2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
77 #define XATTR_SELINUX_SUFFIX "selinux"
78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
80 extern unsigned int policydb_loaded_version
;
81 extern int selinux_nlmsg_lookup(u16 sclass
, u16 nlmsg_type
, u32
*perm
);
83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
84 int selinux_enforcing
= 0;
86 static int __init
enforcing_setup(char *str
)
88 selinux_enforcing
= simple_strtol(str
,NULL
,0);
91 __setup("enforcing=", enforcing_setup
);
94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
95 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
97 static int __init
selinux_enabled_setup(char *str
)
99 selinux_enabled
= simple_strtol(str
, NULL
, 0);
102 __setup("selinux=", selinux_enabled_setup
);
105 /* Original (dummy) security module. */
106 static struct security_operations
*original_ops
= NULL
;
108 /* Minimal support for a secondary security module,
109 just to allow the use of the dummy or capability modules.
110 The owlsm module can alternatively be used as a secondary
111 module as long as CONFIG_OWLSM_FD is not enabled. */
112 static struct security_operations
*secondary_ops
= NULL
;
114 /* Lists of inode and superblock security structures initialized
115 before the policy was loaded. */
116 static LIST_HEAD(superblock_security_head
);
117 static DEFINE_SPINLOCK(sb_security_lock
);
119 /* Allocate and free functions for each kind of security blob. */
121 static int task_alloc_security(struct task_struct
*task
)
123 struct task_security_struct
*tsec
;
125 tsec
= kmalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
129 memset(tsec
, 0, sizeof(struct task_security_struct
));
130 tsec
->magic
= SELINUX_MAGIC
;
132 tsec
->osid
= tsec
->sid
= tsec
->ptrace_sid
= SECINITSID_UNLABELED
;
133 task
->security
= tsec
;
138 static void task_free_security(struct task_struct
*task
)
140 struct task_security_struct
*tsec
= task
->security
;
142 if (!tsec
|| tsec
->magic
!= SELINUX_MAGIC
)
145 task
->security
= NULL
;
149 static int inode_alloc_security(struct inode
*inode
)
151 struct task_security_struct
*tsec
= current
->security
;
152 struct inode_security_struct
*isec
;
154 isec
= kmalloc(sizeof(struct inode_security_struct
), GFP_KERNEL
);
158 memset(isec
, 0, sizeof(struct inode_security_struct
));
159 init_MUTEX(&isec
->sem
);
160 INIT_LIST_HEAD(&isec
->list
);
161 isec
->magic
= SELINUX_MAGIC
;
163 isec
->sid
= SECINITSID_UNLABELED
;
164 isec
->sclass
= SECCLASS_FILE
;
165 if (tsec
&& tsec
->magic
== SELINUX_MAGIC
)
166 isec
->task_sid
= tsec
->sid
;
168 isec
->task_sid
= SECINITSID_UNLABELED
;
169 inode
->i_security
= isec
;
174 static void inode_free_security(struct inode
*inode
)
176 struct inode_security_struct
*isec
= inode
->i_security
;
177 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
179 if (!isec
|| isec
->magic
!= SELINUX_MAGIC
)
182 spin_lock(&sbsec
->isec_lock
);
183 if (!list_empty(&isec
->list
))
184 list_del_init(&isec
->list
);
185 spin_unlock(&sbsec
->isec_lock
);
187 inode
->i_security
= NULL
;
191 static int file_alloc_security(struct file
*file
)
193 struct task_security_struct
*tsec
= current
->security
;
194 struct file_security_struct
*fsec
;
196 fsec
= kmalloc(sizeof(struct file_security_struct
), GFP_ATOMIC
);
200 memset(fsec
, 0, sizeof(struct file_security_struct
));
201 fsec
->magic
= SELINUX_MAGIC
;
203 if (tsec
&& tsec
->magic
== SELINUX_MAGIC
) {
204 fsec
->sid
= tsec
->sid
;
205 fsec
->fown_sid
= tsec
->sid
;
207 fsec
->sid
= SECINITSID_UNLABELED
;
208 fsec
->fown_sid
= SECINITSID_UNLABELED
;
210 file
->f_security
= fsec
;
215 static void file_free_security(struct file
*file
)
217 struct file_security_struct
*fsec
= file
->f_security
;
219 if (!fsec
|| fsec
->magic
!= SELINUX_MAGIC
)
222 file
->f_security
= NULL
;
226 static int superblock_alloc_security(struct super_block
*sb
)
228 struct superblock_security_struct
*sbsec
;
230 sbsec
= kmalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
234 memset(sbsec
, 0, sizeof(struct superblock_security_struct
));
235 init_MUTEX(&sbsec
->sem
);
236 INIT_LIST_HEAD(&sbsec
->list
);
237 INIT_LIST_HEAD(&sbsec
->isec_head
);
238 spin_lock_init(&sbsec
->isec_lock
);
239 sbsec
->magic
= SELINUX_MAGIC
;
241 sbsec
->sid
= SECINITSID_UNLABELED
;
242 sbsec
->def_sid
= SECINITSID_FILE
;
243 sb
->s_security
= sbsec
;
248 static void superblock_free_security(struct super_block
*sb
)
250 struct superblock_security_struct
*sbsec
= sb
->s_security
;
252 if (!sbsec
|| sbsec
->magic
!= SELINUX_MAGIC
)
255 spin_lock(&sb_security_lock
);
256 if (!list_empty(&sbsec
->list
))
257 list_del_init(&sbsec
->list
);
258 spin_unlock(&sb_security_lock
);
260 sb
->s_security
= NULL
;
264 #ifdef CONFIG_SECURITY_NETWORK
265 static int sk_alloc_security(struct sock
*sk
, int family
, int priority
)
267 struct sk_security_struct
*ssec
;
269 if (family
!= PF_UNIX
)
272 ssec
= kmalloc(sizeof(*ssec
), priority
);
276 memset(ssec
, 0, sizeof(*ssec
));
277 ssec
->magic
= SELINUX_MAGIC
;
279 ssec
->peer_sid
= SECINITSID_UNLABELED
;
280 sk
->sk_security
= ssec
;
285 static void sk_free_security(struct sock
*sk
)
287 struct sk_security_struct
*ssec
= sk
->sk_security
;
289 if (sk
->sk_family
!= PF_UNIX
|| ssec
->magic
!= SELINUX_MAGIC
)
292 sk
->sk_security
= NULL
;
295 #endif /* CONFIG_SECURITY_NETWORK */
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized
;
301 /* The file system's label must be initialized prior to use. */
303 static char *labeling_behaviors
[6] = {
305 "uses transition SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
312 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
314 static inline int inode_doinit(struct inode
*inode
)
316 return inode_doinit_with_dentry(inode
, NULL
);
325 static match_table_t tokens
= {
326 {Opt_context
, "context=%s"},
327 {Opt_fscontext
, "fscontext=%s"},
328 {Opt_defcontext
, "defcontext=%s"},
331 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333 static int try_context_mount(struct super_block
*sb
, void *data
)
335 char *context
= NULL
, *defcontext
= NULL
;
338 int alloc
= 0, rc
= 0, seen
= 0;
339 struct task_security_struct
*tsec
= current
->security
;
340 struct superblock_security_struct
*sbsec
= sb
->s_security
;
345 name
= sb
->s_type
->name
;
347 if (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
349 /* NFS we understand. */
350 if (!strcmp(name
, "nfs")) {
351 struct nfs_mount_data
*d
= data
;
353 if (d
->version
< NFS_MOUNT_VERSION
)
357 context
= d
->context
;
364 /* Standard string-based options. */
365 char *p
, *options
= data
;
367 while ((p
= strsep(&options
, ",")) != NULL
) {
369 substring_t args
[MAX_OPT_ARGS
];
374 token
= match_token(p
, tokens
, args
);
380 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
383 context
= match_strdup(&args
[0]);
394 if (seen
& (Opt_context
|Opt_fscontext
)) {
396 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
399 context
= match_strdup(&args
[0]);
406 seen
|= Opt_fscontext
;
410 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
) {
412 printk(KERN_WARNING
"SELinux: "
413 "defcontext option is invalid "
414 "for this filesystem type\n");
417 if (seen
& (Opt_context
|Opt_defcontext
)) {
419 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
422 defcontext
= match_strdup(&args
[0]);
429 seen
|= Opt_defcontext
;
434 printk(KERN_WARNING
"SELinux: unknown mount "
446 rc
= security_context_to_sid(context
, strlen(context
), &sid
);
448 printk(KERN_WARNING
"SELinux: security_context_to_sid"
449 "(%s) failed for (dev %s, type %s) errno=%d\n",
450 context
, sb
->s_id
, name
, rc
);
454 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
455 FILESYSTEM__RELABELFROM
, NULL
);
459 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
460 FILESYSTEM__RELABELTO
, NULL
);
466 if (seen
& Opt_context
)
467 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
471 rc
= security_context_to_sid(defcontext
, strlen(defcontext
), &sid
);
473 printk(KERN_WARNING
"SELinux: security_context_to_sid"
474 "(%s) failed for (dev %s, type %s) errno=%d\n",
475 defcontext
, sb
->s_id
, name
, rc
);
479 if (sid
== sbsec
->def_sid
)
482 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
483 FILESYSTEM__RELABELFROM
, NULL
);
487 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
488 FILESYSTEM__ASSOCIATE
, NULL
);
492 sbsec
->def_sid
= sid
;
504 static int superblock_doinit(struct super_block
*sb
, void *data
)
506 struct superblock_security_struct
*sbsec
= sb
->s_security
;
507 struct dentry
*root
= sb
->s_root
;
508 struct inode
*inode
= root
->d_inode
;
512 if (sbsec
->initialized
)
515 if (!ss_initialized
) {
516 /* Defer initialization until selinux_complete_init,
517 after the initial policy is loaded and the security
518 server is ready to handle calls. */
519 spin_lock(&sb_security_lock
);
520 if (list_empty(&sbsec
->list
))
521 list_add(&sbsec
->list
, &superblock_security_head
);
522 spin_unlock(&sb_security_lock
);
526 /* Determine the labeling behavior to use for this filesystem type. */
527 rc
= security_fs_use(sb
->s_type
->name
, &sbsec
->behavior
, &sbsec
->sid
);
529 printk(KERN_WARNING
"%s: security_fs_use(%s) returned %d\n",
530 __FUNCTION__
, sb
->s_type
->name
, rc
);
534 rc
= try_context_mount(sb
, data
);
538 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
539 /* Make sure that the xattr handler exists and that no
540 error other than -ENODATA is returned by getxattr on
541 the root directory. -ENODATA is ok, as this may be
542 the first boot of the SELinux kernel before we have
543 assigned xattr values to the filesystem. */
544 if (!inode
->i_op
->getxattr
) {
545 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
546 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
550 rc
= inode
->i_op
->getxattr(root
, XATTR_NAME_SELINUX
, NULL
, 0);
551 if (rc
< 0 && rc
!= -ENODATA
) {
552 if (rc
== -EOPNOTSUPP
)
553 printk(KERN_WARNING
"SELinux: (dev %s, type "
554 "%s) has no security xattr handler\n",
555 sb
->s_id
, sb
->s_type
->name
);
557 printk(KERN_WARNING
"SELinux: (dev %s, type "
558 "%s) getxattr errno %d\n", sb
->s_id
,
559 sb
->s_type
->name
, -rc
);
564 if (strcmp(sb
->s_type
->name
, "proc") == 0)
567 sbsec
->initialized
= 1;
569 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
)) {
570 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
571 sb
->s_id
, sb
->s_type
->name
);
574 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), %s\n",
575 sb
->s_id
, sb
->s_type
->name
,
576 labeling_behaviors
[sbsec
->behavior
-1]);
579 /* Initialize the root inode. */
580 rc
= inode_doinit_with_dentry(sb
->s_root
->d_inode
, sb
->s_root
);
582 /* Initialize any other inodes associated with the superblock, e.g.
583 inodes created prior to initial policy load or inodes created
584 during get_sb by a pseudo filesystem that directly
586 spin_lock(&sbsec
->isec_lock
);
588 if (!list_empty(&sbsec
->isec_head
)) {
589 struct inode_security_struct
*isec
=
590 list_entry(sbsec
->isec_head
.next
,
591 struct inode_security_struct
, list
);
592 struct inode
*inode
= isec
->inode
;
593 spin_unlock(&sbsec
->isec_lock
);
594 inode
= igrab(inode
);
596 if (!IS_PRIVATE (inode
))
600 spin_lock(&sbsec
->isec_lock
);
601 list_del_init(&isec
->list
);
604 spin_unlock(&sbsec
->isec_lock
);
610 static inline u16
inode_mode_to_security_class(umode_t mode
)
612 switch (mode
& S_IFMT
) {
614 return SECCLASS_SOCK_FILE
;
616 return SECCLASS_LNK_FILE
;
618 return SECCLASS_FILE
;
620 return SECCLASS_BLK_FILE
;
624 return SECCLASS_CHR_FILE
;
626 return SECCLASS_FIFO_FILE
;
630 return SECCLASS_FILE
;
633 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
640 return SECCLASS_UNIX_STREAM_SOCKET
;
642 return SECCLASS_UNIX_DGRAM_SOCKET
;
649 return SECCLASS_TCP_SOCKET
;
651 return SECCLASS_UDP_SOCKET
;
653 return SECCLASS_RAWIP_SOCKET
;
659 return SECCLASS_NETLINK_ROUTE_SOCKET
;
660 case NETLINK_FIREWALL
:
661 return SECCLASS_NETLINK_FIREWALL_SOCKET
;
662 case NETLINK_INET_DIAG
:
663 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
665 return SECCLASS_NETLINK_NFLOG_SOCKET
;
667 return SECCLASS_NETLINK_XFRM_SOCKET
;
668 case NETLINK_SELINUX
:
669 return SECCLASS_NETLINK_SELINUX_SOCKET
;
671 return SECCLASS_NETLINK_AUDIT_SOCKET
;
673 return SECCLASS_NETLINK_IP6FW_SOCKET
;
674 case NETLINK_DNRTMSG
:
675 return SECCLASS_NETLINK_DNRT_SOCKET
;
676 case NETLINK_KOBJECT_UEVENT
:
677 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
679 return SECCLASS_NETLINK_SOCKET
;
682 return SECCLASS_PACKET_SOCKET
;
684 return SECCLASS_KEY_SOCKET
;
687 return SECCLASS_SOCKET
;
690 #ifdef CONFIG_PROC_FS
691 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
696 char *buffer
, *path
, *end
;
698 buffer
= (char*)__get_free_page(GFP_KERNEL
);
708 while (de
&& de
!= de
->parent
) {
709 buflen
-= de
->namelen
+ 1;
713 memcpy(end
, de
->name
, de
->namelen
);
718 rc
= security_genfs_sid("proc", path
, tclass
, sid
);
719 free_page((unsigned long)buffer
);
723 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
731 /* The inode's security attributes must be initialized before first use. */
732 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
734 struct superblock_security_struct
*sbsec
= NULL
;
735 struct inode_security_struct
*isec
= inode
->i_security
;
737 struct dentry
*dentry
;
738 #define INITCONTEXTLEN 255
739 char *context
= NULL
;
744 if (isec
->initialized
)
749 if (isec
->initialized
)
752 sbsec
= inode
->i_sb
->s_security
;
753 if (!sbsec
->initialized
) {
754 /* Defer initialization until selinux_complete_init,
755 after the initial policy is loaded and the security
756 server is ready to handle calls. */
757 spin_lock(&sbsec
->isec_lock
);
758 if (list_empty(&isec
->list
))
759 list_add(&isec
->list
, &sbsec
->isec_head
);
760 spin_unlock(&sbsec
->isec_lock
);
764 switch (sbsec
->behavior
) {
765 case SECURITY_FS_USE_XATTR
:
766 if (!inode
->i_op
->getxattr
) {
767 isec
->sid
= sbsec
->def_sid
;
771 /* Need a dentry, since the xattr API requires one.
772 Life would be simpler if we could just pass the inode. */
774 /* Called from d_instantiate or d_splice_alias. */
775 dentry
= dget(opt_dentry
);
777 /* Called from selinux_complete_init, try to find a dentry. */
778 dentry
= d_find_alias(inode
);
781 printk(KERN_WARNING
"%s: no dentry for dev=%s "
782 "ino=%ld\n", __FUNCTION__
, inode
->i_sb
->s_id
,
787 len
= INITCONTEXTLEN
;
788 context
= kmalloc(len
, GFP_KERNEL
);
794 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
797 /* Need a larger buffer. Query for the right size. */
798 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
806 context
= kmalloc(len
, GFP_KERNEL
);
812 rc
= inode
->i_op
->getxattr(dentry
,
818 if (rc
!= -ENODATA
) {
819 printk(KERN_WARNING
"%s: getxattr returned "
820 "%d for dev=%s ino=%ld\n", __FUNCTION__
,
821 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
825 /* Map ENODATA to the default file SID */
826 sid
= sbsec
->def_sid
;
829 rc
= security_context_to_sid_default(context
, rc
, &sid
,
832 printk(KERN_WARNING
"%s: context_to_sid(%s) "
833 "returned %d for dev=%s ino=%ld\n",
834 __FUNCTION__
, context
, -rc
,
835 inode
->i_sb
->s_id
, inode
->i_ino
);
837 /* Leave with the unlabeled SID */
845 case SECURITY_FS_USE_TASK
:
846 isec
->sid
= isec
->task_sid
;
848 case SECURITY_FS_USE_TRANS
:
849 /* Default to the fs SID. */
850 isec
->sid
= sbsec
->sid
;
852 /* Try to obtain a transition SID. */
853 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
854 rc
= security_transition_sid(isec
->task_sid
,
863 /* Default to the fs SID. */
864 isec
->sid
= sbsec
->sid
;
867 struct proc_inode
*proci
= PROC_I(inode
);
869 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
870 rc
= selinux_proc_get_sid(proci
->pde
,
881 isec
->initialized
= 1;
884 if (isec
->sclass
== SECCLASS_FILE
)
885 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
892 /* Convert a Linux signal to an access vector. */
893 static inline u32
signal_to_av(int sig
)
899 /* Commonly granted from child to parent. */
900 perm
= PROCESS__SIGCHLD
;
903 /* Cannot be caught or ignored */
904 perm
= PROCESS__SIGKILL
;
907 /* Cannot be caught or ignored */
908 perm
= PROCESS__SIGSTOP
;
911 /* All other signals. */
912 perm
= PROCESS__SIGNAL
;
919 /* Check permission betweeen a pair of tasks, e.g. signal checks,
920 fork check, ptrace check, etc. */
921 static int task_has_perm(struct task_struct
*tsk1
,
922 struct task_struct
*tsk2
,
925 struct task_security_struct
*tsec1
, *tsec2
;
927 tsec1
= tsk1
->security
;
928 tsec2
= tsk2
->security
;
929 return avc_has_perm(tsec1
->sid
, tsec2
->sid
,
930 SECCLASS_PROCESS
, perms
, NULL
);
933 /* Check whether a task is allowed to use a capability. */
934 static int task_has_capability(struct task_struct
*tsk
,
937 struct task_security_struct
*tsec
;
938 struct avc_audit_data ad
;
940 tsec
= tsk
->security
;
942 AVC_AUDIT_DATA_INIT(&ad
,CAP
);
946 return avc_has_perm(tsec
->sid
, tsec
->sid
,
947 SECCLASS_CAPABILITY
, CAP_TO_MASK(cap
), &ad
);
950 /* Check whether a task is allowed to use a system operation. */
951 static int task_has_system(struct task_struct
*tsk
,
954 struct task_security_struct
*tsec
;
956 tsec
= tsk
->security
;
958 return avc_has_perm(tsec
->sid
, SECINITSID_KERNEL
,
959 SECCLASS_SYSTEM
, perms
, NULL
);
962 /* Check whether a task has a particular permission to an inode.
963 The 'adp' parameter is optional and allows other audit
964 data to be passed (e.g. the dentry). */
965 static int inode_has_perm(struct task_struct
*tsk
,
968 struct avc_audit_data
*adp
)
970 struct task_security_struct
*tsec
;
971 struct inode_security_struct
*isec
;
972 struct avc_audit_data ad
;
974 tsec
= tsk
->security
;
975 isec
= inode
->i_security
;
979 AVC_AUDIT_DATA_INIT(&ad
, FS
);
980 ad
.u
.fs
.inode
= inode
;
983 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
986 /* Same as inode_has_perm, but pass explicit audit data containing
987 the dentry to help the auditing code to more easily generate the
988 pathname if needed. */
989 static inline int dentry_has_perm(struct task_struct
*tsk
,
990 struct vfsmount
*mnt
,
991 struct dentry
*dentry
,
994 struct inode
*inode
= dentry
->d_inode
;
995 struct avc_audit_data ad
;
996 AVC_AUDIT_DATA_INIT(&ad
,FS
);
998 ad
.u
.fs
.dentry
= dentry
;
999 return inode_has_perm(tsk
, inode
, av
, &ad
);
1002 /* Check whether a task can use an open file descriptor to
1003 access an inode in a given way. Check access to the
1004 descriptor itself, and then use dentry_has_perm to
1005 check a particular permission to the file.
1006 Access to the descriptor is implicitly granted if it
1007 has the same SID as the process. If av is zero, then
1008 access to the file is not checked, e.g. for cases
1009 where only the descriptor is affected like seek. */
1010 static inline int file_has_perm(struct task_struct
*tsk
,
1014 struct task_security_struct
*tsec
= tsk
->security
;
1015 struct file_security_struct
*fsec
= file
->f_security
;
1016 struct vfsmount
*mnt
= file
->f_vfsmnt
;
1017 struct dentry
*dentry
= file
->f_dentry
;
1018 struct inode
*inode
= dentry
->d_inode
;
1019 struct avc_audit_data ad
;
1022 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1024 ad
.u
.fs
.dentry
= dentry
;
1026 if (tsec
->sid
!= fsec
->sid
) {
1027 rc
= avc_has_perm(tsec
->sid
, fsec
->sid
,
1035 /* av is zero if only checking access to the descriptor. */
1037 return inode_has_perm(tsk
, inode
, av
, &ad
);
1042 /* Check whether a task can create a file. */
1043 static int may_create(struct inode
*dir
,
1044 struct dentry
*dentry
,
1047 struct task_security_struct
*tsec
;
1048 struct inode_security_struct
*dsec
;
1049 struct superblock_security_struct
*sbsec
;
1051 struct avc_audit_data ad
;
1054 tsec
= current
->security
;
1055 dsec
= dir
->i_security
;
1056 sbsec
= dir
->i_sb
->s_security
;
1058 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1059 ad
.u
.fs
.dentry
= dentry
;
1061 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
,
1062 DIR__ADD_NAME
| DIR__SEARCH
,
1067 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
1068 newsid
= tsec
->create_sid
;
1070 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
, tclass
,
1076 rc
= avc_has_perm(tsec
->sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1080 return avc_has_perm(newsid
, sbsec
->sid
,
1081 SECCLASS_FILESYSTEM
,
1082 FILESYSTEM__ASSOCIATE
, &ad
);
1086 #define MAY_UNLINK 1
1089 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1090 static int may_link(struct inode
*dir
,
1091 struct dentry
*dentry
,
1095 struct task_security_struct
*tsec
;
1096 struct inode_security_struct
*dsec
, *isec
;
1097 struct avc_audit_data ad
;
1101 tsec
= current
->security
;
1102 dsec
= dir
->i_security
;
1103 isec
= dentry
->d_inode
->i_security
;
1105 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1106 ad
.u
.fs
.dentry
= dentry
;
1109 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1110 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1125 printk(KERN_WARNING
"may_link: unrecognized kind %d\n", kind
);
1129 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1133 static inline int may_rename(struct inode
*old_dir
,
1134 struct dentry
*old_dentry
,
1135 struct inode
*new_dir
,
1136 struct dentry
*new_dentry
)
1138 struct task_security_struct
*tsec
;
1139 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1140 struct avc_audit_data ad
;
1142 int old_is_dir
, new_is_dir
;
1145 tsec
= current
->security
;
1146 old_dsec
= old_dir
->i_security
;
1147 old_isec
= old_dentry
->d_inode
->i_security
;
1148 old_is_dir
= S_ISDIR(old_dentry
->d_inode
->i_mode
);
1149 new_dsec
= new_dir
->i_security
;
1151 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1153 ad
.u
.fs
.dentry
= old_dentry
;
1154 rc
= avc_has_perm(tsec
->sid
, old_dsec
->sid
, SECCLASS_DIR
,
1155 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1158 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1159 old_isec
->sclass
, FILE__RENAME
, &ad
);
1162 if (old_is_dir
&& new_dir
!= old_dir
) {
1163 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1164 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1169 ad
.u
.fs
.dentry
= new_dentry
;
1170 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1171 if (new_dentry
->d_inode
)
1172 av
|= DIR__REMOVE_NAME
;
1173 rc
= avc_has_perm(tsec
->sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1176 if (new_dentry
->d_inode
) {
1177 new_isec
= new_dentry
->d_inode
->i_security
;
1178 new_is_dir
= S_ISDIR(new_dentry
->d_inode
->i_mode
);
1179 rc
= avc_has_perm(tsec
->sid
, new_isec
->sid
,
1181 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1189 /* Check whether a task can perform a filesystem operation. */
1190 static int superblock_has_perm(struct task_struct
*tsk
,
1191 struct super_block
*sb
,
1193 struct avc_audit_data
*ad
)
1195 struct task_security_struct
*tsec
;
1196 struct superblock_security_struct
*sbsec
;
1198 tsec
= tsk
->security
;
1199 sbsec
= sb
->s_security
;
1200 return avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
1204 /* Convert a Linux mode and permission mask to an access vector. */
1205 static inline u32
file_mask_to_av(int mode
, int mask
)
1209 if ((mode
& S_IFMT
) != S_IFDIR
) {
1210 if (mask
& MAY_EXEC
)
1211 av
|= FILE__EXECUTE
;
1212 if (mask
& MAY_READ
)
1215 if (mask
& MAY_APPEND
)
1217 else if (mask
& MAY_WRITE
)
1221 if (mask
& MAY_EXEC
)
1223 if (mask
& MAY_WRITE
)
1225 if (mask
& MAY_READ
)
1232 /* Convert a Linux file to an access vector. */
1233 static inline u32
file_to_av(struct file
*file
)
1237 if (file
->f_mode
& FMODE_READ
)
1239 if (file
->f_mode
& FMODE_WRITE
) {
1240 if (file
->f_flags
& O_APPEND
)
1249 /* Set an inode's SID to a specified value. */
1250 static int inode_security_set_sid(struct inode
*inode
, u32 sid
)
1252 struct inode_security_struct
*isec
= inode
->i_security
;
1253 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
1255 if (!sbsec
->initialized
) {
1256 /* Defer initialization to selinux_complete_init. */
1261 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1263 isec
->initialized
= 1;
1268 /* Set the security attributes on a newly created file. */
1269 static int post_create(struct inode
*dir
,
1270 struct dentry
*dentry
)
1273 struct task_security_struct
*tsec
;
1274 struct inode
*inode
;
1275 struct inode_security_struct
*dsec
;
1276 struct superblock_security_struct
*sbsec
;
1277 struct inode_security_struct
*isec
;
1283 tsec
= current
->security
;
1284 dsec
= dir
->i_security
;
1285 sbsec
= dir
->i_sb
->s_security
;
1287 inode
= dentry
->d_inode
;
1289 /* Some file system types (e.g. NFS) may not instantiate
1290 a dentry for all create operations (e.g. symlink),
1291 so we have to check to see if the inode is non-NULL. */
1292 printk(KERN_WARNING
"post_create: no inode, dir (dev=%s, "
1293 "ino=%ld)\n", dir
->i_sb
->s_id
, dir
->i_ino
);
1297 isec
= inode
->i_security
;
1299 if (isec
->security_attr_init
)
1302 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
1303 newsid
= tsec
->create_sid
;
1305 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
,
1306 inode_mode_to_security_class(inode
->i_mode
),
1309 printk(KERN_WARNING
"post_create: "
1310 "security_transition_sid failed, rc=%d (dev=%s "
1312 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1317 rc
= inode_security_set_sid(inode
, newsid
);
1319 printk(KERN_WARNING
"post_create: inode_security_set_sid "
1320 "failed, rc=%d (dev=%s ino=%ld)\n",
1321 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1325 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
&&
1326 inode
->i_op
->setxattr
) {
1327 /* Use extended attributes. */
1328 rc
= security_sid_to_context(newsid
, &context
, &len
);
1330 printk(KERN_WARNING
"post_create: sid_to_context "
1331 "failed, rc=%d (dev=%s ino=%ld)\n",
1332 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1335 down(&inode
->i_sem
);
1336 rc
= inode
->i_op
->setxattr(dentry
,
1342 printk(KERN_WARNING
"post_create: setxattr failed, "
1343 "rc=%d (dev=%s ino=%ld)\n",
1344 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1353 /* Hook functions begin here. */
1355 static int selinux_ptrace(struct task_struct
*parent
, struct task_struct
*child
)
1357 struct task_security_struct
*psec
= parent
->security
;
1358 struct task_security_struct
*csec
= child
->security
;
1361 rc
= secondary_ops
->ptrace(parent
,child
);
1365 rc
= task_has_perm(parent
, child
, PROCESS__PTRACE
);
1366 /* Save the SID of the tracing process for later use in apply_creds. */
1368 csec
->ptrace_sid
= psec
->sid
;
1372 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
1373 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1377 error
= task_has_perm(current
, target
, PROCESS__GETCAP
);
1381 return secondary_ops
->capget(target
, effective
, inheritable
, permitted
);
1384 static int selinux_capset_check(struct task_struct
*target
, kernel_cap_t
*effective
,
1385 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1389 error
= secondary_ops
->capset_check(target
, effective
, inheritable
, permitted
);
1393 return task_has_perm(current
, target
, PROCESS__SETCAP
);
1396 static void selinux_capset_set(struct task_struct
*target
, kernel_cap_t
*effective
,
1397 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1399 secondary_ops
->capset_set(target
, effective
, inheritable
, permitted
);
1402 static int selinux_capable(struct task_struct
*tsk
, int cap
)
1406 rc
= secondary_ops
->capable(tsk
, cap
);
1410 return task_has_capability(tsk
,cap
);
1413 static int selinux_sysctl(ctl_table
*table
, int op
)
1417 struct task_security_struct
*tsec
;
1421 rc
= secondary_ops
->sysctl(table
, op
);
1425 tsec
= current
->security
;
1427 rc
= selinux_proc_get_sid(table
->de
, (op
== 001) ?
1428 SECCLASS_DIR
: SECCLASS_FILE
, &tsid
);
1430 /* Default to the well-defined sysctl SID. */
1431 tsid
= SECINITSID_SYSCTL
;
1434 /* The op values are "defined" in sysctl.c, thereby creating
1435 * a bad coupling between this module and sysctl.c */
1437 error
= avc_has_perm(tsec
->sid
, tsid
,
1438 SECCLASS_DIR
, DIR__SEARCH
, NULL
);
1446 error
= avc_has_perm(tsec
->sid
, tsid
,
1447 SECCLASS_FILE
, av
, NULL
);
1453 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
1466 rc
= superblock_has_perm(current
,
1468 FILESYSTEM__QUOTAMOD
, NULL
);
1473 rc
= superblock_has_perm(current
,
1475 FILESYSTEM__QUOTAGET
, NULL
);
1478 rc
= 0; /* let the kernel handle invalid cmds */
1484 static int selinux_quota_on(struct dentry
*dentry
)
1486 return dentry_has_perm(current
, NULL
, dentry
, FILE__QUOTAON
);
1489 static int selinux_syslog(int type
)
1493 rc
= secondary_ops
->syslog(type
);
1498 case 3: /* Read last kernel messages */
1499 case 10: /* Return size of the log buffer */
1500 rc
= task_has_system(current
, SYSTEM__SYSLOG_READ
);
1502 case 6: /* Disable logging to console */
1503 case 7: /* Enable logging to console */
1504 case 8: /* Set level of messages printed to console */
1505 rc
= task_has_system(current
, SYSTEM__SYSLOG_CONSOLE
);
1507 case 0: /* Close log */
1508 case 1: /* Open log */
1509 case 2: /* Read from log */
1510 case 4: /* Read/clear last kernel messages */
1511 case 5: /* Clear ring buffer */
1513 rc
= task_has_system(current
, SYSTEM__SYSLOG_MOD
);
1520 * Check that a process has enough memory to allocate a new virtual
1521 * mapping. 0 means there is enough memory for the allocation to
1522 * succeed and -ENOMEM implies there is not.
1524 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1525 * if the capability is granted, but __vm_enough_memory requires 1 if
1526 * the capability is granted.
1528 * Do not audit the selinux permission check, as this is applied to all
1529 * processes that allocate mappings.
1531 static int selinux_vm_enough_memory(long pages
)
1533 int rc
, cap_sys_admin
= 0;
1534 struct task_security_struct
*tsec
= current
->security
;
1536 rc
= secondary_ops
->capable(current
, CAP_SYS_ADMIN
);
1538 rc
= avc_has_perm_noaudit(tsec
->sid
, tsec
->sid
,
1539 SECCLASS_CAPABILITY
,
1540 CAP_TO_MASK(CAP_SYS_ADMIN
),
1546 return __vm_enough_memory(pages
, cap_sys_admin
);
1549 /* binprm security operations */
1551 static int selinux_bprm_alloc_security(struct linux_binprm
*bprm
)
1553 struct bprm_security_struct
*bsec
;
1555 bsec
= kmalloc(sizeof(struct bprm_security_struct
), GFP_KERNEL
);
1559 memset(bsec
, 0, sizeof *bsec
);
1560 bsec
->magic
= SELINUX_MAGIC
;
1562 bsec
->sid
= SECINITSID_UNLABELED
;
1565 bprm
->security
= bsec
;
1569 static int selinux_bprm_set_security(struct linux_binprm
*bprm
)
1571 struct task_security_struct
*tsec
;
1572 struct inode
*inode
= bprm
->file
->f_dentry
->d_inode
;
1573 struct inode_security_struct
*isec
;
1574 struct bprm_security_struct
*bsec
;
1576 struct avc_audit_data ad
;
1579 rc
= secondary_ops
->bprm_set_security(bprm
);
1583 bsec
= bprm
->security
;
1588 tsec
= current
->security
;
1589 isec
= inode
->i_security
;
1591 /* Default to the current task SID. */
1592 bsec
->sid
= tsec
->sid
;
1594 /* Reset create SID on execve. */
1595 tsec
->create_sid
= 0;
1597 if (tsec
->exec_sid
) {
1598 newsid
= tsec
->exec_sid
;
1599 /* Reset exec SID on execve. */
1602 /* Check for a default transition on this program. */
1603 rc
= security_transition_sid(tsec
->sid
, isec
->sid
,
1604 SECCLASS_PROCESS
, &newsid
);
1609 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1610 ad
.u
.fs
.mnt
= bprm
->file
->f_vfsmnt
;
1611 ad
.u
.fs
.dentry
= bprm
->file
->f_dentry
;
1613 if (bprm
->file
->f_vfsmnt
->mnt_flags
& MNT_NOSUID
)
1616 if (tsec
->sid
== newsid
) {
1617 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
1618 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
1622 /* Check permissions for the transition. */
1623 rc
= avc_has_perm(tsec
->sid
, newsid
,
1624 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
1628 rc
= avc_has_perm(newsid
, isec
->sid
,
1629 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
1633 /* Clear any possibly unsafe personality bits on exec: */
1634 current
->personality
&= ~PER_CLEAR_ON_SETID
;
1636 /* Set the security field to the new SID. */
1644 static int selinux_bprm_check_security (struct linux_binprm
*bprm
)
1646 return secondary_ops
->bprm_check_security(bprm
);
1650 static int selinux_bprm_secureexec (struct linux_binprm
*bprm
)
1652 struct task_security_struct
*tsec
= current
->security
;
1655 if (tsec
->osid
!= tsec
->sid
) {
1656 /* Enable secure mode for SIDs transitions unless
1657 the noatsecure permission is granted between
1658 the two SIDs, i.e. ahp returns 0. */
1659 atsecure
= avc_has_perm(tsec
->osid
, tsec
->sid
,
1661 PROCESS__NOATSECURE
, NULL
);
1664 return (atsecure
|| secondary_ops
->bprm_secureexec(bprm
));
1667 static void selinux_bprm_free_security(struct linux_binprm
*bprm
)
1669 kfree(bprm
->security
);
1670 bprm
->security
= NULL
;
1673 extern struct vfsmount
*selinuxfs_mount
;
1674 extern struct dentry
*selinux_null
;
1676 /* Derived from fs/exec.c:flush_old_files. */
1677 static inline void flush_unauthorized_files(struct files_struct
* files
)
1679 struct avc_audit_data ad
;
1680 struct file
*file
, *devnull
= NULL
;
1681 struct tty_struct
*tty
= current
->signal
->tty
;
1686 file
= list_entry(tty
->tty_files
.next
, typeof(*file
), f_list
);
1688 /* Revalidate access to controlling tty.
1689 Use inode_has_perm on the tty inode directly rather
1690 than using file_has_perm, as this particular open
1691 file may belong to another process and we are only
1692 interested in the inode-based check here. */
1693 struct inode
*inode
= file
->f_dentry
->d_inode
;
1694 if (inode_has_perm(current
, inode
,
1695 FILE__READ
| FILE__WRITE
, NULL
)) {
1696 /* Reset controlling tty. */
1697 current
->signal
->tty
= NULL
;
1698 current
->signal
->tty_old_pgrp
= 0;
1704 /* Revalidate access to inherited open files. */
1706 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1708 spin_lock(&files
->file_lock
);
1710 unsigned long set
, i
;
1715 if (i
>= files
->max_fds
|| i
>= files
->max_fdset
)
1717 set
= files
->open_fds
->fds_bits
[j
];
1720 spin_unlock(&files
->file_lock
);
1721 for ( ; set
; i
++,set
>>= 1) {
1726 if (file_has_perm(current
,
1728 file_to_av(file
))) {
1730 fd
= get_unused_fd();
1738 atomic_inc(&devnull
->f_count
);
1740 devnull
= dentry_open(dget(selinux_null
), mntget(selinuxfs_mount
), O_RDWR
);
1747 fd_install(fd
, devnull
);
1752 spin_lock(&files
->file_lock
);
1755 spin_unlock(&files
->file_lock
);
1758 static void selinux_bprm_apply_creds(struct linux_binprm
*bprm
, int unsafe
)
1760 struct task_security_struct
*tsec
;
1761 struct bprm_security_struct
*bsec
;
1765 secondary_ops
->bprm_apply_creds(bprm
, unsafe
);
1767 tsec
= current
->security
;
1769 bsec
= bprm
->security
;
1772 tsec
->osid
= tsec
->sid
;
1774 if (tsec
->sid
!= sid
) {
1775 /* Check for shared state. If not ok, leave SID
1776 unchanged and kill. */
1777 if (unsafe
& LSM_UNSAFE_SHARE
) {
1778 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
1779 PROCESS__SHARE
, NULL
);
1786 /* Check for ptracing, and update the task SID if ok.
1787 Otherwise, leave SID unchanged and kill. */
1788 if (unsafe
& (LSM_UNSAFE_PTRACE
| LSM_UNSAFE_PTRACE_CAP
)) {
1789 rc
= avc_has_perm(tsec
->ptrace_sid
, sid
,
1790 SECCLASS_PROCESS
, PROCESS__PTRACE
,
1802 * called after apply_creds without the task lock held
1804 static void selinux_bprm_post_apply_creds(struct linux_binprm
*bprm
)
1806 struct task_security_struct
*tsec
;
1807 struct rlimit
*rlim
, *initrlim
;
1808 struct itimerval itimer
;
1809 struct bprm_security_struct
*bsec
;
1812 tsec
= current
->security
;
1813 bsec
= bprm
->security
;
1816 force_sig_specific(SIGKILL
, current
);
1819 if (tsec
->osid
== tsec
->sid
)
1822 /* Close files for which the new task SID is not authorized. */
1823 flush_unauthorized_files(current
->files
);
1825 /* Check whether the new SID can inherit signal state
1826 from the old SID. If not, clear itimers to avoid
1827 subsequent signal generation and flush and unblock
1828 signals. This must occur _after_ the task SID has
1829 been updated so that any kill done after the flush
1830 will be checked against the new SID. */
1831 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1832 PROCESS__SIGINH
, NULL
);
1834 memset(&itimer
, 0, sizeof itimer
);
1835 for (i
= 0; i
< 3; i
++)
1836 do_setitimer(i
, &itimer
, NULL
);
1837 flush_signals(current
);
1838 spin_lock_irq(¤t
->sighand
->siglock
);
1839 flush_signal_handlers(current
, 1);
1840 sigemptyset(¤t
->blocked
);
1841 recalc_sigpending();
1842 spin_unlock_irq(¤t
->sighand
->siglock
);
1845 /* Check whether the new SID can inherit resource limits
1846 from the old SID. If not, reset all soft limits to
1847 the lower of the current task's hard limit and the init
1848 task's soft limit. Note that the setting of hard limits
1849 (even to lower them) can be controlled by the setrlimit
1850 check. The inclusion of the init task's soft limit into
1851 the computation is to avoid resetting soft limits higher
1852 than the default soft limit for cases where the default
1853 is lower than the hard limit, e.g. RLIMIT_CORE or
1855 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1856 PROCESS__RLIMITINH
, NULL
);
1858 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
1859 rlim
= current
->signal
->rlim
+ i
;
1860 initrlim
= init_task
.signal
->rlim
+i
;
1861 rlim
->rlim_cur
= min(rlim
->rlim_max
,initrlim
->rlim_cur
);
1863 if (current
->signal
->rlim
[RLIMIT_CPU
].rlim_cur
!= RLIM_INFINITY
) {
1865 * This will cause RLIMIT_CPU calculations
1868 current
->it_prof_expires
= jiffies_to_cputime(1);
1872 /* Wake up the parent if it is waiting so that it can
1873 recheck wait permission to the new task SID. */
1874 wake_up_interruptible(¤t
->parent
->signal
->wait_chldexit
);
1877 /* superblock security operations */
1879 static int selinux_sb_alloc_security(struct super_block
*sb
)
1881 return superblock_alloc_security(sb
);
1884 static void selinux_sb_free_security(struct super_block
*sb
)
1886 superblock_free_security(sb
);
1889 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
1894 return !memcmp(prefix
, option
, plen
);
1897 static inline int selinux_option(char *option
, int len
)
1899 return (match_prefix("context=", sizeof("context=")-1, option
, len
) ||
1900 match_prefix("fscontext=", sizeof("fscontext=")-1, option
, len
) ||
1901 match_prefix("defcontext=", sizeof("defcontext=")-1, option
, len
));
1904 static inline void take_option(char **to
, char *from
, int *first
, int len
)
1912 memcpy(*to
, from
, len
);
1916 static int selinux_sb_copy_data(struct file_system_type
*type
, void *orig
, void *copy
)
1918 int fnosec
, fsec
, rc
= 0;
1919 char *in_save
, *in_curr
, *in_end
;
1920 char *sec_curr
, *nosec_save
, *nosec
;
1925 /* Binary mount data: just copy */
1926 if (type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
1927 copy_page(sec_curr
, in_curr
);
1931 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
1939 in_save
= in_end
= orig
;
1942 if (*in_end
== ',' || *in_end
== '\0') {
1943 int len
= in_end
- in_curr
;
1945 if (selinux_option(in_curr
, len
))
1946 take_option(&sec_curr
, in_curr
, &fsec
, len
);
1948 take_option(&nosec
, in_curr
, &fnosec
, len
);
1950 in_curr
= in_end
+ 1;
1952 } while (*in_end
++);
1954 strcpy(in_save
, nosec_save
);
1955 free_page((unsigned long)nosec_save
);
1960 static int selinux_sb_kern_mount(struct super_block
*sb
, void *data
)
1962 struct avc_audit_data ad
;
1965 rc
= superblock_doinit(sb
, data
);
1969 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1970 ad
.u
.fs
.dentry
= sb
->s_root
;
1971 return superblock_has_perm(current
, sb
, FILESYSTEM__MOUNT
, &ad
);
1974 static int selinux_sb_statfs(struct super_block
*sb
)
1976 struct avc_audit_data ad
;
1978 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1979 ad
.u
.fs
.dentry
= sb
->s_root
;
1980 return superblock_has_perm(current
, sb
, FILESYSTEM__GETATTR
, &ad
);
1983 static int selinux_mount(char * dev_name
,
1984 struct nameidata
*nd
,
1986 unsigned long flags
,
1991 rc
= secondary_ops
->sb_mount(dev_name
, nd
, type
, flags
, data
);
1995 if (flags
& MS_REMOUNT
)
1996 return superblock_has_perm(current
, nd
->mnt
->mnt_sb
,
1997 FILESYSTEM__REMOUNT
, NULL
);
1999 return dentry_has_perm(current
, nd
->mnt
, nd
->dentry
,
2003 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
2007 rc
= secondary_ops
->sb_umount(mnt
, flags
);
2011 return superblock_has_perm(current
,mnt
->mnt_sb
,
2012 FILESYSTEM__UNMOUNT
,NULL
);
2015 /* inode security operations */
2017 static int selinux_inode_alloc_security(struct inode
*inode
)
2019 return inode_alloc_security(inode
);
2022 static void selinux_inode_free_security(struct inode
*inode
)
2024 inode_free_security(inode
);
2027 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
2028 char **name
, void **value
,
2031 struct task_security_struct
*tsec
;
2032 struct inode_security_struct
*dsec
;
2033 struct superblock_security_struct
*sbsec
;
2034 struct inode_security_struct
*isec
;
2037 char *namep
, *context
;
2039 tsec
= current
->security
;
2040 dsec
= dir
->i_security
;
2041 sbsec
= dir
->i_sb
->s_security
;
2042 isec
= inode
->i_security
;
2044 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
2045 newsid
= tsec
->create_sid
;
2047 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
,
2048 inode_mode_to_security_class(inode
->i_mode
),
2051 printk(KERN_WARNING
"%s: "
2052 "security_transition_sid failed, rc=%d (dev=%s "
2055 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
2060 inode_security_set_sid(inode
, newsid
);
2062 namep
= kstrdup(XATTR_SELINUX_SUFFIX
, GFP_KERNEL
);
2067 rc
= security_sid_to_context(newsid
, &context
, len
);
2074 isec
->security_attr_init
= 1;
2079 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2081 return may_create(dir
, dentry
, SECCLASS_FILE
);
2084 static void selinux_inode_post_create(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2086 post_create(dir
, dentry
);
2089 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2093 rc
= secondary_ops
->inode_link(old_dentry
,dir
,new_dentry
);
2096 return may_link(dir
, old_dentry
, MAY_LINK
);
2099 static void selinux_inode_post_link(struct dentry
*old_dentry
, struct inode
*inode
, struct dentry
*new_dentry
)
2104 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2108 rc
= secondary_ops
->inode_unlink(dir
, dentry
);
2111 return may_link(dir
, dentry
, MAY_UNLINK
);
2114 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2116 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2119 static void selinux_inode_post_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2121 post_create(dir
, dentry
);
2124 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2126 return may_create(dir
, dentry
, SECCLASS_DIR
);
2129 static void selinux_inode_post_mkdir(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2131 post_create(dir
, dentry
);
2134 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2136 return may_link(dir
, dentry
, MAY_RMDIR
);
2139 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, int mode
, dev_t dev
)
2143 rc
= secondary_ops
->inode_mknod(dir
, dentry
, mode
, dev
);
2147 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2150 static void selinux_inode_post_mknod(struct inode
*dir
, struct dentry
*dentry
, int mode
, dev_t dev
)
2152 post_create(dir
, dentry
);
2155 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2156 struct inode
*new_inode
, struct dentry
*new_dentry
)
2158 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2161 static void selinux_inode_post_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2162 struct inode
*new_inode
, struct dentry
*new_dentry
)
2167 static int selinux_inode_readlink(struct dentry
*dentry
)
2169 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2172 static int selinux_inode_follow_link(struct dentry
*dentry
, struct nameidata
*nameidata
)
2176 rc
= secondary_ops
->inode_follow_link(dentry
,nameidata
);
2179 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2182 static int selinux_inode_permission(struct inode
*inode
, int mask
,
2183 struct nameidata
*nd
)
2187 rc
= secondary_ops
->inode_permission(inode
, mask
, nd
);
2192 /* No permission to check. Existence test. */
2196 return inode_has_perm(current
, inode
,
2197 file_mask_to_av(inode
->i_mode
, mask
), NULL
);
2200 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
2204 rc
= secondary_ops
->inode_setattr(dentry
, iattr
);
2208 if (iattr
->ia_valid
& ATTR_FORCE
)
2211 if (iattr
->ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
2212 ATTR_ATIME_SET
| ATTR_MTIME_SET
))
2213 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2215 return dentry_has_perm(current
, NULL
, dentry
, FILE__WRITE
);
2218 static int selinux_inode_getattr(struct vfsmount
*mnt
, struct dentry
*dentry
)
2220 return dentry_has_perm(current
, mnt
, dentry
, FILE__GETATTR
);
2223 static int selinux_inode_setxattr(struct dentry
*dentry
, char *name
, void *value
, size_t size
, int flags
)
2225 struct task_security_struct
*tsec
= current
->security
;
2226 struct inode
*inode
= dentry
->d_inode
;
2227 struct inode_security_struct
*isec
= inode
->i_security
;
2228 struct superblock_security_struct
*sbsec
;
2229 struct avc_audit_data ad
;
2233 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2234 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2235 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2236 !capable(CAP_SYS_ADMIN
)) {
2237 /* A different attribute in the security namespace.
2238 Restrict to administrator. */
2242 /* Not an attribute we recognize, so just check the
2243 ordinary setattr permission. */
2244 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2247 sbsec
= inode
->i_sb
->s_security
;
2248 if (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
2251 if ((current
->fsuid
!= inode
->i_uid
) && !capable(CAP_FOWNER
))
2254 AVC_AUDIT_DATA_INIT(&ad
,FS
);
2255 ad
.u
.fs
.dentry
= dentry
;
2257 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
,
2258 FILE__RELABELFROM
, &ad
);
2262 rc
= security_context_to_sid(value
, size
, &newsid
);
2266 rc
= avc_has_perm(tsec
->sid
, newsid
, isec
->sclass
,
2267 FILE__RELABELTO
, &ad
);
2271 rc
= security_validate_transition(isec
->sid
, newsid
, tsec
->sid
,
2276 return avc_has_perm(newsid
,
2278 SECCLASS_FILESYSTEM
,
2279 FILESYSTEM__ASSOCIATE
,
2283 static void selinux_inode_post_setxattr(struct dentry
*dentry
, char *name
,
2284 void *value
, size_t size
, int flags
)
2286 struct inode
*inode
= dentry
->d_inode
;
2287 struct inode_security_struct
*isec
= inode
->i_security
;
2291 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2292 /* Not an attribute we recognize, so nothing to do. */
2296 rc
= security_context_to_sid(value
, size
, &newsid
);
2298 printk(KERN_WARNING
"%s: unable to obtain SID for context "
2299 "%s, rc=%d\n", __FUNCTION__
, (char*)value
, -rc
);
2307 static int selinux_inode_getxattr (struct dentry
*dentry
, char *name
)
2309 struct inode
*inode
= dentry
->d_inode
;
2310 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
2312 if (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
2315 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2318 static int selinux_inode_listxattr (struct dentry
*dentry
)
2320 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2323 static int selinux_inode_removexattr (struct dentry
*dentry
, char *name
)
2325 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2326 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2327 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2328 !capable(CAP_SYS_ADMIN
)) {
2329 /* A different attribute in the security namespace.
2330 Restrict to administrator. */
2334 /* Not an attribute we recognize, so just check the
2335 ordinary setattr permission. Might want a separate
2336 permission for removexattr. */
2337 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2340 /* No one is allowed to remove a SELinux security label.
2341 You can change the label, but all data must be labeled. */
2345 static int selinux_inode_getsecurity(struct inode
*inode
, const char *name
, void *buffer
, size_t size
)
2347 struct inode_security_struct
*isec
= inode
->i_security
;
2352 /* Permission check handled by selinux_inode_getxattr hook.*/
2354 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2357 rc
= security_sid_to_context(isec
->sid
, &context
, &len
);
2361 if (!buffer
|| !size
) {
2369 memcpy(buffer
, context
, len
);
2374 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
2375 const void *value
, size_t size
, int flags
)
2377 struct inode_security_struct
*isec
= inode
->i_security
;
2381 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2384 if (!value
|| !size
)
2387 rc
= security_context_to_sid((void*)value
, size
, &newsid
);
2395 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
2397 const int len
= sizeof(XATTR_NAME_SELINUX
);
2398 if (buffer
&& len
<= buffer_size
)
2399 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
2403 /* file security operations */
2405 static int selinux_file_permission(struct file
*file
, int mask
)
2407 struct inode
*inode
= file
->f_dentry
->d_inode
;
2410 /* No permission to check. Existence test. */
2414 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2415 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
2418 return file_has_perm(current
, file
,
2419 file_mask_to_av(inode
->i_mode
, mask
));
2422 static int selinux_file_alloc_security(struct file
*file
)
2424 return file_alloc_security(file
);
2427 static void selinux_file_free_security(struct file
*file
)
2429 file_free_security(file
);
2432 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
2444 case EXT2_IOC_GETFLAGS
:
2446 case EXT2_IOC_GETVERSION
:
2447 error
= file_has_perm(current
, file
, FILE__GETATTR
);
2450 case EXT2_IOC_SETFLAGS
:
2452 case EXT2_IOC_SETVERSION
:
2453 error
= file_has_perm(current
, file
, FILE__SETATTR
);
2456 /* sys_ioctl() checks */
2460 error
= file_has_perm(current
, file
, 0);
2465 error
= task_has_capability(current
,CAP_SYS_TTY_CONFIG
);
2468 /* default case assumes that the command will go
2469 * to the file's ioctl() function.
2472 error
= file_has_perm(current
, file
, FILE__IOCTL
);
2478 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
2480 #ifndef CONFIG_PPC32
2481 if ((prot
& PROT_EXEC
) && (!file
|| (!shared
&& (prot
& PROT_WRITE
)))) {
2483 * We are making executable an anonymous mapping or a
2484 * private file mapping that will also be writable.
2485 * This has an additional check.
2487 int rc
= task_has_perm(current
, current
, PROCESS__EXECMEM
);
2494 /* read access is always possible with a mapping */
2495 u32 av
= FILE__READ
;
2497 /* write access only matters if the mapping is shared */
2498 if (shared
&& (prot
& PROT_WRITE
))
2501 if (prot
& PROT_EXEC
)
2502 av
|= FILE__EXECUTE
;
2504 return file_has_perm(current
, file
, av
);
2509 static int selinux_file_mmap(struct file
*file
, unsigned long reqprot
,
2510 unsigned long prot
, unsigned long flags
)
2514 rc
= secondary_ops
->file_mmap(file
, reqprot
, prot
, flags
);
2518 if (selinux_checkreqprot
)
2521 return file_map_prot_check(file
, prot
,
2522 (flags
& MAP_TYPE
) == MAP_SHARED
);
2525 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
2526 unsigned long reqprot
,
2531 rc
= secondary_ops
->file_mprotect(vma
, reqprot
, prot
);
2535 if (selinux_checkreqprot
)
2538 #ifndef CONFIG_PPC32
2539 if ((prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXECUTABLE
) &&
2540 (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
2541 vma
->vm_end
<= vma
->vm_mm
->brk
)) {
2543 * We are making an executable mapping in the brk region.
2544 * This has an additional execheap check.
2546 rc
= task_has_perm(current
, current
, PROCESS__EXECHEAP
);
2550 if (vma
->vm_file
!= NULL
&& vma
->anon_vma
!= NULL
&& (prot
& PROT_EXEC
)) {
2552 * We are making executable a file mapping that has
2553 * had some COW done. Since pages might have been written,
2554 * check ability to execute the possibly modified content.
2555 * This typically should only occur for text relocations.
2557 int rc
= file_has_perm(current
, vma
->vm_file
, FILE__EXECMOD
);
2561 if (!vma
->vm_file
&& (prot
& PROT_EXEC
) &&
2562 vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
2563 vma
->vm_end
>= vma
->vm_mm
->start_stack
) {
2564 /* Attempt to make the process stack executable.
2565 * This has an additional execstack check.
2567 rc
= task_has_perm(current
, current
, PROCESS__EXECSTACK
);
2573 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
2576 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
2578 return file_has_perm(current
, file
, FILE__LOCK
);
2581 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
2588 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2593 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
2594 err
= file_has_perm(current
, file
,FILE__WRITE
);
2603 /* Just check FD__USE permission */
2604 err
= file_has_perm(current
, file
, 0);
2609 #if BITS_PER_LONG == 32
2614 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2618 err
= file_has_perm(current
, file
, FILE__LOCK
);
2625 static int selinux_file_set_fowner(struct file
*file
)
2627 struct task_security_struct
*tsec
;
2628 struct file_security_struct
*fsec
;
2630 tsec
= current
->security
;
2631 fsec
= file
->f_security
;
2632 fsec
->fown_sid
= tsec
->sid
;
2637 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
2638 struct fown_struct
*fown
, int signum
)
2642 struct task_security_struct
*tsec
;
2643 struct file_security_struct
*fsec
;
2645 /* struct fown_struct is never outside the context of a struct file */
2646 file
= (struct file
*)((long)fown
- offsetof(struct file
,f_owner
));
2648 tsec
= tsk
->security
;
2649 fsec
= file
->f_security
;
2652 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
2654 perm
= signal_to_av(signum
);
2656 return avc_has_perm(fsec
->fown_sid
, tsec
->sid
,
2657 SECCLASS_PROCESS
, perm
, NULL
);
2660 static int selinux_file_receive(struct file
*file
)
2662 return file_has_perm(current
, file
, file_to_av(file
));
2665 /* task security operations */
2667 static int selinux_task_create(unsigned long clone_flags
)
2671 rc
= secondary_ops
->task_create(clone_flags
);
2675 return task_has_perm(current
, current
, PROCESS__FORK
);
2678 static int selinux_task_alloc_security(struct task_struct
*tsk
)
2680 struct task_security_struct
*tsec1
, *tsec2
;
2683 tsec1
= current
->security
;
2685 rc
= task_alloc_security(tsk
);
2688 tsec2
= tsk
->security
;
2690 tsec2
->osid
= tsec1
->osid
;
2691 tsec2
->sid
= tsec1
->sid
;
2693 /* Retain the exec and create SIDs across fork */
2694 tsec2
->exec_sid
= tsec1
->exec_sid
;
2695 tsec2
->create_sid
= tsec1
->create_sid
;
2697 /* Retain ptracer SID across fork, if any.
2698 This will be reset by the ptrace hook upon any
2699 subsequent ptrace_attach operations. */
2700 tsec2
->ptrace_sid
= tsec1
->ptrace_sid
;
2705 static void selinux_task_free_security(struct task_struct
*tsk
)
2707 task_free_security(tsk
);
2710 static int selinux_task_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2712 /* Since setuid only affects the current process, and
2713 since the SELinux controls are not based on the Linux
2714 identity attributes, SELinux does not need to control
2715 this operation. However, SELinux does control the use
2716 of the CAP_SETUID and CAP_SETGID capabilities using the
2721 static int selinux_task_post_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2723 return secondary_ops
->task_post_setuid(id0
,id1
,id2
,flags
);
2726 static int selinux_task_setgid(gid_t id0
, gid_t id1
, gid_t id2
, int flags
)
2728 /* See the comment for setuid above. */
2732 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
2734 return task_has_perm(current
, p
, PROCESS__SETPGID
);
2737 static int selinux_task_getpgid(struct task_struct
*p
)
2739 return task_has_perm(current
, p
, PROCESS__GETPGID
);
2742 static int selinux_task_getsid(struct task_struct
*p
)
2744 return task_has_perm(current
, p
, PROCESS__GETSESSION
);
2747 static int selinux_task_setgroups(struct group_info
*group_info
)
2749 /* See the comment for setuid above. */
2753 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
2757 rc
= secondary_ops
->task_setnice(p
, nice
);
2761 return task_has_perm(current
,p
, PROCESS__SETSCHED
);
2764 static int selinux_task_setrlimit(unsigned int resource
, struct rlimit
*new_rlim
)
2766 struct rlimit
*old_rlim
= current
->signal
->rlim
+ resource
;
2769 rc
= secondary_ops
->task_setrlimit(resource
, new_rlim
);
2773 /* Control the ability to change the hard limit (whether
2774 lowering or raising it), so that the hard limit can
2775 later be used as a safe reset point for the soft limit
2776 upon context transitions. See selinux_bprm_apply_creds. */
2777 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
2778 return task_has_perm(current
, current
, PROCESS__SETRLIMIT
);
2783 static int selinux_task_setscheduler(struct task_struct
*p
, int policy
, struct sched_param
*lp
)
2785 return task_has_perm(current
, p
, PROCESS__SETSCHED
);
2788 static int selinux_task_getscheduler(struct task_struct
*p
)
2790 return task_has_perm(current
, p
, PROCESS__GETSCHED
);
2793 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
, int sig
)
2798 rc
= secondary_ops
->task_kill(p
, info
, sig
);
2802 if (info
&& ((unsigned long)info
== 1 ||
2803 (unsigned long)info
== 2 || SI_FROMKERNEL(info
)))
2807 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
2809 perm
= signal_to_av(sig
);
2811 return task_has_perm(current
, p
, perm
);
2814 static int selinux_task_prctl(int option
,
2820 /* The current prctl operations do not appear to require
2821 any SELinux controls since they merely observe or modify
2822 the state of the current process. */
2826 static int selinux_task_wait(struct task_struct
*p
)
2830 perm
= signal_to_av(p
->exit_signal
);
2832 return task_has_perm(p
, current
, perm
);
2835 static void selinux_task_reparent_to_init(struct task_struct
*p
)
2837 struct task_security_struct
*tsec
;
2839 secondary_ops
->task_reparent_to_init(p
);
2842 tsec
->osid
= tsec
->sid
;
2843 tsec
->sid
= SECINITSID_KERNEL
;
2847 static void selinux_task_to_inode(struct task_struct
*p
,
2848 struct inode
*inode
)
2850 struct task_security_struct
*tsec
= p
->security
;
2851 struct inode_security_struct
*isec
= inode
->i_security
;
2853 isec
->sid
= tsec
->sid
;
2854 isec
->initialized
= 1;
2858 #ifdef CONFIG_SECURITY_NETWORK
2860 /* Returns error only if unable to parse addresses */
2861 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2863 int offset
, ihlen
, ret
= -EINVAL
;
2864 struct iphdr _iph
, *ih
;
2866 offset
= skb
->nh
.raw
- skb
->data
;
2867 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
2871 ihlen
= ih
->ihl
* 4;
2872 if (ihlen
< sizeof(_iph
))
2875 ad
->u
.net
.v4info
.saddr
= ih
->saddr
;
2876 ad
->u
.net
.v4info
.daddr
= ih
->daddr
;
2879 switch (ih
->protocol
) {
2881 struct tcphdr _tcph
, *th
;
2883 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2887 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2891 ad
->u
.net
.sport
= th
->source
;
2892 ad
->u
.net
.dport
= th
->dest
;
2897 struct udphdr _udph
, *uh
;
2899 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2903 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2907 ad
->u
.net
.sport
= uh
->source
;
2908 ad
->u
.net
.dport
= uh
->dest
;
2919 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2921 /* Returns error only if unable to parse addresses */
2922 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2925 int ret
= -EINVAL
, offset
;
2926 struct ipv6hdr _ipv6h
, *ip6
;
2928 offset
= skb
->nh
.raw
- skb
->data
;
2929 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
2933 ipv6_addr_copy(&ad
->u
.net
.v6info
.saddr
, &ip6
->saddr
);
2934 ipv6_addr_copy(&ad
->u
.net
.v6info
.daddr
, &ip6
->daddr
);
2937 nexthdr
= ip6
->nexthdr
;
2938 offset
+= sizeof(_ipv6h
);
2939 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
);
2945 struct tcphdr _tcph
, *th
;
2947 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2951 ad
->u
.net
.sport
= th
->source
;
2952 ad
->u
.net
.dport
= th
->dest
;
2957 struct udphdr _udph
, *uh
;
2959 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2963 ad
->u
.net
.sport
= uh
->source
;
2964 ad
->u
.net
.dport
= uh
->dest
;
2968 /* includes fragments */
2978 static int selinux_parse_skb(struct sk_buff
*skb
, struct avc_audit_data
*ad
,
2979 char **addrp
, int *len
, int src
)
2983 switch (ad
->u
.net
.family
) {
2985 ret
= selinux_parse_skb_ipv4(skb
, ad
);
2989 *addrp
= (char *)(src
? &ad
->u
.net
.v4info
.saddr
:
2990 &ad
->u
.net
.v4info
.daddr
);
2993 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2995 ret
= selinux_parse_skb_ipv6(skb
, ad
);
2999 *addrp
= (char *)(src
? &ad
->u
.net
.v6info
.saddr
:
3000 &ad
->u
.net
.v6info
.daddr
);
3010 /* socket security operations */
3011 static int socket_has_perm(struct task_struct
*task
, struct socket
*sock
,
3014 struct inode_security_struct
*isec
;
3015 struct task_security_struct
*tsec
;
3016 struct avc_audit_data ad
;
3019 tsec
= task
->security
;
3020 isec
= SOCK_INODE(sock
)->i_security
;
3022 if (isec
->sid
== SECINITSID_KERNEL
)
3025 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3026 ad
.u
.net
.sk
= sock
->sk
;
3027 err
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
3033 static int selinux_socket_create(int family
, int type
,
3034 int protocol
, int kern
)
3037 struct task_security_struct
*tsec
;
3042 tsec
= current
->security
;
3043 err
= avc_has_perm(tsec
->sid
, tsec
->sid
,
3044 socket_type_to_security_class(family
, type
,
3045 protocol
), SOCKET__CREATE
, NULL
);
3051 static void selinux_socket_post_create(struct socket
*sock
, int family
,
3052 int type
, int protocol
, int kern
)
3054 struct inode_security_struct
*isec
;
3055 struct task_security_struct
*tsec
;
3057 isec
= SOCK_INODE(sock
)->i_security
;
3059 tsec
= current
->security
;
3060 isec
->sclass
= socket_type_to_security_class(family
, type
, protocol
);
3061 isec
->sid
= kern
? SECINITSID_KERNEL
: tsec
->sid
;
3062 isec
->initialized
= 1;
3067 /* Range of port numbers used to automatically bind.
3068 Need to determine whether we should perform a name_bind
3069 permission check between the socket and the port number. */
3070 #define ip_local_port_range_0 sysctl_local_port_range[0]
3071 #define ip_local_port_range_1 sysctl_local_port_range[1]
3073 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3078 err
= socket_has_perm(current
, sock
, SOCKET__BIND
);
3083 * If PF_INET or PF_INET6, check name_bind permission for the port.
3085 family
= sock
->sk
->sk_family
;
3086 if (family
== PF_INET
|| family
== PF_INET6
) {
3088 struct inode_security_struct
*isec
;
3089 struct task_security_struct
*tsec
;
3090 struct avc_audit_data ad
;
3091 struct sockaddr_in
*addr4
= NULL
;
3092 struct sockaddr_in6
*addr6
= NULL
;
3093 unsigned short snum
;
3094 struct sock
*sk
= sock
->sk
;
3095 u32 sid
, node_perm
, addrlen
;
3097 tsec
= current
->security
;
3098 isec
= SOCK_INODE(sock
)->i_security
;
3100 if (family
== PF_INET
) {
3101 addr4
= (struct sockaddr_in
*)address
;
3102 snum
= ntohs(addr4
->sin_port
);
3103 addrlen
= sizeof(addr4
->sin_addr
.s_addr
);
3104 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
3106 addr6
= (struct sockaddr_in6
*)address
;
3107 snum
= ntohs(addr6
->sin6_port
);
3108 addrlen
= sizeof(addr6
->sin6_addr
.s6_addr
);
3109 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
3112 if (snum
&&(snum
< max(PROT_SOCK
,ip_local_port_range_0
) ||
3113 snum
> ip_local_port_range_1
)) {
3114 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3115 sk
->sk_protocol
, snum
, &sid
);
3118 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3119 ad
.u
.net
.sport
= htons(snum
);
3120 ad
.u
.net
.family
= family
;
3121 err
= avc_has_perm(isec
->sid
, sid
,
3123 SOCKET__NAME_BIND
, &ad
);
3128 switch(sk
->sk_protocol
) {
3130 node_perm
= TCP_SOCKET__NODE_BIND
;
3134 node_perm
= UDP_SOCKET__NODE_BIND
;
3138 node_perm
= RAWIP_SOCKET__NODE_BIND
;
3142 err
= security_node_sid(family
, addrp
, addrlen
, &sid
);
3146 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3147 ad
.u
.net
.sport
= htons(snum
);
3148 ad
.u
.net
.family
= family
;
3150 if (family
== PF_INET
)
3151 ad
.u
.net
.v4info
.saddr
= addr4
->sin_addr
.s_addr
;
3153 ipv6_addr_copy(&ad
.u
.net
.v6info
.saddr
, &addr6
->sin6_addr
);
3155 err
= avc_has_perm(isec
->sid
, sid
,
3156 isec
->sclass
, node_perm
, &ad
);
3164 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3166 struct inode_security_struct
*isec
;
3169 err
= socket_has_perm(current
, sock
, SOCKET__CONNECT
);
3174 * If a TCP socket, check name_connect permission for the port.
3176 isec
= SOCK_INODE(sock
)->i_security
;
3177 if (isec
->sclass
== SECCLASS_TCP_SOCKET
) {
3178 struct sock
*sk
= sock
->sk
;
3179 struct avc_audit_data ad
;
3180 struct sockaddr_in
*addr4
= NULL
;
3181 struct sockaddr_in6
*addr6
= NULL
;
3182 unsigned short snum
;
3185 if (sk
->sk_family
== PF_INET
) {
3186 addr4
= (struct sockaddr_in
*)address
;
3187 if (addrlen
< sizeof(struct sockaddr_in
))
3189 snum
= ntohs(addr4
->sin_port
);
3191 addr6
= (struct sockaddr_in6
*)address
;
3192 if (addrlen
< SIN6_LEN_RFC2133
)
3194 snum
= ntohs(addr6
->sin6_port
);
3197 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3198 sk
->sk_protocol
, snum
, &sid
);
3202 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3203 ad
.u
.net
.dport
= htons(snum
);
3204 ad
.u
.net
.family
= sk
->sk_family
;
3205 err
= avc_has_perm(isec
->sid
, sid
, isec
->sclass
,
3206 TCP_SOCKET__NAME_CONNECT
, &ad
);
3215 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
3217 return socket_has_perm(current
, sock
, SOCKET__LISTEN
);
3220 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
3223 struct inode_security_struct
*isec
;
3224 struct inode_security_struct
*newisec
;
3226 err
= socket_has_perm(current
, sock
, SOCKET__ACCEPT
);
3230 newisec
= SOCK_INODE(newsock
)->i_security
;
3232 isec
= SOCK_INODE(sock
)->i_security
;
3233 newisec
->sclass
= isec
->sclass
;
3234 newisec
->sid
= isec
->sid
;
3235 newisec
->initialized
= 1;
3240 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
3243 return socket_has_perm(current
, sock
, SOCKET__WRITE
);
3246 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
3247 int size
, int flags
)
3249 return socket_has_perm(current
, sock
, SOCKET__READ
);
3252 static int selinux_socket_getsockname(struct socket
*sock
)
3254 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3257 static int selinux_socket_getpeername(struct socket
*sock
)
3259 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3262 static int selinux_socket_setsockopt(struct socket
*sock
,int level
,int optname
)
3264 return socket_has_perm(current
, sock
, SOCKET__SETOPT
);
3267 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
3270 return socket_has_perm(current
, sock
, SOCKET__GETOPT
);
3273 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
3275 return socket_has_perm(current
, sock
, SOCKET__SHUTDOWN
);
3278 static int selinux_socket_unix_stream_connect(struct socket
*sock
,
3279 struct socket
*other
,
3282 struct sk_security_struct
*ssec
;
3283 struct inode_security_struct
*isec
;
3284 struct inode_security_struct
*other_isec
;
3285 struct avc_audit_data ad
;
3288 err
= secondary_ops
->unix_stream_connect(sock
, other
, newsk
);
3292 isec
= SOCK_INODE(sock
)->i_security
;
3293 other_isec
= SOCK_INODE(other
)->i_security
;
3295 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3296 ad
.u
.net
.sk
= other
->sk
;
3298 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3300 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
3304 /* connecting socket */
3305 ssec
= sock
->sk
->sk_security
;
3306 ssec
->peer_sid
= other_isec
->sid
;
3308 /* server child socket */
3309 ssec
= newsk
->sk_security
;
3310 ssec
->peer_sid
= isec
->sid
;
3315 static int selinux_socket_unix_may_send(struct socket
*sock
,
3316 struct socket
*other
)
3318 struct inode_security_struct
*isec
;
3319 struct inode_security_struct
*other_isec
;
3320 struct avc_audit_data ad
;
3323 isec
= SOCK_INODE(sock
)->i_security
;
3324 other_isec
= SOCK_INODE(other
)->i_security
;
3326 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3327 ad
.u
.net
.sk
= other
->sk
;
3329 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3330 isec
->sclass
, SOCKET__SENDTO
, &ad
);
3337 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
3342 u32 netif_perm
, node_perm
, node_sid
, if_sid
, recv_perm
= 0;
3345 struct socket
*sock
;
3346 struct net_device
*dev
;
3347 struct avc_audit_data ad
;
3349 family
= sk
->sk_family
;
3350 if (family
!= PF_INET
&& family
!= PF_INET6
)
3353 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3354 if (family
== PF_INET6
&& skb
->protocol
== ntohs(ETH_P_IP
))
3357 read_lock_bh(&sk
->sk_callback_lock
);
3358 sock
= sk
->sk_socket
;
3360 struct inode
*inode
;
3361 inode
= SOCK_INODE(sock
);
3363 struct inode_security_struct
*isec
;
3364 isec
= inode
->i_security
;
3365 sock_sid
= isec
->sid
;
3366 sock_class
= isec
->sclass
;
3369 read_unlock_bh(&sk
->sk_callback_lock
);
3377 err
= sel_netif_sids(dev
, &if_sid
, NULL
);
3381 switch (sock_class
) {
3382 case SECCLASS_UDP_SOCKET
:
3383 netif_perm
= NETIF__UDP_RECV
;
3384 node_perm
= NODE__UDP_RECV
;
3385 recv_perm
= UDP_SOCKET__RECV_MSG
;
3388 case SECCLASS_TCP_SOCKET
:
3389 netif_perm
= NETIF__TCP_RECV
;
3390 node_perm
= NODE__TCP_RECV
;
3391 recv_perm
= TCP_SOCKET__RECV_MSG
;
3395 netif_perm
= NETIF__RAWIP_RECV
;
3396 node_perm
= NODE__RAWIP_RECV
;
3400 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3401 ad
.u
.net
.netif
= dev
->name
;
3402 ad
.u
.net
.family
= family
;
3404 err
= selinux_parse_skb(skb
, &ad
, &addrp
, &len
, 1);
3408 err
= avc_has_perm(sock_sid
, if_sid
, SECCLASS_NETIF
, netif_perm
, &ad
);
3412 /* Fixme: this lookup is inefficient */
3413 err
= security_node_sid(family
, addrp
, len
, &node_sid
);
3417 err
= avc_has_perm(sock_sid
, node_sid
, SECCLASS_NODE
, node_perm
, &ad
);
3424 /* Fixme: make this more efficient */
3425 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3426 sk
->sk_protocol
, ntohs(ad
.u
.net
.sport
),
3431 err
= avc_has_perm(sock_sid
, port_sid
,
3432 sock_class
, recv_perm
, &ad
);
3438 static int selinux_socket_getpeersec(struct socket
*sock
, char __user
*optval
,
3439 int __user
*optlen
, unsigned len
)
3444 struct sk_security_struct
*ssec
;
3445 struct inode_security_struct
*isec
;
3447 isec
= SOCK_INODE(sock
)->i_security
;
3448 if (isec
->sclass
!= SECCLASS_UNIX_STREAM_SOCKET
) {
3453 ssec
= sock
->sk
->sk_security
;
3455 err
= security_sid_to_context(ssec
->peer_sid
, &scontext
, &scontext_len
);
3459 if (scontext_len
> len
) {
3464 if (copy_to_user(optval
, scontext
, scontext_len
))
3468 if (put_user(scontext_len
, optlen
))
3476 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, int priority
)
3478 return sk_alloc_security(sk
, family
, priority
);
3481 static void selinux_sk_free_security(struct sock
*sk
)
3483 sk_free_security(sk
);
3486 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
3490 struct nlmsghdr
*nlh
;
3491 struct socket
*sock
= sk
->sk_socket
;
3492 struct inode_security_struct
*isec
= SOCK_INODE(sock
)->i_security
;
3494 if (skb
->len
< NLMSG_SPACE(0)) {
3498 nlh
= (struct nlmsghdr
*)skb
->data
;
3500 err
= selinux_nlmsg_lookup(isec
->sclass
, nlh
->nlmsg_type
, &perm
);
3502 if (err
== -EINVAL
) {
3503 audit_log(current
->audit_context
, AUDIT_SELINUX_ERR
,
3504 "SELinux: unrecognized netlink message"
3505 " type=%hu for sclass=%hu\n",
3506 nlh
->nlmsg_type
, isec
->sclass
);
3507 if (!selinux_enforcing
)
3517 err
= socket_has_perm(current
, sock
, perm
);
3522 #ifdef CONFIG_NETFILTER
3524 static unsigned int selinux_ip_postroute_last(unsigned int hooknum
,
3525 struct sk_buff
**pskb
,
3526 const struct net_device
*in
,
3527 const struct net_device
*out
,
3528 int (*okfn
)(struct sk_buff
*),
3532 int len
, err
= NF_ACCEPT
;
3533 u32 netif_perm
, node_perm
, node_sid
, if_sid
, send_perm
= 0;
3535 struct socket
*sock
;
3536 struct inode
*inode
;
3537 struct sk_buff
*skb
= *pskb
;
3538 struct inode_security_struct
*isec
;
3539 struct avc_audit_data ad
;
3540 struct net_device
*dev
= (struct net_device
*)out
;
3546 sock
= sk
->sk_socket
;
3550 inode
= SOCK_INODE(sock
);
3554 err
= sel_netif_sids(dev
, &if_sid
, NULL
);
3558 isec
= inode
->i_security
;
3560 switch (isec
->sclass
) {
3561 case SECCLASS_UDP_SOCKET
:
3562 netif_perm
= NETIF__UDP_SEND
;
3563 node_perm
= NODE__UDP_SEND
;
3564 send_perm
= UDP_SOCKET__SEND_MSG
;
3567 case SECCLASS_TCP_SOCKET
:
3568 netif_perm
= NETIF__TCP_SEND
;
3569 node_perm
= NODE__TCP_SEND
;
3570 send_perm
= TCP_SOCKET__SEND_MSG
;
3574 netif_perm
= NETIF__RAWIP_SEND
;
3575 node_perm
= NODE__RAWIP_SEND
;
3580 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3581 ad
.u
.net
.netif
= dev
->name
;
3582 ad
.u
.net
.family
= family
;
3584 err
= selinux_parse_skb(skb
, &ad
, &addrp
,
3585 &len
, 0) ? NF_DROP
: NF_ACCEPT
;
3586 if (err
!= NF_ACCEPT
)
3589 err
= avc_has_perm(isec
->sid
, if_sid
, SECCLASS_NETIF
,
3590 netif_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3591 if (err
!= NF_ACCEPT
)
3594 /* Fixme: this lookup is inefficient */
3595 err
= security_node_sid(family
, addrp
, len
,
3596 &node_sid
) ? NF_DROP
: NF_ACCEPT
;
3597 if (err
!= NF_ACCEPT
)
3600 err
= avc_has_perm(isec
->sid
, node_sid
, SECCLASS_NODE
,
3601 node_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3602 if (err
!= NF_ACCEPT
)
3608 /* Fixme: make this more efficient */
3609 err
= security_port_sid(sk
->sk_family
,
3612 ntohs(ad
.u
.net
.dport
),
3613 &port_sid
) ? NF_DROP
: NF_ACCEPT
;
3614 if (err
!= NF_ACCEPT
)
3617 err
= avc_has_perm(isec
->sid
, port_sid
, isec
->sclass
,
3618 send_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3625 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum
,
3626 struct sk_buff
**pskb
,
3627 const struct net_device
*in
,
3628 const struct net_device
*out
,
3629 int (*okfn
)(struct sk_buff
*))
3631 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET
);
3634 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3636 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum
,
3637 struct sk_buff
**pskb
,
3638 const struct net_device
*in
,
3639 const struct net_device
*out
,
3640 int (*okfn
)(struct sk_buff
*))
3642 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET6
);
3647 #endif /* CONFIG_NETFILTER */
3651 static inline int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
3656 #endif /* CONFIG_SECURITY_NETWORK */
3658 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
3660 struct task_security_struct
*tsec
;
3661 struct av_decision avd
;
3664 err
= secondary_ops
->netlink_send(sk
, skb
);
3668 tsec
= current
->security
;
3671 avc_has_perm_noaudit(tsec
->sid
, tsec
->sid
,
3672 SECCLASS_CAPABILITY
, ~0, &avd
);
3673 cap_mask(NETLINK_CB(skb
).eff_cap
, avd
.allowed
);
3675 if (policydb_loaded_version
>= POLICYDB_VERSION_NLCLASS
)
3676 err
= selinux_nlmsg_perm(sk
, skb
);
3681 static int selinux_netlink_recv(struct sk_buff
*skb
)
3683 if (!cap_raised(NETLINK_CB(skb
).eff_cap
, CAP_NET_ADMIN
))
3688 static int ipc_alloc_security(struct task_struct
*task
,
3689 struct kern_ipc_perm
*perm
,
3692 struct task_security_struct
*tsec
= task
->security
;
3693 struct ipc_security_struct
*isec
;
3695 isec
= kmalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
3699 memset(isec
, 0, sizeof(struct ipc_security_struct
));
3700 isec
->magic
= SELINUX_MAGIC
;
3701 isec
->sclass
= sclass
;
3702 isec
->ipc_perm
= perm
;
3704 isec
->sid
= tsec
->sid
;
3706 isec
->sid
= SECINITSID_UNLABELED
;
3708 perm
->security
= isec
;
3713 static void ipc_free_security(struct kern_ipc_perm
*perm
)
3715 struct ipc_security_struct
*isec
= perm
->security
;
3716 if (!isec
|| isec
->magic
!= SELINUX_MAGIC
)
3719 perm
->security
= NULL
;
3723 static int msg_msg_alloc_security(struct msg_msg
*msg
)
3725 struct msg_security_struct
*msec
;
3727 msec
= kmalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
3731 memset(msec
, 0, sizeof(struct msg_security_struct
));
3732 msec
->magic
= SELINUX_MAGIC
;
3734 msec
->sid
= SECINITSID_UNLABELED
;
3735 msg
->security
= msec
;
3740 static void msg_msg_free_security(struct msg_msg
*msg
)
3742 struct msg_security_struct
*msec
= msg
->security
;
3743 if (!msec
|| msec
->magic
!= SELINUX_MAGIC
)
3746 msg
->security
= NULL
;
3750 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
3753 struct task_security_struct
*tsec
;
3754 struct ipc_security_struct
*isec
;
3755 struct avc_audit_data ad
;
3757 tsec
= current
->security
;
3758 isec
= ipc_perms
->security
;
3760 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3761 ad
.u
.ipc_id
= ipc_perms
->key
;
3763 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
3766 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
3768 return msg_msg_alloc_security(msg
);
3771 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
3773 msg_msg_free_security(msg
);
3776 /* message queue security operations */
3777 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
3779 struct task_security_struct
*tsec
;
3780 struct ipc_security_struct
*isec
;
3781 struct avc_audit_data ad
;
3784 rc
= ipc_alloc_security(current
, &msq
->q_perm
, SECCLASS_MSGQ
);
3788 tsec
= current
->security
;
3789 isec
= msq
->q_perm
.security
;
3791 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3792 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3794 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3797 ipc_free_security(&msq
->q_perm
);
3803 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
3805 ipc_free_security(&msq
->q_perm
);
3808 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
3810 struct task_security_struct
*tsec
;
3811 struct ipc_security_struct
*isec
;
3812 struct avc_audit_data ad
;
3814 tsec
= current
->security
;
3815 isec
= msq
->q_perm
.security
;
3817 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3818 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3820 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3821 MSGQ__ASSOCIATE
, &ad
);
3824 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
3832 /* No specific object, just general system-wide information. */
3833 return task_has_system(current
, SYSTEM__IPC_INFO
);
3836 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
3839 perms
= MSGQ__SETATTR
;
3842 perms
= MSGQ__DESTROY
;
3848 err
= ipc_has_perm(&msq
->q_perm
, perms
);
3852 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
3854 struct task_security_struct
*tsec
;
3855 struct ipc_security_struct
*isec
;
3856 struct msg_security_struct
*msec
;
3857 struct avc_audit_data ad
;
3860 tsec
= current
->security
;
3861 isec
= msq
->q_perm
.security
;
3862 msec
= msg
->security
;
3865 * First time through, need to assign label to the message
3867 if (msec
->sid
== SECINITSID_UNLABELED
) {
3869 * Compute new sid based on current process and
3870 * message queue this message will be stored in
3872 rc
= security_transition_sid(tsec
->sid
,
3880 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3881 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3883 /* Can this process write to the queue? */
3884 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3887 /* Can this process send the message */
3888 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
3889 SECCLASS_MSG
, MSG__SEND
, &ad
);
3891 /* Can the message be put in the queue? */
3892 rc
= avc_has_perm(msec
->sid
, isec
->sid
,
3893 SECCLASS_MSGQ
, MSGQ__ENQUEUE
, &ad
);
3898 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
3899 struct task_struct
*target
,
3900 long type
, int mode
)
3902 struct task_security_struct
*tsec
;
3903 struct ipc_security_struct
*isec
;
3904 struct msg_security_struct
*msec
;
3905 struct avc_audit_data ad
;
3908 tsec
= target
->security
;
3909 isec
= msq
->q_perm
.security
;
3910 msec
= msg
->security
;
3912 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3913 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3915 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
3916 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
3918 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
3919 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
3923 /* Shared Memory security operations */
3924 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
3926 struct task_security_struct
*tsec
;
3927 struct ipc_security_struct
*isec
;
3928 struct avc_audit_data ad
;
3931 rc
= ipc_alloc_security(current
, &shp
->shm_perm
, SECCLASS_SHM
);
3935 tsec
= current
->security
;
3936 isec
= shp
->shm_perm
.security
;
3938 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3939 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
3941 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
3944 ipc_free_security(&shp
->shm_perm
);
3950 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
3952 ipc_free_security(&shp
->shm_perm
);
3955 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
3957 struct task_security_struct
*tsec
;
3958 struct ipc_security_struct
*isec
;
3959 struct avc_audit_data ad
;
3961 tsec
= current
->security
;
3962 isec
= shp
->shm_perm
.security
;
3964 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3965 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
3967 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
3968 SHM__ASSOCIATE
, &ad
);
3971 /* Note, at this point, shp is locked down */
3972 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
3980 /* No specific object, just general system-wide information. */
3981 return task_has_system(current
, SYSTEM__IPC_INFO
);
3984 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
3987 perms
= SHM__SETATTR
;
3994 perms
= SHM__DESTROY
;
4000 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
4004 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
4005 char __user
*shmaddr
, int shmflg
)
4010 rc
= secondary_ops
->shm_shmat(shp
, shmaddr
, shmflg
);
4014 if (shmflg
& SHM_RDONLY
)
4017 perms
= SHM__READ
| SHM__WRITE
;
4019 return ipc_has_perm(&shp
->shm_perm
, perms
);
4022 /* Semaphore security operations */
4023 static int selinux_sem_alloc_security(struct sem_array
*sma
)
4025 struct task_security_struct
*tsec
;
4026 struct ipc_security_struct
*isec
;
4027 struct avc_audit_data ad
;
4030 rc
= ipc_alloc_security(current
, &sma
->sem_perm
, SECCLASS_SEM
);
4034 tsec
= current
->security
;
4035 isec
= sma
->sem_perm
.security
;
4037 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4038 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
4040 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
4043 ipc_free_security(&sma
->sem_perm
);
4049 static void selinux_sem_free_security(struct sem_array
*sma
)
4051 ipc_free_security(&sma
->sem_perm
);
4054 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
4056 struct task_security_struct
*tsec
;
4057 struct ipc_security_struct
*isec
;
4058 struct avc_audit_data ad
;
4060 tsec
= current
->security
;
4061 isec
= sma
->sem_perm
.security
;
4063 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4064 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
4066 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
4067 SEM__ASSOCIATE
, &ad
);
4070 /* Note, at this point, sma is locked down */
4071 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
4079 /* No specific object, just general system-wide information. */
4080 return task_has_system(current
, SYSTEM__IPC_INFO
);
4084 perms
= SEM__GETATTR
;
4095 perms
= SEM__DESTROY
;
4098 perms
= SEM__SETATTR
;
4102 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
4108 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
4112 static int selinux_sem_semop(struct sem_array
*sma
,
4113 struct sembuf
*sops
, unsigned nsops
, int alter
)
4118 perms
= SEM__READ
| SEM__WRITE
;
4122 return ipc_has_perm(&sma
->sem_perm
, perms
);
4125 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
4131 av
|= IPC__UNIX_READ
;
4133 av
|= IPC__UNIX_WRITE
;
4138 return ipc_has_perm(ipcp
, av
);
4141 /* module stacking operations */
4142 static int selinux_register_security (const char *name
, struct security_operations
*ops
)
4144 if (secondary_ops
!= original_ops
) {
4145 printk(KERN_INFO
"%s: There is already a secondary security "
4146 "module registered.\n", __FUNCTION__
);
4150 secondary_ops
= ops
;
4152 printk(KERN_INFO
"%s: Registering secondary module %s\n",
4159 static int selinux_unregister_security (const char *name
, struct security_operations
*ops
)
4161 if (ops
!= secondary_ops
) {
4162 printk (KERN_INFO
"%s: trying to unregister a security module "
4163 "that is not registered.\n", __FUNCTION__
);
4167 secondary_ops
= original_ops
;
4172 static void selinux_d_instantiate (struct dentry
*dentry
, struct inode
*inode
)
4175 inode_doinit_with_dentry(inode
, dentry
);
4178 static int selinux_getprocattr(struct task_struct
*p
,
4179 char *name
, void *value
, size_t size
)
4181 struct task_security_struct
*tsec
;
4187 error
= task_has_perm(current
, p
, PROCESS__GETATTR
);
4197 if (!strcmp(name
, "current"))
4199 else if (!strcmp(name
, "prev"))
4201 else if (!strcmp(name
, "exec"))
4202 sid
= tsec
->exec_sid
;
4203 else if (!strcmp(name
, "fscreate"))
4204 sid
= tsec
->create_sid
;
4211 error
= security_sid_to_context(sid
, &context
, &len
);
4218 memcpy(value
, context
, len
);
4223 static int selinux_setprocattr(struct task_struct
*p
,
4224 char *name
, void *value
, size_t size
)
4226 struct task_security_struct
*tsec
;
4232 /* SELinux only allows a process to change its own
4233 security attributes. */
4238 * Basic control over ability to set these attributes at all.
4239 * current == p, but we'll pass them separately in case the
4240 * above restriction is ever removed.
4242 if (!strcmp(name
, "exec"))
4243 error
= task_has_perm(current
, p
, PROCESS__SETEXEC
);
4244 else if (!strcmp(name
, "fscreate"))
4245 error
= task_has_perm(current
, p
, PROCESS__SETFSCREATE
);
4246 else if (!strcmp(name
, "current"))
4247 error
= task_has_perm(current
, p
, PROCESS__SETCURRENT
);
4253 /* Obtain a SID for the context, if one was specified. */
4254 if (size
&& str
[1] && str
[1] != '\n') {
4255 if (str
[size
-1] == '\n') {
4259 error
= security_context_to_sid(value
, size
, &sid
);
4264 /* Permission checking based on the specified context is
4265 performed during the actual operation (execve,
4266 open/mkdir/...), when we know the full context of the
4267 operation. See selinux_bprm_set_security for the execve
4268 checks and may_create for the file creation checks. The
4269 operation will then fail if the context is not permitted. */
4271 if (!strcmp(name
, "exec"))
4272 tsec
->exec_sid
= sid
;
4273 else if (!strcmp(name
, "fscreate"))
4274 tsec
->create_sid
= sid
;
4275 else if (!strcmp(name
, "current")) {
4276 struct av_decision avd
;
4281 /* Only allow single threaded processes to change context */
4282 if (atomic_read(&p
->mm
->mm_users
) != 1) {
4283 struct task_struct
*g
, *t
;
4284 struct mm_struct
*mm
= p
->mm
;
4285 read_lock(&tasklist_lock
);
4286 do_each_thread(g
, t
)
4287 if (t
->mm
== mm
&& t
!= p
) {
4288 read_unlock(&tasklist_lock
);
4291 while_each_thread(g
, t
);
4292 read_unlock(&tasklist_lock
);
4295 /* Check permissions for the transition. */
4296 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
4297 PROCESS__DYNTRANSITION
, NULL
);
4301 /* Check for ptracing, and update the task SID if ok.
4302 Otherwise, leave SID unchanged and fail. */
4304 if (p
->ptrace
& PT_PTRACED
) {
4305 error
= avc_has_perm_noaudit(tsec
->ptrace_sid
, sid
,
4307 PROCESS__PTRACE
, &avd
);
4311 avc_audit(tsec
->ptrace_sid
, sid
, SECCLASS_PROCESS
,
4312 PROCESS__PTRACE
, &avd
, error
, NULL
);
4326 static struct security_operations selinux_ops
= {
4327 .ptrace
= selinux_ptrace
,
4328 .capget
= selinux_capget
,
4329 .capset_check
= selinux_capset_check
,
4330 .capset_set
= selinux_capset_set
,
4331 .sysctl
= selinux_sysctl
,
4332 .capable
= selinux_capable
,
4333 .quotactl
= selinux_quotactl
,
4334 .quota_on
= selinux_quota_on
,
4335 .syslog
= selinux_syslog
,
4336 .vm_enough_memory
= selinux_vm_enough_memory
,
4338 .netlink_send
= selinux_netlink_send
,
4339 .netlink_recv
= selinux_netlink_recv
,
4341 .bprm_alloc_security
= selinux_bprm_alloc_security
,
4342 .bprm_free_security
= selinux_bprm_free_security
,
4343 .bprm_apply_creds
= selinux_bprm_apply_creds
,
4344 .bprm_post_apply_creds
= selinux_bprm_post_apply_creds
,
4345 .bprm_set_security
= selinux_bprm_set_security
,
4346 .bprm_check_security
= selinux_bprm_check_security
,
4347 .bprm_secureexec
= selinux_bprm_secureexec
,
4349 .sb_alloc_security
= selinux_sb_alloc_security
,
4350 .sb_free_security
= selinux_sb_free_security
,
4351 .sb_copy_data
= selinux_sb_copy_data
,
4352 .sb_kern_mount
= selinux_sb_kern_mount
,
4353 .sb_statfs
= selinux_sb_statfs
,
4354 .sb_mount
= selinux_mount
,
4355 .sb_umount
= selinux_umount
,
4357 .inode_alloc_security
= selinux_inode_alloc_security
,
4358 .inode_free_security
= selinux_inode_free_security
,
4359 .inode_init_security
= selinux_inode_init_security
,
4360 .inode_create
= selinux_inode_create
,
4361 .inode_post_create
= selinux_inode_post_create
,
4362 .inode_link
= selinux_inode_link
,
4363 .inode_post_link
= selinux_inode_post_link
,
4364 .inode_unlink
= selinux_inode_unlink
,
4365 .inode_symlink
= selinux_inode_symlink
,
4366 .inode_post_symlink
= selinux_inode_post_symlink
,
4367 .inode_mkdir
= selinux_inode_mkdir
,
4368 .inode_post_mkdir
= selinux_inode_post_mkdir
,
4369 .inode_rmdir
= selinux_inode_rmdir
,
4370 .inode_mknod
= selinux_inode_mknod
,
4371 .inode_post_mknod
= selinux_inode_post_mknod
,
4372 .inode_rename
= selinux_inode_rename
,
4373 .inode_post_rename
= selinux_inode_post_rename
,
4374 .inode_readlink
= selinux_inode_readlink
,
4375 .inode_follow_link
= selinux_inode_follow_link
,
4376 .inode_permission
= selinux_inode_permission
,
4377 .inode_setattr
= selinux_inode_setattr
,
4378 .inode_getattr
= selinux_inode_getattr
,
4379 .inode_setxattr
= selinux_inode_setxattr
,
4380 .inode_post_setxattr
= selinux_inode_post_setxattr
,
4381 .inode_getxattr
= selinux_inode_getxattr
,
4382 .inode_listxattr
= selinux_inode_listxattr
,
4383 .inode_removexattr
= selinux_inode_removexattr
,
4384 .inode_getsecurity
= selinux_inode_getsecurity
,
4385 .inode_setsecurity
= selinux_inode_setsecurity
,
4386 .inode_listsecurity
= selinux_inode_listsecurity
,
4388 .file_permission
= selinux_file_permission
,
4389 .file_alloc_security
= selinux_file_alloc_security
,
4390 .file_free_security
= selinux_file_free_security
,
4391 .file_ioctl
= selinux_file_ioctl
,
4392 .file_mmap
= selinux_file_mmap
,
4393 .file_mprotect
= selinux_file_mprotect
,
4394 .file_lock
= selinux_file_lock
,
4395 .file_fcntl
= selinux_file_fcntl
,
4396 .file_set_fowner
= selinux_file_set_fowner
,
4397 .file_send_sigiotask
= selinux_file_send_sigiotask
,
4398 .file_receive
= selinux_file_receive
,
4400 .task_create
= selinux_task_create
,
4401 .task_alloc_security
= selinux_task_alloc_security
,
4402 .task_free_security
= selinux_task_free_security
,
4403 .task_setuid
= selinux_task_setuid
,
4404 .task_post_setuid
= selinux_task_post_setuid
,
4405 .task_setgid
= selinux_task_setgid
,
4406 .task_setpgid
= selinux_task_setpgid
,
4407 .task_getpgid
= selinux_task_getpgid
,
4408 .task_getsid
= selinux_task_getsid
,
4409 .task_setgroups
= selinux_task_setgroups
,
4410 .task_setnice
= selinux_task_setnice
,
4411 .task_setrlimit
= selinux_task_setrlimit
,
4412 .task_setscheduler
= selinux_task_setscheduler
,
4413 .task_getscheduler
= selinux_task_getscheduler
,
4414 .task_kill
= selinux_task_kill
,
4415 .task_wait
= selinux_task_wait
,
4416 .task_prctl
= selinux_task_prctl
,
4417 .task_reparent_to_init
= selinux_task_reparent_to_init
,
4418 .task_to_inode
= selinux_task_to_inode
,
4420 .ipc_permission
= selinux_ipc_permission
,
4422 .msg_msg_alloc_security
= selinux_msg_msg_alloc_security
,
4423 .msg_msg_free_security
= selinux_msg_msg_free_security
,
4425 .msg_queue_alloc_security
= selinux_msg_queue_alloc_security
,
4426 .msg_queue_free_security
= selinux_msg_queue_free_security
,
4427 .msg_queue_associate
= selinux_msg_queue_associate
,
4428 .msg_queue_msgctl
= selinux_msg_queue_msgctl
,
4429 .msg_queue_msgsnd
= selinux_msg_queue_msgsnd
,
4430 .msg_queue_msgrcv
= selinux_msg_queue_msgrcv
,
4432 .shm_alloc_security
= selinux_shm_alloc_security
,
4433 .shm_free_security
= selinux_shm_free_security
,
4434 .shm_associate
= selinux_shm_associate
,
4435 .shm_shmctl
= selinux_shm_shmctl
,
4436 .shm_shmat
= selinux_shm_shmat
,
4438 .sem_alloc_security
= selinux_sem_alloc_security
,
4439 .sem_free_security
= selinux_sem_free_security
,
4440 .sem_associate
= selinux_sem_associate
,
4441 .sem_semctl
= selinux_sem_semctl
,
4442 .sem_semop
= selinux_sem_semop
,
4444 .register_security
= selinux_register_security
,
4445 .unregister_security
= selinux_unregister_security
,
4447 .d_instantiate
= selinux_d_instantiate
,
4449 .getprocattr
= selinux_getprocattr
,
4450 .setprocattr
= selinux_setprocattr
,
4452 #ifdef CONFIG_SECURITY_NETWORK
4453 .unix_stream_connect
= selinux_socket_unix_stream_connect
,
4454 .unix_may_send
= selinux_socket_unix_may_send
,
4456 .socket_create
= selinux_socket_create
,
4457 .socket_post_create
= selinux_socket_post_create
,
4458 .socket_bind
= selinux_socket_bind
,
4459 .socket_connect
= selinux_socket_connect
,
4460 .socket_listen
= selinux_socket_listen
,
4461 .socket_accept
= selinux_socket_accept
,
4462 .socket_sendmsg
= selinux_socket_sendmsg
,
4463 .socket_recvmsg
= selinux_socket_recvmsg
,
4464 .socket_getsockname
= selinux_socket_getsockname
,
4465 .socket_getpeername
= selinux_socket_getpeername
,
4466 .socket_getsockopt
= selinux_socket_getsockopt
,
4467 .socket_setsockopt
= selinux_socket_setsockopt
,
4468 .socket_shutdown
= selinux_socket_shutdown
,
4469 .socket_sock_rcv_skb
= selinux_socket_sock_rcv_skb
,
4470 .socket_getpeersec
= selinux_socket_getpeersec
,
4471 .sk_alloc_security
= selinux_sk_alloc_security
,
4472 .sk_free_security
= selinux_sk_free_security
,
4476 static __init
int selinux_init(void)
4478 struct task_security_struct
*tsec
;
4480 if (!selinux_enabled
) {
4481 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
4485 printk(KERN_INFO
"SELinux: Initializing.\n");
4487 /* Set the security state for the initial task. */
4488 if (task_alloc_security(current
))
4489 panic("SELinux: Failed to initialize initial task.\n");
4490 tsec
= current
->security
;
4491 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
4495 original_ops
= secondary_ops
= security_ops
;
4497 panic ("SELinux: No initial security operations\n");
4498 if (register_security (&selinux_ops
))
4499 panic("SELinux: Unable to register with kernel.\n");
4501 if (selinux_enforcing
) {
4502 printk(KERN_INFO
"SELinux: Starting in enforcing mode\n");
4504 printk(KERN_INFO
"SELinux: Starting in permissive mode\n");
4509 void selinux_complete_init(void)
4511 printk(KERN_INFO
"SELinux: Completing initialization.\n");
4513 /* Set up any superblocks initialized prior to the policy load. */
4514 printk(KERN_INFO
"SELinux: Setting up existing superblocks.\n");
4515 spin_lock(&sb_security_lock
);
4517 if (!list_empty(&superblock_security_head
)) {
4518 struct superblock_security_struct
*sbsec
=
4519 list_entry(superblock_security_head
.next
,
4520 struct superblock_security_struct
,
4522 struct super_block
*sb
= sbsec
->sb
;
4523 spin_lock(&sb_lock
);
4525 spin_unlock(&sb_lock
);
4526 spin_unlock(&sb_security_lock
);
4527 down_read(&sb
->s_umount
);
4529 superblock_doinit(sb
, NULL
);
4531 spin_lock(&sb_security_lock
);
4532 list_del_init(&sbsec
->list
);
4535 spin_unlock(&sb_security_lock
);
4538 /* SELinux requires early initialization in order to label
4539 all processes and objects when they are created. */
4540 security_initcall(selinux_init
);
4542 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4544 static struct nf_hook_ops selinux_ipv4_op
= {
4545 .hook
= selinux_ipv4_postroute_last
,
4546 .owner
= THIS_MODULE
,
4548 .hooknum
= NF_IP_POST_ROUTING
,
4549 .priority
= NF_IP_PRI_SELINUX_LAST
,
4552 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4554 static struct nf_hook_ops selinux_ipv6_op
= {
4555 .hook
= selinux_ipv6_postroute_last
,
4556 .owner
= THIS_MODULE
,
4558 .hooknum
= NF_IP6_POST_ROUTING
,
4559 .priority
= NF_IP6_PRI_SELINUX_LAST
,
4564 static int __init
selinux_nf_ip_init(void)
4568 if (!selinux_enabled
)
4571 printk(KERN_INFO
"SELinux: Registering netfilter hooks\n");
4573 err
= nf_register_hook(&selinux_ipv4_op
);
4575 panic("SELinux: nf_register_hook for IPv4: error %d\n", err
);
4577 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4579 err
= nf_register_hook(&selinux_ipv6_op
);
4581 panic("SELinux: nf_register_hook for IPv6: error %d\n", err
);
4588 __initcall(selinux_nf_ip_init
);
4590 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4591 static void selinux_nf_ip_exit(void)
4593 printk(KERN_INFO
"SELinux: Unregistering netfilter hooks\n");
4595 nf_unregister_hook(&selinux_ipv4_op
);
4596 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4597 nf_unregister_hook(&selinux_ipv6_op
);
4602 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4604 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4605 #define selinux_nf_ip_exit()
4608 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4610 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4611 int selinux_disable(void)
4613 extern void exit_sel_fs(void);
4614 static int selinux_disabled
= 0;
4616 if (ss_initialized
) {
4617 /* Not permitted after initial policy load. */
4621 if (selinux_disabled
) {
4622 /* Only do this once. */
4626 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
4628 selinux_disabled
= 1;
4630 /* Reset security_ops to the secondary module, dummy or capability. */
4631 security_ops
= secondary_ops
;
4633 /* Unregister netfilter hooks. */
4634 selinux_nf_ip_exit();
4636 /* Unregister selinuxfs. */