?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
[linux-2.6/pdupreez.git] / security / selinux / hooks.c
blobda36dac6535f05cec337734ad5dfe9c06fee299e
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kernel.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched.h>
31 #include <linux/security.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/swap.h>
40 #include <linux/spinlock.h>
41 #include <linux/syscalls.h>
42 #include <linux/file.h>
43 #include <linux/fdtable.h>
44 #include <linux/namei.h>
45 #include <linux/mount.h>
46 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <linux/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78
79 #include "avc.h"
80 #include "objsec.h"
81 #include "netif.h"
82 #include "netnode.h"
83 #include "netport.h"
84 #include "xfrm.h"
85 #include "netlabel.h"
86 #include "audit.h"
87
88 #define XATTR_SELINUX_SUFFIX "selinux"
89 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
90
91 #define NUM_SEL_MNT_OPTS 4
92
93 extern unsigned int policydb_loaded_version;
94 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
95 extern int selinux_compat_net;
96 extern struct security_operations *security_ops;
97
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
103
104 static int __init enforcing_setup(char *str)
105 {
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
109 return 1;
110 }
111 __setup("enforcing=", enforcing_setup);
112 #endif
113
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117 static int __init selinux_enabled_setup(char *str)
118 {
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
122 return 1;
123 }
124 __setup("selinux=", selinux_enabled_setup);
125 #else
126 int selinux_enabled = 1;
127 #endif
128
129
130 /*
131 * Minimal support for a secondary security module,
132 * just to allow the use of the capability module.
133 */
134 static struct security_operations *secondary_ops;
135
136 /* Lists of inode and superblock security structures initialized
137 before the policy was loaded. */
138 static LIST_HEAD(superblock_security_head);
139 static DEFINE_SPINLOCK(sb_security_lock);
140
141 static struct kmem_cache *sel_inode_cache;
142
143 /**
144 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
145 *
146 * Description:
147 * This function checks the SECMARK reference counter to see if any SECMARK
148 * targets are currently configured, if the reference counter is greater than
149 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
150 * enabled, false (0) if SECMARK is disabled.
151 *
152 */
153 static int selinux_secmark_enabled(void)
154 {
155 return (atomic_read(&selinux_secmark_refcount) > 0);
156 }
157
158 /* Allocate and free functions for each kind of security blob. */
159
160 static int task_alloc_security(struct task_struct *task)
161 {
162 struct task_security_struct *tsec;
163
164 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
165 if (!tsec)
166 return -ENOMEM;
167
168 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
169 task->security = tsec;
170
171 return 0;
172 }
173
174 static void task_free_security(struct task_struct *task)
175 {
176 struct task_security_struct *tsec = task->security;
177 task->security = NULL;
178 kfree(tsec);
179 }
180
181 static int inode_alloc_security(struct inode *inode)
182 {
183 struct task_security_struct *tsec = current->security;
184 struct inode_security_struct *isec;
185
186 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
187 if (!isec)
188 return -ENOMEM;
189
190 mutex_init(&isec->lock);
191 INIT_LIST_HEAD(&isec->list);
192 isec->inode = inode;
193 isec->sid = SECINITSID_UNLABELED;
194 isec->sclass = SECCLASS_FILE;
195 isec->task_sid = tsec->sid;
196 inode->i_security = isec;
197
198 return 0;
199 }
200
201 static void inode_free_security(struct inode *inode)
202 {
203 struct inode_security_struct *isec = inode->i_security;
204 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
205
206 spin_lock(&sbsec->isec_lock);
207 if (!list_empty(&isec->list))
208 list_del_init(&isec->list);
209 spin_unlock(&sbsec->isec_lock);
210
211 inode->i_security = NULL;
212 kmem_cache_free(sel_inode_cache, isec);
213 }
214
215 static int file_alloc_security(struct file *file)
216 {
217 struct task_security_struct *tsec = current->security;
218 struct file_security_struct *fsec;
219
220 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
221 if (!fsec)
222 return -ENOMEM;
223
224 fsec->sid = tsec->sid;
225 fsec->fown_sid = tsec->sid;
226 file->f_security = fsec;
227
228 return 0;
229 }
230
231 static void file_free_security(struct file *file)
232 {
233 struct file_security_struct *fsec = file->f_security;
234 file->f_security = NULL;
235 kfree(fsec);
236 }
237
238 static int superblock_alloc_security(struct super_block *sb)
239 {
240 struct superblock_security_struct *sbsec;
241
242 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
243 if (!sbsec)
244 return -ENOMEM;
245
246 mutex_init(&sbsec->lock);
247 INIT_LIST_HEAD(&sbsec->list);
248 INIT_LIST_HEAD(&sbsec->isec_head);
249 spin_lock_init(&sbsec->isec_lock);
250 sbsec->sb = sb;
251 sbsec->sid = SECINITSID_UNLABELED;
252 sbsec->def_sid = SECINITSID_FILE;
253 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
254 sb->s_security = sbsec;
255
256 return 0;
257 }
258
259 static void superblock_free_security(struct super_block *sb)
260 {
261 struct superblock_security_struct *sbsec = sb->s_security;
262
263 spin_lock(&sb_security_lock);
264 if (!list_empty(&sbsec->list))
265 list_del_init(&sbsec->list);
266 spin_unlock(&sb_security_lock);
267
268 sb->s_security = NULL;
269 kfree(sbsec);
270 }
271
272 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
273 {
274 struct sk_security_struct *ssec;
275
276 ssec = kzalloc(sizeof(*ssec), priority);
277 if (!ssec)
278 return -ENOMEM;
279
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 ssec->sid = SECINITSID_UNLABELED;
282 sk->sk_security = ssec;
283
284 selinux_netlbl_sk_security_reset(ssec, family);
285
286 return 0;
287 }
288
289 static void sk_free_security(struct sock *sk)
290 {
291 struct sk_security_struct *ssec = sk->sk_security;
292
293 sk->sk_security = NULL;
294 kfree(ssec);
295 }
296
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316 return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320 Opt_error = -1,
321 Opt_context = 1,
322 Opt_fscontext = 2,
323 Opt_defcontext = 3,
324 Opt_rootcontext = 4,
325 };
326
327 static match_table_t tokens = {
328 {Opt_context, CONTEXT_STR "%s"},
329 {Opt_fscontext, FSCONTEXT_STR "%s"},
330 {Opt_defcontext, DEFCONTEXT_STR "%s"},
331 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
332 {Opt_error, NULL},
333 };
334
335 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
336
337 static int may_context_mount_sb_relabel(u32 sid,
338 struct superblock_security_struct *sbsec,
339 struct task_security_struct *tsec)
340 {
341 int rc;
342
343 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
344 FILESYSTEM__RELABELFROM, NULL);
345 if (rc)
346 return rc;
347
348 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
349 FILESYSTEM__RELABELTO, NULL);
350 return rc;
351 }
352
353 static int may_context_mount_inode_relabel(u32 sid,
354 struct superblock_security_struct *sbsec,
355 struct task_security_struct *tsec)
356 {
357 int rc;
358 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
359 FILESYSTEM__RELABELFROM, NULL);
360 if (rc)
361 return rc;
362
363 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
364 FILESYSTEM__ASSOCIATE, NULL);
365 return rc;
366 }
367
368 static int sb_finish_set_opts(struct super_block *sb)
369 {
370 struct superblock_security_struct *sbsec = sb->s_security;
371 struct dentry *root = sb->s_root;
372 struct inode *root_inode = root->d_inode;
373 int rc = 0;
374
375 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
376 /* Make sure that the xattr handler exists and that no
377 error other than -ENODATA is returned by getxattr on
378 the root directory. -ENODATA is ok, as this may be
379 the first boot of the SELinux kernel before we have
380 assigned xattr values to the filesystem. */
381 if (!root_inode->i_op->getxattr) {
382 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
383 "xattr support\n", sb->s_id, sb->s_type->name);
384 rc = -EOPNOTSUPP;
385 goto out;
386 }
387 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
388 if (rc < 0 && rc != -ENODATA) {
389 if (rc == -EOPNOTSUPP)
390 printk(KERN_WARNING "SELinux: (dev %s, type "
391 "%s) has no security xattr handler\n",
392 sb->s_id, sb->s_type->name);
393 else
394 printk(KERN_WARNING "SELinux: (dev %s, type "
395 "%s) getxattr errno %d\n", sb->s_id,
396 sb->s_type->name, -rc);
397 goto out;
398 }
399 }
400
401 sbsec->initialized = 1;
402
403 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
404 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
405 sb->s_id, sb->s_type->name);
406 else
407 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
408 sb->s_id, sb->s_type->name,
409 labeling_behaviors[sbsec->behavior-1]);
410
411 /* Initialize the root inode. */
412 rc = inode_doinit_with_dentry(root_inode, root);
413
414 /* Initialize any other inodes associated with the superblock, e.g.
415 inodes created prior to initial policy load or inodes created
416 during get_sb by a pseudo filesystem that directly
417 populates itself. */
418 spin_lock(&sbsec->isec_lock);
419 next_inode:
420 if (!list_empty(&sbsec->isec_head)) {
421 struct inode_security_struct *isec =
422 list_entry(sbsec->isec_head.next,
423 struct inode_security_struct, list);
424 struct inode *inode = isec->inode;
425 spin_unlock(&sbsec->isec_lock);
426 inode = igrab(inode);
427 if (inode) {
428 if (!IS_PRIVATE(inode))
429 inode_doinit(inode);
430 iput(inode);
431 }
432 spin_lock(&sbsec->isec_lock);
433 list_del_init(&isec->list);
434 goto next_inode;
435 }
436 spin_unlock(&sbsec->isec_lock);
437 out:
438 return rc;
439 }
440
441 /*
442 * This function should allow an FS to ask what it's mount security
443 * options were so it can use those later for submounts, displaying
444 * mount options, or whatever.
445 */
446 static int selinux_get_mnt_opts(const struct super_block *sb,
447 struct security_mnt_opts *opts)
448 {
449 int rc = 0, i;
450 struct superblock_security_struct *sbsec = sb->s_security;
451 char *context = NULL;
452 u32 len;
453 char tmp;
454
455 security_init_mnt_opts(opts);
456
457 if (!sbsec->initialized)
458 return -EINVAL;
459
460 if (!ss_initialized)
461 return -EINVAL;
462
463 /*
464 * if we ever use sbsec flags for anything other than tracking mount
465 * settings this is going to need a mask
466 */
467 tmp = sbsec->flags;
468 /* count the number of mount options for this sb */
469 for (i = 0; i < 8; i++) {
470 if (tmp & 0x01)
471 opts->num_mnt_opts++;
472 tmp >>= 1;
473 }
474
475 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
476 if (!opts->mnt_opts) {
477 rc = -ENOMEM;
478 goto out_free;
479 }
480
481 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
482 if (!opts->mnt_opts_flags) {
483 rc = -ENOMEM;
484 goto out_free;
485 }
486
487 i = 0;
488 if (sbsec->flags & FSCONTEXT_MNT) {
489 rc = security_sid_to_context(sbsec->sid, &context, &len);
490 if (rc)
491 goto out_free;
492 opts->mnt_opts[i] = context;
493 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
494 }
495 if (sbsec->flags & CONTEXT_MNT) {
496 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
497 if (rc)
498 goto out_free;
499 opts->mnt_opts[i] = context;
500 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
501 }
502 if (sbsec->flags & DEFCONTEXT_MNT) {
503 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
504 if (rc)
505 goto out_free;
506 opts->mnt_opts[i] = context;
507 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
508 }
509 if (sbsec->flags & ROOTCONTEXT_MNT) {
510 struct inode *root = sbsec->sb->s_root->d_inode;
511 struct inode_security_struct *isec = root->i_security;
512
513 rc = security_sid_to_context(isec->sid, &context, &len);
514 if (rc)
515 goto out_free;
516 opts->mnt_opts[i] = context;
517 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
518 }
519
520 BUG_ON(i != opts->num_mnt_opts);
521
522 return 0;
523
524 out_free:
525 security_free_mnt_opts(opts);
526 return rc;
527 }
528
529 static int bad_option(struct superblock_security_struct *sbsec, char flag,
530 u32 old_sid, u32 new_sid)
531 {
532 /* check if the old mount command had the same options */
533 if (sbsec->initialized)
534 if (!(sbsec->flags & flag) ||
535 (old_sid != new_sid))
536 return 1;
537
538 /* check if we were passed the same options twice,
539 * aka someone passed context=a,context=b
540 */
541 if (!sbsec->initialized)
542 if (sbsec->flags & flag)
543 return 1;
544 return 0;
545 }
546
547 /*
548 * Allow filesystems with binary mount data to explicitly set mount point
549 * labeling information.
550 */
551 static int selinux_set_mnt_opts(struct super_block *sb,
552 struct security_mnt_opts *opts)
553 {
554 int rc = 0, i;
555 struct task_security_struct *tsec = current->security;
556 struct superblock_security_struct *sbsec = sb->s_security;
557 const char *name = sb->s_type->name;
558 struct inode *inode = sbsec->sb->s_root->d_inode;
559 struct inode_security_struct *root_isec = inode->i_security;
560 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
561 u32 defcontext_sid = 0;
562 char **mount_options = opts->mnt_opts;
563 int *flags = opts->mnt_opts_flags;
564 int num_opts = opts->num_mnt_opts;
565
566 mutex_lock(&sbsec->lock);
567
568 if (!ss_initialized) {
569 if (!num_opts) {
570 /* Defer initialization until selinux_complete_init,
571 after the initial policy is loaded and the security
572 server is ready to handle calls. */
573 spin_lock(&sb_security_lock);
574 if (list_empty(&sbsec->list))
575 list_add(&sbsec->list, &superblock_security_head);
576 spin_unlock(&sb_security_lock);
577 goto out;
578 }
579 rc = -EINVAL;
580 printk(KERN_WARNING "SELinux: Unable to set superblock options "
581 "before the security server is initialized\n");
582 goto out;
583 }
584
585 /*
586 * Binary mount data FS will come through this function twice. Once
587 * from an explicit call and once from the generic calls from the vfs.
588 * Since the generic VFS calls will not contain any security mount data
589 * we need to skip the double mount verification.
590 *
591 * This does open a hole in which we will not notice if the first
592 * mount using this sb set explict options and a second mount using
593 * this sb does not set any security options. (The first options
594 * will be used for both mounts)
595 */
596 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
597 && (num_opts == 0))
598 goto out;
599
600 /*
601 * parse the mount options, check if they are valid sids.
602 * also check if someone is trying to mount the same sb more
603 * than once with different security options.
604 */
605 for (i = 0; i < num_opts; i++) {
606 u32 sid;
607 rc = security_context_to_sid(mount_options[i],
608 strlen(mount_options[i]), &sid);
609 if (rc) {
610 printk(KERN_WARNING "SELinux: security_context_to_sid"
611 "(%s) failed for (dev %s, type %s) errno=%d\n",
612 mount_options[i], sb->s_id, name, rc);
613 goto out;
614 }
615 switch (flags[i]) {
616 case FSCONTEXT_MNT:
617 fscontext_sid = sid;
618
619 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
620 fscontext_sid))
621 goto out_double_mount;
622
623 sbsec->flags |= FSCONTEXT_MNT;
624 break;
625 case CONTEXT_MNT:
626 context_sid = sid;
627
628 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
629 context_sid))
630 goto out_double_mount;
631
632 sbsec->flags |= CONTEXT_MNT;
633 break;
634 case ROOTCONTEXT_MNT:
635 rootcontext_sid = sid;
636
637 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
638 rootcontext_sid))
639 goto out_double_mount;
640
641 sbsec->flags |= ROOTCONTEXT_MNT;
642
643 break;
644 case DEFCONTEXT_MNT:
645 defcontext_sid = sid;
646
647 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
648 defcontext_sid))
649 goto out_double_mount;
650
651 sbsec->flags |= DEFCONTEXT_MNT;
652
653 break;
654 default:
655 rc = -EINVAL;
656 goto out;
657 }
658 }
659
660 if (sbsec->initialized) {
661 /* previously mounted with options, but not on this attempt? */
662 if (sbsec->flags && !num_opts)
663 goto out_double_mount;
664 rc = 0;
665 goto out;
666 }
667
668 if (strcmp(sb->s_type->name, "proc") == 0)
669 sbsec->proc = 1;
670
671 /* Determine the labeling behavior to use for this filesystem type. */
672 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
673 if (rc) {
674 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
675 __func__, sb->s_type->name, rc);
676 goto out;
677 }
678
679 /* sets the context of the superblock for the fs being mounted. */
680 if (fscontext_sid) {
681
682 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
683 if (rc)
684 goto out;
685
686 sbsec->sid = fscontext_sid;
687 }
688
689 /*
690 * Switch to using mount point labeling behavior.
691 * sets the label used on all file below the mountpoint, and will set
692 * the superblock context if not already set.
693 */
694 if (context_sid) {
695 if (!fscontext_sid) {
696 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
697 if (rc)
698 goto out;
699 sbsec->sid = context_sid;
700 } else {
701 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
702 if (rc)
703 goto out;
704 }
705 if (!rootcontext_sid)
706 rootcontext_sid = context_sid;
707
708 sbsec->mntpoint_sid = context_sid;
709 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
710 }
711
712 if (rootcontext_sid) {
713 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
714 if (rc)
715 goto out;
716
717 root_isec->sid = rootcontext_sid;
718 root_isec->initialized = 1;
719 }
720
721 if (defcontext_sid) {
722 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
723 rc = -EINVAL;
724 printk(KERN_WARNING "SELinux: defcontext option is "
725 "invalid for this filesystem type\n");
726 goto out;
727 }
728
729 if (defcontext_sid != sbsec->def_sid) {
730 rc = may_context_mount_inode_relabel(defcontext_sid,
731 sbsec, tsec);
732 if (rc)
733 goto out;
734 }
735
736 sbsec->def_sid = defcontext_sid;
737 }
738
739 rc = sb_finish_set_opts(sb);
740 out:
741 mutex_unlock(&sbsec->lock);
742 return rc;
743 out_double_mount:
744 rc = -EINVAL;
745 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
746 "security settings for (dev %s, type %s)\n", sb->s_id, name);
747 goto out;
748 }
749
750 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
751 struct super_block *newsb)
752 {
753 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
754 struct superblock_security_struct *newsbsec = newsb->s_security;
755
756 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
757 int set_context = (oldsbsec->flags & CONTEXT_MNT);
758 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
759
760 /*
761 * if the parent was able to be mounted it clearly had no special lsm
762 * mount options. thus we can safely put this sb on the list and deal
763 * with it later
764 */
765 if (!ss_initialized) {
766 spin_lock(&sb_security_lock);
767 if (list_empty(&newsbsec->list))
768 list_add(&newsbsec->list, &superblock_security_head);
769 spin_unlock(&sb_security_lock);
770 return;
771 }
772
773 /* how can we clone if the old one wasn't set up?? */
774 BUG_ON(!oldsbsec->initialized);
775
776 /* if fs is reusing a sb, just let its options stand... */
777 if (newsbsec->initialized)
778 return;
779
780 mutex_lock(&newsbsec->lock);
781
782 newsbsec->flags = oldsbsec->flags;
783
784 newsbsec->sid = oldsbsec->sid;
785 newsbsec->def_sid = oldsbsec->def_sid;
786 newsbsec->behavior = oldsbsec->behavior;
787
788 if (set_context) {
789 u32 sid = oldsbsec->mntpoint_sid;
790
791 if (!set_fscontext)
792 newsbsec->sid = sid;
793 if (!set_rootcontext) {
794 struct inode *newinode = newsb->s_root->d_inode;
795 struct inode_security_struct *newisec = newinode->i_security;
796 newisec->sid = sid;
797 }
798 newsbsec->mntpoint_sid = sid;
799 }
800 if (set_rootcontext) {
801 const struct inode *oldinode = oldsb->s_root->d_inode;
802 const struct inode_security_struct *oldisec = oldinode->i_security;
803 struct inode *newinode = newsb->s_root->d_inode;
804 struct inode_security_struct *newisec = newinode->i_security;
805
806 newisec->sid = oldisec->sid;
807 }
808
809 sb_finish_set_opts(newsb);
810 mutex_unlock(&newsbsec->lock);
811 }
812
813 static int selinux_parse_opts_str(char *options,
814 struct security_mnt_opts *opts)
815 {
816 char *p;
817 char *context = NULL, *defcontext = NULL;
818 char *fscontext = NULL, *rootcontext = NULL;
819 int rc, num_mnt_opts = 0;
820
821 opts->num_mnt_opts = 0;
822
823 /* Standard string-based options. */
824 while ((p = strsep(&options, "|")) != NULL) {
825 int token;
826 substring_t args[MAX_OPT_ARGS];
827
828 if (!*p)
829 continue;
830
831 token = match_token(p, tokens, args);
832
833 switch (token) {
834 case Opt_context:
835 if (context || defcontext) {
836 rc = -EINVAL;
837 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
838 goto out_err;
839 }
840 context = match_strdup(&args[0]);
841 if (!context) {
842 rc = -ENOMEM;
843 goto out_err;
844 }
845 break;
846
847 case Opt_fscontext:
848 if (fscontext) {
849 rc = -EINVAL;
850 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
851 goto out_err;
852 }
853 fscontext = match_strdup(&args[0]);
854 if (!fscontext) {
855 rc = -ENOMEM;
856 goto out_err;
857 }
858 break;
859
860 case Opt_rootcontext:
861 if (rootcontext) {
862 rc = -EINVAL;
863 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
864 goto out_err;
865 }
866 rootcontext = match_strdup(&args[0]);
867 if (!rootcontext) {
868 rc = -ENOMEM;
869 goto out_err;
870 }
871 break;
872
873 case Opt_defcontext:
874 if (context || defcontext) {
875 rc = -EINVAL;
876 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
877 goto out_err;
878 }
879 defcontext = match_strdup(&args[0]);
880 if (!defcontext) {
881 rc = -ENOMEM;
882 goto out_err;
883 }
884 break;
885
886 default:
887 rc = -EINVAL;
888 printk(KERN_WARNING "SELinux: unknown mount option\n");
889 goto out_err;
890
891 }
892 }
893
894 rc = -ENOMEM;
895 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
896 if (!opts->mnt_opts)
897 goto out_err;
898
899 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
900 if (!opts->mnt_opts_flags) {
901 kfree(opts->mnt_opts);
902 goto out_err;
903 }
904
905 if (fscontext) {
906 opts->mnt_opts[num_mnt_opts] = fscontext;
907 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
908 }
909 if (context) {
910 opts->mnt_opts[num_mnt_opts] = context;
911 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
912 }
913 if (rootcontext) {
914 opts->mnt_opts[num_mnt_opts] = rootcontext;
915 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
916 }
917 if (defcontext) {
918 opts->mnt_opts[num_mnt_opts] = defcontext;
919 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
920 }
921
922 opts->num_mnt_opts = num_mnt_opts;
923 return 0;
924
925 out_err:
926 kfree(context);
927 kfree(defcontext);
928 kfree(fscontext);
929 kfree(rootcontext);
930 return rc;
931 }
932 /*
933 * string mount options parsing and call set the sbsec
934 */
935 static int superblock_doinit(struct super_block *sb, void *data)
936 {
937 int rc = 0;
938 char *options = data;
939 struct security_mnt_opts opts;
940
941 security_init_mnt_opts(&opts);
942
943 if (!data)
944 goto out;
945
946 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
947
948 rc = selinux_parse_opts_str(options, &opts);
949 if (rc)
950 goto out_err;
951
952 out:
953 rc = selinux_set_mnt_opts(sb, &opts);
954
955 out_err:
956 security_free_mnt_opts(&opts);
957 return rc;
958 }
959
960 void selinux_write_opts(struct seq_file *m, struct security_mnt_opts *opts)
961 {
962 int i;
963 char *prefix;
964
965 for (i = 0; i < opts->num_mnt_opts; i++) {
966 char *has_comma = strchr(opts->mnt_opts[i], ',');
967
968 switch (opts->mnt_opts_flags[i]) {
969 case CONTEXT_MNT:
970 prefix = CONTEXT_STR;
971 break;
972 case FSCONTEXT_MNT:
973 prefix = FSCONTEXT_STR;
974 break;
975 case ROOTCONTEXT_MNT:
976 prefix = ROOTCONTEXT_STR;
977 break;
978 case DEFCONTEXT_MNT:
979 prefix = DEFCONTEXT_STR;
980 break;
981 default:
982 BUG();
983 };
984 /* we need a comma before each option */
985 seq_putc(m, ',');
986 seq_puts(m, prefix);
987 if (has_comma)
988 seq_putc(m, '\"');
989 seq_puts(m, opts->mnt_opts[i]);
990 if (has_comma)
991 seq_putc(m, '\"');
992 }
993 }
994
995 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
996 {
997 struct security_mnt_opts opts;
998 int rc;
999
1000 rc = selinux_get_mnt_opts(sb, &opts);
1001 if (rc)
1002 return rc;
1003
1004 selinux_write_opts(m, &opts);
1005
1006 security_free_mnt_opts(&opts);
1007
1008 return rc;
1009 }
1010
1011 static inline u16 inode_mode_to_security_class(umode_t mode)
1012 {
1013 switch (mode & S_IFMT) {
1014 case S_IFSOCK:
1015 return SECCLASS_SOCK_FILE;
1016 case S_IFLNK:
1017 return SECCLASS_LNK_FILE;
1018 case S_IFREG:
1019 return SECCLASS_FILE;
1020 case S_IFBLK:
1021 return SECCLASS_BLK_FILE;
1022 case S_IFDIR:
1023 return SECCLASS_DIR;
1024 case S_IFCHR:
1025 return SECCLASS_CHR_FILE;
1026 case S_IFIFO:
1027 return SECCLASS_FIFO_FILE;
1028
1029 }
1030
1031 return SECCLASS_FILE;
1032 }
1033
1034 static inline int default_protocol_stream(int protocol)
1035 {
1036 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1037 }
1038
1039 static inline int default_protocol_dgram(int protocol)
1040 {
1041 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1042 }
1043
1044 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1045 {
1046 switch (family) {
1047 case PF_UNIX:
1048 switch (type) {
1049 case SOCK_STREAM:
1050 case SOCK_SEQPACKET:
1051 return SECCLASS_UNIX_STREAM_SOCKET;
1052 case SOCK_DGRAM:
1053 return SECCLASS_UNIX_DGRAM_SOCKET;
1054 }
1055 break;
1056 case PF_INET:
1057 case PF_INET6:
1058 switch (type) {
1059 case SOCK_STREAM:
1060 if (default_protocol_stream(protocol))
1061 return SECCLASS_TCP_SOCKET;
1062 else
1063 return SECCLASS_RAWIP_SOCKET;
1064 case SOCK_DGRAM:
1065 if (default_protocol_dgram(protocol))
1066 return SECCLASS_UDP_SOCKET;
1067 else
1068 return SECCLASS_RAWIP_SOCKET;
1069 case SOCK_DCCP:
1070 return SECCLASS_DCCP_SOCKET;
1071 default:
1072 return SECCLASS_RAWIP_SOCKET;
1073 }
1074 break;
1075 case PF_NETLINK:
1076 switch (protocol) {
1077 case NETLINK_ROUTE:
1078 return SECCLASS_NETLINK_ROUTE_SOCKET;
1079 case NETLINK_FIREWALL:
1080 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1081 case NETLINK_INET_DIAG:
1082 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1083 case NETLINK_NFLOG:
1084 return SECCLASS_NETLINK_NFLOG_SOCKET;
1085 case NETLINK_XFRM:
1086 return SECCLASS_NETLINK_XFRM_SOCKET;
1087 case NETLINK_SELINUX:
1088 return SECCLASS_NETLINK_SELINUX_SOCKET;
1089 case NETLINK_AUDIT:
1090 return SECCLASS_NETLINK_AUDIT_SOCKET;
1091 case NETLINK_IP6_FW:
1092 return SECCLASS_NETLINK_IP6FW_SOCKET;
1093 case NETLINK_DNRTMSG:
1094 return SECCLASS_NETLINK_DNRT_SOCKET;
1095 case NETLINK_KOBJECT_UEVENT:
1096 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1097 default:
1098 return SECCLASS_NETLINK_SOCKET;
1099 }
1100 case PF_PACKET:
1101 return SECCLASS_PACKET_SOCKET;
1102 case PF_KEY:
1103 return SECCLASS_KEY_SOCKET;
1104 case PF_APPLETALK:
1105 return SECCLASS_APPLETALK_SOCKET;
1106 }
1107
1108 return SECCLASS_SOCKET;
1109 }
1110
1111 #ifdef CONFIG_PROC_FS
1112 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1113 u16 tclass,
1114 u32 *sid)
1115 {
1116 int buflen, rc;
1117 char *buffer, *path, *end;
1118
1119 buffer = (char *)__get_free_page(GFP_KERNEL);
1120 if (!buffer)
1121 return -ENOMEM;
1122
1123 buflen = PAGE_SIZE;
1124 end = buffer+buflen;
1125 *--end = '\0';
1126 buflen--;
1127 path = end-1;
1128 *path = '/';
1129 while (de && de != de->parent) {
1130 buflen -= de->namelen + 1;
1131 if (buflen < 0)
1132 break;
1133 end -= de->namelen;
1134 memcpy(end, de->name, de->namelen);
1135 *--end = '/';
1136 path = end;
1137 de = de->parent;
1138 }
1139 rc = security_genfs_sid("proc", path, tclass, sid);
1140 free_page((unsigned long)buffer);
1141 return rc;
1142 }
1143 #else
1144 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1145 u16 tclass,
1146 u32 *sid)
1147 {
1148 return -EINVAL;
1149 }
1150 #endif
1151
1152 /* The inode's security attributes must be initialized before first use. */
1153 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1154 {
1155 struct superblock_security_struct *sbsec = NULL;
1156 struct inode_security_struct *isec = inode->i_security;
1157 u32 sid;
1158 struct dentry *dentry;
1159 #define INITCONTEXTLEN 255
1160 char *context = NULL;
1161 unsigned len = 0;
1162 int rc = 0;
1163
1164 if (isec->initialized)
1165 goto out;
1166
1167 mutex_lock(&isec->lock);
1168 if (isec->initialized)
1169 goto out_unlock;
1170
1171 sbsec = inode->i_sb->s_security;
1172 if (!sbsec->initialized) {
1173 /* Defer initialization until selinux_complete_init,
1174 after the initial policy is loaded and the security
1175 server is ready to handle calls. */
1176 spin_lock(&sbsec->isec_lock);
1177 if (list_empty(&isec->list))
1178 list_add(&isec->list, &sbsec->isec_head);
1179 spin_unlock(&sbsec->isec_lock);
1180 goto out_unlock;
1181 }
1182
1183 switch (sbsec->behavior) {
1184 case SECURITY_FS_USE_XATTR:
1185 if (!inode->i_op->getxattr) {
1186 isec->sid = sbsec->def_sid;
1187 break;
1188 }
1189
1190 /* Need a dentry, since the xattr API requires one.
1191 Life would be simpler if we could just pass the inode. */
1192 if (opt_dentry) {
1193 /* Called from d_instantiate or d_splice_alias. */
1194 dentry = dget(opt_dentry);
1195 } else {
1196 /* Called from selinux_complete_init, try to find a dentry. */
1197 dentry = d_find_alias(inode);
1198 }
1199 if (!dentry) {
1200 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
1201 "ino=%ld\n", __func__, inode->i_sb->s_id,
1202 inode->i_ino);
1203 goto out_unlock;
1204 }
1205
1206 len = INITCONTEXTLEN;
1207 context = kmalloc(len, GFP_NOFS);
1208 if (!context) {
1209 rc = -ENOMEM;
1210 dput(dentry);
1211 goto out_unlock;
1212 }
1213 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1214 context, len);
1215 if (rc == -ERANGE) {
1216 /* Need a larger buffer. Query for the right size. */
1217 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1218 NULL, 0);
1219 if (rc < 0) {
1220 dput(dentry);
1221 goto out_unlock;
1222 }
1223 kfree(context);
1224 len = rc;
1225 context = kmalloc(len, GFP_NOFS);
1226 if (!context) {
1227 rc = -ENOMEM;
1228 dput(dentry);
1229 goto out_unlock;
1230 }
1231 rc = inode->i_op->getxattr(dentry,
1232 XATTR_NAME_SELINUX,
1233 context, len);
1234 }
1235 dput(dentry);
1236 if (rc < 0) {
1237 if (rc != -ENODATA) {
1238 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1239 "%d for dev=%s ino=%ld\n", __func__,
1240 -rc, inode->i_sb->s_id, inode->i_ino);
1241 kfree(context);
1242 goto out_unlock;
1243 }
1244 /* Map ENODATA to the default file SID */
1245 sid = sbsec->def_sid;
1246 rc = 0;
1247 } else {
1248 rc = security_context_to_sid_default(context, rc, &sid,
1249 sbsec->def_sid,
1250 GFP_NOFS);
1251 if (rc) {
1252 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1253 "returned %d for dev=%s ino=%ld\n",
1254 __func__, context, -rc,
1255 inode->i_sb->s_id, inode->i_ino);
1256 kfree(context);
1257 /* Leave with the unlabeled SID */
1258 rc = 0;
1259 break;
1260 }
1261 }
1262 kfree(context);
1263 isec->sid = sid;
1264 break;
1265 case SECURITY_FS_USE_TASK:
1266 isec->sid = isec->task_sid;
1267 break;
1268 case SECURITY_FS_USE_TRANS:
1269 /* Default to the fs SID. */
1270 isec->sid = sbsec->sid;
1271
1272 /* Try to obtain a transition SID. */
1273 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1274 rc = security_transition_sid(isec->task_sid,
1275 sbsec->sid,
1276 isec->sclass,
1277 &sid);
1278 if (rc)
1279 goto out_unlock;
1280 isec->sid = sid;
1281 break;
1282 case SECURITY_FS_USE_MNTPOINT:
1283 isec->sid = sbsec->mntpoint_sid;
1284 break;
1285 default:
1286 /* Default to the fs superblock SID. */
1287 isec->sid = sbsec->sid;
1288
1289 if (sbsec->proc) {
1290 struct proc_inode *proci = PROC_I(inode);
1291 if (proci->pde) {
1292 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1293 rc = selinux_proc_get_sid(proci->pde,
1294 isec->sclass,
1295 &sid);
1296 if (rc)
1297 goto out_unlock;
1298 isec->sid = sid;
1299 }
1300 }
1301 break;
1302 }
1303
1304 isec->initialized = 1;
1305
1306 out_unlock:
1307 mutex_unlock(&isec->lock);
1308 out:
1309 if (isec->sclass == SECCLASS_FILE)
1310 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1311 return rc;
1312 }
1313
1314 /* Convert a Linux signal to an access vector. */
1315 static inline u32 signal_to_av(int sig)
1316 {
1317 u32 perm = 0;
1318
1319 switch (sig) {
1320 case SIGCHLD:
1321 /* Commonly granted from child to parent. */
1322 perm = PROCESS__SIGCHLD;
1323 break;
1324 case SIGKILL:
1325 /* Cannot be caught or ignored */
1326 perm = PROCESS__SIGKILL;
1327 break;
1328 case SIGSTOP:
1329 /* Cannot be caught or ignored */
1330 perm = PROCESS__SIGSTOP;
1331 break;
1332 default:
1333 /* All other signals. */
1334 perm = PROCESS__SIGNAL;
1335 break;
1336 }
1337
1338 return perm;
1339 }
1340
1341 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1342 fork check, ptrace check, etc. */
1343 static int task_has_perm(struct task_struct *tsk1,
1344 struct task_struct *tsk2,
1345 u32 perms)
1346 {
1347 struct task_security_struct *tsec1, *tsec2;
1348
1349 tsec1 = tsk1->security;
1350 tsec2 = tsk2->security;
1351 return avc_has_perm(tsec1->sid, tsec2->sid,
1352 SECCLASS_PROCESS, perms, NULL);
1353 }
1354
1355 #if CAP_LAST_CAP > 63
1356 #error Fix SELinux to handle capabilities > 63.
1357 #endif
1358
1359 /* Check whether a task is allowed to use a capability. */
1360 static int task_has_capability(struct task_struct *tsk,
1361 int cap)
1362 {
1363 struct task_security_struct *tsec;
1364 struct avc_audit_data ad;
1365 u16 sclass;
1366 u32 av = CAP_TO_MASK(cap);
1367
1368 tsec = tsk->security;
1369
1370 AVC_AUDIT_DATA_INIT(&ad, CAP);
1371 ad.tsk = tsk;
1372 ad.u.cap = cap;
1373
1374 switch (CAP_TO_INDEX(cap)) {
1375 case 0:
1376 sclass = SECCLASS_CAPABILITY;
1377 break;
1378 case 1:
1379 sclass = SECCLASS_CAPABILITY2;
1380 break;
1381 default:
1382 printk(KERN_ERR
1383 "SELinux: out of range capability %d\n", cap);
1384 BUG();
1385 }
1386 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1387 }
1388
1389 /* Check whether a task is allowed to use a system operation. */
1390 static int task_has_system(struct task_struct *tsk,
1391 u32 perms)
1392 {
1393 struct task_security_struct *tsec;
1394
1395 tsec = tsk->security;
1396
1397 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1398 SECCLASS_SYSTEM, perms, NULL);
1399 }
1400
1401 /* Check whether a task has a particular permission to an inode.
1402 The 'adp' parameter is optional and allows other audit
1403 data to be passed (e.g. the dentry). */
1404 static int inode_has_perm(struct task_struct *tsk,
1405 struct inode *inode,
1406 u32 perms,
1407 struct avc_audit_data *adp)
1408 {
1409 struct task_security_struct *tsec;
1410 struct inode_security_struct *isec;
1411 struct avc_audit_data ad;
1412
1413 if (unlikely(IS_PRIVATE(inode)))
1414 return 0;
1415
1416 tsec = tsk->security;
1417 isec = inode->i_security;
1418
1419 if (!adp) {
1420 adp = &ad;
1421 AVC_AUDIT_DATA_INIT(&ad, FS);
1422 ad.u.fs.inode = inode;
1423 }
1424
1425 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1426 }
1427
1428 /* Same as inode_has_perm, but pass explicit audit data containing
1429 the dentry to help the auditing code to more easily generate the
1430 pathname if needed. */
1431 static inline int dentry_has_perm(struct task_struct *tsk,
1432 struct vfsmount *mnt,
1433 struct dentry *dentry,
1434 u32 av)
1435 {
1436 struct inode *inode = dentry->d_inode;
1437 struct avc_audit_data ad;
1438 AVC_AUDIT_DATA_INIT(&ad, FS);
1439 ad.u.fs.path.mnt = mnt;
1440 ad.u.fs.path.dentry = dentry;
1441 return inode_has_perm(tsk, inode, av, &ad);
1442 }
1443
1444 /* Check whether a task can use an open file descriptor to
1445 access an inode in a given way. Check access to the
1446 descriptor itself, and then use dentry_has_perm to
1447 check a particular permission to the file.
1448 Access to the descriptor is implicitly granted if it
1449 has the same SID as the process. If av is zero, then
1450 access to the file is not checked, e.g. for cases
1451 where only the descriptor is affected like seek. */
1452 static int file_has_perm(struct task_struct *tsk,
1453 struct file *file,
1454 u32 av)
1455 {
1456 struct task_security_struct *tsec = tsk->security;
1457 struct file_security_struct *fsec = file->f_security;
1458 struct inode *inode = file->f_path.dentry->d_inode;
1459 struct avc_audit_data ad;
1460 int rc;
1461
1462 AVC_AUDIT_DATA_INIT(&ad, FS);
1463 ad.u.fs.path = file->f_path;
1464
1465 if (tsec->sid != fsec->sid) {
1466 rc = avc_has_perm(tsec->sid, fsec->sid,
1467 SECCLASS_FD,
1468 FD__USE,
1469 &ad);
1470 if (rc)
1471 return rc;
1472 }
1473
1474 /* av is zero if only checking access to the descriptor. */
1475 if (av)
1476 return inode_has_perm(tsk, inode, av, &ad);
1477
1478 return 0;
1479 }
1480
1481 /* Check whether a task can create a file. */
1482 static int may_create(struct inode *dir,
1483 struct dentry *dentry,
1484 u16 tclass)
1485 {
1486 struct task_security_struct *tsec;
1487 struct inode_security_struct *dsec;
1488 struct superblock_security_struct *sbsec;
1489 u32 newsid;
1490 struct avc_audit_data ad;
1491 int rc;
1492
1493 tsec = current->security;
1494 dsec = dir->i_security;
1495 sbsec = dir->i_sb->s_security;
1496
1497 AVC_AUDIT_DATA_INIT(&ad, FS);
1498 ad.u.fs.path.dentry = dentry;
1499
1500 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1501 DIR__ADD_NAME | DIR__SEARCH,
1502 &ad);
1503 if (rc)
1504 return rc;
1505
1506 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1507 newsid = tsec->create_sid;
1508 } else {
1509 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1510 &newsid);
1511 if (rc)
1512 return rc;
1513 }
1514
1515 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1516 if (rc)
1517 return rc;
1518
1519 return avc_has_perm(newsid, sbsec->sid,
1520 SECCLASS_FILESYSTEM,
1521 FILESYSTEM__ASSOCIATE, &ad);
1522 }
1523
1524 /* Check whether a task can create a key. */
1525 static int may_create_key(u32 ksid,
1526 struct task_struct *ctx)
1527 {
1528 struct task_security_struct *tsec;
1529
1530 tsec = ctx->security;
1531
1532 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1533 }
1534
1535 #define MAY_LINK 0
1536 #define MAY_UNLINK 1
1537 #define MAY_RMDIR 2
1538
1539 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1540 static int may_link(struct inode *dir,
1541 struct dentry *dentry,
1542 int kind)
1543
1544 {
1545 struct task_security_struct *tsec;
1546 struct inode_security_struct *dsec, *isec;
1547 struct avc_audit_data ad;
1548 u32 av;
1549 int rc;
1550
1551 tsec = current->security;
1552 dsec = dir->i_security;
1553 isec = dentry->d_inode->i_security;
1554
1555 AVC_AUDIT_DATA_INIT(&ad, FS);
1556 ad.u.fs.path.dentry = dentry;
1557
1558 av = DIR__SEARCH;
1559 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1560 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1561 if (rc)
1562 return rc;
1563
1564 switch (kind) {
1565 case MAY_LINK:
1566 av = FILE__LINK;
1567 break;
1568 case MAY_UNLINK:
1569 av = FILE__UNLINK;
1570 break;
1571 case MAY_RMDIR:
1572 av = DIR__RMDIR;
1573 break;
1574 default:
1575 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1576 __func__, kind);
1577 return 0;
1578 }
1579
1580 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1581 return rc;
1582 }
1583
1584 static inline int may_rename(struct inode *old_dir,
1585 struct dentry *old_dentry,
1586 struct inode *new_dir,
1587 struct dentry *new_dentry)
1588 {
1589 struct task_security_struct *tsec;
1590 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1591 struct avc_audit_data ad;
1592 u32 av;
1593 int old_is_dir, new_is_dir;
1594 int rc;
1595
1596 tsec = current->security;
1597 old_dsec = old_dir->i_security;
1598 old_isec = old_dentry->d_inode->i_security;
1599 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1600 new_dsec = new_dir->i_security;
1601
1602 AVC_AUDIT_DATA_INIT(&ad, FS);
1603
1604 ad.u.fs.path.dentry = old_dentry;
1605 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1606 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1607 if (rc)
1608 return rc;
1609 rc = avc_has_perm(tsec->sid, old_isec->sid,
1610 old_isec->sclass, FILE__RENAME, &ad);
1611 if (rc)
1612 return rc;
1613 if (old_is_dir && new_dir != old_dir) {
1614 rc = avc_has_perm(tsec->sid, old_isec->sid,
1615 old_isec->sclass, DIR__REPARENT, &ad);
1616 if (rc)
1617 return rc;
1618 }
1619
1620 ad.u.fs.path.dentry = new_dentry;
1621 av = DIR__ADD_NAME | DIR__SEARCH;
1622 if (new_dentry->d_inode)
1623 av |= DIR__REMOVE_NAME;
1624 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1625 if (rc)
1626 return rc;
1627 if (new_dentry->d_inode) {
1628 new_isec = new_dentry->d_inode->i_security;
1629 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1630 rc = avc_has_perm(tsec->sid, new_isec->sid,
1631 new_isec->sclass,
1632 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1633 if (rc)
1634 return rc;
1635 }
1636
1637 return 0;
1638 }
1639
1640 /* Check whether a task can perform a filesystem operation. */
1641 static int superblock_has_perm(struct task_struct *tsk,
1642 struct super_block *sb,
1643 u32 perms,
1644 struct avc_audit_data *ad)
1645 {
1646 struct task_security_struct *tsec;
1647 struct superblock_security_struct *sbsec;
1648
1649 tsec = tsk->security;
1650 sbsec = sb->s_security;
1651 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1652 perms, ad);
1653 }
1654
1655 /* Convert a Linux mode and permission mask to an access vector. */
1656 static inline u32 file_mask_to_av(int mode, int mask)
1657 {
1658 u32 av = 0;
1659
1660 if ((mode & S_IFMT) != S_IFDIR) {
1661 if (mask & MAY_EXEC)
1662 av |= FILE__EXECUTE;
1663 if (mask & MAY_READ)
1664 av |= FILE__READ;
1665
1666 if (mask & MAY_APPEND)
1667 av |= FILE__APPEND;
1668 else if (mask & MAY_WRITE)
1669 av |= FILE__WRITE;
1670
1671 } else {
1672 if (mask & MAY_EXEC)
1673 av |= DIR__SEARCH;
1674 if (mask & MAY_WRITE)
1675 av |= DIR__WRITE;
1676 if (mask & MAY_READ)
1677 av |= DIR__READ;
1678 }
1679
1680 return av;
1681 }
1682
1683 /*
1684 * Convert a file mask to an access vector and include the correct open
1685 * open permission.
1686 */
1687 static inline u32 open_file_mask_to_av(int mode, int mask)
1688 {
1689 u32 av = file_mask_to_av(mode, mask);
1690
1691 if (selinux_policycap_openperm) {
1692 /*
1693 * lnk files and socks do not really have an 'open'
1694 */
1695 if (S_ISREG(mode))
1696 av |= FILE__OPEN;
1697 else if (S_ISCHR(mode))
1698 av |= CHR_FILE__OPEN;
1699 else if (S_ISBLK(mode))
1700 av |= BLK_FILE__OPEN;
1701 else if (S_ISFIFO(mode))
1702 av |= FIFO_FILE__OPEN;
1703 else if (S_ISDIR(mode))
1704 av |= DIR__OPEN;
1705 else
1706 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1707 "unknown mode:%x\n", __func__, mode);
1708 }
1709 return av;
1710 }
1711
1712 /* Convert a Linux file to an access vector. */
1713 static inline u32 file_to_av(struct file *file)
1714 {
1715 u32 av = 0;
1716
1717 if (file->f_mode & FMODE_READ)
1718 av |= FILE__READ;
1719 if (file->f_mode & FMODE_WRITE) {
1720 if (file->f_flags & O_APPEND)
1721 av |= FILE__APPEND;
1722 else
1723 av |= FILE__WRITE;
1724 }
1725 if (!av) {
1726 /*
1727 * Special file opened with flags 3 for ioctl-only use.
1728 */
1729 av = FILE__IOCTL;
1730 }
1731
1732 return av;
1733 }
1734
1735 /* Hook functions begin here. */
1736
1737 static int selinux_ptrace(struct task_struct *parent,
1738 struct task_struct *child,
1739 unsigned int mode)
1740 {
1741 int rc;
1742
1743 rc = secondary_ops->ptrace(parent, child, mode);
1744 if (rc)
1745 return rc;
1746
1747 if (mode == PTRACE_MODE_READ) {
1748 struct task_security_struct *tsec = parent->security;
1749 struct task_security_struct *csec = child->security;
1750 return avc_has_perm(tsec->sid, csec->sid,
1751 SECCLASS_FILE, FILE__READ, NULL);
1752 }
1753
1754 return task_has_perm(parent, child, PROCESS__PTRACE);
1755 }
1756
1757 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1758 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1759 {
1760 int error;
1761
1762 error = task_has_perm(current, target, PROCESS__GETCAP);
1763 if (error)
1764 return error;
1765
1766 return secondary_ops->capget(target, effective, inheritable, permitted);
1767 }
1768
1769 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1770 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1771 {
1772 int error;
1773
1774 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1775 if (error)
1776 return error;
1777
1778 return task_has_perm(current, target, PROCESS__SETCAP);
1779 }
1780
1781 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1782 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1783 {
1784 secondary_ops->capset_set(target, effective, inheritable, permitted);
1785 }
1786
1787 static int selinux_capable(struct task_struct *tsk, int cap)
1788 {
1789 int rc;
1790
1791 rc = secondary_ops->capable(tsk, cap);
1792 if (rc)
1793 return rc;
1794
1795 return task_has_capability(tsk, cap);
1796 }
1797
1798 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1799 {
1800 int buflen, rc;
1801 char *buffer, *path, *end;
1802
1803 rc = -ENOMEM;
1804 buffer = (char *)__get_free_page(GFP_KERNEL);
1805 if (!buffer)
1806 goto out;
1807
1808 buflen = PAGE_SIZE;
1809 end = buffer+buflen;
1810 *--end = '\0';
1811 buflen--;
1812 path = end-1;
1813 *path = '/';
1814 while (table) {
1815 const char *name = table->procname;
1816 size_t namelen = strlen(name);
1817 buflen -= namelen + 1;
1818 if (buflen < 0)
1819 goto out_free;
1820 end -= namelen;
1821 memcpy(end, name, namelen);
1822 *--end = '/';
1823 path = end;
1824 table = table->parent;
1825 }
1826 buflen -= 4;
1827 if (buflen < 0)
1828 goto out_free;
1829 end -= 4;
1830 memcpy(end, "/sys", 4);
1831 path = end;
1832 rc = security_genfs_sid("proc", path, tclass, sid);
1833 out_free:
1834 free_page((unsigned long)buffer);
1835 out:
1836 return rc;
1837 }
1838
1839 static int selinux_sysctl(ctl_table *table, int op)
1840 {
1841 int error = 0;
1842 u32 av;
1843 struct task_security_struct *tsec;
1844 u32 tsid;
1845 int rc;
1846
1847 rc = secondary_ops->sysctl(table, op);
1848 if (rc)
1849 return rc;
1850
1851 tsec = current->security;
1852
1853 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1854 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1855 if (rc) {
1856 /* Default to the well-defined sysctl SID. */
1857 tsid = SECINITSID_SYSCTL;
1858 }
1859
1860 /* The op values are "defined" in sysctl.c, thereby creating
1861 * a bad coupling between this module and sysctl.c */
1862 if (op == 001) {
1863 error = avc_has_perm(tsec->sid, tsid,
1864 SECCLASS_DIR, DIR__SEARCH, NULL);
1865 } else {
1866 av = 0;
1867 if (op & 004)
1868 av |= FILE__READ;
1869 if (op & 002)
1870 av |= FILE__WRITE;
1871 if (av)
1872 error = avc_has_perm(tsec->sid, tsid,
1873 SECCLASS_FILE, av, NULL);
1874 }
1875
1876 return error;
1877 }
1878
1879 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1880 {
1881 int rc = 0;
1882
1883 if (!sb)
1884 return 0;
1885
1886 switch (cmds) {
1887 case Q_SYNC:
1888 case Q_QUOTAON:
1889 case Q_QUOTAOFF:
1890 case Q_SETINFO:
1891 case Q_SETQUOTA:
1892 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1893 NULL);
1894 break;
1895 case Q_GETFMT:
1896 case Q_GETINFO:
1897 case Q_GETQUOTA:
1898 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1899 NULL);
1900 break;
1901 default:
1902 rc = 0; /* let the kernel handle invalid cmds */
1903 break;
1904 }
1905 return rc;
1906 }
1907
1908 static int selinux_quota_on(struct dentry *dentry)
1909 {
1910 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1911 }
1912
1913 static int selinux_syslog(int type)
1914 {
1915 int rc;
1916
1917 rc = secondary_ops->syslog(type);
1918 if (rc)
1919 return rc;
1920
1921 switch (type) {
1922 case 3: /* Read last kernel messages */
1923 case 10: /* Return size of the log buffer */
1924 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1925 break;
1926 case 6: /* Disable logging to console */
1927 case 7: /* Enable logging to console */
1928 case 8: /* Set level of messages printed to console */
1929 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1930 break;
1931 case 0: /* Close log */
1932 case 1: /* Open log */
1933 case 2: /* Read from log */
1934 case 4: /* Read/clear last kernel messages */
1935 case 5: /* Clear ring buffer */
1936 default:
1937 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1938 break;
1939 }
1940 return rc;
1941 }
1942
1943 /*
1944 * Check that a process has enough memory to allocate a new virtual
1945 * mapping. 0 means there is enough memory for the allocation to
1946 * succeed and -ENOMEM implies there is not.
1947 *
1948 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1949 * if the capability is granted, but __vm_enough_memory requires 1 if
1950 * the capability is granted.
1951 *
1952 * Do not audit the selinux permission check, as this is applied to all
1953 * processes that allocate mappings.
1954 */
1955 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1956 {
1957 int rc, cap_sys_admin = 0;
1958 struct task_security_struct *tsec = current->security;
1959
1960 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1961 if (rc == 0)
1962 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1963 SECCLASS_CAPABILITY,
1964 CAP_TO_MASK(CAP_SYS_ADMIN),
1965 0,
1966 NULL);
1967
1968 if (rc == 0)
1969 cap_sys_admin = 1;
1970
1971 return __vm_enough_memory(mm, pages, cap_sys_admin);
1972 }
1973
1974 /* binprm security operations */
1975
1976 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1977 {
1978 struct bprm_security_struct *bsec;
1979
1980 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1981 if (!bsec)
1982 return -ENOMEM;
1983
1984 bsec->sid = SECINITSID_UNLABELED;
1985 bsec->set = 0;
1986
1987 bprm->security = bsec;
1988 return 0;
1989 }
1990
1991 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1992 {
1993 struct task_security_struct *tsec;
1994 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1995 struct inode_security_struct *isec;
1996 struct bprm_security_struct *bsec;
1997 u32 newsid;
1998 struct avc_audit_data ad;
1999 int rc;
2000
2001 rc = secondary_ops->bprm_set_security(bprm);
2002 if (rc)
2003 return rc;
2004
2005 bsec = bprm->security;
2006
2007 if (bsec->set)
2008 return 0;
2009
2010 tsec = current->security;
2011 isec = inode->i_security;
2012
2013 /* Default to the current task SID. */
2014 bsec->sid = tsec->sid;
2015
2016 /* Reset fs, key, and sock SIDs on execve. */
2017 tsec->create_sid = 0;
2018 tsec->keycreate_sid = 0;
2019 tsec->sockcreate_sid = 0;
2020
2021 if (tsec->exec_sid) {
2022 newsid = tsec->exec_sid;
2023 /* Reset exec SID on execve. */
2024 tsec->exec_sid = 0;
2025 } else {
2026 /* Check for a default transition on this program. */
2027 rc = security_transition_sid(tsec->sid, isec->sid,
2028 SECCLASS_PROCESS, &newsid);
2029 if (rc)
2030 return rc;
2031 }
2032
2033 AVC_AUDIT_DATA_INIT(&ad, FS);
2034 ad.u.fs.path = bprm->file->f_path;
2035
2036 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2037 newsid = tsec->sid;
2038
2039 if (tsec->sid == newsid) {
2040 rc = avc_has_perm(tsec->sid, isec->sid,
2041 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2042 if (rc)
2043 return rc;
2044 } else {
2045 /* Check permissions for the transition. */
2046 rc = avc_has_perm(tsec->sid, newsid,
2047 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2048 if (rc)
2049 return rc;
2050
2051 rc = avc_has_perm(newsid, isec->sid,
2052 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2053 if (rc)
2054 return rc;
2055
2056 /* Clear any possibly unsafe personality bits on exec: */
2057 current->personality &= ~PER_CLEAR_ON_SETID;
2058
2059 /* Set the security field to the new SID. */
2060 bsec->sid = newsid;
2061 }
2062
2063 bsec->set = 1;
2064 return 0;
2065 }
2066
2067 static int selinux_bprm_check_security(struct linux_binprm *bprm)
2068 {
2069 return secondary_ops->bprm_check_security(bprm);
2070 }
2071
2072
2073 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2074 {
2075 struct task_security_struct *tsec = current->security;
2076 int atsecure = 0;
2077
2078 if (tsec->osid != tsec->sid) {
2079 /* Enable secure mode for SIDs transitions unless
2080 the noatsecure permission is granted between
2081 the two SIDs, i.e. ahp returns 0. */
2082 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2083 SECCLASS_PROCESS,
2084 PROCESS__NOATSECURE, NULL);
2085 }
2086
2087 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2088 }
2089
2090 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2091 {
2092 kfree(bprm->security);
2093 bprm->security = NULL;
2094 }
2095
2096 extern struct vfsmount *selinuxfs_mount;
2097 extern struct dentry *selinux_null;
2098
2099 /* Derived from fs/exec.c:flush_old_files. */
2100 static inline void flush_unauthorized_files(struct files_struct *files)
2101 {
2102 struct avc_audit_data ad;
2103 struct file *file, *devnull = NULL;
2104 struct tty_struct *tty;
2105 struct fdtable *fdt;
2106 long j = -1;
2107 int drop_tty = 0;
2108
2109 mutex_lock(&tty_mutex);
2110 tty = get_current_tty();
2111 if (tty) {
2112 file_list_lock();
2113 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2114 if (file) {
2115 /* Revalidate access to controlling tty.
2116 Use inode_has_perm on the tty inode directly rather
2117 than using file_has_perm, as this particular open
2118 file may belong to another process and we are only
2119 interested in the inode-based check here. */
2120 struct inode *inode = file->f_path.dentry->d_inode;
2121 if (inode_has_perm(current, inode,
2122 FILE__READ | FILE__WRITE, NULL)) {
2123 drop_tty = 1;
2124 }
2125 }
2126 file_list_unlock();
2127 }
2128 mutex_unlock(&tty_mutex);
2129 /* Reset controlling tty. */
2130 if (drop_tty)
2131 no_tty();
2132
2133 /* Revalidate access to inherited open files. */
2134
2135 AVC_AUDIT_DATA_INIT(&ad, FS);
2136
2137 spin_lock(&files->file_lock);
2138 for (;;) {
2139 unsigned long set, i;
2140 int fd;
2141
2142 j++;
2143 i = j * __NFDBITS;
2144 fdt = files_fdtable(files);
2145 if (i >= fdt->max_fds)
2146 break;
2147 set = fdt->open_fds->fds_bits[j];
2148 if (!set)
2149 continue;
2150 spin_unlock(&files->file_lock);
2151 for ( ; set ; i++, set >>= 1) {
2152 if (set & 1) {
2153 file = fget(i);
2154 if (!file)
2155 continue;
2156 if (file_has_perm(current,
2157 file,
2158 file_to_av(file))) {
2159 sys_close(i);
2160 fd = get_unused_fd();
2161 if (fd != i) {
2162 if (fd >= 0)
2163 put_unused_fd(fd);
2164 fput(file);
2165 continue;
2166 }
2167 if (devnull) {
2168 get_file(devnull);
2169 } else {
2170 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2171 if (IS_ERR(devnull)) {
2172 devnull = NULL;
2173 put_unused_fd(fd);
2174 fput(file);
2175 continue;
2176 }
2177 }
2178 fd_install(fd, devnull);
2179 }
2180 fput(file);
2181 }
2182 }
2183 spin_lock(&files->file_lock);
2184
2185 }
2186 spin_unlock(&files->file_lock);
2187 }
2188
2189 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2190 {
2191 struct task_security_struct *tsec;
2192 struct bprm_security_struct *bsec;
2193 u32 sid;
2194 int rc;
2195
2196 secondary_ops->bprm_apply_creds(bprm, unsafe);
2197
2198 tsec = current->security;
2199
2200 bsec = bprm->security;
2201 sid = bsec->sid;
2202
2203 tsec->osid = tsec->sid;
2204 bsec->unsafe = 0;
2205 if (tsec->sid != sid) {
2206 /* Check for shared state. If not ok, leave SID
2207 unchanged and kill. */
2208 if (unsafe & LSM_UNSAFE_SHARE) {
2209 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2210 PROCESS__SHARE, NULL);
2211 if (rc) {
2212 bsec->unsafe = 1;
2213 return;
2214 }
2215 }
2216
2217 /* Check for ptracing, and update the task SID if ok.
2218 Otherwise, leave SID unchanged and kill. */
2219 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2220 struct task_struct *tracer;
2221 struct task_security_struct *sec;
2222 u32 ptsid = 0;
2223
2224 rcu_read_lock();
2225 tracer = tracehook_tracer_task(current);
2226 if (likely(tracer != NULL)) {
2227 sec = tracer->security;
2228 ptsid = sec->sid;
2229 }
2230 rcu_read_unlock();
2231
2232 if (ptsid != 0) {
2233 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2234 PROCESS__PTRACE, NULL);
2235 if (rc) {
2236 bsec->unsafe = 1;
2237 return;
2238 }
2239 }
2240 }
2241 tsec->sid = sid;
2242 }
2243 }
2244
2245 /*
2246 * called after apply_creds without the task lock held
2247 */
2248 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2249 {
2250 struct task_security_struct *tsec;
2251 struct rlimit *rlim, *initrlim;
2252 struct itimerval itimer;
2253 struct bprm_security_struct *bsec;
2254 int rc, i;
2255
2256 tsec = current->security;
2257 bsec = bprm->security;
2258
2259 if (bsec->unsafe) {
2260 force_sig_specific(SIGKILL, current);
2261 return;
2262 }
2263 if (tsec->osid == tsec->sid)
2264 return;
2265
2266 /* Close files for which the new task SID is not authorized. */
2267 flush_unauthorized_files(current->files);
2268
2269 /* Check whether the new SID can inherit signal state
2270 from the old SID. If not, clear itimers to avoid
2271 subsequent signal generation and flush and unblock
2272 signals. This must occur _after_ the task SID has
2273 been updated so that any kill done after the flush
2274 will be checked against the new SID. */
2275 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2276 PROCESS__SIGINH, NULL);
2277 if (rc) {
2278 memset(&itimer, 0, sizeof itimer);
2279 for (i = 0; i < 3; i++)
2280 do_setitimer(i, &itimer, NULL);
2281 flush_signals(current);
2282 spin_lock_irq(&current->sighand->siglock);
2283 flush_signal_handlers(current, 1);
2284 sigemptyset(&current->blocked);
2285 recalc_sigpending();
2286 spin_unlock_irq(&current->sighand->siglock);
2287 }
2288
2289 /* Always clear parent death signal on SID transitions. */
2290 current->pdeath_signal = 0;
2291
2292 /* Check whether the new SID can inherit resource limits
2293 from the old SID. If not, reset all soft limits to
2294 the lower of the current task's hard limit and the init
2295 task's soft limit. Note that the setting of hard limits
2296 (even to lower them) can be controlled by the setrlimit
2297 check. The inclusion of the init task's soft limit into
2298 the computation is to avoid resetting soft limits higher
2299 than the default soft limit for cases where the default
2300 is lower than the hard limit, e.g. RLIMIT_CORE or
2301 RLIMIT_STACK.*/
2302 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2303 PROCESS__RLIMITINH, NULL);
2304 if (rc) {
2305 for (i = 0; i < RLIM_NLIMITS; i++) {
2306 rlim = current->signal->rlim + i;
2307 initrlim = init_task.signal->rlim+i;
2308 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2309 }
2310 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2311 /*
2312 * This will cause RLIMIT_CPU calculations
2313 * to be refigured.
2314 */
2315 current->it_prof_expires = jiffies_to_cputime(1);
2316 }
2317 }
2318
2319 /* Wake up the parent if it is waiting so that it can
2320 recheck wait permission to the new task SID. */
2321 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2322 }
2323
2324 /* superblock security operations */
2325
2326 static int selinux_sb_alloc_security(struct super_block *sb)
2327 {
2328 return superblock_alloc_security(sb);
2329 }
2330
2331 static void selinux_sb_free_security(struct super_block *sb)
2332 {
2333 superblock_free_security(sb);
2334 }
2335
2336 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2337 {
2338 if (plen > olen)
2339 return 0;
2340
2341 return !memcmp(prefix, option, plen);
2342 }
2343
2344 static inline int selinux_option(char *option, int len)
2345 {
2346 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2347 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2348 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2349 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2350 }
2351
2352 static inline void take_option(char **to, char *from, int *first, int len)
2353 {
2354 if (!*first) {
2355 **to = ',';
2356 *to += 1;
2357 } else
2358 *first = 0;
2359 memcpy(*to, from, len);
2360 *to += len;
2361 }
2362
2363 static inline void take_selinux_option(char **to, char *from, int *first,
2364 int len)
2365 {
2366 int current_size = 0;
2367
2368 if (!*first) {
2369 **to = '|';
2370 *to += 1;
2371 } else
2372 *first = 0;
2373
2374 while (current_size < len) {
2375 if (*from != '"') {
2376 **to = *from;
2377 *to += 1;
2378 }
2379 from += 1;
2380 current_size += 1;
2381 }
2382 }
2383
2384 static int selinux_sb_copy_data(char *orig, char *copy)
2385 {
2386 int fnosec, fsec, rc = 0;
2387 char *in_save, *in_curr, *in_end;
2388 char *sec_curr, *nosec_save, *nosec;
2389 int open_quote = 0;
2390
2391 in_curr = orig;
2392 sec_curr = copy;
2393
2394 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2395 if (!nosec) {
2396 rc = -ENOMEM;
2397 goto out;
2398 }
2399
2400 nosec_save = nosec;
2401 fnosec = fsec = 1;
2402 in_save = in_end = orig;
2403
2404 do {
2405 if (*in_end == '"')
2406 open_quote = !open_quote;
2407 if ((*in_end == ',' && open_quote == 0) ||
2408 *in_end == '\0') {
2409 int len = in_end - in_curr;
2410
2411 if (selinux_option(in_curr, len))
2412 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2413 else
2414 take_option(&nosec, in_curr, &fnosec, len);
2415
2416 in_curr = in_end + 1;
2417 }
2418 } while (*in_end++);
2419
2420 strcpy(in_save, nosec_save);
2421 free_page((unsigned long)nosec_save);
2422 out:
2423 return rc;
2424 }
2425
2426 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2427 {
2428 struct avc_audit_data ad;
2429 int rc;
2430
2431 rc = superblock_doinit(sb, data);
2432 if (rc)
2433 return rc;
2434
2435 AVC_AUDIT_DATA_INIT(&ad, FS);
2436 ad.u.fs.path.dentry = sb->s_root;
2437 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2438 }
2439
2440 static int selinux_sb_statfs(struct dentry *dentry)
2441 {
2442 struct avc_audit_data ad;
2443
2444 AVC_AUDIT_DATA_INIT(&ad, FS);
2445 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2446 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2447 }
2448
2449 static int selinux_mount(char *dev_name,
2450 struct path *path,
2451 char *type,
2452 unsigned long flags,
2453 void *data)
2454 {
2455 int rc;
2456
2457 rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
2458 if (rc)
2459 return rc;
2460
2461 if (flags & MS_REMOUNT)
2462 return superblock_has_perm(current, path->mnt->mnt_sb,
2463 FILESYSTEM__REMOUNT, NULL);
2464 else
2465 return dentry_has_perm(current, path->mnt, path->dentry,
2466 FILE__MOUNTON);
2467 }
2468
2469 static int selinux_umount(struct vfsmount *mnt, int flags)
2470 {
2471 int rc;
2472
2473 rc = secondary_ops->sb_umount(mnt, flags);
2474 if (rc)
2475 return rc;
2476
2477 return superblock_has_perm(current, mnt->mnt_sb,
2478 FILESYSTEM__UNMOUNT, NULL);
2479 }
2480
2481 /* inode security operations */
2482
2483 static int selinux_inode_alloc_security(struct inode *inode)
2484 {
2485 return inode_alloc_security(inode);
2486 }
2487
2488 static void selinux_inode_free_security(struct inode *inode)
2489 {
2490 inode_free_security(inode);
2491 }
2492
2493 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2494 char **name, void **value,
2495 size_t *len)
2496 {
2497 struct task_security_struct *tsec;
2498 struct inode_security_struct *dsec;
2499 struct superblock_security_struct *sbsec;
2500 u32 newsid, clen;
2501 int rc;
2502 char *namep = NULL, *context;
2503
2504 tsec = current->security;
2505 dsec = dir->i_security;
2506 sbsec = dir->i_sb->s_security;
2507
2508 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2509 newsid = tsec->create_sid;
2510 } else {
2511 rc = security_transition_sid(tsec->sid, dsec->sid,
2512 inode_mode_to_security_class(inode->i_mode),
2513 &newsid);
2514 if (rc) {
2515 printk(KERN_WARNING "%s: "
2516 "security_transition_sid failed, rc=%d (dev=%s "
2517 "ino=%ld)\n",
2518 __func__,
2519 -rc, inode->i_sb->s_id, inode->i_ino);
2520 return rc;
2521 }
2522 }
2523
2524 /* Possibly defer initialization to selinux_complete_init. */
2525 if (sbsec->initialized) {
2526 struct inode_security_struct *isec = inode->i_security;
2527 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2528 isec->sid = newsid;
2529 isec->initialized = 1;
2530 }
2531
2532 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2533 return -EOPNOTSUPP;
2534
2535 if (name) {
2536 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2537 if (!namep)
2538 return -ENOMEM;
2539 *name = namep;
2540 }
2541
2542 if (value && len) {
2543 rc = security_sid_to_context_force(newsid, &context, &clen);
2544 if (rc) {
2545 kfree(namep);
2546 return rc;
2547 }
2548 *value = context;
2549 *len = clen;
2550 }
2551
2552 return 0;
2553 }
2554
2555 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2556 {
2557 return may_create(dir, dentry, SECCLASS_FILE);
2558 }
2559
2560 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2561 {
2562 int rc;
2563
2564 rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
2565 if (rc)
2566 return rc;
2567 return may_link(dir, old_dentry, MAY_LINK);
2568 }
2569
2570 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2571 {
2572 int rc;
2573
2574 rc = secondary_ops->inode_unlink(dir, dentry);
2575 if (rc)
2576 return rc;
2577 return may_link(dir, dentry, MAY_UNLINK);
2578 }
2579
2580 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2581 {
2582 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2583 }
2584
2585 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2586 {
2587 return may_create(dir, dentry, SECCLASS_DIR);
2588 }
2589
2590 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2591 {
2592 return may_link(dir, dentry, MAY_RMDIR);
2593 }
2594
2595 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2596 {
2597 int rc;
2598
2599 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2600 if (rc)
2601 return rc;
2602
2603 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2604 }
2605
2606 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2607 struct inode *new_inode, struct dentry *new_dentry)
2608 {
2609 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2610 }
2611
2612 static int selinux_inode_readlink(struct dentry *dentry)
2613 {
2614 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2615 }
2616
2617 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2618 {
2619 int rc;
2620
2621 rc = secondary_ops->inode_follow_link(dentry, nameidata);
2622 if (rc)
2623 return rc;
2624 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2625 }
2626
2627 static int selinux_inode_permission(struct inode *inode, int mask,
2628 struct nameidata *nd)
2629 {
2630 int rc;
2631
2632 rc = secondary_ops->inode_permission(inode, mask, nd);
2633 if (rc)
2634 return rc;
2635
2636 if (!mask) {
2637 /* No permission to check. Existence test. */
2638 return 0;
2639 }
2640
2641 return inode_has_perm(current, inode,
2642 open_file_mask_to_av(inode->i_mode, mask), NULL);
2643 }
2644
2645 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2646 {
2647 int rc;
2648
2649 rc = secondary_ops->inode_setattr(dentry, iattr);
2650 if (rc)
2651 return rc;
2652
2653 if (iattr->ia_valid & ATTR_FORCE)
2654 return 0;
2655
2656 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2657 ATTR_ATIME_SET | ATTR_MTIME_SET))
2658 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2659
2660 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2661 }
2662
2663 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2664 {
2665 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2666 }
2667
2668 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2669 {
2670 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2671 sizeof XATTR_SECURITY_PREFIX - 1)) {
2672 if (!strcmp(name, XATTR_NAME_CAPS)) {
2673 if (!capable(CAP_SETFCAP))
2674 return -EPERM;
2675 } else if (!capable(CAP_SYS_ADMIN)) {
2676 /* A different attribute in the security namespace.
2677 Restrict to administrator. */
2678 return -EPERM;
2679 }
2680 }
2681
2682 /* Not an attribute we recognize, so just check the
2683 ordinary setattr permission. */
2684 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2685 }
2686
2687 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2688 const void *value, size_t size, int flags)
2689 {
2690 struct task_security_struct *tsec = current->security;
2691 struct inode *inode = dentry->d_inode;
2692 struct inode_security_struct *isec = inode->i_security;
2693 struct superblock_security_struct *sbsec;
2694 struct avc_audit_data ad;
2695 u32 newsid;
2696 int rc = 0;
2697
2698 if (strcmp(name, XATTR_NAME_SELINUX))
2699 return selinux_inode_setotherxattr(dentry, name);
2700
2701 sbsec = inode->i_sb->s_security;
2702 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2703 return -EOPNOTSUPP;
2704
2705 if (!is_owner_or_cap(inode))
2706 return -EPERM;
2707
2708 AVC_AUDIT_DATA_INIT(&ad, FS);
2709 ad.u.fs.path.dentry = dentry;
2710
2711 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2712 FILE__RELABELFROM, &ad);
2713 if (rc)
2714 return rc;
2715
2716 rc = security_context_to_sid(value, size, &newsid);
2717 if (rc == -EINVAL) {
2718 if (!capable(CAP_MAC_ADMIN))
2719 return rc;
2720 rc = security_context_to_sid_force(value, size, &newsid);
2721 }
2722 if (rc)
2723 return rc;
2724
2725 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2726 FILE__RELABELTO, &ad);
2727 if (rc)
2728 return rc;
2729
2730 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2731 isec->sclass);
2732 if (rc)
2733 return rc;
2734
2735 return avc_has_perm(newsid,
2736 sbsec->sid,
2737 SECCLASS_FILESYSTEM,
2738 FILESYSTEM__ASSOCIATE,
2739 &ad);
2740 }
2741
2742 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2743 const void *value, size_t size,
2744 int flags)
2745 {
2746 struct inode *inode = dentry->d_inode;
2747 struct inode_security_struct *isec = inode->i_security;
2748 u32 newsid;
2749 int rc;
2750
2751 if (strcmp(name, XATTR_NAME_SELINUX)) {
2752 /* Not an attribute we recognize, so nothing to do. */
2753 return;
2754 }
2755
2756 rc = security_context_to_sid_force(value, size, &newsid);
2757 if (rc) {
2758 printk(KERN_ERR "SELinux: unable to map context to SID"
2759 "for (%s, %lu), rc=%d\n",
2760 inode->i_sb->s_id, inode->i_ino, -rc);
2761 return;
2762 }
2763
2764 isec->sid = newsid;
2765 return;
2766 }
2767
2768 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2769 {
2770 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2771 }
2772
2773 static int selinux_inode_listxattr(struct dentry *dentry)
2774 {
2775 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2776 }
2777
2778 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2779 {
2780 if (strcmp(name, XATTR_NAME_SELINUX))
2781 return selinux_inode_setotherxattr(dentry, name);
2782
2783 /* No one is allowed to remove a SELinux security label.
2784 You can change the label, but all data must be labeled. */
2785 return -EACCES;
2786 }
2787
2788 /*
2789 * Copy the inode security context value to the user.
2790 *
2791 * Permission check is handled by selinux_inode_getxattr hook.
2792 */
2793 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2794 {
2795 u32 size;
2796 int error;
2797 char *context = NULL;
2798 struct task_security_struct *tsec = current->security;
2799 struct inode_security_struct *isec = inode->i_security;
2800
2801 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2802 return -EOPNOTSUPP;
2803
2804 /*
2805 * If the caller has CAP_MAC_ADMIN, then get the raw context
2806 * value even if it is not defined by current policy; otherwise,
2807 * use the in-core value under current policy.
2808 * Use the non-auditing forms of the permission checks since
2809 * getxattr may be called by unprivileged processes commonly
2810 * and lack of permission just means that we fall back to the
2811 * in-core context value, not a denial.
2812 */
2813 error = secondary_ops->capable(current, CAP_MAC_ADMIN);
2814 if (!error)
2815 error = avc_has_perm_noaudit(tsec->sid, tsec->sid,
2816 SECCLASS_CAPABILITY2,
2817 CAPABILITY2__MAC_ADMIN,
2818 0,
2819 NULL);
2820 if (!error)
2821 error = security_sid_to_context_force(isec->sid, &context,
2822 &size);
2823 else
2824 error = security_sid_to_context(isec->sid, &context, &size);
2825 if (error)
2826 return error;
2827 error = size;
2828 if (alloc) {
2829 *buffer = context;
2830 goto out_nofree;
2831 }
2832 kfree(context);
2833 out_nofree:
2834 return error;
2835 }
2836
2837 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2838 const void *value, size_t size, int flags)
2839 {
2840 struct inode_security_struct *isec = inode->i_security;
2841 u32 newsid;
2842 int rc;
2843
2844 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2845 return -EOPNOTSUPP;
2846
2847 if (!value || !size)
2848 return -EACCES;
2849
2850 rc = security_context_to_sid((void *)value, size, &newsid);
2851 if (rc)
2852 return rc;
2853
2854 isec->sid = newsid;
2855 return 0;
2856 }
2857
2858 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2859 {
2860 const int len = sizeof(XATTR_NAME_SELINUX);
2861 if (buffer && len <= buffer_size)
2862 memcpy(buffer, XATTR_NAME_SELINUX, len);
2863 return len;
2864 }
2865
2866 static int selinux_inode_need_killpriv(struct dentry *dentry)
2867 {
2868 return secondary_ops->inode_need_killpriv(dentry);
2869 }
2870
2871 static int selinux_inode_killpriv(struct dentry *dentry)
2872 {
2873 return secondary_ops->inode_killpriv(dentry);
2874 }
2875
2876 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2877 {
2878 struct inode_security_struct *isec = inode->i_security;
2879 *secid = isec->sid;
2880 }
2881
2882 /* file security operations */
2883
2884 static int selinux_revalidate_file_permission(struct file *file, int mask)
2885 {
2886 int rc;
2887 struct inode *inode = file->f_path.dentry->d_inode;
2888
2889 if (!mask) {
2890 /* No permission to check. Existence test. */
2891 return 0;
2892 }
2893
2894 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2895 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2896 mask |= MAY_APPEND;
2897
2898 rc = file_has_perm(current, file,
2899 file_mask_to_av(inode->i_mode, mask));
2900 if (rc)
2901 return rc;
2902
2903 return selinux_netlbl_inode_permission(inode, mask);
2904 }
2905
2906 static int selinux_file_permission(struct file *file, int mask)
2907 {
2908 struct inode *inode = file->f_path.dentry->d_inode;
2909 struct task_security_struct *tsec = current->security;
2910 struct file_security_struct *fsec = file->f_security;
2911 struct inode_security_struct *isec = inode->i_security;
2912
2913 if (!mask) {
2914 /* No permission to check. Existence test. */
2915 return 0;
2916 }
2917
2918 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2919 && fsec->pseqno == avc_policy_seqno())
2920 return selinux_netlbl_inode_permission(inode, mask);
2921
2922 return selinux_revalidate_file_permission(file, mask);
2923 }
2924
2925 static int selinux_file_alloc_security(struct file *file)
2926 {
2927 return file_alloc_security(file);
2928 }
2929
2930 static void selinux_file_free_security(struct file *file)
2931 {
2932 file_free_security(file);
2933 }
2934
2935 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2936 unsigned long arg)
2937 {
2938 u32 av = 0;
2939
2940 if (_IOC_DIR(cmd) & _IOC_WRITE)
2941 av |= FILE__WRITE;
2942 if (_IOC_DIR(cmd) & _IOC_READ)
2943 av |= FILE__READ;
2944 if (!av)
2945 av = FILE__IOCTL;
2946
2947 return file_has_perm(current, file, av);
2948 }
2949
2950 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2951 {
2952 #ifndef CONFIG_PPC32
2953 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2954 /*
2955 * We are making executable an anonymous mapping or a
2956 * private file mapping that will also be writable.
2957 * This has an additional check.
2958 */
2959 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2960 if (rc)
2961 return rc;
2962 }
2963 #endif
2964
2965 if (file) {
2966 /* read access is always possible with a mapping */
2967 u32 av = FILE__READ;
2968
2969 /* write access only matters if the mapping is shared */
2970 if (shared && (prot & PROT_WRITE))
2971 av |= FILE__WRITE;
2972
2973 if (prot & PROT_EXEC)
2974 av |= FILE__EXECUTE;
2975
2976 return file_has_perm(current, file, av);
2977 }
2978 return 0;
2979 }
2980
2981 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2982 unsigned long prot, unsigned long flags,
2983 unsigned long addr, unsigned long addr_only)
2984 {
2985 int rc = 0;
2986 u32 sid = ((struct task_security_struct *)(current->security))->sid;
2987
2988 if (addr < mmap_min_addr)
2989 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2990 MEMPROTECT__MMAP_ZERO, NULL);
2991 if (rc || addr_only)
2992 return rc;
2993
2994 if (selinux_checkreqprot)
2995 prot = reqprot;
2996
2997 return file_map_prot_check(file, prot,
2998 (flags & MAP_TYPE) == MAP_SHARED);
2999 }
3000
3001 static int selinux_file_mprotect(struct vm_area_struct *vma,
3002 unsigned long reqprot,
3003 unsigned long prot)
3004 {
3005 int rc;
3006
3007 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
3008 if (rc)
3009 return rc;
3010
3011 if (selinux_checkreqprot)
3012 prot = reqprot;
3013
3014 #ifndef CONFIG_PPC32
3015 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3016 rc = 0;
3017 if (vma->vm_start >= vma->vm_mm->start_brk &&
3018 vma->vm_end <= vma->vm_mm->brk) {
3019 rc = task_has_perm(current, current,
3020 PROCESS__EXECHEAP);
3021 } else if (!vma->vm_file &&
3022 vma->vm_start <= vma->vm_mm->start_stack &&
3023 vma->vm_end >= vma->vm_mm->start_stack) {
3024 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
3025 } else if (vma->vm_file && vma->anon_vma) {
3026 /*
3027 * We are making executable a file mapping that has
3028 * had some COW done. Since pages might have been
3029 * written, check ability to execute the possibly
3030 * modified content. This typically should only
3031 * occur for text relocations.
3032 */
3033 rc = file_has_perm(current, vma->vm_file,
3034 FILE__EXECMOD);
3035 }
3036 if (rc)
3037 return rc;
3038 }
3039 #endif
3040
3041 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3042 }
3043
3044 static int selinux_file_lock(struct file *file, unsigned int cmd)
3045 {
3046 return file_has_perm(current, file, FILE__LOCK);
3047 }
3048
3049 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3050 unsigned long arg)
3051 {
3052 int err = 0;
3053
3054 switch (cmd) {
3055 case F_SETFL:
3056 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3057 err = -EINVAL;
3058 break;
3059 }
3060
3061 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3062 err = file_has_perm(current, file, FILE__WRITE);
3063 break;
3064 }
3065 /* fall through */
3066 case F_SETOWN:
3067 case F_SETSIG:
3068 case F_GETFL:
3069 case F_GETOWN:
3070 case F_GETSIG:
3071 /* Just check FD__USE permission */
3072 err = file_has_perm(current, file, 0);
3073 break;
3074 case F_GETLK:
3075 case F_SETLK:
3076 case F_SETLKW:
3077 #if BITS_PER_LONG == 32
3078 case F_GETLK64:
3079 case F_SETLK64:
3080 case F_SETLKW64:
3081 #endif
3082 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3083 err = -EINVAL;
3084 break;
3085 }
3086 err = file_has_perm(current, file, FILE__LOCK);
3087 break;
3088 }
3089
3090 return err;
3091 }
3092
3093 static int selinux_file_set_fowner(struct file *file)
3094 {
3095 struct task_security_struct *tsec;
3096 struct file_security_struct *fsec;
3097
3098 tsec = current->security;
3099 fsec = file->f_security;
3100 fsec->fown_sid = tsec->sid;
3101
3102 return 0;
3103 }
3104
3105 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3106 struct fown_struct *fown, int signum)
3107 {
3108 struct file *file;
3109 u32 perm;
3110 struct task_security_struct *tsec;
3111 struct file_security_struct *fsec;
3112
3113 /* struct fown_struct is never outside the context of a struct file */
3114 file = container_of(fown, struct file, f_owner);
3115
3116 tsec = tsk->security;
3117 fsec = file->f_security;
3118
3119 if (!signum)
3120 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3121 else
3122 perm = signal_to_av(signum);
3123
3124 return avc_has_perm(fsec->fown_sid, tsec->sid,
3125 SECCLASS_PROCESS, perm, NULL);
3126 }
3127
3128 static int selinux_file_receive(struct file *file)
3129 {
3130 return file_has_perm(current, file, file_to_av(file));
3131 }
3132
3133 static int selinux_dentry_open(struct file *file)
3134 {
3135 struct file_security_struct *fsec;
3136 struct inode *inode;
3137 struct inode_security_struct *isec;
3138 inode = file->f_path.dentry->d_inode;
3139 fsec = file->f_security;
3140 isec = inode->i_security;
3141 /*
3142 * Save inode label and policy sequence number
3143 * at open-time so that selinux_file_permission
3144 * can determine whether revalidation is necessary.
3145 * Task label is already saved in the file security
3146 * struct as its SID.
3147 */
3148 fsec->isid = isec->sid;
3149 fsec->pseqno = avc_policy_seqno();
3150 /*
3151 * Since the inode label or policy seqno may have changed
3152 * between the selinux_inode_permission check and the saving
3153 * of state above, recheck that access is still permitted.
3154 * Otherwise, access might never be revalidated against the
3155 * new inode label or new policy.
3156 * This check is not redundant - do not remove.
3157 */
3158 return inode_has_perm(current, inode, file_to_av(file), NULL);
3159 }
3160
3161 /* task security operations */
3162
3163 static int selinux_task_create(unsigned long clone_flags)
3164 {
3165 int rc;
3166
3167 rc = secondary_ops->task_create(clone_flags);
3168 if (rc)
3169 return rc;
3170
3171 return task_has_perm(current, current, PROCESS__FORK);
3172 }
3173
3174 static int selinux_task_alloc_security(struct task_struct *tsk)
3175 {
3176 struct task_security_struct *tsec1, *tsec2;
3177 int rc;
3178
3179 tsec1 = current->security;
3180
3181 rc = task_alloc_security(tsk);
3182 if (rc)
3183 return rc;
3184 tsec2 = tsk->security;
3185
3186 tsec2->osid = tsec1->osid;
3187 tsec2->sid = tsec1->sid;
3188
3189 /* Retain the exec, fs, key, and sock SIDs across fork */
3190 tsec2->exec_sid = tsec1->exec_sid;
3191 tsec2->create_sid = tsec1->create_sid;
3192 tsec2->keycreate_sid = tsec1->keycreate_sid;
3193 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3194
3195 return 0;
3196 }
3197
3198 static void selinux_task_free_security(struct task_struct *tsk)
3199 {
3200 task_free_security(tsk);
3201 }
3202
3203 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3204 {
3205 /* Since setuid only affects the current process, and
3206 since the SELinux controls are not based on the Linux
3207 identity attributes, SELinux does not need to control
3208 this operation. However, SELinux does control the use
3209 of the CAP_SETUID and CAP_SETGID capabilities using the
3210 capable hook. */
3211 return 0;
3212 }
3213
3214 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3215 {
3216 return secondary_ops->task_post_setuid(id0, id1, id2, flags);
3217 }
3218
3219 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3220 {
3221 /* See the comment for setuid above. */
3222 return 0;
3223 }
3224
3225 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3226 {
3227 return task_has_perm(current, p, PROCESS__SETPGID);
3228 }
3229
3230 static int selinux_task_getpgid(struct task_struct *p)
3231 {
3232 return task_has_perm(current, p, PROCESS__GETPGID);
3233 }
3234
3235 static int selinux_task_getsid(struct task_struct *p)
3236 {
3237 return task_has_perm(current, p, PROCESS__GETSESSION);
3238 }
3239
3240 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3241 {
3242 struct task_security_struct *tsec = p->security;
3243 *secid = tsec->sid;
3244 }
3245
3246 static int selinux_task_setgroups(struct group_info *group_info)
3247 {
3248 /* See the comment for setuid above. */
3249 return 0;
3250 }
3251
3252 static int selinux_task_setnice(struct task_struct *p, int nice)
3253 {
3254 int rc;
3255
3256 rc = secondary_ops->task_setnice(p, nice);
3257 if (rc)
3258 return rc;
3259
3260 return task_has_perm(current, p, PROCESS__SETSCHED);
3261 }
3262
3263 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3264 {
3265 int rc;
3266
3267 rc = secondary_ops->task_setioprio(p, ioprio);
3268 if (rc)
3269 return rc;
3270
3271 return task_has_perm(current, p, PROCESS__SETSCHED);
3272 }
3273
3274 static int selinux_task_getioprio(struct task_struct *p)
3275 {
3276 return task_has_perm(current, p, PROCESS__GETSCHED);
3277 }
3278
3279 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3280 {
3281 struct rlimit *old_rlim = current->signal->rlim + resource;
3282 int rc;
3283
3284 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3285 if (rc)
3286 return rc;
3287
3288 /* Control the ability to change the hard limit (whether
3289 lowering or raising it), so that the hard limit can
3290 later be used as a safe reset point for the soft limit
3291 upon context transitions. See selinux_bprm_apply_creds. */
3292 if (old_rlim->rlim_max != new_rlim->rlim_max)
3293 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3294
3295 return 0;
3296 }
3297
3298 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3299 {
3300 int rc;
3301
3302 rc = secondary_ops->task_setscheduler(p, policy, lp);
3303 if (rc)
3304 return rc;
3305
3306 return task_has_perm(current, p, PROCESS__SETSCHED);
3307 }
3308
3309 static int selinux_task_getscheduler(struct task_struct *p)
3310 {
3311 return task_has_perm(current, p, PROCESS__GETSCHED);
3312 }
3313
3314 static int selinux_task_movememory(struct task_struct *p)
3315 {
3316 return task_has_perm(current, p, PROCESS__SETSCHED);
3317 }
3318
3319 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3320 int sig, u32 secid)
3321 {
3322 u32 perm;
3323 int rc;
3324 struct task_security_struct *tsec;
3325
3326 rc = secondary_ops->task_kill(p, info, sig, secid);
3327 if (rc)
3328 return rc;
3329
3330 if (!sig)
3331 perm = PROCESS__SIGNULL; /* null signal; existence test */
3332 else
3333 perm = signal_to_av(sig);
3334 tsec = p->security;
3335 if (secid)
3336 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3337 else
3338 rc = task_has_perm(current, p, perm);
3339 return rc;
3340 }
3341
3342 static int selinux_task_prctl(int option,
3343 unsigned long arg2,
3344 unsigned long arg3,
3345 unsigned long arg4,
3346 unsigned long arg5,
3347 long *rc_p)
3348 {
3349 /* The current prctl operations do not appear to require
3350 any SELinux controls since they merely observe or modify
3351 the state of the current process. */
3352 return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
3353 }
3354
3355 static int selinux_task_wait(struct task_struct *p)
3356 {
3357 return task_has_perm(p, current, PROCESS__SIGCHLD);
3358 }
3359
3360 static void selinux_task_reparent_to_init(struct task_struct *p)
3361 {
3362 struct task_security_struct *tsec;
3363
3364 secondary_ops->task_reparent_to_init(p);
3365
3366 tsec = p->security;
3367 tsec->osid = tsec->sid;
3368 tsec->sid = SECINITSID_KERNEL;
3369 return;
3370 }
3371
3372 static void selinux_task_to_inode(struct task_struct *p,
3373 struct inode *inode)
3374 {
3375 struct task_security_struct *tsec = p->security;
3376 struct inode_security_struct *isec = inode->i_security;
3377
3378 isec->sid = tsec->sid;
3379 isec->initialized = 1;
3380 return;
3381 }
3382
3383 /* Returns error only if unable to parse addresses */
3384 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3385 struct avc_audit_data *ad, u8 *proto)
3386 {
3387 int offset, ihlen, ret = -EINVAL;
3388 struct iphdr _iph, *ih;
3389
3390 offset = skb_network_offset(skb);
3391 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3392 if (ih == NULL)
3393 goto out;
3394
3395 ihlen = ih->ihl * 4;
3396 if (ihlen < sizeof(_iph))
3397 goto out;
3398
3399 ad->u.net.v4info.saddr = ih->saddr;
3400 ad->u.net.v4info.daddr = ih->daddr;
3401 ret = 0;
3402
3403 if (proto)
3404 *proto = ih->protocol;
3405
3406 switch (ih->protocol) {
3407 case IPPROTO_TCP: {
3408 struct tcphdr _tcph, *th;
3409
3410 if (ntohs(ih->frag_off) & IP_OFFSET)
3411 break;
3412
3413 offset += ihlen;
3414 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3415 if (th == NULL)
3416 break;
3417
3418 ad->u.net.sport = th->source;
3419 ad->u.net.dport = th->dest;
3420 break;
3421 }
3422
3423 case IPPROTO_UDP: {
3424 struct udphdr _udph, *uh;
3425
3426 if (ntohs(ih->frag_off) & IP_OFFSET)
3427 break;
3428
3429 offset += ihlen;
3430 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3431 if (uh == NULL)
3432 break;
3433
3434 ad->u.net.sport = uh->source;
3435 ad->u.net.dport = uh->dest;
3436 break;
3437 }
3438
3439 case IPPROTO_DCCP: {
3440 struct dccp_hdr _dccph, *dh;
3441
3442 if (ntohs(ih->frag_off) & IP_OFFSET)
3443 break;
3444
3445 offset += ihlen;
3446 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3447 if (dh == NULL)
3448 break;
3449
3450 ad->u.net.sport = dh->dccph_sport;
3451 ad->u.net.dport = dh->dccph_dport;
3452 break;
3453 }
3454
3455 default:
3456 break;
3457 }
3458 out:
3459 return ret;
3460 }
3461
3462 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3463
3464 /* Returns error only if unable to parse addresses */
3465 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3466 struct avc_audit_data *ad, u8 *proto)
3467 {
3468 u8 nexthdr;
3469 int ret = -EINVAL, offset;
3470 struct ipv6hdr _ipv6h, *ip6;
3471
3472 offset = skb_network_offset(skb);
3473 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3474 if (ip6 == NULL)
3475 goto out;
3476
3477 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3478 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3479 ret = 0;
3480
3481 nexthdr = ip6->nexthdr;
3482 offset += sizeof(_ipv6h);
3483 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3484 if (offset < 0)
3485 goto out;
3486
3487 if (proto)
3488 *proto = nexthdr;
3489
3490 switch (nexthdr) {
3491 case IPPROTO_TCP: {
3492 struct tcphdr _tcph, *th;
3493
3494 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3495 if (th == NULL)
3496 break;
3497
3498 ad->u.net.sport = th->source;
3499 ad->u.net.dport = th->dest;
3500 break;
3501 }
3502
3503 case IPPROTO_UDP: {
3504 struct udphdr _udph, *uh;
3505
3506 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3507 if (uh == NULL)
3508 break;
3509
3510 ad->u.net.sport = uh->source;
3511 ad->u.net.dport = uh->dest;
3512 break;
3513 }
3514
3515 case IPPROTO_DCCP: {
3516 struct dccp_hdr _dccph, *dh;
3517
3518 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3519 if (dh == NULL)
3520 break;
3521
3522 ad->u.net.sport = dh->dccph_sport;
3523 ad->u.net.dport = dh->dccph_dport;
3524 break;
3525 }
3526
3527 /* includes fragments */
3528 default:
3529 break;
3530 }
3531 out:
3532 return ret;
3533 }
3534
3535 #endif /* IPV6 */
3536
3537 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3538 char **addrp, int src, u8 *proto)
3539 {
3540 int ret = 0;
3541
3542 switch (ad->u.net.family) {
3543 case PF_INET:
3544 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3545 if (ret || !addrp)
3546 break;
3547 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3548 &ad->u.net.v4info.daddr);
3549 break;
3550
3551 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3552 case PF_INET6:
3553 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3554 if (ret || !addrp)
3555 break;
3556 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3557 &ad->u.net.v6info.daddr);
3558 break;
3559 #endif /* IPV6 */
3560 default:
3561 break;
3562 }
3563
3564 if (unlikely(ret))
3565 printk(KERN_WARNING
3566 "SELinux: failure in selinux_parse_skb(),"
3567 " unable to parse packet\n");
3568
3569 return ret;
3570 }
3571
3572 /**
3573 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3574 * @skb: the packet
3575 * @family: protocol family
3576 * @sid: the packet's peer label SID
3577 *
3578 * Description:
3579 * Check the various different forms of network peer labeling and determine
3580 * the peer label/SID for the packet; most of the magic actually occurs in
3581 * the security server function security_net_peersid_cmp(). The function
3582 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3583 * or -EACCES if @sid is invalid due to inconsistencies with the different
3584 * peer labels.
3585 *
3586 */
3587 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3588 {
3589 int err;
3590 u32 xfrm_sid;
3591 u32 nlbl_sid;
3592 u32 nlbl_type;
3593
3594 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3595 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3596
3597 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3598 if (unlikely(err)) {
3599 printk(KERN_WARNING
3600 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3601 " unable to determine packet's peer label\n");
3602 return -EACCES;
3603 }
3604
3605 return 0;
3606 }
3607
3608 /* socket security operations */
3609 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3610 u32 perms)
3611 {
3612 struct inode_security_struct *isec;
3613 struct task_security_struct *tsec;
3614 struct avc_audit_data ad;
3615 int err = 0;
3616
3617 tsec = task->security;
3618 isec = SOCK_INODE(sock)->i_security;
3619
3620 if (isec->sid == SECINITSID_KERNEL)
3621 goto out;
3622
3623 AVC_AUDIT_DATA_INIT(&ad, NET);
3624 ad.u.net.sk = sock->sk;
3625 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3626
3627 out:
3628 return err;
3629 }
3630
3631 static int selinux_socket_create(int family, int type,
3632 int protocol, int kern)
3633 {
3634 int err = 0;
3635 struct task_security_struct *tsec;
3636 u32 newsid;
3637
3638 if (kern)
3639 goto out;
3640
3641 tsec = current->security;
3642 newsid = tsec->sockcreate_sid ? : tsec->sid;
3643 err = avc_has_perm(tsec->sid, newsid,
3644 socket_type_to_security_class(family, type,
3645 protocol), SOCKET__CREATE, NULL);
3646
3647 out:
3648 return err;
3649 }
3650
3651 static int selinux_socket_post_create(struct socket *sock, int family,
3652 int type, int protocol, int kern)
3653 {
3654 int err = 0;
3655 struct inode_security_struct *isec;
3656 struct task_security_struct *tsec;
3657 struct sk_security_struct *sksec;
3658 u32 newsid;
3659
3660 isec = SOCK_INODE(sock)->i_security;
3661
3662 tsec = current->security;
3663 newsid = tsec->sockcreate_sid ? : tsec->sid;
3664 isec->sclass = socket_type_to_security_class(family, type, protocol);
3665 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3666 isec->initialized = 1;
3667
3668 if (sock->sk) {
3669 sksec = sock->sk->sk_security;
3670 sksec->sid = isec->sid;
3671 sksec->sclass = isec->sclass;
3672 err = selinux_netlbl_socket_post_create(sock);
3673 }
3674
3675 return err;
3676 }
3677
3678 /* Range of port numbers used to automatically bind.
3679 Need to determine whether we should perform a name_bind
3680 permission check between the socket and the port number. */
3681
3682 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3683 {
3684 u16 family;
3685 int err;
3686
3687 err = socket_has_perm(current, sock, SOCKET__BIND);
3688 if (err)
3689 goto out;
3690
3691 /*
3692 * If PF_INET or PF_INET6, check name_bind permission for the port.
3693 * Multiple address binding for SCTP is not supported yet: we just
3694 * check the first address now.
3695 */
3696 family = sock->sk->sk_family;
3697 if (family == PF_INET || family == PF_INET6) {
3698 char *addrp;
3699 struct inode_security_struct *isec;
3700 struct task_security_struct *tsec;
3701 struct avc_audit_data ad;
3702 struct sockaddr_in *addr4 = NULL;
3703 struct sockaddr_in6 *addr6 = NULL;
3704 unsigned short snum;
3705 struct sock *sk = sock->sk;
3706 u32 sid, node_perm;
3707
3708 tsec = current->security;
3709 isec = SOCK_INODE(sock)->i_security;
3710
3711 if (family == PF_INET) {
3712 addr4 = (struct sockaddr_in *)address;
3713 snum = ntohs(addr4->sin_port);
3714 addrp = (char *)&addr4->sin_addr.s_addr;
3715 } else {
3716 addr6 = (struct sockaddr_in6 *)address;
3717 snum = ntohs(addr6->sin6_port);
3718 addrp = (char *)&addr6->sin6_addr.s6_addr;
3719 }
3720
3721 if (snum) {
3722 int low, high;
3723
3724 inet_get_local_port_range(&low, &high);
3725
3726 if (snum < max(PROT_SOCK, low) || snum > high) {
3727 err = sel_netport_sid(sk->sk_protocol,
3728 snum, &sid);
3729 if (err)
3730 goto out;
3731 AVC_AUDIT_DATA_INIT(&ad, NET);
3732 ad.u.net.sport = htons(snum);
3733 ad.u.net.family = family;
3734 err = avc_has_perm(isec->sid, sid,
3735 isec->sclass,
3736 SOCKET__NAME_BIND, &ad);
3737 if (err)
3738 goto out;
3739 }
3740 }
3741
3742 switch (isec->sclass) {
3743 case SECCLASS_TCP_SOCKET:
3744 node_perm = TCP_SOCKET__NODE_BIND;
3745 break;
3746
3747 case SECCLASS_UDP_SOCKET:
3748 node_perm = UDP_SOCKET__NODE_BIND;
3749 break;
3750
3751 case SECCLASS_DCCP_SOCKET:
3752 node_perm = DCCP_SOCKET__NODE_BIND;
3753 break;
3754
3755 default:
3756 node_perm = RAWIP_SOCKET__NODE_BIND;
3757 break;
3758 }
3759
3760 err = sel_netnode_sid(addrp, family, &sid);
3761 if (err)
3762 goto out;
3763
3764 AVC_AUDIT_DATA_INIT(&ad, NET);
3765 ad.u.net.sport = htons(snum);
3766 ad.u.net.family = family;
3767
3768 if (family == PF_INET)
3769 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3770 else
3771 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3772
3773 err = avc_has_perm(isec->sid, sid,
3774 isec->sclass, node_perm, &ad);
3775 if (err)
3776 goto out;
3777 }
3778 out:
3779 return err;
3780 }
3781
3782 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3783 {
3784 struct inode_security_struct *isec;
3785 int err;
3786
3787 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3788 if (err)
3789 return err;
3790
3791 /*
3792 * If a TCP or DCCP socket, check name_connect permission for the port.
3793 */
3794 isec = SOCK_INODE(sock)->i_security;
3795 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3796 isec->sclass == SECCLASS_DCCP_SOCKET) {
3797 struct sock *sk = sock->sk;
3798 struct avc_audit_data ad;
3799 struct sockaddr_in *addr4 = NULL;
3800 struct sockaddr_in6 *addr6 = NULL;
3801 unsigned short snum;
3802 u32 sid, perm;
3803
3804 if (sk->sk_family == PF_INET) {
3805 addr4 = (struct sockaddr_in *)address;
3806 if (addrlen < sizeof(struct sockaddr_in))
3807 return -EINVAL;
3808 snum = ntohs(addr4->sin_port);
3809 } else {
3810 addr6 = (struct sockaddr_in6 *)address;
3811 if (addrlen < SIN6_LEN_RFC2133)
3812 return -EINVAL;
3813 snum = ntohs(addr6->sin6_port);
3814 }
3815
3816 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3817 if (err)
3818 goto out;
3819
3820 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3821 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3822
3823 AVC_AUDIT_DATA_INIT(&ad, NET);
3824 ad.u.net.dport = htons(snum);
3825 ad.u.net.family = sk->sk_family;
3826 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3827 if (err)
3828 goto out;
3829 }
3830
3831 out:
3832 return err;
3833 }
3834
3835 static int selinux_socket_listen(struct socket *sock, int backlog)
3836 {
3837 return socket_has_perm(current, sock, SOCKET__LISTEN);
3838 }
3839
3840 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3841 {
3842 int err;
3843 struct inode_security_struct *isec;
3844 struct inode_security_struct *newisec;
3845
3846 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3847 if (err)
3848 return err;
3849
3850 newisec = SOCK_INODE(newsock)->i_security;
3851
3852 isec = SOCK_INODE(sock)->i_security;
3853 newisec->sclass = isec->sclass;
3854 newisec->sid = isec->sid;
3855 newisec->initialized = 1;
3856
3857 return 0;
3858 }
3859
3860 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3861 int size)
3862 {
3863 int rc;
3864
3865 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3866 if (rc)
3867 return rc;
3868
3869 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3870 }
3871
3872 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3873 int size, int flags)
3874 {
3875 return socket_has_perm(current, sock, SOCKET__READ);
3876 }
3877
3878 static int selinux_socket_getsockname(struct socket *sock)
3879 {
3880 return socket_has_perm(current, sock, SOCKET__GETATTR);
3881 }
3882
3883 static int selinux_socket_getpeername(struct socket *sock)
3884 {
3885 return socket_has_perm(current, sock, SOCKET__GETATTR);
3886 }
3887
3888 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3889 {
3890 int err;
3891
3892 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3893 if (err)
3894 return err;
3895
3896 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3897 }
3898
3899 static int selinux_socket_getsockopt(struct socket *sock, int level,
3900 int optname)
3901 {
3902 return socket_has_perm(current, sock, SOCKET__GETOPT);
3903 }
3904
3905 static int selinux_socket_shutdown(struct socket *sock, int how)
3906 {
3907 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3908 }
3909
3910 static int selinux_socket_unix_stream_connect(struct socket *sock,
3911 struct socket *other,
3912 struct sock *newsk)
3913 {
3914 struct sk_security_struct *ssec;
3915 struct inode_security_struct *isec;
3916 struct inode_security_struct *other_isec;
3917 struct avc_audit_data ad;
3918 int err;
3919
3920 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3921 if (err)
3922 return err;
3923
3924 isec = SOCK_INODE(sock)->i_security;
3925 other_isec = SOCK_INODE(other)->i_security;
3926
3927 AVC_AUDIT_DATA_INIT(&ad, NET);
3928 ad.u.net.sk = other->sk;
3929
3930 err = avc_has_perm(isec->sid, other_isec->sid,
3931 isec->sclass,
3932 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3933 if (err)
3934 return err;
3935
3936 /* connecting socket */
3937 ssec = sock->sk->sk_security;
3938 ssec->peer_sid = other_isec->sid;
3939
3940 /* server child socket */
3941 ssec = newsk->sk_security;
3942 ssec->peer_sid = isec->sid;
3943 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3944
3945 return err;
3946 }
3947
3948 static int selinux_socket_unix_may_send(struct socket *sock,
3949 struct socket *other)
3950 {
3951 struct inode_security_struct *isec;
3952 struct inode_security_struct *other_isec;
3953 struct avc_audit_data ad;
3954 int err;
3955
3956 isec = SOCK_INODE(sock)->i_security;
3957 other_isec = SOCK_INODE(other)->i_security;
3958
3959 AVC_AUDIT_DATA_INIT(&ad, NET);
3960 ad.u.net.sk = other->sk;
3961
3962 err = avc_has_perm(isec->sid, other_isec->sid,
3963 isec->sclass, SOCKET__SENDTO, &ad);
3964 if (err)
3965 return err;
3966
3967 return 0;
3968 }
3969
3970 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3971 u32 peer_sid,
3972 struct avc_audit_data *ad)
3973 {
3974 int err;
3975 u32 if_sid;
3976 u32 node_sid;
3977
3978 err = sel_netif_sid(ifindex, &if_sid);
3979 if (err)
3980 return err;
3981 err = avc_has_perm(peer_sid, if_sid,
3982 SECCLASS_NETIF, NETIF__INGRESS, ad);
3983 if (err)
3984 return err;
3985
3986 err = sel_netnode_sid(addrp, family, &node_sid);
3987 if (err)
3988 return err;
3989 return avc_has_perm(peer_sid, node_sid,
3990 SECCLASS_NODE, NODE__RECVFROM, ad);
3991 }
3992
3993 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3994 struct sk_buff *skb,
3995 struct avc_audit_data *ad,
3996 u16 family,
3997 char *addrp)
3998 {
3999 int err;
4000 struct sk_security_struct *sksec = sk->sk_security;
4001 u16 sk_class;
4002 u32 netif_perm, node_perm, recv_perm;
4003 u32 port_sid, node_sid, if_sid, sk_sid;
4004
4005 sk_sid = sksec->sid;
4006 sk_class = sksec->sclass;
4007
4008 switch (sk_class) {
4009 case SECCLASS_UDP_SOCKET:
4010 netif_perm = NETIF__UDP_RECV;
4011 node_perm = NODE__UDP_RECV;
4012 recv_perm = UDP_SOCKET__RECV_MSG;
4013 break;
4014 case SECCLASS_TCP_SOCKET:
4015 netif_perm = NETIF__TCP_RECV;
4016 node_perm = NODE__TCP_RECV;
4017 recv_perm = TCP_SOCKET__RECV_MSG;
4018 break;
4019 case SECCLASS_DCCP_SOCKET:
4020 netif_perm = NETIF__DCCP_RECV;
4021 node_perm = NODE__DCCP_RECV;
4022 recv_perm = DCCP_SOCKET__RECV_MSG;
4023 break;
4024 default:
4025 netif_perm = NETIF__RAWIP_RECV;
4026 node_perm = NODE__RAWIP_RECV;
4027 recv_perm = 0;
4028 break;
4029 }
4030
4031 err = sel_netif_sid(skb->iif, &if_sid);
4032 if (err)
4033 return err;
4034 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4035 if (err)
4036 return err;
4037
4038 err = sel_netnode_sid(addrp, family, &node_sid);
4039 if (err)
4040 return err;
4041 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4042 if (err)
4043 return err;
4044
4045 if (!recv_perm)
4046 return 0;
4047 err = sel_netport_sid(sk->sk_protocol,
4048 ntohs(ad->u.net.sport), &port_sid);
4049 if (unlikely(err)) {
4050 printk(KERN_WARNING
4051 "SELinux: failure in"
4052 " selinux_sock_rcv_skb_iptables_compat(),"
4053 " network port label not found\n");
4054 return err;
4055 }
4056 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4057 }
4058
4059 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4060 struct avc_audit_data *ad,
4061 u16 family, char *addrp)
4062 {
4063 int err;
4064 struct sk_security_struct *sksec = sk->sk_security;
4065 u32 peer_sid;
4066 u32 sk_sid = sksec->sid;
4067
4068 if (selinux_compat_net)
4069 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4070 family, addrp);
4071 else
4072 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4073 PACKET__RECV, ad);
4074 if (err)
4075 return err;
4076
4077 if (selinux_policycap_netpeer) {
4078 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4079 if (err)
4080 return err;
4081 err = avc_has_perm(sk_sid, peer_sid,
4082 SECCLASS_PEER, PEER__RECV, ad);
4083 } else {
4084 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4085 if (err)
4086 return err;
4087 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4088 }
4089
4090 return err;
4091 }
4092
4093 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4094 {
4095 int err;
4096 struct sk_security_struct *sksec = sk->sk_security;
4097 u16 family = sk->sk_family;
4098 u32 sk_sid = sksec->sid;
4099 struct avc_audit_data ad;
4100 char *addrp;
4101
4102 if (family != PF_INET && family != PF_INET6)
4103 return 0;
4104
4105 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4106 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4107 family = PF_INET;
4108
4109 AVC_AUDIT_DATA_INIT(&ad, NET);
4110 ad.u.net.netif = skb->iif;
4111 ad.u.net.family = family;
4112 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4113 if (err)
4114 return err;
4115
4116 /* If any sort of compatibility mode is enabled then handoff processing
4117 * to the selinux_sock_rcv_skb_compat() function to deal with the
4118 * special handling. We do this in an attempt to keep this function
4119 * as fast and as clean as possible. */
4120 if (selinux_compat_net || !selinux_policycap_netpeer)
4121 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4122 family, addrp);
4123
4124 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4125 u32 peer_sid;
4126
4127 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4128 if (err)
4129 return err;
4130 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4131 peer_sid, &ad);
4132 if (err)
4133 return err;
4134 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4135 PEER__RECV, &ad);
4136 }
4137
4138 if (selinux_secmark_enabled()) {
4139 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4140 PACKET__RECV, &ad);
4141 if (err)
4142 return err;
4143 }
4144
4145 return err;
4146 }
4147
4148 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4149 int __user *optlen, unsigned len)
4150 {
4151 int err = 0;
4152 char *scontext;
4153 u32 scontext_len;
4154 struct sk_security_struct *ssec;
4155 struct inode_security_struct *isec;
4156 u32 peer_sid = SECSID_NULL;
4157
4158 isec = SOCK_INODE(sock)->i_security;
4159
4160 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4161 isec->sclass == SECCLASS_TCP_SOCKET) {
4162 ssec = sock->sk->sk_security;
4163 peer_sid = ssec->peer_sid;
4164 }
4165 if (peer_sid == SECSID_NULL) {
4166 err = -ENOPROTOOPT;
4167 goto out;
4168 }
4169
4170 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4171
4172 if (err)
4173 goto out;
4174
4175 if (scontext_len > len) {
4176 err = -ERANGE;
4177 goto out_len;
4178 }
4179
4180 if (copy_to_user(optval, scontext, scontext_len))
4181 err = -EFAULT;
4182
4183 out_len:
4184 if (put_user(scontext_len, optlen))
4185 err = -EFAULT;
4186
4187 kfree(scontext);
4188 out:
4189 return err;
4190 }
4191
4192 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4193 {
4194 u32 peer_secid = SECSID_NULL;
4195 u16 family;
4196
4197 if (sock)
4198 family = sock->sk->sk_family;
4199 else if (skb && skb->sk)
4200 family = skb->sk->sk_family;
4201 else
4202 goto out;
4203
4204 if (sock && family == PF_UNIX)
4205 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4206 else if (skb)
4207 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4208
4209 out:
4210 *secid = peer_secid;
4211 if (peer_secid == SECSID_NULL)
4212 return -EINVAL;
4213 return 0;
4214 }
4215
4216 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4217 {
4218 return sk_alloc_security(sk, family, priority);
4219 }
4220
4221 static void selinux_sk_free_security(struct sock *sk)
4222 {
4223 sk_free_security(sk);
4224 }
4225
4226 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4227 {
4228 struct sk_security_struct *ssec = sk->sk_security;
4229 struct sk_security_struct *newssec = newsk->sk_security;
4230
4231 newssec->sid = ssec->sid;
4232 newssec->peer_sid = ssec->peer_sid;
4233 newssec->sclass = ssec->sclass;
4234
4235 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4236 }
4237
4238 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4239 {
4240 if (!sk)
4241 *secid = SECINITSID_ANY_SOCKET;
4242 else {
4243 struct sk_security_struct *sksec = sk->sk_security;
4244
4245 *secid = sksec->sid;
4246 }
4247 }
4248
4249 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4250 {
4251 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4252 struct sk_security_struct *sksec = sk->sk_security;
4253
4254 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4255 sk->sk_family == PF_UNIX)
4256 isec->sid = sksec->sid;
4257 sksec->sclass = isec->sclass;
4258
4259 selinux_netlbl_sock_graft(sk, parent);
4260 }
4261
4262 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4263 struct request_sock *req)
4264 {
4265 struct sk_security_struct *sksec = sk->sk_security;
4266 int err;
4267 u32 newsid;
4268 u32 peersid;
4269
4270 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4271 if (err)
4272 return err;
4273 if (peersid == SECSID_NULL) {
4274 req->secid = sksec->sid;
4275 req->peer_secid = SECSID_NULL;
4276 return 0;
4277 }
4278
4279 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4280 if (err)
4281 return err;
4282
4283 req->secid = newsid;
4284 req->peer_secid = peersid;
4285 return 0;
4286 }
4287
4288 static void selinux_inet_csk_clone(struct sock *newsk,
4289 const struct request_sock *req)
4290 {
4291 struct sk_security_struct *newsksec = newsk->sk_security;
4292
4293 newsksec->sid = req->secid;
4294 newsksec->peer_sid = req->peer_secid;
4295 /* NOTE: Ideally, we should also get the isec->sid for the
4296 new socket in sync, but we don't have the isec available yet.
4297 So we will wait until sock_graft to do it, by which
4298 time it will have been created and available. */
4299
4300 /* We don't need to take any sort of lock here as we are the only
4301 * thread with access to newsksec */
4302 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4303 }
4304
4305 static void selinux_inet_conn_established(struct sock *sk,
4306 struct sk_buff *skb)
4307 {
4308 struct sk_security_struct *sksec = sk->sk_security;
4309
4310 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4311 }
4312
4313 static void selinux_req_classify_flow(const struct request_sock *req,
4314 struct flowi *fl)
4315 {
4316 fl->secid = req->secid;
4317 }
4318
4319 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4320 {
4321 int err = 0;
4322 u32 perm;
4323 struct nlmsghdr *nlh;
4324 struct socket *sock = sk->sk_socket;
4325 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4326
4327 if (skb->len < NLMSG_SPACE(0)) {
4328 err = -EINVAL;
4329 goto out;
4330 }
4331 nlh = nlmsg_hdr(skb);
4332
4333 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4334 if (err) {
4335 if (err == -EINVAL) {
4336 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4337 "SELinux: unrecognized netlink message"
4338 " type=%hu for sclass=%hu\n",
4339 nlh->nlmsg_type, isec->sclass);
4340 if (!selinux_enforcing)
4341 err = 0;
4342 }
4343
4344 /* Ignore */
4345 if (err == -ENOENT)
4346 err = 0;
4347 goto out;
4348 }
4349
4350 err = socket_has_perm(current, sock, perm);
4351 out:
4352 return err;
4353 }
4354
4355 #ifdef CONFIG_NETFILTER
4356
4357 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4358 u16 family)
4359 {
4360 char *addrp;
4361 u32 peer_sid;
4362 struct avc_audit_data ad;
4363 u8 secmark_active;
4364 u8 peerlbl_active;
4365
4366 if (!selinux_policycap_netpeer)
4367 return NF_ACCEPT;
4368
4369 secmark_active = selinux_secmark_enabled();
4370 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4371 if (!secmark_active && !peerlbl_active)
4372 return NF_ACCEPT;
4373
4374 AVC_AUDIT_DATA_INIT(&ad, NET);
4375 ad.u.net.netif = ifindex;
4376 ad.u.net.family = family;
4377 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4378 return NF_DROP;
4379
4380 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4381 return NF_DROP;
4382
4383 if (peerlbl_active)
4384 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4385 peer_sid, &ad) != 0)
4386 return NF_DROP;
4387
4388 if (secmark_active)
4389 if (avc_has_perm(peer_sid, skb->secmark,
4390 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4391 return NF_DROP;
4392
4393 return NF_ACCEPT;
4394 }
4395
4396 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4397 struct sk_buff *skb,
4398 const struct net_device *in,
4399 const struct net_device *out,
4400 int (*okfn)(struct sk_buff *))
4401 {
4402 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4403 }
4404
4405 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4406 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4407 struct sk_buff *skb,
4408 const struct net_device *in,
4409 const struct net_device *out,
4410 int (*okfn)(struct sk_buff *))
4411 {
4412 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4413 }
4414 #endif /* IPV6 */
4415
4416 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4417 int ifindex,
4418 struct avc_audit_data *ad,
4419 u16 family, char *addrp)
4420 {
4421 int err;
4422 struct sk_security_struct *sksec = sk->sk_security;
4423 u16 sk_class;
4424 u32 netif_perm, node_perm, send_perm;
4425 u32 port_sid, node_sid, if_sid, sk_sid;
4426
4427 sk_sid = sksec->sid;
4428 sk_class = sksec->sclass;
4429
4430 switch (sk_class) {
4431 case SECCLASS_UDP_SOCKET:
4432 netif_perm = NETIF__UDP_SEND;
4433 node_perm = NODE__UDP_SEND;
4434 send_perm = UDP_SOCKET__SEND_MSG;
4435 break;
4436 case SECCLASS_TCP_SOCKET:
4437 netif_perm = NETIF__TCP_SEND;
4438 node_perm = NODE__TCP_SEND;
4439 send_perm = TCP_SOCKET__SEND_MSG;
4440 break;
4441 case SECCLASS_DCCP_SOCKET:
4442 netif_perm = NETIF__DCCP_SEND;
4443 node_perm = NODE__DCCP_SEND;
4444 send_perm = DCCP_SOCKET__SEND_MSG;
4445 break;
4446 default:
4447 netif_perm = NETIF__RAWIP_SEND;
4448 node_perm = NODE__RAWIP_SEND;
4449 send_perm = 0;
4450 break;
4451 }
4452
4453 err = sel_netif_sid(ifindex, &if_sid);
4454 if (err)
4455 return err;
4456 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4457 return err;
4458
4459 err = sel_netnode_sid(addrp, family, &node_sid);
4460 if (err)
4461 return err;
4462 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4463 if (err)
4464 return err;
4465
4466 if (send_perm != 0)
4467 return 0;
4468
4469 err = sel_netport_sid(sk->sk_protocol,
4470 ntohs(ad->u.net.dport), &port_sid);
4471 if (unlikely(err)) {
4472 printk(KERN_WARNING
4473 "SELinux: failure in"
4474 " selinux_ip_postroute_iptables_compat(),"
4475 " network port label not found\n");
4476 return err;
4477 }
4478 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4479 }
4480
4481 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4482 int ifindex,
4483 struct avc_audit_data *ad,
4484 u16 family,
4485 char *addrp,
4486 u8 proto)
4487 {
4488 struct sock *sk = skb->sk;
4489 struct sk_security_struct *sksec;
4490
4491 if (sk == NULL)
4492 return NF_ACCEPT;
4493 sksec = sk->sk_security;
4494
4495 if (selinux_compat_net) {
4496 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4497 ad, family, addrp))
4498 return NF_DROP;
4499 } else {
4500 if (avc_has_perm(sksec->sid, skb->secmark,
4501 SECCLASS_PACKET, PACKET__SEND, ad))
4502 return NF_DROP;
4503 }
4504
4505 if (selinux_policycap_netpeer)
4506 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4507 return NF_DROP;
4508
4509 return NF_ACCEPT;
4510 }
4511
4512 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4513 u16 family)
4514 {
4515 u32 secmark_perm;
4516 u32 peer_sid;
4517 struct sock *sk;
4518 struct avc_audit_data ad;
4519 char *addrp;
4520 u8 proto;
4521 u8 secmark_active;
4522 u8 peerlbl_active;
4523
4524 AVC_AUDIT_DATA_INIT(&ad, NET);
4525 ad.u.net.netif = ifindex;
4526 ad.u.net.family = family;
4527 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4528 return NF_DROP;
4529
4530 /* If any sort of compatibility mode is enabled then handoff processing
4531 * to the selinux_ip_postroute_compat() function to deal with the
4532 * special handling. We do this in an attempt to keep this function
4533 * as fast and as clean as possible. */
4534 if (selinux_compat_net || !selinux_policycap_netpeer)
4535 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4536 family, addrp, proto);
4537
4538 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4539 * packet transformation so allow the packet to pass without any checks
4540 * since we'll have another chance to perform access control checks
4541 * when the packet is on it's final way out.
4542 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4543 * is NULL, in this case go ahead and apply access control. */
4544 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4545 return NF_ACCEPT;
4546
4547 secmark_active = selinux_secmark_enabled();
4548 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4549 if (!secmark_active && !peerlbl_active)
4550 return NF_ACCEPT;
4551
4552 /* if the packet is locally generated (skb->sk != NULL) then use the
4553 * socket's label as the peer label, otherwise the packet is being
4554 * forwarded through this system and we need to fetch the peer label
4555 * directly from the packet */
4556 sk = skb->sk;
4557 if (sk) {
4558 struct sk_security_struct *sksec = sk->sk_security;
4559 peer_sid = sksec->sid;
4560 secmark_perm = PACKET__SEND;
4561 } else {
4562 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4563 return NF_DROP;
4564 secmark_perm = PACKET__FORWARD_OUT;
4565 }
4566
4567 if (secmark_active)
4568 if (avc_has_perm(peer_sid, skb->secmark,
4569 SECCLASS_PACKET, secmark_perm, &ad))
4570 return NF_DROP;
4571
4572 if (peerlbl_active) {
4573 u32 if_sid;
4574 u32 node_sid;
4575
4576 if (sel_netif_sid(ifindex, &if_sid))
4577 return NF_DROP;
4578 if (avc_has_perm(peer_sid, if_sid,
4579 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4580 return NF_DROP;
4581
4582 if (sel_netnode_sid(addrp, family, &node_sid))
4583 return NF_DROP;
4584 if (avc_has_perm(peer_sid, node_sid,
4585 SECCLASS_NODE, NODE__SENDTO, &ad))
4586 return NF_DROP;
4587 }
4588
4589 return NF_ACCEPT;
4590 }
4591
4592 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4593 struct sk_buff *skb,
4594 const struct net_device *in,
4595 const struct net_device *out,
4596 int (*okfn)(struct sk_buff *))
4597 {
4598 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4599 }
4600
4601 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4602 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4603 struct sk_buff *skb,
4604 const struct net_device *in,
4605 const struct net_device *out,
4606 int (*okfn)(struct sk_buff *))
4607 {
4608 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4609 }
4610 #endif /* IPV6 */
4611
4612 #endif /* CONFIG_NETFILTER */
4613
4614 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4615 {
4616 int err;
4617
4618 err = secondary_ops->netlink_send(sk, skb);
4619 if (err)
4620 return err;
4621
4622 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4623 err = selinux_nlmsg_perm(sk, skb);
4624
4625 return err;
4626 }
4627
4628 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4629 {
4630 int err;
4631 struct avc_audit_data ad;
4632
4633 err = secondary_ops->netlink_recv(skb, capability);
4634 if (err)
4635 return err;
4636
4637 AVC_AUDIT_DATA_INIT(&ad, CAP);
4638 ad.u.cap = capability;
4639
4640 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4641 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4642 }
4643
4644 static int ipc_alloc_security(struct task_struct *task,
4645 struct kern_ipc_perm *perm,
4646 u16 sclass)
4647 {
4648 struct task_security_struct *tsec = task->security;
4649 struct ipc_security_struct *isec;
4650
4651 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4652 if (!isec)
4653 return -ENOMEM;
4654
4655 isec->sclass = sclass;
4656 isec->sid = tsec->sid;
4657 perm->security = isec;
4658
4659 return 0;
4660 }
4661
4662 static void ipc_free_security(struct kern_ipc_perm *perm)
4663 {
4664 struct ipc_security_struct *isec = perm->security;
4665 perm->security = NULL;
4666 kfree(isec);
4667 }
4668
4669 static int msg_msg_alloc_security(struct msg_msg *msg)
4670 {
4671 struct msg_security_struct *msec;
4672
4673 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4674 if (!msec)
4675 return -ENOMEM;
4676
4677 msec->sid = SECINITSID_UNLABELED;
4678 msg->security = msec;
4679
4680 return 0;
4681 }
4682
4683 static void msg_msg_free_security(struct msg_msg *msg)
4684 {
4685 struct msg_security_struct *msec = msg->security;
4686
4687 msg->security = NULL;
4688 kfree(msec);
4689 }
4690
4691 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4692 u32 perms)
4693 {
4694 struct task_security_struct *tsec;
4695 struct ipc_security_struct *isec;
4696 struct avc_audit_data ad;
4697
4698 tsec = current->security;
4699 isec = ipc_perms->security;
4700
4701 AVC_AUDIT_DATA_INIT(&ad, IPC);
4702 ad.u.ipc_id = ipc_perms->key;
4703
4704 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4705 }
4706
4707 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4708 {
4709 return msg_msg_alloc_security(msg);
4710 }
4711
4712 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4713 {
4714 msg_msg_free_security(msg);
4715 }
4716
4717 /* message queue security operations */
4718 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4719 {
4720 struct task_security_struct *tsec;
4721 struct ipc_security_struct *isec;
4722 struct avc_audit_data ad;
4723 int rc;
4724
4725 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4726 if (rc)
4727 return rc;
4728
4729 tsec = current->security;
4730 isec = msq->q_perm.security;
4731
4732 AVC_AUDIT_DATA_INIT(&ad, IPC);
4733 ad.u.ipc_id = msq->q_perm.key;
4734
4735 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4736 MSGQ__CREATE, &ad);
4737 if (rc) {
4738 ipc_free_security(&msq->q_perm);
4739 return rc;
4740 }
4741 return 0;
4742 }
4743
4744 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4745 {
4746 ipc_free_security(&msq->q_perm);
4747 }
4748
4749 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4750 {
4751 struct task_security_struct *tsec;
4752 struct ipc_security_struct *isec;
4753 struct avc_audit_data ad;
4754
4755 tsec = current->security;
4756 isec = msq->q_perm.security;
4757
4758 AVC_AUDIT_DATA_INIT(&ad, IPC);
4759 ad.u.ipc_id = msq->q_perm.key;
4760
4761 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4762 MSGQ__ASSOCIATE, &ad);
4763 }
4764
4765 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4766 {
4767 int err;
4768 int perms;
4769
4770 switch (cmd) {
4771 case IPC_INFO:
4772 case MSG_INFO:
4773 /* No specific object, just general system-wide information. */
4774 return task_has_system(current, SYSTEM__IPC_INFO);
4775 case IPC_STAT:
4776 case MSG_STAT:
4777 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4778 break;
4779 case IPC_SET:
4780 perms = MSGQ__SETATTR;
4781 break;
4782 case IPC_RMID:
4783 perms = MSGQ__DESTROY;
4784 break;
4785 default:
4786 return 0;
4787 }
4788
4789 err = ipc_has_perm(&msq->q_perm, perms);
4790 return err;
4791 }
4792
4793 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4794 {
4795 struct task_security_struct *tsec;
4796 struct ipc_security_struct *isec;
4797 struct msg_security_struct *msec;
4798 struct avc_audit_data ad;
4799 int rc;
4800
4801 tsec = current->security;
4802 isec = msq->q_perm.security;
4803 msec = msg->security;
4804
4805 /*
4806 * First time through, need to assign label to the message
4807 */
4808 if (msec->sid == SECINITSID_UNLABELED) {
4809 /*
4810 * Compute new sid based on current process and
4811 * message queue this message will be stored in
4812 */
4813 rc = security_transition_sid(tsec->sid,
4814 isec->sid,
4815 SECCLASS_MSG,
4816 &msec->sid);
4817 if (rc)
4818 return rc;
4819 }
4820
4821 AVC_AUDIT_DATA_INIT(&ad, IPC);
4822 ad.u.ipc_id = msq->q_perm.key;
4823
4824 /* Can this process write to the queue? */
4825 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4826 MSGQ__WRITE, &ad);
4827 if (!rc)
4828 /* Can this process send the message */
4829 rc = avc_has_perm(tsec->sid, msec->sid,
4830 SECCLASS_MSG, MSG__SEND, &ad);
4831 if (!rc)
4832 /* Can the message be put in the queue? */
4833 rc = avc_has_perm(msec->sid, isec->sid,
4834 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4835
4836 return rc;
4837 }
4838
4839 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4840 struct task_struct *target,
4841 long type, int mode)
4842 {
4843 struct task_security_struct *tsec;
4844 struct ipc_security_struct *isec;
4845 struct msg_security_struct *msec;
4846 struct avc_audit_data ad;
4847 int rc;
4848
4849 tsec = target->security;
4850 isec = msq->q_perm.security;
4851 msec = msg->security;
4852
4853 AVC_AUDIT_DATA_INIT(&ad, IPC);
4854 ad.u.ipc_id = msq->q_perm.key;
4855
4856 rc = avc_has_perm(tsec->sid, isec->sid,
4857 SECCLASS_MSGQ, MSGQ__READ, &ad);
4858 if (!rc)
4859 rc = avc_has_perm(tsec->sid, msec->sid,
4860 SECCLASS_MSG, MSG__RECEIVE, &ad);
4861 return rc;
4862 }
4863
4864 /* Shared Memory security operations */
4865 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4866 {
4867 struct task_security_struct *tsec;
4868 struct ipc_security_struct *isec;
4869 struct avc_audit_data ad;
4870 int rc;
4871
4872 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4873 if (rc)
4874 return rc;
4875
4876 tsec = current->security;
4877 isec = shp->shm_perm.security;
4878
4879 AVC_AUDIT_DATA_INIT(&ad, IPC);
4880 ad.u.ipc_id = shp->shm_perm.key;
4881
4882 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4883 SHM__CREATE, &ad);
4884 if (rc) {
4885 ipc_free_security(&shp->shm_perm);
4886 return rc;
4887 }
4888 return 0;
4889 }
4890
4891 static void selinux_shm_free_security(struct shmid_kernel *shp)
4892 {
4893 ipc_free_security(&shp->shm_perm);
4894 }
4895
4896 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4897 {
4898 struct task_security_struct *tsec;
4899 struct ipc_security_struct *isec;
4900 struct avc_audit_data ad;
4901
4902 tsec = current->security;
4903 isec = shp->shm_perm.security;
4904
4905 AVC_AUDIT_DATA_INIT(&ad, IPC);
4906 ad.u.ipc_id = shp->shm_perm.key;
4907
4908 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4909 SHM__ASSOCIATE, &ad);
4910 }
4911
4912 /* Note, at this point, shp is locked down */
4913 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4914 {
4915 int perms;
4916 int err;
4917
4918 switch (cmd) {
4919 case IPC_INFO:
4920 case SHM_INFO:
4921 /* No specific object, just general system-wide information. */
4922 return task_has_system(current, SYSTEM__IPC_INFO);
4923 case IPC_STAT:
4924 case SHM_STAT:
4925 perms = SHM__GETATTR | SHM__ASSOCIATE;
4926 break;
4927 case IPC_SET:
4928 perms = SHM__SETATTR;
4929 break;
4930 case SHM_LOCK:
4931 case SHM_UNLOCK:
4932 perms = SHM__LOCK;
4933 break;
4934 case IPC_RMID:
4935 perms = SHM__DESTROY;
4936 break;
4937 default:
4938 return 0;
4939 }
4940
4941 err = ipc_has_perm(&shp->shm_perm, perms);
4942 return err;
4943 }
4944
4945 static int selinux_shm_shmat(struct shmid_kernel *shp,
4946 char __user *shmaddr, int shmflg)
4947 {
4948 u32 perms;
4949 int rc;
4950
4951 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4952 if (rc)
4953 return rc;
4954
4955 if (shmflg & SHM_RDONLY)
4956 perms = SHM__READ;
4957 else
4958 perms = SHM__READ | SHM__WRITE;
4959
4960 return ipc_has_perm(&shp->shm_perm, perms);
4961 }
4962
4963 /* Semaphore security operations */
4964 static int selinux_sem_alloc_security(struct sem_array *sma)
4965 {
4966 struct task_security_struct *tsec;
4967 struct ipc_security_struct *isec;
4968 struct avc_audit_data ad;
4969 int rc;
4970
4971 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4972 if (rc)
4973 return rc;
4974
4975 tsec = current->security;
4976 isec = sma->sem_perm.security;
4977
4978 AVC_AUDIT_DATA_INIT(&ad, IPC);
4979 ad.u.ipc_id = sma->sem_perm.key;
4980
4981 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4982 SEM__CREATE, &ad);
4983 if (rc) {
4984 ipc_free_security(&sma->sem_perm);
4985 return rc;
4986 }
4987 return 0;
4988 }
4989
4990 static void selinux_sem_free_security(struct sem_array *sma)
4991 {
4992 ipc_free_security(&sma->sem_perm);
4993 }
4994
4995 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4996 {
4997 struct task_security_struct *tsec;
4998 struct ipc_security_struct *isec;
4999 struct avc_audit_data ad;
5000
5001 tsec = current->security;
5002 isec = sma->sem_perm.security;
5003
5004 AVC_AUDIT_DATA_INIT(&ad, IPC);
5005 ad.u.ipc_id = sma->sem_perm.key;
5006
5007 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
5008 SEM__ASSOCIATE, &ad);
5009 }
5010
5011 /* Note, at this point, sma is locked down */
5012 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5013 {
5014 int err;
5015 u32 perms;
5016
5017 switch (cmd) {
5018 case IPC_INFO:
5019 case SEM_INFO:
5020 /* No specific object, just general system-wide information. */
5021 return task_has_system(current, SYSTEM__IPC_INFO);
5022 case GETPID:
5023 case GETNCNT:
5024 case GETZCNT:
5025 perms = SEM__GETATTR;
5026 break;
5027 case GETVAL:
5028 case GETALL:
5029 perms = SEM__READ;
5030 break;
5031 case SETVAL:
5032 case SETALL:
5033 perms = SEM__WRITE;
5034 break;
5035 case IPC_RMID:
5036 perms = SEM__DESTROY;
5037 break;
5038 case IPC_SET:
5039 perms = SEM__SETATTR;
5040 break;
5041 case IPC_STAT:
5042 case SEM_STAT:
5043 perms = SEM__GETATTR | SEM__ASSOCIATE;
5044 break;
5045 default:
5046 return 0;
5047 }
5048
5049 err = ipc_has_perm(&sma->sem_perm, perms);
5050 return err;
5051 }
5052
5053 static int selinux_sem_semop(struct sem_array *sma,
5054 struct sembuf *sops, unsigned nsops, int alter)
5055 {
5056 u32 perms;
5057
5058 if (alter)
5059 perms = SEM__READ | SEM__WRITE;
5060 else
5061 perms = SEM__READ;
5062
5063 return ipc_has_perm(&sma->sem_perm, perms);
5064 }
5065
5066 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5067 {
5068 u32 av = 0;
5069
5070 av = 0;
5071 if (flag & S_IRUGO)
5072 av |= IPC__UNIX_READ;
5073 if (flag & S_IWUGO)
5074 av |= IPC__UNIX_WRITE;
5075
5076 if (av == 0)
5077 return 0;
5078
5079 return ipc_has_perm(ipcp, av);
5080 }
5081
5082 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5083 {
5084 struct ipc_security_struct *isec = ipcp->security;
5085 *secid = isec->sid;
5086 }
5087
5088 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5089 {
5090 if (inode)
5091 inode_doinit_with_dentry(inode, dentry);
5092 }
5093
5094 static int selinux_getprocattr(struct task_struct *p,
5095 char *name, char **value)
5096 {
5097 struct task_security_struct *tsec;
5098 u32 sid;
5099 int error;
5100 unsigned len;
5101
5102 if (current != p) {
5103 error = task_has_perm(current, p, PROCESS__GETATTR);
5104 if (error)
5105 return error;
5106 }
5107
5108 tsec = p->security;
5109
5110 if (!strcmp(name, "current"))
5111 sid = tsec->sid;
5112 else if (!strcmp(name, "prev"))
5113 sid = tsec->osid;
5114 else if (!strcmp(name, "exec"))
5115 sid = tsec->exec_sid;
5116 else if (!strcmp(name, "fscreate"))
5117 sid = tsec->create_sid;
5118 else if (!strcmp(name, "keycreate"))
5119 sid = tsec->keycreate_sid;
5120 else if (!strcmp(name, "sockcreate"))
5121 sid = tsec->sockcreate_sid;
5122 else
5123 return -EINVAL;
5124
5125 if (!sid)
5126 return 0;
5127
5128 error = security_sid_to_context(sid, value, &len);
5129 if (error)
5130 return error;
5131 return len;
5132 }
5133
5134 static int selinux_setprocattr(struct task_struct *p,
5135 char *name, void *value, size_t size)
5136 {
5137 struct task_security_struct *tsec;
5138 struct task_struct *tracer;
5139 u32 sid = 0;
5140 int error;
5141 char *str = value;
5142
5143 if (current != p) {
5144 /* SELinux only allows a process to change its own
5145 security attributes. */
5146 return -EACCES;
5147 }
5148
5149 /*
5150 * Basic control over ability to set these attributes at all.
5151 * current == p, but we'll pass them separately in case the
5152 * above restriction is ever removed.
5153 */
5154 if (!strcmp(name, "exec"))
5155 error = task_has_perm(current, p, PROCESS__SETEXEC);
5156 else if (!strcmp(name, "fscreate"))
5157 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5158 else if (!strcmp(name, "keycreate"))
5159 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5160 else if (!strcmp(name, "sockcreate"))
5161 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5162 else if (!strcmp(name, "current"))
5163 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5164 else
5165 error = -EINVAL;
5166 if (error)
5167 return error;
5168
5169 /* Obtain a SID for the context, if one was specified. */
5170 if (size && str[1] && str[1] != '\n') {
5171 if (str[size-1] == '\n') {
5172 str[size-1] = 0;
5173 size--;
5174 }
5175 error = security_context_to_sid(value, size, &sid);
5176 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5177 if (!capable(CAP_MAC_ADMIN))
5178 return error;
5179 error = security_context_to_sid_force(value, size,
5180 &sid);
5181 }
5182 if (error)
5183 return error;
5184 }
5185
5186 /* Permission checking based on the specified context is
5187 performed during the actual operation (execve,
5188 open/mkdir/...), when we know the full context of the
5189 operation. See selinux_bprm_set_security for the execve
5190 checks and may_create for the file creation checks. The
5191 operation will then fail if the context is not permitted. */
5192 tsec = p->security;
5193 if (!strcmp(name, "exec"))
5194 tsec->exec_sid = sid;
5195 else if (!strcmp(name, "fscreate"))
5196 tsec->create_sid = sid;
5197 else if (!strcmp(name, "keycreate")) {
5198 error = may_create_key(sid, p);
5199 if (error)
5200 return error;
5201 tsec->keycreate_sid = sid;
5202 } else if (!strcmp(name, "sockcreate"))
5203 tsec->sockcreate_sid = sid;
5204 else if (!strcmp(name, "current")) {
5205 struct av_decision avd;
5206
5207 if (sid == 0)
5208 return -EINVAL;
5209
5210 /* Only allow single threaded processes to change context */
5211 if (atomic_read(&p->mm->mm_users) != 1) {
5212 struct task_struct *g, *t;
5213 struct mm_struct *mm = p->mm;
5214 read_lock(&tasklist_lock);
5215 do_each_thread(g, t) {
5216 if (t->mm == mm && t != p) {
5217 read_unlock(&tasklist_lock);
5218 return -EPERM;
5219 }
5220 } while_each_thread(g, t);
5221 read_unlock(&tasklist_lock);
5222 }
5223
5224 /* Check permissions for the transition. */
5225 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5226 PROCESS__DYNTRANSITION, NULL);
5227 if (error)
5228 return error;
5229
5230 /* Check for ptracing, and update the task SID if ok.
5231 Otherwise, leave SID unchanged and fail. */
5232 task_lock(p);
5233 rcu_read_lock();
5234 tracer = tracehook_tracer_task(p);
5235 if (tracer != NULL) {
5236 struct task_security_struct *ptsec = tracer->security;
5237 u32 ptsid = ptsec->sid;
5238 rcu_read_unlock();
5239 error = avc_has_perm_noaudit(ptsid, sid,
5240 SECCLASS_PROCESS,
5241 PROCESS__PTRACE, 0, &avd);
5242 if (!error)
5243 tsec->sid = sid;
5244 task_unlock(p);
5245 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5246 PROCESS__PTRACE, &avd, error, NULL);
5247 if (error)
5248 return error;
5249 } else {
5250 rcu_read_unlock();
5251 tsec->sid = sid;
5252 task_unlock(p);
5253 }
5254 } else
5255 return -EINVAL;
5256
5257 return size;
5258 }
5259
5260 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5261 {
5262 return security_sid_to_context(secid, secdata, seclen);
5263 }
5264
5265 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5266 {
5267 return security_context_to_sid(secdata, seclen, secid);
5268 }
5269
5270 static void selinux_release_secctx(char *secdata, u32 seclen)
5271 {
5272 kfree(secdata);
5273 }
5274
5275 #ifdef CONFIG_KEYS
5276
5277 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5278 unsigned long flags)
5279 {
5280 struct task_security_struct *tsec = tsk->security;
5281 struct key_security_struct *ksec;
5282
5283 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5284 if (!ksec)
5285 return -ENOMEM;
5286
5287 if (tsec->keycreate_sid)
5288 ksec->sid = tsec->keycreate_sid;
5289 else
5290 ksec->sid = tsec->sid;
5291 k->security = ksec;
5292
5293 return 0;
5294 }
5295
5296 static void selinux_key_free(struct key *k)
5297 {
5298 struct key_security_struct *ksec = k->security;
5299
5300 k->security = NULL;
5301 kfree(ksec);
5302 }
5303
5304 static int selinux_key_permission(key_ref_t key_ref,
5305 struct task_struct *ctx,
5306 key_perm_t perm)
5307 {
5308 struct key *key;
5309 struct task_security_struct *tsec;
5310 struct key_security_struct *ksec;
5311
5312 key = key_ref_to_ptr(key_ref);
5313
5314 tsec = ctx->security;
5315 ksec = key->security;
5316
5317 /* if no specific permissions are requested, we skip the
5318 permission check. No serious, additional covert channels
5319 appear to be created. */
5320 if (perm == 0)
5321 return 0;
5322
5323 return avc_has_perm(tsec->sid, ksec->sid,
5324 SECCLASS_KEY, perm, NULL);
5325 }
5326
5327 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5328 {
5329 struct key_security_struct *ksec = key->security;
5330 char *context = NULL;
5331 unsigned len;
5332 int rc;
5333
5334 rc = security_sid_to_context(ksec->sid, &context, &len);
5335 if (!rc)
5336 rc = len;
5337 *_buffer = context;
5338 return rc;
5339 }
5340
5341 #endif
5342
5343 static struct security_operations selinux_ops = {
5344 .name = "selinux",
5345
5346 .ptrace = selinux_ptrace,
5347 .capget = selinux_capget,
5348 .capset_check = selinux_capset_check,
5349 .capset_set = selinux_capset_set,
5350 .sysctl = selinux_sysctl,
5351 .capable = selinux_capable,
5352 .quotactl = selinux_quotactl,
5353 .quota_on = selinux_quota_on,
5354 .syslog = selinux_syslog,
5355 .vm_enough_memory = selinux_vm_enough_memory,
5356
5357 .netlink_send = selinux_netlink_send,
5358 .netlink_recv = selinux_netlink_recv,
5359
5360 .bprm_alloc_security = selinux_bprm_alloc_security,
5361 .bprm_free_security = selinux_bprm_free_security,
5362 .bprm_apply_creds = selinux_bprm_apply_creds,
5363 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5364 .bprm_set_security = selinux_bprm_set_security,
5365 .bprm_check_security = selinux_bprm_check_security,
5366 .bprm_secureexec = selinux_bprm_secureexec,
5367
5368 .sb_alloc_security = selinux_sb_alloc_security,
5369 .sb_free_security = selinux_sb_free_security,
5370 .sb_copy_data = selinux_sb_copy_data,
5371 .sb_kern_mount = selinux_sb_kern_mount,
5372 .sb_show_options = selinux_sb_show_options,
5373 .sb_statfs = selinux_sb_statfs,
5374 .sb_mount = selinux_mount,
5375 .sb_umount = selinux_umount,
5376 .sb_set_mnt_opts = selinux_set_mnt_opts,
5377 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5378 .sb_parse_opts_str = selinux_parse_opts_str,
5379
5380
5381 .inode_alloc_security = selinux_inode_alloc_security,
5382 .inode_free_security = selinux_inode_free_security,
5383 .inode_init_security = selinux_inode_init_security,
5384 .inode_create = selinux_inode_create,
5385 .inode_link = selinux_inode_link,
5386 .inode_unlink = selinux_inode_unlink,
5387 .inode_symlink = selinux_inode_symlink,
5388 .inode_mkdir = selinux_inode_mkdir,
5389 .inode_rmdir = selinux_inode_rmdir,
5390 .inode_mknod = selinux_inode_mknod,
5391 .inode_rename = selinux_inode_rename,
5392 .inode_readlink = selinux_inode_readlink,
5393 .inode_follow_link = selinux_inode_follow_link,
5394 .inode_permission = selinux_inode_permission,
5395 .inode_setattr = selinux_inode_setattr,
5396 .inode_getattr = selinux_inode_getattr,
5397 .inode_setxattr = selinux_inode_setxattr,
5398 .inode_post_setxattr = selinux_inode_post_setxattr,
5399 .inode_getxattr = selinux_inode_getxattr,
5400 .inode_listxattr = selinux_inode_listxattr,
5401 .inode_removexattr = selinux_inode_removexattr,
5402 .inode_getsecurity = selinux_inode_getsecurity,
5403 .inode_setsecurity = selinux_inode_setsecurity,
5404 .inode_listsecurity = selinux_inode_listsecurity,
5405 .inode_need_killpriv = selinux_inode_need_killpriv,
5406 .inode_killpriv = selinux_inode_killpriv,
5407 .inode_getsecid = selinux_inode_getsecid,
5408
5409 .file_permission = selinux_file_permission,
5410 .file_alloc_security = selinux_file_alloc_security,
5411 .file_free_security = selinux_file_free_security,
5412 .file_ioctl = selinux_file_ioctl,
5413 .file_mmap = selinux_file_mmap,
5414 .file_mprotect = selinux_file_mprotect,
5415 .file_lock = selinux_file_lock,
5416 .file_fcntl = selinux_file_fcntl,
5417 .file_set_fowner = selinux_file_set_fowner,
5418 .file_send_sigiotask = selinux_file_send_sigiotask,
5419 .file_receive = selinux_file_receive,
5420
5421 .dentry_open = selinux_dentry_open,
5422
5423 .task_create = selinux_task_create,
5424 .task_alloc_security = selinux_task_alloc_security,
5425 .task_free_security = selinux_task_free_security,
5426 .task_setuid = selinux_task_setuid,
5427 .task_post_setuid = selinux_task_post_setuid,
5428 .task_setgid = selinux_task_setgid,
5429 .task_setpgid = selinux_task_setpgid,
5430 .task_getpgid = selinux_task_getpgid,
5431 .task_getsid = selinux_task_getsid,
5432 .task_getsecid = selinux_task_getsecid,
5433 .task_setgroups = selinux_task_setgroups,
5434 .task_setnice = selinux_task_setnice,
5435 .task_setioprio = selinux_task_setioprio,
5436 .task_getioprio = selinux_task_getioprio,
5437 .task_setrlimit = selinux_task_setrlimit,
5438 .task_setscheduler = selinux_task_setscheduler,
5439 .task_getscheduler = selinux_task_getscheduler,
5440 .task_movememory = selinux_task_movememory,
5441 .task_kill = selinux_task_kill,
5442 .task_wait = selinux_task_wait,
5443 .task_prctl = selinux_task_prctl,
5444 .task_reparent_to_init = selinux_task_reparent_to_init,
5445 .task_to_inode = selinux_task_to_inode,
5446
5447 .ipc_permission = selinux_ipc_permission,
5448 .ipc_getsecid = selinux_ipc_getsecid,
5449
5450 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5451 .msg_msg_free_security = selinux_msg_msg_free_security,
5452
5453 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5454 .msg_queue_free_security = selinux_msg_queue_free_security,
5455 .msg_queue_associate = selinux_msg_queue_associate,
5456 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5457 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5458 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5459
5460 .shm_alloc_security = selinux_shm_alloc_security,
5461 .shm_free_security = selinux_shm_free_security,
5462 .shm_associate = selinux_shm_associate,
5463 .shm_shmctl = selinux_shm_shmctl,
5464 .shm_shmat = selinux_shm_shmat,
5465
5466 .sem_alloc_security = selinux_sem_alloc_security,
5467 .sem_free_security = selinux_sem_free_security,
5468 .sem_associate = selinux_sem_associate,
5469 .sem_semctl = selinux_sem_semctl,
5470 .sem_semop = selinux_sem_semop,
5471
5472 .d_instantiate = selinux_d_instantiate,
5473
5474 .getprocattr = selinux_getprocattr,
5475 .setprocattr = selinux_setprocattr,
5476
5477 .secid_to_secctx = selinux_secid_to_secctx,
5478 .secctx_to_secid = selinux_secctx_to_secid,
5479 .release_secctx = selinux_release_secctx,
5480
5481 .unix_stream_connect = selinux_socket_unix_stream_connect,
5482 .unix_may_send = selinux_socket_unix_may_send,
5483
5484 .socket_create = selinux_socket_create,
5485 .socket_post_create = selinux_socket_post_create,
5486 .socket_bind = selinux_socket_bind,
5487 .socket_connect = selinux_socket_connect,
5488 .socket_listen = selinux_socket_listen,
5489 .socket_accept = selinux_socket_accept,
5490 .socket_sendmsg = selinux_socket_sendmsg,
5491 .socket_recvmsg = selinux_socket_recvmsg,
5492 .socket_getsockname = selinux_socket_getsockname,
5493 .socket_getpeername = selinux_socket_getpeername,
5494 .socket_getsockopt = selinux_socket_getsockopt,
5495 .socket_setsockopt = selinux_socket_setsockopt,
5496 .socket_shutdown = selinux_socket_shutdown,
5497 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5498 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5499 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5500 .sk_alloc_security = selinux_sk_alloc_security,
5501 .sk_free_security = selinux_sk_free_security,
5502 .sk_clone_security = selinux_sk_clone_security,
5503 .sk_getsecid = selinux_sk_getsecid,
5504 .sock_graft = selinux_sock_graft,
5505 .inet_conn_request = selinux_inet_conn_request,
5506 .inet_csk_clone = selinux_inet_csk_clone,
5507 .inet_conn_established = selinux_inet_conn_established,
5508 .req_classify_flow = selinux_req_classify_flow,
5509
5510 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5511 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5512 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5513 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5514 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5515 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5516 .xfrm_state_free_security = selinux_xfrm_state_free,
5517 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5518 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5519 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5520 .xfrm_decode_session = selinux_xfrm_decode_session,
5521 #endif
5522
5523 #ifdef CONFIG_KEYS
5524 .key_alloc = selinux_key_alloc,
5525 .key_free = selinux_key_free,
5526 .key_permission = selinux_key_permission,
5527 .key_getsecurity = selinux_key_getsecurity,
5528 #endif
5529
5530 #ifdef CONFIG_AUDIT
5531 .audit_rule_init = selinux_audit_rule_init,
5532 .audit_rule_known = selinux_audit_rule_known,
5533 .audit_rule_match = selinux_audit_rule_match,
5534 .audit_rule_free = selinux_audit_rule_free,
5535 #endif
5536 };
5537
5538 static __init int selinux_init(void)
5539 {
5540 struct task_security_struct *tsec;
5541
5542 if (!security_module_enable(&selinux_ops)) {
5543 selinux_enabled = 0;
5544 return 0;
5545 }
5546
5547 if (!selinux_enabled) {
5548 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5549 return 0;
5550 }
5551
5552 printk(KERN_INFO "SELinux: Initializing.\n");
5553
5554 /* Set the security state for the initial task. */
5555 if (task_alloc_security(current))
5556 panic("SELinux: Failed to initialize initial task.\n");
5557 tsec = current->security;
5558 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5559
5560 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5561 sizeof(struct inode_security_struct),
5562 0, SLAB_PANIC, NULL);
5563 avc_init();
5564
5565 secondary_ops = security_ops;
5566 if (!secondary_ops)
5567 panic("SELinux: No initial security operations\n");
5568 if (register_security(&selinux_ops))
5569 panic("SELinux: Unable to register with kernel.\n");
5570
5571 if (selinux_enforcing)
5572 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5573 else
5574 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5575
5576 return 0;
5577 }
5578
5579 void selinux_complete_init(void)
5580 {
5581 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5582
5583 /* Set up any superblocks initialized prior to the policy load. */
5584 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5585 spin_lock(&sb_lock);
5586 spin_lock(&sb_security_lock);
5587 next_sb:
5588 if (!list_empty(&superblock_security_head)) {
5589 struct superblock_security_struct *sbsec =
5590 list_entry(superblock_security_head.next,
5591 struct superblock_security_struct,
5592 list);
5593 struct super_block *sb = sbsec->sb;
5594 sb->s_count++;
5595 spin_unlock(&sb_security_lock);
5596 spin_unlock(&sb_lock);
5597 down_read(&sb->s_umount);
5598 if (sb->s_root)
5599 superblock_doinit(sb, NULL);
5600 drop_super(sb);
5601 spin_lock(&sb_lock);
5602 spin_lock(&sb_security_lock);
5603 list_del_init(&sbsec->list);
5604 goto next_sb;
5605 }
5606 spin_unlock(&sb_security_lock);
5607 spin_unlock(&sb_lock);
5608 }
5609
5610 /* SELinux requires early initialization in order to label
5611 all processes and objects when they are created. */
5612 security_initcall(selinux_init);
5613
5614 #if defined(CONFIG_NETFILTER)
5615
5616 static struct nf_hook_ops selinux_ipv4_ops[] = {
5617 {
5618 .hook = selinux_ipv4_postroute,
5619 .owner = THIS_MODULE,
5620 .pf = PF_INET,
5621 .hooknum = NF_INET_POST_ROUTING,
5622 .priority = NF_IP_PRI_SELINUX_LAST,
5623 },
5624 {
5625 .hook = selinux_ipv4_forward,
5626 .owner = THIS_MODULE,
5627 .pf = PF_INET,
5628 .hooknum = NF_INET_FORWARD,
5629 .priority = NF_IP_PRI_SELINUX_FIRST,
5630 }
5631 };
5632
5633 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5634
5635 static struct nf_hook_ops selinux_ipv6_ops[] = {
5636 {
5637 .hook = selinux_ipv6_postroute,
5638 .owner = THIS_MODULE,
5639 .pf = PF_INET6,
5640 .hooknum = NF_INET_POST_ROUTING,
5641 .priority = NF_IP6_PRI_SELINUX_LAST,
5642 },
5643 {
5644 .hook = selinux_ipv6_forward,
5645 .owner = THIS_MODULE,
5646 .pf = PF_INET6,
5647 .hooknum = NF_INET_FORWARD,
5648 .priority = NF_IP6_PRI_SELINUX_FIRST,
5649 }
5650 };
5651
5652 #endif /* IPV6 */
5653
5654 static int __init selinux_nf_ip_init(void)
5655 {
5656 int err = 0;
5657
5658 if (!selinux_enabled)
5659 goto out;
5660
5661 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5662
5663 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5664 if (err)
5665 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5666
5667 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5668 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5669 if (err)
5670 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5671 #endif /* IPV6 */
5672
5673 out:
5674 return err;
5675 }
5676
5677 __initcall(selinux_nf_ip_init);
5678
5679 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5680 static void selinux_nf_ip_exit(void)
5681 {
5682 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5683
5684 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5685 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5686 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5687 #endif /* IPV6 */
5688 }
5689 #endif
5690
5691 #else /* CONFIG_NETFILTER */
5692
5693 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5694 #define selinux_nf_ip_exit()
5695 #endif
5696
5697 #endif /* CONFIG_NETFILTER */
5698
5699 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5700 static int selinux_disabled;
5701
5702 int selinux_disable(void)
5703 {
5704 extern void exit_sel_fs(void);
5705
5706 if (ss_initialized) {
5707 /* Not permitted after initial policy load. */
5708 return -EINVAL;
5709 }
5710
5711 if (selinux_disabled) {
5712 /* Only do this once. */
5713 return -EINVAL;
5714 }
5715
5716 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5717
5718 selinux_disabled = 1;
5719 selinux_enabled = 0;
5720
5721 /* Reset security_ops to the secondary module, dummy or capability. */
5722 security_ops = secondary_ops;
5723
5724 /* Unregister netfilter hooks. */
5725 selinux_nf_ip_exit();
5726
5727 /* Unregister selinuxfs. */
5728 exit_sel_fs();
5729
5730 return 0;
5731 }
5732 #endif
Linux branches of Pieter du Preez