
4073 case GETNCNT:
4074 case GETZCNT:
4075 perms = SEM__GETATTR;
4076 break;
4077 case GETVAL:
4078 case GETALL:
4079 perms = SEM__READ;
4080 break;
4081 case SETVAL:
4082 case SETALL:
4083 perms = SEM__WRITE;
4084 break;
4085 case IPC_RMID:
4086 perms = SEM__DESTROY;
4087 break;
4088 case IPC_SET:
4089 perms = SEM__SETATTR;
4090 break;
4091 case IPC_STAT:
4092 case SEM_STAT:
4093 perms = SEM__GETATTR | SEM__ASSOCIATE;
4094 break;
4095 default:
4096 return 0;
4097 }
4098
4099 err = ipc_has_perm(&sma->sem_perm, perms);
4100 return err;
4101 }
4102
4103 static int selinux_sem_semop(struct sem_array *sma,
4104 struct sembuf *sops, unsigned nsops, int alter)
4105 {
4106 u32 perms;
4107
4108 if (alter)
4109 perms = SEM__READ | SEM__WRITE;
4110 else
4111 perms = SEM__READ;
4112
4113 return ipc_has_perm(&sma->sem_perm, perms);
4114 }
4115
4116 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4117 {
4118 u32 av = 0;
4119
4120 av = 0;
4121 if (flag & S_IRUGO)
4122 av |= IPC__UNIX_READ;
4123 if (flag & S_IWUGO)
4124 av |= IPC__UNIX_WRITE;
4125
4126 if (av == 0)
4127 return 0;
4128
4129 return ipc_has_perm(ipcp, av);
4130 }
4131
4132 /* module stacking operations */
4133 static int selinux_register_security (const char *name, struct security_operations *ops)
4134 {
4135 if (secondary_ops != original_ops) {
4136 printk(KERN_INFO "%s: There is already a secondary security "
4137 "module registered.\n", __FUNCTION__);
4138 return -EINVAL;
4139 }
4140
4141 secondary_ops = ops;
4142
4143 printk(KERN_INFO "%s: Registering secondary module %s\n",
4144 __FUNCTION__,
4145 name);
4146
4147 return 0;
4148 }
4149
4150 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4151 {
4152 if (ops != secondary_ops) {
4153 printk (KERN_INFO "%s: trying to unregister a security module "
4154 "that is not registered.\n", __FUNCTION__);
4155 return -EINVAL;
4156 }
4157
4158 secondary_ops = original_ops;
4159
4160 return 0;
4161 }
4162
4163 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4164 {
4165 if (inode)
4166 inode_doinit_with_dentry(inode, dentry);
4167 }
4168
4169 static int selinux_getprocattr(struct task_struct *p,
4170 char *name, void *value, size_t size)
4171 {
4172 struct task_security_struct *tsec;
4173 u32 sid;
4174 int error;
4175
4176 if (current != p) {
4177 error = task_has_perm(current, p, PROCESS__GETATTR);
4178 if (error)
4179 return error;
4180 }
4181
4182 tsec = p->security;
4183
4184 if (!strcmp(name, "current"))
4185 sid = tsec->sid;
4186 else if (!strcmp(name, "prev"))
4187 sid = tsec->osid;
4188 else if (!strcmp(name, "exec"))
4189 sid = tsec->exec_sid;
4190 else if (!strcmp(name, "fscreate"))
4191 sid = tsec->create_sid;
4192 else if (!strcmp(name, "keycreate"))
4193 sid = tsec->keycreate_sid;
4194 else if (!strcmp(name, "sockcreate"))
4195 sid = tsec->sockcreate_sid;
4196 else
4197 return -EINVAL;
4198
4199 if (!sid)
4200 return 0;
4201
4202 return selinux_getsecurity(sid, value, size);
4203 }
4204
4205 static int selinux_setprocattr(struct task_struct *p,
4206 char *name, void *value, size_t size)
4207 {
4208 struct task_security_struct *tsec;
4209 u32 sid = 0;
4210 int error;
4211 char *str = value;
4212
4213 if (current != p) {
4214 /* SELinux only allows a process to change its own
4215 security attributes. */
4216 return -EACCES;
4217 }
4218
4219 /*
4220 * Basic control over ability to set these attributes at all.
4221 * current == p, but we'll pass them separately in case the
4222 * above restriction is ever removed.
4223 */
4224 if (!strcmp(name, "exec"))
4225 error = task_has_perm(current, p, PROCESS__SETEXEC);
4226 else if (!strcmp(name, "fscreate"))
4227 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4228 else if (!strcmp(name, "keycreate"))
4229 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4230 else if (!strcmp(name, "sockcreate"))
4231 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4232 else if (!strcmp(name, "current"))
4233 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4234 else
4235 error = -EINVAL;
4236 if (error)
4237 return error;
4238
4239 /* Obtain a SID for the context, if one was specified. */
4240 if (size && str[1] && str[1] != '\n') {
4241 if (str[size-1] == '\n') {
4242 str[size-1] = 0;
4243 size--;
4244 }
4245 error = security_context_to_sid(value, size, &sid);
4246 if (error)
4247 return error;
4248 }
4249
4250 /* Permission checking based on the specified context is
4251 performed during the actual operation (execve,
4252 open/mkdir/...), when we know the full context of the
4253 operation. See selinux_bprm_set_security for the execve
4254 checks and may_create for the file creation checks. The
4255 operation will then fail if the context is not permitted. */
4256 tsec = p->security;
4257 if (!strcmp(name, "exec"))
4258 tsec->exec_sid = sid;
4259 else if (!strcmp(name, "fscreate"))
4260 tsec->create_sid = sid;
4261 else if (!strcmp(name, "keycreate")) {
4262 error = may_create_key(sid, p);
4263 if (error)
4264 return error;
4265 tsec->keycreate_sid = sid;
4266 } else if (!strcmp(name, "sockcreate"))
4267 tsec->sockcreate_sid = sid;
4268 else if (!strcmp(name, "current")) {
4269 struct av_decision avd;
4270
4271 if (sid == 0)
4272 return -EINVAL;
4273
4274 /* Only allow single threaded processes to change context */
4275 if (atomic_read(&p->mm->mm_users) != 1) {
4276 struct task_struct *g, *t;
4277 struct mm_struct *mm = p->mm;
4278 read_lock(&tasklist_lock);
4279 do_each_thread(g, t)
4280 if (t->mm == mm && t != p) {
4281 read_unlock(&tasklist_lock);
4282 return -EPERM;
4283 }
4284 while_each_thread(g, t);
4285 read_unlock(&tasklist_lock);
4286 }
4287
4288 /* Check permissions for the transition. */
4289 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4290 PROCESS__DYNTRANSITION, NULL);
4291 if (error)
4292 return error;
4293
4294 /* Check for ptracing, and update the task SID if ok.
4295 Otherwise, leave SID unchanged and fail. */
4296 task_lock(p);
4297 if (p->ptrace & PT_PTRACED) {
4298 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4299 SECCLASS_PROCESS,
4300 PROCESS__PTRACE, &avd);
4301 if (!error)
4302 tsec->sid = sid;
4303 task_unlock(p);
4304 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4305 PROCESS__PTRACE, &avd, error, NULL);
4306 if (error)
4307 return error;
4308 } else {
4309 tsec->sid = sid;
4310 task_unlock(p);
4311 }
4312 }
4313 else
4314 return -EINVAL;
4315
4316 return size;
4317 }
4318
4319 #ifdef CONFIG_KEYS
4320
4321 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4322 unsigned long flags)
4323 {
4324 struct task_security_struct *tsec = tsk->security;
4325 struct key_security_struct *ksec;
4326
4327 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4328 if (!ksec)
4329 return -ENOMEM;
4330
4331 ksec->obj = k;
4332 if (tsec->keycreate_sid)
4333 ksec->sid = tsec->keycreate_sid;
4334 else
4335 ksec->sid = tsec->sid;
4336 k->security = ksec;
4337
4338 return 0;
4339 }
4340
4341 static void selinux_key_free(struct key *k)
4342 {
4343 struct key_security_struct *ksec = k->security;
4344
4345 k->security = NULL;
4346 kfree(ksec);
4347 }
4348
4349 static int selinux_key_permission(key_ref_t key_ref,
4350 struct task_struct *ctx,
4351 key_perm_t perm)
4352 {
4353 struct key *key;
4354 struct task_security_struct *tsec;
4355 struct key_security_struct *ksec;
4356
4357 key = key_ref_to_ptr(key_ref);
4358
4359 tsec = ctx->security;
4360 ksec = key->security;
4361
4362 /* if no specific permissions are requested, we skip the
4363 permission check. No serious, additional covert channels
4364 appear to be created. */
4365 if (perm == 0)
4366 return 0;
4367
4368 return avc_has_perm(tsec->sid, ksec->sid,
4369 SECCLASS_KEY, perm, NULL);
4370 }
4371
4372 #endif
4373
4374 static struct security_operations selinux_ops = {
4375 .ptrace = selinux_ptrace,
4376 .capget = selinux_capget,
4377 .capset_check = selinux_capset_check,
4378 .capset_set = selinux_capset_set,
4379 .sysctl = selinux_sysctl,
4380 .capable = selinux_capable,
4381 .quotactl = selinux_quotactl,
4382 .quota_on = selinux_quota_on,
4383 .syslog = selinux_syslog,
4384 .vm_enough_memory = selinux_vm_enough_memory,
4385
4386 .netlink_send = selinux_netlink_send,
4387 .netlink_recv = selinux_netlink_recv,
4388
4389 .bprm_alloc_security = selinux_bprm_alloc_security,
4390 .bprm_free_security = selinux_bprm_free_security,
4391 .bprm_apply_creds = selinux_bprm_apply_creds,
4392 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4393 .bprm_set_security = selinux_bprm_set_security,
4394 .bprm_check_security = selinux_bprm_check_security,
4395 .bprm_secureexec = selinux_bprm_secureexec,
4396
4397 .sb_alloc_security = selinux_sb_alloc_security,
4398 .sb_free_security = selinux_sb_free_security,
4399 .sb_copy_data = selinux_sb_copy_data,
4400 .sb_kern_mount = selinux_sb_kern_mount,
4401 .sb_statfs = selinux_sb_statfs,
4402 .sb_mount = selinux_mount,
4403 .sb_umount = selinux_umount,
4404
4405 .inode_alloc_security = selinux_inode_alloc_security,
4406 .inode_free_security = selinux_inode_free_security,
4407 .inode_init_security = selinux_inode_init_security,
4408 .inode_create = selinux_inode_create,
4409 .inode_link = selinux_inode_link,
4410 .inode_unlink = selinux_inode_unlink,
4411 .inode_symlink = selinux_inode_symlink,
4412 .inode_mkdir = selinux_inode_mkdir,
4413 .inode_rmdir = selinux_inode_rmdir,
4414 .inode_mknod = selinux_inode_mknod,
4415 .inode_rename = selinux_inode_rename,
4416 .inode_readlink = selinux_inode_readlink,
4417 .inode_follow_link = selinux_inode_follow_link,
4418 .inode_permission = selinux_inode_permission,
4419 .inode_setattr = selinux_inode_setattr,
4420 .inode_getattr = selinux_inode_getattr,
4421 .inode_setxattr = selinux_inode_setxattr,
4422 .inode_post_setxattr = selinux_inode_post_setxattr,
4423 .inode_getxattr = selinux_inode_getxattr,
4424 .inode_listxattr = selinux_inode_listxattr,
4425 .inode_removexattr = selinux_inode_removexattr,
4426 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4427 .inode_getsecurity = selinux_inode_getsecurity,
4428 .inode_setsecurity = selinux_inode_setsecurity,
4429 .inode_listsecurity = selinux_inode_listsecurity,
4430
4431 .file_permission = selinux_file_permission,
4432 .file_alloc_security = selinux_file_alloc_security,
4433 .file_free_security = selinux_file_free_security,
4434 .file_ioctl = selinux_file_ioctl,
4435 .file_mmap = selinux_file_mmap,
4436 .file_mprotect = selinux_file_mprotect,
4437 .file_lock = selinux_file_lock,
4438 .file_fcntl = selinux_file_fcntl,
4439 .file_set_fowner = selinux_file_set_fowner,
4440 .file_send_sigiotask = selinux_file_send_sigiotask,
4441 .file_receive = selinux_file_receive,
4442
4443 .task_create = selinux_task_create,
4444 .task_alloc_security = selinux_task_alloc_security,
4445 .task_free_security = selinux_task_free_security,
4446 .task_setuid = selinux_task_setuid,
4447 .task_post_setuid = selinux_task_post_setuid,
4448 .task_setgid = selinux_task_setgid,
4449 .task_setpgid = selinux_task_setpgid,
4450 .task_getpgid = selinux_task_getpgid,
4451 .task_getsid = selinux_task_getsid,
4452 .task_getsecid = selinux_task_getsecid,
4453 .task_setgroups = selinux_task_setgroups,
4454 .task_setnice = selinux_task_setnice,
4455 .task_setioprio = selinux_task_setioprio,
4456 .task_getioprio = selinux_task_getioprio,
4457 .task_setrlimit = selinux_task_setrlimit,
4458 .task_setscheduler = selinux_task_setscheduler,
4459 .task_getscheduler = selinux_task_getscheduler,
4460 .task_movememory = selinux_task_movememory,
4461 .task_kill = selinux_task_kill,
4462 .task_wait = selinux_task_wait,
4463 .task_prctl = selinux_task_prctl,
4464 .task_reparent_to_init = selinux_task_reparent_to_init,
4465 .task_to_inode = selinux_task_to_inode,
4466
4467 .ipc_permission = selinux_ipc_permission,
4468
4469 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4470 .msg_msg_free_security = selinux_msg_msg_free_security,
4471
4472 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4473 .msg_queue_free_security = selinux_msg_queue_free_security,
4474 .msg_queue_associate = selinux_msg_queue_associate,
4475 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4476 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4477 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4478
4479 .shm_alloc_security = selinux_shm_alloc_security,
4480 .shm_free_security = selinux_shm_free_security,
4481 .shm_associate = selinux_shm_associate,
4482 .shm_shmctl = selinux_shm_shmctl,
4483 .shm_shmat = selinux_shm_shmat,
4484
4485 .sem_alloc_security = selinux_sem_alloc_security,
4486 .sem_free_security = selinux_sem_free_security,
4487 .sem_associate = selinux_sem_associate,
4488 .sem_semctl = selinux_sem_semctl,
4489 .sem_semop = selinux_sem_semop,
4490
4491 .register_security = selinux_register_security,
4492 .unregister_security = selinux_unregister_security,
4493
4494 .d_instantiate = selinux_d_instantiate,
4495
4496 .getprocattr = selinux_getprocattr,
4497 .setprocattr = selinux_setprocattr,
4498
4499 .unix_stream_connect = selinux_socket_unix_stream_connect,
4500 .unix_may_send = selinux_socket_unix_may_send,
4501
4502 .socket_create = selinux_socket_create,
4503 .socket_post_create = selinux_socket_post_create,
4504 .socket_bind = selinux_socket_bind,
4505 .socket_connect = selinux_socket_connect,
4506 .socket_listen = selinux_socket_listen,
4507 .socket_accept = selinux_socket_accept,
4508 .socket_sendmsg = selinux_socket_sendmsg,
4509 .socket_recvmsg = selinux_socket_recvmsg,
4510 .socket_getsockname = selinux_socket_getsockname,
4511 .socket_getpeername = selinux_socket_getpeername,
4512 .socket_getsockopt = selinux_socket_getsockopt,
4513 .socket_setsockopt = selinux_socket_setsockopt,
4514 .socket_shutdown = selinux_socket_shutdown,
4515 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4516 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4517 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4518 .sk_alloc_security = selinux_sk_alloc_security,
4519 .sk_free_security = selinux_sk_free_security,
4520 .sk_getsid = selinux_sk_getsid_security,
4521
4522 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4523 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4524 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4525 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4526 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4527 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4528 .xfrm_state_free_security = selinux_xfrm_state_free,
4529 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4530 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4531 #endif
4532
4533 #ifdef CONFIG_KEYS
4534 .key_alloc = selinux_key_alloc,
4535 .key_free = selinux_key_free,
4536 .key_permission = selinux_key_permission,
4537 #endif
4538 };
4539
4540 static __init int selinux_init(void)
4541 {
4542 struct task_security_struct *tsec;
4543
4544 if (!selinux_enabled) {
4545 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4546 return 0;
4547 }
4548
4549 printk(KERN_INFO "SELinux: Initializing.\n");
4550
4551 /* Set the security state for the initial task. */
4552 if (task_alloc_security(current))
4553 panic("SELinux: Failed to initialize initial task.\n");
4554 tsec = current->security;
4555 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4556
4557 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4558 sizeof(struct inode_security_struct),
4559 0, SLAB_PANIC, NULL, NULL);
4560 avc_init();
4561
4562 original_ops = secondary_ops = security_ops;
4563 if (!secondary_ops)
4564 panic ("SELinux: No initial security operations\n");
4565 if (register_security (&selinux_ops))
4566 panic("SELinux: Unable to register with kernel.\n");
4567
4568 if (selinux_enforcing) {
4569 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4570 } else {
4571 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4572 }
4573
4574 #ifdef CONFIG_KEYS
4575 /* Add security information to initial keyrings */
4576 selinux_key_alloc(&root_user_keyring, current,
4577 KEY_ALLOC_NOT_IN_QUOTA);
4578 selinux_key_alloc(&root_session_keyring, current,
4579 KEY_ALLOC_NOT_IN_QUOTA);
4580 #endif
4581
4582 return 0;
4583 }
4584
4585 void selinux_complete_init(void)
4586 {
4587 printk(KERN_INFO "SELinux: Completing initialization.\n");
4588
4589 /* Set up any superblocks initialized prior to the policy load. */
4590 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4591 spin_lock(&sb_lock);
4592 spin_lock(&sb_security_lock);
4593 next_sb:
4594 if (!list_empty(&superblock_security_head)) {
4595 struct superblock_security_struct *sbsec =
4596 list_entry(superblock_security_head.next,
4597 struct superblock_security_struct,
4598 list);
4599 struct super_block *sb = sbsec->sb;
4600 sb->s_count++;
4601 spin_unlock(&sb_security_lock);
4602 spin_unlock(&sb_lock);
4603 down_read(&sb->s_umount);
4604 if (sb->s_root)
4605 superblock_doinit(sb, NULL);
4606 drop_super(sb);
4607 spin_lock(&sb_lock);
4608 spin_lock(&sb_security_lock);
4609 list_del_init(&sbsec->list);
4610 goto next_sb;
4611 }
4612 spin_unlock(&sb_security_lock);
4613 spin_unlock(&sb_lock);
4614 }
4615
4616 /* SELinux requires early initialization in order to label
4617 all processes and objects when they are created. */
4618 security_initcall(selinux_init);
4619
4620 #if defined(CONFIG_NETFILTER)
4621
4622 static struct nf_hook_ops selinux_ipv4_op = {
4623 .hook = selinux_ipv4_postroute_last,
4624 .owner = THIS_MODULE,
4625 .pf = PF_INET,
4626 .hooknum = NF_IP_POST_ROUTING,
4627 .priority = NF_IP_PRI_SELINUX_LAST,
4628 };
4629
4630 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4631
4632 static struct nf_hook_ops selinux_ipv6_op = {
4633 .hook = selinux_ipv6_postroute_last,
4634 .owner = THIS_MODULE,
4635 .pf = PF_INET6,
4636 .hooknum = NF_IP6_POST_ROUTING,
4637 .priority = NF_IP6_PRI_SELINUX_LAST,
4638 };
4639
4640 #endif /* IPV6 */
4641
4642 static int __init selinux_nf_ip_init(void)
4643 {
4644 int err = 0;
4645
4646 if (!selinux_enabled)
4647 goto out;
4648
4649 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4650
4651 err = nf_register_hook(&selinux_ipv4_op);
4652 if (err)
4653 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4654
4655 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4656
4657 err = nf_register_hook(&selinux_ipv6_op);
4658 if (err)
4659 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4660
4661 #endif /* IPV6 */
4662
4663 out:
4664 return err;
4665 }
4666
4667 __initcall(selinux_nf_ip_init);
4668
4669 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4670 static void selinux_nf_ip_exit(void)
4671 {
4672 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4673
4674 nf_unregister_hook(&selinux_ipv4_op);
4675 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4676 nf_unregister_hook(&selinux_ipv6_op);
4677 #endif /* IPV6 */
4678 }
4679 #endif
4680
4681 #else /* CONFIG_NETFILTER */
4682
4683 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4684 #define selinux_nf_ip_exit()
4685 #endif
4686
4687 #endif /* CONFIG_NETFILTER */
4688
4689 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4690 int selinux_disable(void)
4691 {
4692 extern void exit_sel_fs(void);
4693 static int selinux_disabled = 0;
4694
4695 if (ss_initialized) {
4696 /* Not permitted after initial policy load. */
4697 return -EINVAL;
4698 }
4699
4700 if (selinux_disabled) {
4701 /* Only do this once. */
4702 return -EINVAL;
4703 }
4704
4705 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4706
4707 selinux_disabled = 1;
4708 selinux_enabled = 0;
4709
4710 /* Reset security_ops to the secondary module, dummy or capability. */
4711 security_ops = secondary_ops;
4712
4713 /* Unregister netfilter hooks. */
4714 selinux_nf_ip_exit();
4715
4716 /* Unregister selinuxfs. */
4717 exit_sel_fs();
4718
4719 return 0;
4720 }
4721 #endif
4722
4723
Community contributions to the Openmoko Kernel