?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Committer: Michael Beasley <mike@snafu.setup>
[mikesnafu-overlay.git] / security / selinux / hooks.c
blobf4fa9822b23fc61c8139c0e35a733e0d0fa050b7
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
16 * Paul Moore <paul.moore@hp.com>
17 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
18 * Yuichi Nakamura <ynakam@hitachisoft.jp>
19 *
20 * This program is free software; you can redistribute it and/or modify
21 * it under the terms of the GNU General Public License version 2,
22 * as published by the Free Software Foundation.
23 */
24
25 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/ptrace.h>
28 #include <linux/errno.h>
29 #include <linux/sched.h>
30 #include <linux/security.h>
31 #include <linux/xattr.h>
32 #include <linux/capability.h>
33 #include <linux/unistd.h>
34 #include <linux/mm.h>
35 #include <linux/mman.h>
36 #include <linux/slab.h>
37 #include <linux/pagemap.h>
38 #include <linux/swap.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <asm/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78
79 #include "avc.h"
80 #include "objsec.h"
81 #include "netif.h"
82 #include "netnode.h"
83 #include "xfrm.h"
84 #include "netlabel.h"
85
86 #define XATTR_SELINUX_SUFFIX "selinux"
87 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
88
89 #define NUM_SEL_MNT_OPTS 4
90
91 extern unsigned int policydb_loaded_version;
92 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
93 extern int selinux_compat_net;
94 extern struct security_operations *security_ops;
95
96 /* SECMARK reference count */
97 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
98
99 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
100 int selinux_enforcing = 0;
101
102 static int __init enforcing_setup(char *str)
103 {
104 selinux_enforcing = simple_strtol(str,NULL,0);
105 return 1;
106 }
107 __setup("enforcing=", enforcing_setup);
108 #endif
109
110 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
111 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
112
113 static int __init selinux_enabled_setup(char *str)
114 {
115 selinux_enabled = simple_strtol(str, NULL, 0);
116 return 1;
117 }
118 __setup("selinux=", selinux_enabled_setup);
119 #else
120 int selinux_enabled = 1;
121 #endif
122
123 /* Original (dummy) security module. */
124 static struct security_operations *original_ops = NULL;
125
126 /* Minimal support for a secondary security module,
127 just to allow the use of the dummy or capability modules.
128 The owlsm module can alternatively be used as a secondary
129 module as long as CONFIG_OWLSM_FD is not enabled. */
130 static struct security_operations *secondary_ops = NULL;
131
132 /* Lists of inode and superblock security structures initialized
133 before the policy was loaded. */
134 static LIST_HEAD(superblock_security_head);
135 static DEFINE_SPINLOCK(sb_security_lock);
136
137 static struct kmem_cache *sel_inode_cache;
138
139 /**
140 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
141 *
142 * Description:
143 * This function checks the SECMARK reference counter to see if any SECMARK
144 * targets are currently configured, if the reference counter is greater than
145 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
146 * enabled, false (0) if SECMARK is disabled.
147 *
148 */
149 static int selinux_secmark_enabled(void)
150 {
151 return (atomic_read(&selinux_secmark_refcount) > 0);
152 }
153
154 /* Allocate and free functions for each kind of security blob. */
155
156 static int task_alloc_security(struct task_struct *task)
157 {
158 struct task_security_struct *tsec;
159
160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
161 if (!tsec)
162 return -ENOMEM;
163
164 tsec->task = task;
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
167
168 return 0;
169 }
170
171 static void task_free_security(struct task_struct *task)
172 {
173 struct task_security_struct *tsec = task->security;
174 task->security = NULL;
175 kfree(tsec);
176 }
177
178 static int inode_alloc_security(struct inode *inode)
179 {
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
182
183 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
184 if (!isec)
185 return -ENOMEM;
186
187 mutex_init(&isec->lock);
188 INIT_LIST_HEAD(&isec->list);
189 isec->inode = inode;
190 isec->sid = SECINITSID_UNLABELED;
191 isec->sclass = SECCLASS_FILE;
192 isec->task_sid = tsec->sid;
193 inode->i_security = isec;
194
195 return 0;
196 }
197
198 static void inode_free_security(struct inode *inode)
199 {
200 struct inode_security_struct *isec = inode->i_security;
201 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
202
203 spin_lock(&sbsec->isec_lock);
204 if (!list_empty(&isec->list))
205 list_del_init(&isec->list);
206 spin_unlock(&sbsec->isec_lock);
207
208 inode->i_security = NULL;
209 kmem_cache_free(sel_inode_cache, isec);
210 }
211
212 static int file_alloc_security(struct file *file)
213 {
214 struct task_security_struct *tsec = current->security;
215 struct file_security_struct *fsec;
216
217 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
218 if (!fsec)
219 return -ENOMEM;
220
221 fsec->file = file;
222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
224 file->f_security = fsec;
225
226 return 0;
227 }
228
229 static void file_free_security(struct file *file)
230 {
231 struct file_security_struct *fsec = file->f_security;
232 file->f_security = NULL;
233 kfree(fsec);
234 }
235
236 static int superblock_alloc_security(struct super_block *sb)
237 {
238 struct superblock_security_struct *sbsec;
239
240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
241 if (!sbsec)
242 return -ENOMEM;
243
244 mutex_init(&sbsec->lock);
245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
252 sb->s_security = sbsec;
253
254 return 0;
255 }
256
257 static void superblock_free_security(struct super_block *sb)
258 {
259 struct superblock_security_struct *sbsec = sb->s_security;
260
261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268 }
269
270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
271 {
272 struct sk_security_struct *ssec;
273
274 ssec = kzalloc(sizeof(*ssec), priority);
275 if (!ssec)
276 return -ENOMEM;
277
278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 ssec->sid = SECINITSID_UNLABELED;
281 sk->sk_security = ssec;
282
283 selinux_netlbl_sk_security_init(ssec, family);
284
285 return 0;
286 }
287
288 static void sk_free_security(struct sock *sk)
289 {
290 struct sk_security_struct *ssec = sk->sk_security;
291
292 sk->sk_security = NULL;
293 kfree(ssec);
294 }
295
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
299
300 /* The file system's label must be initialized prior to use. */
301
302 static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309 };
310
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313 static inline int inode_doinit(struct inode *inode)
314 {
315 return inode_doinit_with_dentry(inode, NULL);
316 }
317
318 enum {
319 Opt_error = -1,
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 3,
323 Opt_rootcontext = 4,
324 };
325
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
331 {Opt_error, NULL},
332 };
333
334 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
335
336 static int may_context_mount_sb_relabel(u32 sid,
337 struct superblock_security_struct *sbsec,
338 struct task_security_struct *tsec)
339 {
340 int rc;
341
342 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
343 FILESYSTEM__RELABELFROM, NULL);
344 if (rc)
345 return rc;
346
347 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELTO, NULL);
349 return rc;
350 }
351
352 static int may_context_mount_inode_relabel(u32 sid,
353 struct superblock_security_struct *sbsec,
354 struct task_security_struct *tsec)
355 {
356 int rc;
357 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
358 FILESYSTEM__RELABELFROM, NULL);
359 if (rc)
360 return rc;
361
362 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
363 FILESYSTEM__ASSOCIATE, NULL);
364 return rc;
365 }
366
367 static int sb_finish_set_opts(struct super_block *sb)
368 {
369 struct superblock_security_struct *sbsec = sb->s_security;
370 struct dentry *root = sb->s_root;
371 struct inode *root_inode = root->d_inode;
372 int rc = 0;
373
374 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
375 /* Make sure that the xattr handler exists and that no
376 error other than -ENODATA is returned by getxattr on
377 the root directory. -ENODATA is ok, as this may be
378 the first boot of the SELinux kernel before we have
379 assigned xattr values to the filesystem. */
380 if (!root_inode->i_op->getxattr) {
381 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
382 "xattr support\n", sb->s_id, sb->s_type->name);
383 rc = -EOPNOTSUPP;
384 goto out;
385 }
386 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
387 if (rc < 0 && rc != -ENODATA) {
388 if (rc == -EOPNOTSUPP)
389 printk(KERN_WARNING "SELinux: (dev %s, type "
390 "%s) has no security xattr handler\n",
391 sb->s_id, sb->s_type->name);
392 else
393 printk(KERN_WARNING "SELinux: (dev %s, type "
394 "%s) getxattr errno %d\n", sb->s_id,
395 sb->s_type->name, -rc);
396 goto out;
397 }
398 }
399
400 sbsec->initialized = 1;
401
402 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
403 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
404 sb->s_id, sb->s_type->name);
405 else
406 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
407 sb->s_id, sb->s_type->name,
408 labeling_behaviors[sbsec->behavior-1]);
409
410 /* Initialize the root inode. */
411 rc = inode_doinit_with_dentry(root_inode, root);
412
413 /* Initialize any other inodes associated with the superblock, e.g.
414 inodes created prior to initial policy load or inodes created
415 during get_sb by a pseudo filesystem that directly
416 populates itself. */
417 spin_lock(&sbsec->isec_lock);
418 next_inode:
419 if (!list_empty(&sbsec->isec_head)) {
420 struct inode_security_struct *isec =
421 list_entry(sbsec->isec_head.next,
422 struct inode_security_struct, list);
423 struct inode *inode = isec->inode;
424 spin_unlock(&sbsec->isec_lock);
425 inode = igrab(inode);
426 if (inode) {
427 if (!IS_PRIVATE(inode))
428 inode_doinit(inode);
429 iput(inode);
430 }
431 spin_lock(&sbsec->isec_lock);
432 list_del_init(&isec->list);
433 goto next_inode;
434 }
435 spin_unlock(&sbsec->isec_lock);
436 out:
437 return rc;
438 }
439
440 /*
441 * This function should allow an FS to ask what it's mount security
442 * options were so it can use those later for submounts, displaying
443 * mount options, or whatever.
444 */
445 static int selinux_get_mnt_opts(const struct super_block *sb,
446 struct security_mnt_opts *opts)
447 {
448 int rc = 0, i;
449 struct superblock_security_struct *sbsec = sb->s_security;
450 char *context = NULL;
451 u32 len;
452 char tmp;
453
454 security_init_mnt_opts(opts);
455
456 if (!sbsec->initialized)
457 return -EINVAL;
458
459 if (!ss_initialized)
460 return -EINVAL;
461
462 /*
463 * if we ever use sbsec flags for anything other than tracking mount
464 * settings this is going to need a mask
465 */
466 tmp = sbsec->flags;
467 /* count the number of mount options for this sb */
468 for (i = 0; i < 8; i++) {
469 if (tmp & 0x01)
470 opts->num_mnt_opts++;
471 tmp >>= 1;
472 }
473
474 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
475 if (!opts->mnt_opts) {
476 rc = -ENOMEM;
477 goto out_free;
478 }
479
480 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
481 if (!opts->mnt_opts_flags) {
482 rc = -ENOMEM;
483 goto out_free;
484 }
485
486 i = 0;
487 if (sbsec->flags & FSCONTEXT_MNT) {
488 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 if (rc)
490 goto out_free;
491 opts->mnt_opts[i] = context;
492 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
493 }
494 if (sbsec->flags & CONTEXT_MNT) {
495 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 if (rc)
497 goto out_free;
498 opts->mnt_opts[i] = context;
499 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
500 }
501 if (sbsec->flags & DEFCONTEXT_MNT) {
502 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 if (rc)
504 goto out_free;
505 opts->mnt_opts[i] = context;
506 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
507 }
508 if (sbsec->flags & ROOTCONTEXT_MNT) {
509 struct inode *root = sbsec->sb->s_root->d_inode;
510 struct inode_security_struct *isec = root->i_security;
511
512 rc = security_sid_to_context(isec->sid, &context, &len);
513 if (rc)
514 goto out_free;
515 opts->mnt_opts[i] = context;
516 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
517 }
518
519 BUG_ON(i != opts->num_mnt_opts);
520
521 return 0;
522
523 out_free:
524 security_free_mnt_opts(opts);
525 return rc;
526 }
527
528 static int bad_option(struct superblock_security_struct *sbsec, char flag,
529 u32 old_sid, u32 new_sid)
530 {
531 /* check if the old mount command had the same options */
532 if (sbsec->initialized)
533 if (!(sbsec->flags & flag) ||
534 (old_sid != new_sid))
535 return 1;
536
537 /* check if we were passed the same options twice,
538 * aka someone passed context=a,context=b
539 */
540 if (!sbsec->initialized)
541 if (sbsec->flags & flag)
542 return 1;
543 return 0;
544 }
545
546 /*
547 * Allow filesystems with binary mount data to explicitly set mount point
548 * labeling information.
549 */
550 static int selinux_set_mnt_opts(struct super_block *sb,
551 struct security_mnt_opts *opts)
552 {
553 int rc = 0, i;
554 struct task_security_struct *tsec = current->security;
555 struct superblock_security_struct *sbsec = sb->s_security;
556 const char *name = sb->s_type->name;
557 struct inode *inode = sbsec->sb->s_root->d_inode;
558 struct inode_security_struct *root_isec = inode->i_security;
559 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
560 u32 defcontext_sid = 0;
561 char **mount_options = opts->mnt_opts;
562 int *flags = opts->mnt_opts_flags;
563 int num_opts = opts->num_mnt_opts;
564
565 mutex_lock(&sbsec->lock);
566
567 if (!ss_initialized) {
568 if (!num_opts) {
569 /* Defer initialization until selinux_complete_init,
570 after the initial policy is loaded and the security
571 server is ready to handle calls. */
572 spin_lock(&sb_security_lock);
573 if (list_empty(&sbsec->list))
574 list_add(&sbsec->list, &superblock_security_head);
575 spin_unlock(&sb_security_lock);
576 goto out;
577 }
578 rc = -EINVAL;
579 printk(KERN_WARNING "Unable to set superblock options before "
580 "the security server is initialized\n");
581 goto out;
582 }
583
584 /*
585 * Binary mount data FS will come through this function twice. Once
586 * from an explicit call and once from the generic calls from the vfs.
587 * Since the generic VFS calls will not contain any security mount data
588 * we need to skip the double mount verification.
589 *
590 * This does open a hole in which we will not notice if the first
591 * mount using this sb set explict options and a second mount using
592 * this sb does not set any security options. (The first options
593 * will be used for both mounts)
594 */
595 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
596 && (num_opts == 0))
597 goto out;
598
599 /*
600 * parse the mount options, check if they are valid sids.
601 * also check if someone is trying to mount the same sb more
602 * than once with different security options.
603 */
604 for (i = 0; i < num_opts; i++) {
605 u32 sid;
606 rc = security_context_to_sid(mount_options[i],
607 strlen(mount_options[i]), &sid);
608 if (rc) {
609 printk(KERN_WARNING "SELinux: security_context_to_sid"
610 "(%s) failed for (dev %s, type %s) errno=%d\n",
611 mount_options[i], sb->s_id, name, rc);
612 goto out;
613 }
614 switch (flags[i]) {
615 case FSCONTEXT_MNT:
616 fscontext_sid = sid;
617
618 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
619 fscontext_sid))
620 goto out_double_mount;
621
622 sbsec->flags |= FSCONTEXT_MNT;
623 break;
624 case CONTEXT_MNT:
625 context_sid = sid;
626
627 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
628 context_sid))
629 goto out_double_mount;
630
631 sbsec->flags |= CONTEXT_MNT;
632 break;
633 case ROOTCONTEXT_MNT:
634 rootcontext_sid = sid;
635
636 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
637 rootcontext_sid))
638 goto out_double_mount;
639
640 sbsec->flags |= ROOTCONTEXT_MNT;
641
642 break;
643 case DEFCONTEXT_MNT:
644 defcontext_sid = sid;
645
646 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
647 defcontext_sid))
648 goto out_double_mount;
649
650 sbsec->flags |= DEFCONTEXT_MNT;
651
652 break;
653 default:
654 rc = -EINVAL;
655 goto out;
656 }
657 }
658
659 if (sbsec->initialized) {
660 /* previously mounted with options, but not on this attempt? */
661 if (sbsec->flags && !num_opts)
662 goto out_double_mount;
663 rc = 0;
664 goto out;
665 }
666
667 if (strcmp(sb->s_type->name, "proc") == 0)
668 sbsec->proc = 1;
669
670 /* Determine the labeling behavior to use for this filesystem type. */
671 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
672 if (rc) {
673 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
674 __FUNCTION__, sb->s_type->name, rc);
675 goto out;
676 }
677
678 /* sets the context of the superblock for the fs being mounted. */
679 if (fscontext_sid) {
680
681 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
682 if (rc)
683 goto out;
684
685 sbsec->sid = fscontext_sid;
686 }
687
688 /*
689 * Switch to using mount point labeling behavior.
690 * sets the label used on all file below the mountpoint, and will set
691 * the superblock context if not already set.
692 */
693 if (context_sid) {
694 if (!fscontext_sid) {
695 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
696 if (rc)
697 goto out;
698 sbsec->sid = context_sid;
699 } else {
700 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
701 if (rc)
702 goto out;
703 }
704 if (!rootcontext_sid)
705 rootcontext_sid = context_sid;
706
707 sbsec->mntpoint_sid = context_sid;
708 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
709 }
710
711 if (rootcontext_sid) {
712 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
713 if (rc)
714 goto out;
715
716 root_isec->sid = rootcontext_sid;
717 root_isec->initialized = 1;
718 }
719
720 if (defcontext_sid) {
721 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
722 rc = -EINVAL;
723 printk(KERN_WARNING "SELinux: defcontext option is "
724 "invalid for this filesystem type\n");
725 goto out;
726 }
727
728 if (defcontext_sid != sbsec->def_sid) {
729 rc = may_context_mount_inode_relabel(defcontext_sid,
730 sbsec, tsec);
731 if (rc)
732 goto out;
733 }
734
735 sbsec->def_sid = defcontext_sid;
736 }
737
738 rc = sb_finish_set_opts(sb);
739 out:
740 mutex_unlock(&sbsec->lock);
741 return rc;
742 out_double_mount:
743 rc = -EINVAL;
744 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
745 "security settings for (dev %s, type %s)\n", sb->s_id, name);
746 goto out;
747 }
748
749 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
750 struct super_block *newsb)
751 {
752 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
753 struct superblock_security_struct *newsbsec = newsb->s_security;
754
755 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
756 int set_context = (oldsbsec->flags & CONTEXT_MNT);
757 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
758
759 /*
760 * if the parent was able to be mounted it clearly had no special lsm
761 * mount options. thus we can safely put this sb on the list and deal
762 * with it later
763 */
764 if (!ss_initialized) {
765 spin_lock(&sb_security_lock);
766 if (list_empty(&newsbsec->list))
767 list_add(&newsbsec->list, &superblock_security_head);
768 spin_unlock(&sb_security_lock);
769 return;
770 }
771
772 /* how can we clone if the old one wasn't set up?? */
773 BUG_ON(!oldsbsec->initialized);
774
775 /* if fs is reusing a sb, just let its options stand... */
776 if (newsbsec->initialized)
777 return;
778
779 mutex_lock(&newsbsec->lock);
780
781 newsbsec->flags = oldsbsec->flags;
782
783 newsbsec->sid = oldsbsec->sid;
784 newsbsec->def_sid = oldsbsec->def_sid;
785 newsbsec->behavior = oldsbsec->behavior;
786
787 if (set_context) {
788 u32 sid = oldsbsec->mntpoint_sid;
789
790 if (!set_fscontext)
791 newsbsec->sid = sid;
792 if (!set_rootcontext) {
793 struct inode *newinode = newsb->s_root->d_inode;
794 struct inode_security_struct *newisec = newinode->i_security;
795 newisec->sid = sid;
796 }
797 newsbsec->mntpoint_sid = sid;
798 }
799 if (set_rootcontext) {
800 const struct inode *oldinode = oldsb->s_root->d_inode;
801 const struct inode_security_struct *oldisec = oldinode->i_security;
802 struct inode *newinode = newsb->s_root->d_inode;
803 struct inode_security_struct *newisec = newinode->i_security;
804
805 newisec->sid = oldisec->sid;
806 }
807
808 sb_finish_set_opts(newsb);
809 mutex_unlock(&newsbsec->lock);
810 }
811
812 static int selinux_parse_opts_str(char *options,
813 struct security_mnt_opts *opts)
814 {
815 char *p;
816 char *context = NULL, *defcontext = NULL;
817 char *fscontext = NULL, *rootcontext = NULL;
818 int rc, num_mnt_opts = 0;
819
820 opts->num_mnt_opts = 0;
821
822 /* Standard string-based options. */
823 while ((p = strsep(&options, "|")) != NULL) {
824 int token;
825 substring_t args[MAX_OPT_ARGS];
826
827 if (!*p)
828 continue;
829
830 token = match_token(p, tokens, args);
831
832 switch (token) {
833 case Opt_context:
834 if (context || defcontext) {
835 rc = -EINVAL;
836 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
837 goto out_err;
838 }
839 context = match_strdup(&args[0]);
840 if (!context) {
841 rc = -ENOMEM;
842 goto out_err;
843 }
844 break;
845
846 case Opt_fscontext:
847 if (fscontext) {
848 rc = -EINVAL;
849 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
850 goto out_err;
851 }
852 fscontext = match_strdup(&args[0]);
853 if (!fscontext) {
854 rc = -ENOMEM;
855 goto out_err;
856 }
857 break;
858
859 case Opt_rootcontext:
860 if (rootcontext) {
861 rc = -EINVAL;
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
863 goto out_err;
864 }
865 rootcontext = match_strdup(&args[0]);
866 if (!rootcontext) {
867 rc = -ENOMEM;
868 goto out_err;
869 }
870 break;
871
872 case Opt_defcontext:
873 if (context || defcontext) {
874 rc = -EINVAL;
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
876 goto out_err;
877 }
878 defcontext = match_strdup(&args[0]);
879 if (!defcontext) {
880 rc = -ENOMEM;
881 goto out_err;
882 }
883 break;
884
885 default:
886 rc = -EINVAL;
887 printk(KERN_WARNING "SELinux: unknown mount option\n");
888 goto out_err;
889
890 }
891 }
892
893 rc = -ENOMEM;
894 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
895 if (!opts->mnt_opts)
896 goto out_err;
897
898 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
899 if (!opts->mnt_opts_flags) {
900 kfree(opts->mnt_opts);
901 goto out_err;
902 }
903
904 if (fscontext) {
905 opts->mnt_opts[num_mnt_opts] = fscontext;
906 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
907 }
908 if (context) {
909 opts->mnt_opts[num_mnt_opts] = context;
910 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
911 }
912 if (rootcontext) {
913 opts->mnt_opts[num_mnt_opts] = rootcontext;
914 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
915 }
916 if (defcontext) {
917 opts->mnt_opts[num_mnt_opts] = defcontext;
918 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
919 }
920
921 opts->num_mnt_opts = num_mnt_opts;
922 return 0;
923
924 out_err:
925 kfree(context);
926 kfree(defcontext);
927 kfree(fscontext);
928 kfree(rootcontext);
929 return rc;
930 }
931 /*
932 * string mount options parsing and call set the sbsec
933 */
934 static int superblock_doinit(struct super_block *sb, void *data)
935 {
936 int rc = 0;
937 char *options = data;
938 struct security_mnt_opts opts;
939
940 security_init_mnt_opts(&opts);
941
942 if (!data)
943 goto out;
944
945 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
946
947 rc = selinux_parse_opts_str(options, &opts);
948 if (rc)
949 goto out_err;
950
951 out:
952 rc = selinux_set_mnt_opts(sb, &opts);
953
954 out_err:
955 security_free_mnt_opts(&opts);
956 return rc;
957 }
958
959 static inline u16 inode_mode_to_security_class(umode_t mode)
960 {
961 switch (mode & S_IFMT) {
962 case S_IFSOCK:
963 return SECCLASS_SOCK_FILE;
964 case S_IFLNK:
965 return SECCLASS_LNK_FILE;
966 case S_IFREG:
967 return SECCLASS_FILE;
968 case S_IFBLK:
969 return SECCLASS_BLK_FILE;
970 case S_IFDIR:
971 return SECCLASS_DIR;
972 case S_IFCHR:
973 return SECCLASS_CHR_FILE;
974 case S_IFIFO:
975 return SECCLASS_FIFO_FILE;
976
977 }
978
979 return SECCLASS_FILE;
980 }
981
982 static inline int default_protocol_stream(int protocol)
983 {
984 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
985 }
986
987 static inline int default_protocol_dgram(int protocol)
988 {
989 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
990 }
991
992 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
993 {
994 switch (family) {
995 case PF_UNIX:
996 switch (type) {
997 case SOCK_STREAM:
998 case SOCK_SEQPACKET:
999 return SECCLASS_UNIX_STREAM_SOCKET;
1000 case SOCK_DGRAM:
1001 return SECCLASS_UNIX_DGRAM_SOCKET;
1002 }
1003 break;
1004 case PF_INET:
1005 case PF_INET6:
1006 switch (type) {
1007 case SOCK_STREAM:
1008 if (default_protocol_stream(protocol))
1009 return SECCLASS_TCP_SOCKET;
1010 else
1011 return SECCLASS_RAWIP_SOCKET;
1012 case SOCK_DGRAM:
1013 if (default_protocol_dgram(protocol))
1014 return SECCLASS_UDP_SOCKET;
1015 else
1016 return SECCLASS_RAWIP_SOCKET;
1017 case SOCK_DCCP:
1018 return SECCLASS_DCCP_SOCKET;
1019 default:
1020 return SECCLASS_RAWIP_SOCKET;
1021 }
1022 break;
1023 case PF_NETLINK:
1024 switch (protocol) {
1025 case NETLINK_ROUTE:
1026 return SECCLASS_NETLINK_ROUTE_SOCKET;
1027 case NETLINK_FIREWALL:
1028 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1029 case NETLINK_INET_DIAG:
1030 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1031 case NETLINK_NFLOG:
1032 return SECCLASS_NETLINK_NFLOG_SOCKET;
1033 case NETLINK_XFRM:
1034 return SECCLASS_NETLINK_XFRM_SOCKET;
1035 case NETLINK_SELINUX:
1036 return SECCLASS_NETLINK_SELINUX_SOCKET;
1037 case NETLINK_AUDIT:
1038 return SECCLASS_NETLINK_AUDIT_SOCKET;
1039 case NETLINK_IP6_FW:
1040 return SECCLASS_NETLINK_IP6FW_SOCKET;
1041 case NETLINK_DNRTMSG:
1042 return SECCLASS_NETLINK_DNRT_SOCKET;
1043 case NETLINK_KOBJECT_UEVENT:
1044 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1045 default:
1046 return SECCLASS_NETLINK_SOCKET;
1047 }
1048 case PF_PACKET:
1049 return SECCLASS_PACKET_SOCKET;
1050 case PF_KEY:
1051 return SECCLASS_KEY_SOCKET;
1052 case PF_APPLETALK:
1053 return SECCLASS_APPLETALK_SOCKET;
1054 }
1055
1056 return SECCLASS_SOCKET;
1057 }
1058
1059 #ifdef CONFIG_PROC_FS
1060 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1061 u16 tclass,
1062 u32 *sid)
1063 {
1064 int buflen, rc;
1065 char *buffer, *path, *end;
1066
1067 buffer = (char*)__get_free_page(GFP_KERNEL);
1068 if (!buffer)
1069 return -ENOMEM;
1070
1071 buflen = PAGE_SIZE;
1072 end = buffer+buflen;
1073 *--end = '\0';
1074 buflen--;
1075 path = end-1;
1076 *path = '/';
1077 while (de && de != de->parent) {
1078 buflen -= de->namelen + 1;
1079 if (buflen < 0)
1080 break;
1081 end -= de->namelen;
1082 memcpy(end, de->name, de->namelen);
1083 *--end = '/';
1084 path = end;
1085 de = de->parent;
1086 }
1087 rc = security_genfs_sid("proc", path, tclass, sid);
1088 free_page((unsigned long)buffer);
1089 return rc;
1090 }
1091 #else
1092 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1093 u16 tclass,
1094 u32 *sid)
1095 {
1096 return -EINVAL;
1097 }
1098 #endif
1099
1100 /* The inode's security attributes must be initialized before first use. */
1101 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1102 {
1103 struct superblock_security_struct *sbsec = NULL;
1104 struct inode_security_struct *isec = inode->i_security;
1105 u32 sid;
1106 struct dentry *dentry;
1107 #define INITCONTEXTLEN 255
1108 char *context = NULL;
1109 unsigned len = 0;
1110 int rc = 0;
1111
1112 if (isec->initialized)
1113 goto out;
1114
1115 mutex_lock(&isec->lock);
1116 if (isec->initialized)
1117 goto out_unlock;
1118
1119 sbsec = inode->i_sb->s_security;
1120 if (!sbsec->initialized) {
1121 /* Defer initialization until selinux_complete_init,
1122 after the initial policy is loaded and the security
1123 server is ready to handle calls. */
1124 spin_lock(&sbsec->isec_lock);
1125 if (list_empty(&isec->list))
1126 list_add(&isec->list, &sbsec->isec_head);
1127 spin_unlock(&sbsec->isec_lock);
1128 goto out_unlock;
1129 }
1130
1131 switch (sbsec->behavior) {
1132 case SECURITY_FS_USE_XATTR:
1133 if (!inode->i_op->getxattr) {
1134 isec->sid = sbsec->def_sid;
1135 break;
1136 }
1137
1138 /* Need a dentry, since the xattr API requires one.
1139 Life would be simpler if we could just pass the inode. */
1140 if (opt_dentry) {
1141 /* Called from d_instantiate or d_splice_alias. */
1142 dentry = dget(opt_dentry);
1143 } else {
1144 /* Called from selinux_complete_init, try to find a dentry. */
1145 dentry = d_find_alias(inode);
1146 }
1147 if (!dentry) {
1148 printk(KERN_WARNING "%s: no dentry for dev=%s "
1149 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
1150 inode->i_ino);
1151 goto out_unlock;
1152 }
1153
1154 len = INITCONTEXTLEN;
1155 context = kmalloc(len, GFP_NOFS);
1156 if (!context) {
1157 rc = -ENOMEM;
1158 dput(dentry);
1159 goto out_unlock;
1160 }
1161 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1162 context, len);
1163 if (rc == -ERANGE) {
1164 /* Need a larger buffer. Query for the right size. */
1165 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1166 NULL, 0);
1167 if (rc < 0) {
1168 dput(dentry);
1169 goto out_unlock;
1170 }
1171 kfree(context);
1172 len = rc;
1173 context = kmalloc(len, GFP_NOFS);
1174 if (!context) {
1175 rc = -ENOMEM;
1176 dput(dentry);
1177 goto out_unlock;
1178 }
1179 rc = inode->i_op->getxattr(dentry,
1180 XATTR_NAME_SELINUX,
1181 context, len);
1182 }
1183 dput(dentry);
1184 if (rc < 0) {
1185 if (rc != -ENODATA) {
1186 printk(KERN_WARNING "%s: getxattr returned "
1187 "%d for dev=%s ino=%ld\n", __FUNCTION__,
1188 -rc, inode->i_sb->s_id, inode->i_ino);
1189 kfree(context);
1190 goto out_unlock;
1191 }
1192 /* Map ENODATA to the default file SID */
1193 sid = sbsec->def_sid;
1194 rc = 0;
1195 } else {
1196 rc = security_context_to_sid_default(context, rc, &sid,
1197 sbsec->def_sid,
1198 GFP_NOFS);
1199 if (rc) {
1200 printk(KERN_WARNING "%s: context_to_sid(%s) "
1201 "returned %d for dev=%s ino=%ld\n",
1202 __FUNCTION__, context, -rc,
1203 inode->i_sb->s_id, inode->i_ino);
1204 kfree(context);
1205 /* Leave with the unlabeled SID */
1206 rc = 0;
1207 break;
1208 }
1209 }
1210 kfree(context);
1211 isec->sid = sid;
1212 break;
1213 case SECURITY_FS_USE_TASK:
1214 isec->sid = isec->task_sid;
1215 break;
1216 case SECURITY_FS_USE_TRANS:
1217 /* Default to the fs SID. */
1218 isec->sid = sbsec->sid;
1219
1220 /* Try to obtain a transition SID. */
1221 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1222 rc = security_transition_sid(isec->task_sid,
1223 sbsec->sid,
1224 isec->sclass,
1225 &sid);
1226 if (rc)
1227 goto out_unlock;
1228 isec->sid = sid;
1229 break;
1230 case SECURITY_FS_USE_MNTPOINT:
1231 isec->sid = sbsec->mntpoint_sid;
1232 break;
1233 default:
1234 /* Default to the fs superblock SID. */
1235 isec->sid = sbsec->sid;
1236
1237 if (sbsec->proc) {
1238 struct proc_inode *proci = PROC_I(inode);
1239 if (proci->pde) {
1240 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1241 rc = selinux_proc_get_sid(proci->pde,
1242 isec->sclass,
1243 &sid);
1244 if (rc)
1245 goto out_unlock;
1246 isec->sid = sid;
1247 }
1248 }
1249 break;
1250 }
1251
1252 isec->initialized = 1;
1253
1254 out_unlock:
1255 mutex_unlock(&isec->lock);
1256 out:
1257 if (isec->sclass == SECCLASS_FILE)
1258 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1259 return rc;
1260 }
1261
1262 /* Convert a Linux signal to an access vector. */
1263 static inline u32 signal_to_av(int sig)
1264 {
1265 u32 perm = 0;
1266
1267 switch (sig) {
1268 case SIGCHLD:
1269 /* Commonly granted from child to parent. */
1270 perm = PROCESS__SIGCHLD;
1271 break;
1272 case SIGKILL:
1273 /* Cannot be caught or ignored */
1274 perm = PROCESS__SIGKILL;
1275 break;
1276 case SIGSTOP:
1277 /* Cannot be caught or ignored */
1278 perm = PROCESS__SIGSTOP;
1279 break;
1280 default:
1281 /* All other signals. */
1282 perm = PROCESS__SIGNAL;
1283 break;
1284 }
1285
1286 return perm;
1287 }
1288
1289 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1290 fork check, ptrace check, etc. */
1291 static int task_has_perm(struct task_struct *tsk1,
1292 struct task_struct *tsk2,
1293 u32 perms)
1294 {
1295 struct task_security_struct *tsec1, *tsec2;
1296
1297 tsec1 = tsk1->security;
1298 tsec2 = tsk2->security;
1299 return avc_has_perm(tsec1->sid, tsec2->sid,
1300 SECCLASS_PROCESS, perms, NULL);
1301 }
1302
1303 #if CAP_LAST_CAP > 63
1304 #error Fix SELinux to handle capabilities > 63.
1305 #endif
1306
1307 /* Check whether a task is allowed to use a capability. */
1308 static int task_has_capability(struct task_struct *tsk,
1309 int cap)
1310 {
1311 struct task_security_struct *tsec;
1312 struct avc_audit_data ad;
1313 u16 sclass;
1314 u32 av = CAP_TO_MASK(cap);
1315
1316 tsec = tsk->security;
1317
1318 AVC_AUDIT_DATA_INIT(&ad,CAP);
1319 ad.tsk = tsk;
1320 ad.u.cap = cap;
1321
1322 switch (CAP_TO_INDEX(cap)) {
1323 case 0:
1324 sclass = SECCLASS_CAPABILITY;
1325 break;
1326 case 1:
1327 sclass = SECCLASS_CAPABILITY2;
1328 break;
1329 default:
1330 printk(KERN_ERR
1331 "SELinux: out of range capability %d\n", cap);
1332 BUG();
1333 }
1334 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1335 }
1336
1337 /* Check whether a task is allowed to use a system operation. */
1338 static int task_has_system(struct task_struct *tsk,
1339 u32 perms)
1340 {
1341 struct task_security_struct *tsec;
1342
1343 tsec = tsk->security;
1344
1345 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1346 SECCLASS_SYSTEM, perms, NULL);
1347 }
1348
1349 /* Check whether a task has a particular permission to an inode.
1350 The 'adp' parameter is optional and allows other audit
1351 data to be passed (e.g. the dentry). */
1352 static int inode_has_perm(struct task_struct *tsk,
1353 struct inode *inode,
1354 u32 perms,
1355 struct avc_audit_data *adp)
1356 {
1357 struct task_security_struct *tsec;
1358 struct inode_security_struct *isec;
1359 struct avc_audit_data ad;
1360
1361 if (unlikely (IS_PRIVATE (inode)))
1362 return 0;
1363
1364 tsec = tsk->security;
1365 isec = inode->i_security;
1366
1367 if (!adp) {
1368 adp = &ad;
1369 AVC_AUDIT_DATA_INIT(&ad, FS);
1370 ad.u.fs.inode = inode;
1371 }
1372
1373 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1374 }
1375
1376 /* Same as inode_has_perm, but pass explicit audit data containing
1377 the dentry to help the auditing code to more easily generate the
1378 pathname if needed. */
1379 static inline int dentry_has_perm(struct task_struct *tsk,
1380 struct vfsmount *mnt,
1381 struct dentry *dentry,
1382 u32 av)
1383 {
1384 struct inode *inode = dentry->d_inode;
1385 struct avc_audit_data ad;
1386 AVC_AUDIT_DATA_INIT(&ad,FS);
1387 ad.u.fs.path.mnt = mnt;
1388 ad.u.fs.path.dentry = dentry;
1389 return inode_has_perm(tsk, inode, av, &ad);
1390 }
1391
1392 /* Check whether a task can use an open file descriptor to
1393 access an inode in a given way. Check access to the
1394 descriptor itself, and then use dentry_has_perm to
1395 check a particular permission to the file.
1396 Access to the descriptor is implicitly granted if it
1397 has the same SID as the process. If av is zero, then
1398 access to the file is not checked, e.g. for cases
1399 where only the descriptor is affected like seek. */
1400 static int file_has_perm(struct task_struct *tsk,
1401 struct file *file,
1402 u32 av)
1403 {
1404 struct task_security_struct *tsec = tsk->security;
1405 struct file_security_struct *fsec = file->f_security;
1406 struct inode *inode = file->f_path.dentry->d_inode;
1407 struct avc_audit_data ad;
1408 int rc;
1409
1410 AVC_AUDIT_DATA_INIT(&ad, FS);
1411 ad.u.fs.path = file->f_path;
1412
1413 if (tsec->sid != fsec->sid) {
1414 rc = avc_has_perm(tsec->sid, fsec->sid,
1415 SECCLASS_FD,
1416 FD__USE,
1417 &ad);
1418 if (rc)
1419 return rc;
1420 }
1421
1422 /* av is zero if only checking access to the descriptor. */
1423 if (av)
1424 return inode_has_perm(tsk, inode, av, &ad);
1425
1426 return 0;
1427 }
1428
1429 /* Check whether a task can create a file. */
1430 static int may_create(struct inode *dir,
1431 struct dentry *dentry,
1432 u16 tclass)
1433 {
1434 struct task_security_struct *tsec;
1435 struct inode_security_struct *dsec;
1436 struct superblock_security_struct *sbsec;
1437 u32 newsid;
1438 struct avc_audit_data ad;
1439 int rc;
1440
1441 tsec = current->security;
1442 dsec = dir->i_security;
1443 sbsec = dir->i_sb->s_security;
1444
1445 AVC_AUDIT_DATA_INIT(&ad, FS);
1446 ad.u.fs.path.dentry = dentry;
1447
1448 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1449 DIR__ADD_NAME | DIR__SEARCH,
1450 &ad);
1451 if (rc)
1452 return rc;
1453
1454 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1455 newsid = tsec->create_sid;
1456 } else {
1457 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1458 &newsid);
1459 if (rc)
1460 return rc;
1461 }
1462
1463 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1464 if (rc)
1465 return rc;
1466
1467 return avc_has_perm(newsid, sbsec->sid,
1468 SECCLASS_FILESYSTEM,
1469 FILESYSTEM__ASSOCIATE, &ad);
1470 }
1471
1472 /* Check whether a task can create a key. */
1473 static int may_create_key(u32 ksid,
1474 struct task_struct *ctx)
1475 {
1476 struct task_security_struct *tsec;
1477
1478 tsec = ctx->security;
1479
1480 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1481 }
1482
1483 #define MAY_LINK 0
1484 #define MAY_UNLINK 1
1485 #define MAY_RMDIR 2
1486
1487 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1488 static int may_link(struct inode *dir,
1489 struct dentry *dentry,
1490 int kind)
1491
1492 {
1493 struct task_security_struct *tsec;
1494 struct inode_security_struct *dsec, *isec;
1495 struct avc_audit_data ad;
1496 u32 av;
1497 int rc;
1498
1499 tsec = current->security;
1500 dsec = dir->i_security;
1501 isec = dentry->d_inode->i_security;
1502
1503 AVC_AUDIT_DATA_INIT(&ad, FS);
1504 ad.u.fs.path.dentry = dentry;
1505
1506 av = DIR__SEARCH;
1507 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1508 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1509 if (rc)
1510 return rc;
1511
1512 switch (kind) {
1513 case MAY_LINK:
1514 av = FILE__LINK;
1515 break;
1516 case MAY_UNLINK:
1517 av = FILE__UNLINK;
1518 break;
1519 case MAY_RMDIR:
1520 av = DIR__RMDIR;
1521 break;
1522 default:
1523 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1524 return 0;
1525 }
1526
1527 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1528 return rc;
1529 }
1530
1531 static inline int may_rename(struct inode *old_dir,
1532 struct dentry *old_dentry,
1533 struct inode *new_dir,
1534 struct dentry *new_dentry)
1535 {
1536 struct task_security_struct *tsec;
1537 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1538 struct avc_audit_data ad;
1539 u32 av;
1540 int old_is_dir, new_is_dir;
1541 int rc;
1542
1543 tsec = current->security;
1544 old_dsec = old_dir->i_security;
1545 old_isec = old_dentry->d_inode->i_security;
1546 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1547 new_dsec = new_dir->i_security;
1548
1549 AVC_AUDIT_DATA_INIT(&ad, FS);
1550
1551 ad.u.fs.path.dentry = old_dentry;
1552 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1553 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1554 if (rc)
1555 return rc;
1556 rc = avc_has_perm(tsec->sid, old_isec->sid,
1557 old_isec->sclass, FILE__RENAME, &ad);
1558 if (rc)
1559 return rc;
1560 if (old_is_dir && new_dir != old_dir) {
1561 rc = avc_has_perm(tsec->sid, old_isec->sid,
1562 old_isec->sclass, DIR__REPARENT, &ad);
1563 if (rc)
1564 return rc;
1565 }
1566
1567 ad.u.fs.path.dentry = new_dentry;
1568 av = DIR__ADD_NAME | DIR__SEARCH;
1569 if (new_dentry->d_inode)
1570 av |= DIR__REMOVE_NAME;
1571 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1572 if (rc)
1573 return rc;
1574 if (new_dentry->d_inode) {
1575 new_isec = new_dentry->d_inode->i_security;
1576 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1577 rc = avc_has_perm(tsec->sid, new_isec->sid,
1578 new_isec->sclass,
1579 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1580 if (rc)
1581 return rc;
1582 }
1583
1584 return 0;
1585 }
1586
1587 /* Check whether a task can perform a filesystem operation. */
1588 static int superblock_has_perm(struct task_struct *tsk,
1589 struct super_block *sb,
1590 u32 perms,
1591 struct avc_audit_data *ad)
1592 {
1593 struct task_security_struct *tsec;
1594 struct superblock_security_struct *sbsec;
1595
1596 tsec = tsk->security;
1597 sbsec = sb->s_security;
1598 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1599 perms, ad);
1600 }
1601
1602 /* Convert a Linux mode and permission mask to an access vector. */
1603 static inline u32 file_mask_to_av(int mode, int mask)
1604 {
1605 u32 av = 0;
1606
1607 if ((mode & S_IFMT) != S_IFDIR) {
1608 if (mask & MAY_EXEC)
1609 av |= FILE__EXECUTE;
1610 if (mask & MAY_READ)
1611 av |= FILE__READ;
1612
1613 if (mask & MAY_APPEND)
1614 av |= FILE__APPEND;
1615 else if (mask & MAY_WRITE)
1616 av |= FILE__WRITE;
1617
1618 } else {
1619 if (mask & MAY_EXEC)
1620 av |= DIR__SEARCH;
1621 if (mask & MAY_WRITE)
1622 av |= DIR__WRITE;
1623 if (mask & MAY_READ)
1624 av |= DIR__READ;
1625 }
1626
1627 return av;
1628 }
1629
1630 /* Convert a Linux file to an access vector. */
1631 static inline u32 file_to_av(struct file *file)
1632 {
1633 u32 av = 0;
1634
1635 if (file->f_mode & FMODE_READ)
1636 av |= FILE__READ;
1637 if (file->f_mode & FMODE_WRITE) {
1638 if (file->f_flags & O_APPEND)
1639 av |= FILE__APPEND;
1640 else
1641 av |= FILE__WRITE;
1642 }
1643 if (!av) {
1644 /*
1645 * Special file opened with flags 3 for ioctl-only use.
1646 */
1647 av = FILE__IOCTL;
1648 }
1649
1650 return av;
1651 }
1652
1653 /* Hook functions begin here. */
1654
1655 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1656 {
1657 struct task_security_struct *psec = parent->security;
1658 struct task_security_struct *csec = child->security;
1659 int rc;
1660
1661 rc = secondary_ops->ptrace(parent,child);
1662 if (rc)
1663 return rc;
1664
1665 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1666 /* Save the SID of the tracing process for later use in apply_creds. */
1667 if (!(child->ptrace & PT_PTRACED) && !rc)
1668 csec->ptrace_sid = psec->sid;
1669 return rc;
1670 }
1671
1672 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1673 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1674 {
1675 int error;
1676
1677 error = task_has_perm(current, target, PROCESS__GETCAP);
1678 if (error)
1679 return error;
1680
1681 return secondary_ops->capget(target, effective, inheritable, permitted);
1682 }
1683
1684 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1685 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1686 {
1687 int error;
1688
1689 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1690 if (error)
1691 return error;
1692
1693 return task_has_perm(current, target, PROCESS__SETCAP);
1694 }
1695
1696 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1697 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1698 {
1699 secondary_ops->capset_set(target, effective, inheritable, permitted);
1700 }
1701
1702 static int selinux_capable(struct task_struct *tsk, int cap)
1703 {
1704 int rc;
1705
1706 rc = secondary_ops->capable(tsk, cap);
1707 if (rc)
1708 return rc;
1709
1710 return task_has_capability(tsk,cap);
1711 }
1712
1713 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1714 {
1715 int buflen, rc;
1716 char *buffer, *path, *end;
1717
1718 rc = -ENOMEM;
1719 buffer = (char*)__get_free_page(GFP_KERNEL);
1720 if (!buffer)
1721 goto out;
1722
1723 buflen = PAGE_SIZE;
1724 end = buffer+buflen;
1725 *--end = '\0';
1726 buflen--;
1727 path = end-1;
1728 *path = '/';
1729 while (table) {
1730 const char *name = table->procname;
1731 size_t namelen = strlen(name);
1732 buflen -= namelen + 1;
1733 if (buflen < 0)
1734 goto out_free;
1735 end -= namelen;
1736 memcpy(end, name, namelen);
1737 *--end = '/';
1738 path = end;
1739 table = table->parent;
1740 }
1741 buflen -= 4;
1742 if (buflen < 0)
1743 goto out_free;
1744 end -= 4;
1745 memcpy(end, "/sys", 4);
1746 path = end;
1747 rc = security_genfs_sid("proc", path, tclass, sid);
1748 out_free:
1749 free_page((unsigned long)buffer);
1750 out:
1751 return rc;
1752 }
1753
1754 static int selinux_sysctl(ctl_table *table, int op)
1755 {
1756 int error = 0;
1757 u32 av;
1758 struct task_security_struct *tsec;
1759 u32 tsid;
1760 int rc;
1761
1762 rc = secondary_ops->sysctl(table, op);
1763 if (rc)
1764 return rc;
1765
1766 tsec = current->security;
1767
1768 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1769 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1770 if (rc) {
1771 /* Default to the well-defined sysctl SID. */
1772 tsid = SECINITSID_SYSCTL;
1773 }
1774
1775 /* The op values are "defined" in sysctl.c, thereby creating
1776 * a bad coupling between this module and sysctl.c */
1777 if(op == 001) {
1778 error = avc_has_perm(tsec->sid, tsid,
1779 SECCLASS_DIR, DIR__SEARCH, NULL);
1780 } else {
1781 av = 0;
1782 if (op & 004)
1783 av |= FILE__READ;
1784 if (op & 002)
1785 av |= FILE__WRITE;
1786 if (av)
1787 error = avc_has_perm(tsec->sid, tsid,
1788 SECCLASS_FILE, av, NULL);
1789 }
1790
1791 return error;
1792 }
1793
1794 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1795 {
1796 int rc = 0;
1797
1798 if (!sb)
1799 return 0;
1800
1801 switch (cmds) {
1802 case Q_SYNC:
1803 case Q_QUOTAON:
1804 case Q_QUOTAOFF:
1805 case Q_SETINFO:
1806 case Q_SETQUOTA:
1807 rc = superblock_has_perm(current,
1808 sb,
1809 FILESYSTEM__QUOTAMOD, NULL);
1810 break;
1811 case Q_GETFMT:
1812 case Q_GETINFO:
1813 case Q_GETQUOTA:
1814 rc = superblock_has_perm(current,
1815 sb,
1816 FILESYSTEM__QUOTAGET, NULL);
1817 break;
1818 default:
1819 rc = 0; /* let the kernel handle invalid cmds */
1820 break;
1821 }
1822 return rc;
1823 }
1824
1825 static int selinux_quota_on(struct dentry *dentry)
1826 {
1827 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1828 }
1829
1830 static int selinux_syslog(int type)
1831 {
1832 int rc;
1833
1834 rc = secondary_ops->syslog(type);
1835 if (rc)
1836 return rc;
1837
1838 switch (type) {
1839 case 3: /* Read last kernel messages */
1840 case 10: /* Return size of the log buffer */
1841 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1842 break;
1843 case 6: /* Disable logging to console */
1844 case 7: /* Enable logging to console */
1845 case 8: /* Set level of messages printed to console */
1846 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1847 break;
1848 case 0: /* Close log */
1849 case 1: /* Open log */
1850 case 2: /* Read from log */
1851 case 4: /* Read/clear last kernel messages */
1852 case 5: /* Clear ring buffer */
1853 default:
1854 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1855 break;
1856 }
1857 return rc;
1858 }
1859
1860 /*
1861 * Check that a process has enough memory to allocate a new virtual
1862 * mapping. 0 means there is enough memory for the allocation to
1863 * succeed and -ENOMEM implies there is not.
1864 *
1865 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1866 * if the capability is granted, but __vm_enough_memory requires 1 if
1867 * the capability is granted.
1868 *
1869 * Do not audit the selinux permission check, as this is applied to all
1870 * processes that allocate mappings.
1871 */
1872 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1873 {
1874 int rc, cap_sys_admin = 0;
1875 struct task_security_struct *tsec = current->security;
1876
1877 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1878 if (rc == 0)
1879 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1880 SECCLASS_CAPABILITY,
1881 CAP_TO_MASK(CAP_SYS_ADMIN),
1882 0,
1883 NULL);
1884
1885 if (rc == 0)
1886 cap_sys_admin = 1;
1887
1888 return __vm_enough_memory(mm, pages, cap_sys_admin);
1889 }
1890
1891 /* binprm security operations */
1892
1893 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1894 {
1895 struct bprm_security_struct *bsec;
1896
1897 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1898 if (!bsec)
1899 return -ENOMEM;
1900
1901 bsec->bprm = bprm;
1902 bsec->sid = SECINITSID_UNLABELED;
1903 bsec->set = 0;
1904
1905 bprm->security = bsec;
1906 return 0;
1907 }
1908
1909 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1910 {
1911 struct task_security_struct *tsec;
1912 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1913 struct inode_security_struct *isec;
1914 struct bprm_security_struct *bsec;
1915 u32 newsid;
1916 struct avc_audit_data ad;
1917 int rc;
1918
1919 rc = secondary_ops->bprm_set_security(bprm);
1920 if (rc)
1921 return rc;
1922
1923 bsec = bprm->security;
1924
1925 if (bsec->set)
1926 return 0;
1927
1928 tsec = current->security;
1929 isec = inode->i_security;
1930
1931 /* Default to the current task SID. */
1932 bsec->sid = tsec->sid;
1933
1934 /* Reset fs, key, and sock SIDs on execve. */
1935 tsec->create_sid = 0;
1936 tsec->keycreate_sid = 0;
1937 tsec->sockcreate_sid = 0;
1938
1939 if (tsec->exec_sid) {
1940 newsid = tsec->exec_sid;
1941 /* Reset exec SID on execve. */
1942 tsec->exec_sid = 0;
1943 } else {
1944 /* Check for a default transition on this program. */
1945 rc = security_transition_sid(tsec->sid, isec->sid,
1946 SECCLASS_PROCESS, &newsid);
1947 if (rc)
1948 return rc;
1949 }
1950
1951 AVC_AUDIT_DATA_INIT(&ad, FS);
1952 ad.u.fs.path = bprm->file->f_path;
1953
1954 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1955 newsid = tsec->sid;
1956
1957 if (tsec->sid == newsid) {
1958 rc = avc_has_perm(tsec->sid, isec->sid,
1959 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1960 if (rc)
1961 return rc;
1962 } else {
1963 /* Check permissions for the transition. */
1964 rc = avc_has_perm(tsec->sid, newsid,
1965 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1966 if (rc)
1967 return rc;
1968
1969 rc = avc_has_perm(newsid, isec->sid,
1970 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1971 if (rc)
1972 return rc;
1973
1974 /* Clear any possibly unsafe personality bits on exec: */
1975 current->personality &= ~PER_CLEAR_ON_SETID;
1976
1977 /* Set the security field to the new SID. */
1978 bsec->sid = newsid;
1979 }
1980
1981 bsec->set = 1;
1982 return 0;
1983 }
1984
1985 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1986 {
1987 return secondary_ops->bprm_check_security(bprm);
1988 }
1989
1990
1991 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1992 {
1993 struct task_security_struct *tsec = current->security;
1994 int atsecure = 0;
1995
1996 if (tsec->osid != tsec->sid) {
1997 /* Enable secure mode for SIDs transitions unless
1998 the noatsecure permission is granted between
1999 the two SIDs, i.e. ahp returns 0. */
2000 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2001 SECCLASS_PROCESS,
2002 PROCESS__NOATSECURE, NULL);
2003 }
2004
2005 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2006 }
2007
2008 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2009 {
2010 kfree(bprm->security);
2011 bprm->security = NULL;
2012 }
2013
2014 extern struct vfsmount *selinuxfs_mount;
2015 extern struct dentry *selinux_null;
2016
2017 /* Derived from fs/exec.c:flush_old_files. */
2018 static inline void flush_unauthorized_files(struct files_struct * files)
2019 {
2020 struct avc_audit_data ad;
2021 struct file *file, *devnull = NULL;
2022 struct tty_struct *tty;
2023 struct fdtable *fdt;
2024 long j = -1;
2025 int drop_tty = 0;
2026
2027 mutex_lock(&tty_mutex);
2028 tty = get_current_tty();
2029 if (tty) {
2030 file_list_lock();
2031 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2032 if (file) {
2033 /* Revalidate access to controlling tty.
2034 Use inode_has_perm on the tty inode directly rather
2035 than using file_has_perm, as this particular open
2036 file may belong to another process and we are only
2037 interested in the inode-based check here. */
2038 struct inode *inode = file->f_path.dentry->d_inode;
2039 if (inode_has_perm(current, inode,
2040 FILE__READ | FILE__WRITE, NULL)) {
2041 drop_tty = 1;
2042 }
2043 }
2044 file_list_unlock();
2045 }
2046 mutex_unlock(&tty_mutex);
2047 /* Reset controlling tty. */
2048 if (drop_tty)
2049 no_tty();
2050
2051 /* Revalidate access to inherited open files. */
2052
2053 AVC_AUDIT_DATA_INIT(&ad,FS);
2054
2055 spin_lock(&files->file_lock);
2056 for (;;) {
2057 unsigned long set, i;
2058 int fd;
2059
2060 j++;
2061 i = j * __NFDBITS;
2062 fdt = files_fdtable(files);
2063 if (i >= fdt->max_fds)
2064 break;
2065 set = fdt->open_fds->fds_bits[j];
2066 if (!set)
2067 continue;
2068 spin_unlock(&files->file_lock);
2069 for ( ; set ; i++,set >>= 1) {
2070 if (set & 1) {
2071 file = fget(i);
2072 if (!file)
2073 continue;
2074 if (file_has_perm(current,
2075 file,
2076 file_to_av(file))) {
2077 sys_close(i);
2078 fd = get_unused_fd();
2079 if (fd != i) {
2080 if (fd >= 0)
2081 put_unused_fd(fd);
2082 fput(file);
2083 continue;
2084 }
2085 if (devnull) {
2086 get_file(devnull);
2087 } else {
2088 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2089 if (IS_ERR(devnull)) {
2090 devnull = NULL;
2091 put_unused_fd(fd);
2092 fput(file);
2093 continue;
2094 }
2095 }
2096 fd_install(fd, devnull);
2097 }
2098 fput(file);
2099 }
2100 }
2101 spin_lock(&files->file_lock);
2102
2103 }
2104 spin_unlock(&files->file_lock);
2105 }
2106
2107 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2108 {
2109 struct task_security_struct *tsec;
2110 struct bprm_security_struct *bsec;
2111 u32 sid;
2112 int rc;
2113
2114 secondary_ops->bprm_apply_creds(bprm, unsafe);
2115
2116 tsec = current->security;
2117
2118 bsec = bprm->security;
2119 sid = bsec->sid;
2120
2121 tsec->osid = tsec->sid;
2122 bsec->unsafe = 0;
2123 if (tsec->sid != sid) {
2124 /* Check for shared state. If not ok, leave SID
2125 unchanged and kill. */
2126 if (unsafe & LSM_UNSAFE_SHARE) {
2127 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2128 PROCESS__SHARE, NULL);
2129 if (rc) {
2130 bsec->unsafe = 1;
2131 return;
2132 }
2133 }
2134
2135 /* Check for ptracing, and update the task SID if ok.
2136 Otherwise, leave SID unchanged and kill. */
2137 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2138 rc = avc_has_perm(tsec->ptrace_sid, sid,
2139 SECCLASS_PROCESS, PROCESS__PTRACE,
2140 NULL);
2141 if (rc) {
2142 bsec->unsafe = 1;
2143 return;
2144 }
2145 }
2146 tsec->sid = sid;
2147 }
2148 }
2149
2150 /*
2151 * called after apply_creds without the task lock held
2152 */
2153 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2154 {
2155 struct task_security_struct *tsec;
2156 struct rlimit *rlim, *initrlim;
2157 struct itimerval itimer;
2158 struct bprm_security_struct *bsec;
2159 int rc, i;
2160
2161 tsec = current->security;
2162 bsec = bprm->security;
2163
2164 if (bsec->unsafe) {
2165 force_sig_specific(SIGKILL, current);
2166 return;
2167 }
2168 if (tsec->osid == tsec->sid)
2169 return;
2170
2171 /* Close files for which the new task SID is not authorized. */
2172 flush_unauthorized_files(current->files);
2173
2174 /* Check whether the new SID can inherit signal state
2175 from the old SID. If not, clear itimers to avoid
2176 subsequent signal generation and flush and unblock
2177 signals. This must occur _after_ the task SID has
2178 been updated so that any kill done after the flush
2179 will be checked against the new SID. */
2180 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2181 PROCESS__SIGINH, NULL);
2182 if (rc) {
2183 memset(&itimer, 0, sizeof itimer);
2184 for (i = 0; i < 3; i++)
2185 do_setitimer(i, &itimer, NULL);
2186 flush_signals(current);
2187 spin_lock_irq(&current->sighand->siglock);
2188 flush_signal_handlers(current, 1);
2189 sigemptyset(&current->blocked);
2190 recalc_sigpending();
2191 spin_unlock_irq(&current->sighand->siglock);
2192 }
2193
2194 /* Always clear parent death signal on SID transitions. */
2195 current->pdeath_signal = 0;
2196
2197 /* Check whether the new SID can inherit resource limits
2198 from the old SID. If not, reset all soft limits to
2199 the lower of the current task's hard limit and the init
2200 task's soft limit. Note that the setting of hard limits
2201 (even to lower them) can be controlled by the setrlimit
2202 check. The inclusion of the init task's soft limit into
2203 the computation is to avoid resetting soft limits higher
2204 than the default soft limit for cases where the default
2205 is lower than the hard limit, e.g. RLIMIT_CORE or
2206 RLIMIT_STACK.*/
2207 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2208 PROCESS__RLIMITINH, NULL);
2209 if (rc) {
2210 for (i = 0; i < RLIM_NLIMITS; i++) {
2211 rlim = current->signal->rlim + i;
2212 initrlim = init_task.signal->rlim+i;
2213 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2214 }
2215 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2216 /*
2217 * This will cause RLIMIT_CPU calculations
2218 * to be refigured.
2219 */
2220 current->it_prof_expires = jiffies_to_cputime(1);
2221 }
2222 }
2223
2224 /* Wake up the parent if it is waiting so that it can
2225 recheck wait permission to the new task SID. */
2226 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2227 }
2228
2229 /* superblock security operations */
2230
2231 static int selinux_sb_alloc_security(struct super_block *sb)
2232 {
2233 return superblock_alloc_security(sb);
2234 }
2235
2236 static void selinux_sb_free_security(struct super_block *sb)
2237 {
2238 superblock_free_security(sb);
2239 }
2240
2241 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2242 {
2243 if (plen > olen)
2244 return 0;
2245
2246 return !memcmp(prefix, option, plen);
2247 }
2248
2249 static inline int selinux_option(char *option, int len)
2250 {
2251 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
2252 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
2253 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
2254 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
2255 }
2256
2257 static inline void take_option(char **to, char *from, int *first, int len)
2258 {
2259 if (!*first) {
2260 **to = ',';
2261 *to += 1;
2262 } else
2263 *first = 0;
2264 memcpy(*to, from, len);
2265 *to += len;
2266 }
2267
2268 static inline void take_selinux_option(char **to, char *from, int *first,
2269 int len)
2270 {
2271 int current_size = 0;
2272
2273 if (!*first) {
2274 **to = '|';
2275 *to += 1;
2276 }
2277 else
2278 *first = 0;
2279
2280 while (current_size < len) {
2281 if (*from != '"') {
2282 **to = *from;
2283 *to += 1;
2284 }
2285 from += 1;
2286 current_size += 1;
2287 }
2288 }
2289
2290 static int selinux_sb_copy_data(char *orig, char *copy)
2291 {
2292 int fnosec, fsec, rc = 0;
2293 char *in_save, *in_curr, *in_end;
2294 char *sec_curr, *nosec_save, *nosec;
2295 int open_quote = 0;
2296
2297 in_curr = orig;
2298 sec_curr = copy;
2299
2300 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2301 if (!nosec) {
2302 rc = -ENOMEM;
2303 goto out;
2304 }
2305
2306 nosec_save = nosec;
2307 fnosec = fsec = 1;
2308 in_save = in_end = orig;
2309
2310 do {
2311 if (*in_end == '"')
2312 open_quote = !open_quote;
2313 if ((*in_end == ',' && open_quote == 0) ||
2314 *in_end == '\0') {
2315 int len = in_end - in_curr;
2316
2317 if (selinux_option(in_curr, len))
2318 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2319 else
2320 take_option(&nosec, in_curr, &fnosec, len);
2321
2322 in_curr = in_end + 1;
2323 }
2324 } while (*in_end++);
2325
2326 strcpy(in_save, nosec_save);
2327 free_page((unsigned long)nosec_save);
2328 out:
2329 return rc;
2330 }
2331
2332 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2333 {
2334 struct avc_audit_data ad;
2335 int rc;
2336
2337 rc = superblock_doinit(sb, data);
2338 if (rc)
2339 return rc;
2340
2341 AVC_AUDIT_DATA_INIT(&ad,FS);
2342 ad.u.fs.path.dentry = sb->s_root;
2343 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2344 }
2345
2346 static int selinux_sb_statfs(struct dentry *dentry)
2347 {
2348 struct avc_audit_data ad;
2349
2350 AVC_AUDIT_DATA_INIT(&ad,FS);
2351 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2352 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2353 }
2354
2355 static int selinux_mount(char * dev_name,
2356 struct nameidata *nd,
2357 char * type,
2358 unsigned long flags,
2359 void * data)
2360 {
2361 int rc;
2362
2363 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2364 if (rc)
2365 return rc;
2366
2367 if (flags & MS_REMOUNT)
2368 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2369 FILESYSTEM__REMOUNT, NULL);
2370 else
2371 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2372 FILE__MOUNTON);
2373 }
2374
2375 static int selinux_umount(struct vfsmount *mnt, int flags)
2376 {
2377 int rc;
2378
2379 rc = secondary_ops->sb_umount(mnt, flags);
2380 if (rc)
2381 return rc;
2382
2383 return superblock_has_perm(current,mnt->mnt_sb,
2384 FILESYSTEM__UNMOUNT,NULL);
2385 }
2386
2387 /* inode security operations */
2388
2389 static int selinux_inode_alloc_security(struct inode *inode)
2390 {
2391 return inode_alloc_security(inode);
2392 }
2393
2394 static void selinux_inode_free_security(struct inode *inode)
2395 {
2396 inode_free_security(inode);
2397 }
2398
2399 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2400 char **name, void **value,
2401 size_t *len)
2402 {
2403 struct task_security_struct *tsec;
2404 struct inode_security_struct *dsec;
2405 struct superblock_security_struct *sbsec;
2406 u32 newsid, clen;
2407 int rc;
2408 char *namep = NULL, *context;
2409
2410 tsec = current->security;
2411 dsec = dir->i_security;
2412 sbsec = dir->i_sb->s_security;
2413
2414 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2415 newsid = tsec->create_sid;
2416 } else {
2417 rc = security_transition_sid(tsec->sid, dsec->sid,
2418 inode_mode_to_security_class(inode->i_mode),
2419 &newsid);
2420 if (rc) {
2421 printk(KERN_WARNING "%s: "
2422 "security_transition_sid failed, rc=%d (dev=%s "
2423 "ino=%ld)\n",
2424 __FUNCTION__,
2425 -rc, inode->i_sb->s_id, inode->i_ino);
2426 return rc;
2427 }
2428 }
2429
2430 /* Possibly defer initialization to selinux_complete_init. */
2431 if (sbsec->initialized) {
2432 struct inode_security_struct *isec = inode->i_security;
2433 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2434 isec->sid = newsid;
2435 isec->initialized = 1;
2436 }
2437
2438 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2439 return -EOPNOTSUPP;
2440
2441 if (name) {
2442 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2443 if (!namep)
2444 return -ENOMEM;
2445 *name = namep;
2446 }
2447
2448 if (value && len) {
2449 rc = security_sid_to_context(newsid, &context, &clen);
2450 if (rc) {
2451 kfree(namep);
2452 return rc;
2453 }
2454 *value = context;
2455 *len = clen;
2456 }
2457
2458 return 0;
2459 }
2460
2461 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2462 {
2463 return may_create(dir, dentry, SECCLASS_FILE);
2464 }
2465
2466 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2467 {
2468 int rc;
2469
2470 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2471 if (rc)
2472 return rc;
2473 return may_link(dir, old_dentry, MAY_LINK);
2474 }
2475
2476 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2477 {
2478 int rc;
2479
2480 rc = secondary_ops->inode_unlink(dir, dentry);
2481 if (rc)
2482 return rc;
2483 return may_link(dir, dentry, MAY_UNLINK);
2484 }
2485
2486 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2487 {
2488 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2489 }
2490
2491 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2492 {
2493 return may_create(dir, dentry, SECCLASS_DIR);
2494 }
2495
2496 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2497 {
2498 return may_link(dir, dentry, MAY_RMDIR);
2499 }
2500
2501 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2502 {
2503 int rc;
2504
2505 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2506 if (rc)
2507 return rc;
2508
2509 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2510 }
2511
2512 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2513 struct inode *new_inode, struct dentry *new_dentry)
2514 {
2515 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2516 }
2517
2518 static int selinux_inode_readlink(struct dentry *dentry)
2519 {
2520 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2521 }
2522
2523 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2524 {
2525 int rc;
2526
2527 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2528 if (rc)
2529 return rc;
2530 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2531 }
2532
2533 static int selinux_inode_permission(struct inode *inode, int mask,
2534 struct nameidata *nd)
2535 {
2536 int rc;
2537
2538 rc = secondary_ops->inode_permission(inode, mask, nd);
2539 if (rc)
2540 return rc;
2541
2542 if (!mask) {
2543 /* No permission to check. Existence test. */
2544 return 0;
2545 }
2546
2547 return inode_has_perm(current, inode,
2548 file_mask_to_av(inode->i_mode, mask), NULL);
2549 }
2550
2551 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2552 {
2553 int rc;
2554
2555 rc = secondary_ops->inode_setattr(dentry, iattr);
2556 if (rc)
2557 return rc;
2558
2559 if (iattr->ia_valid & ATTR_FORCE)
2560 return 0;
2561
2562 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2563 ATTR_ATIME_SET | ATTR_MTIME_SET))
2564 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2565
2566 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2567 }
2568
2569 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2570 {
2571 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2572 }
2573
2574 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2575 {
2576 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2577 sizeof XATTR_SECURITY_PREFIX - 1)) {
2578 if (!strcmp(name, XATTR_NAME_CAPS)) {
2579 if (!capable(CAP_SETFCAP))
2580 return -EPERM;
2581 } else if (!capable(CAP_SYS_ADMIN)) {
2582 /* A different attribute in the security namespace.
2583 Restrict to administrator. */
2584 return -EPERM;
2585 }
2586 }
2587
2588 /* Not an attribute we recognize, so just check the
2589 ordinary setattr permission. */
2590 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2591 }
2592
2593 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2594 {
2595 struct task_security_struct *tsec = current->security;
2596 struct inode *inode = dentry->d_inode;
2597 struct inode_security_struct *isec = inode->i_security;
2598 struct superblock_security_struct *sbsec;
2599 struct avc_audit_data ad;
2600 u32 newsid;
2601 int rc = 0;
2602
2603 if (strcmp(name, XATTR_NAME_SELINUX))
2604 return selinux_inode_setotherxattr(dentry, name);
2605
2606 sbsec = inode->i_sb->s_security;
2607 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2608 return -EOPNOTSUPP;
2609
2610 if (!is_owner_or_cap(inode))
2611 return -EPERM;
2612
2613 AVC_AUDIT_DATA_INIT(&ad,FS);
2614 ad.u.fs.path.dentry = dentry;
2615
2616 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2617 FILE__RELABELFROM, &ad);
2618 if (rc)
2619 return rc;
2620
2621 rc = security_context_to_sid(value, size, &newsid);
2622 if (rc)
2623 return rc;
2624
2625 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2626 FILE__RELABELTO, &ad);
2627 if (rc)
2628 return rc;
2629
2630 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2631 isec->sclass);
2632 if (rc)
2633 return rc;
2634
2635 return avc_has_perm(newsid,
2636 sbsec->sid,
2637 SECCLASS_FILESYSTEM,
2638 FILESYSTEM__ASSOCIATE,
2639 &ad);
2640 }
2641
2642 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2643 void *value, size_t size, int flags)
2644 {
2645 struct inode *inode = dentry->d_inode;
2646 struct inode_security_struct *isec = inode->i_security;
2647 u32 newsid;
2648 int rc;
2649
2650 if (strcmp(name, XATTR_NAME_SELINUX)) {
2651 /* Not an attribute we recognize, so nothing to do. */
2652 return;
2653 }
2654
2655 rc = security_context_to_sid(value, size, &newsid);
2656 if (rc) {
2657 printk(KERN_WARNING "%s: unable to obtain SID for context "
2658 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2659 return;
2660 }
2661
2662 isec->sid = newsid;
2663 return;
2664 }
2665
2666 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2667 {
2668 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2669 }
2670
2671 static int selinux_inode_listxattr (struct dentry *dentry)
2672 {
2673 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2674 }
2675
2676 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2677 {
2678 if (strcmp(name, XATTR_NAME_SELINUX))
2679 return selinux_inode_setotherxattr(dentry, name);
2680
2681 /* No one is allowed to remove a SELinux security label.
2682 You can change the label, but all data must be labeled. */
2683 return -EACCES;
2684 }
2685
2686 /*
2687 * Copy the in-core inode security context value to the user. If the
2688 * getxattr() prior to this succeeded, check to see if we need to
2689 * canonicalize the value to be finally returned to the user.
2690 *
2691 * Permission check is handled by selinux_inode_getxattr hook.
2692 */
2693 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2694 {
2695 u32 size;
2696 int error;
2697 char *context = NULL;
2698 struct inode_security_struct *isec = inode->i_security;
2699
2700 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2701 return -EOPNOTSUPP;
2702
2703 error = security_sid_to_context(isec->sid, &context, &size);
2704 if (error)
2705 return error;
2706 error = size;
2707 if (alloc) {
2708 *buffer = context;
2709 goto out_nofree;
2710 }
2711 kfree(context);
2712 out_nofree:
2713 return error;
2714 }
2715
2716 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2717 const void *value, size_t size, int flags)
2718 {
2719 struct inode_security_struct *isec = inode->i_security;
2720 u32 newsid;
2721 int rc;
2722
2723 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2724 return -EOPNOTSUPP;
2725
2726 if (!value || !size)
2727 return -EACCES;
2728
2729 rc = security_context_to_sid((void*)value, size, &newsid);
2730 if (rc)
2731 return rc;
2732
2733 isec->sid = newsid;
2734 return 0;
2735 }
2736
2737 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2738 {
2739 const int len = sizeof(XATTR_NAME_SELINUX);
2740 if (buffer && len <= buffer_size)
2741 memcpy(buffer, XATTR_NAME_SELINUX, len);
2742 return len;
2743 }
2744
2745 static int selinux_inode_need_killpriv(struct dentry *dentry)
2746 {
2747 return secondary_ops->inode_need_killpriv(dentry);
2748 }
2749
2750 static int selinux_inode_killpriv(struct dentry *dentry)
2751 {
2752 return secondary_ops->inode_killpriv(dentry);
2753 }
2754
2755 /* file security operations */
2756
2757 static int selinux_revalidate_file_permission(struct file *file, int mask)
2758 {
2759 int rc;
2760 struct inode *inode = file->f_path.dentry->d_inode;
2761
2762 if (!mask) {
2763 /* No permission to check. Existence test. */
2764 return 0;
2765 }
2766
2767 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2768 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2769 mask |= MAY_APPEND;
2770
2771 rc = file_has_perm(current, file,
2772 file_mask_to_av(inode->i_mode, mask));
2773 if (rc)
2774 return rc;
2775
2776 return selinux_netlbl_inode_permission(inode, mask);
2777 }
2778
2779 static int selinux_file_permission(struct file *file, int mask)
2780 {
2781 struct inode *inode = file->f_path.dentry->d_inode;
2782 struct task_security_struct *tsec = current->security;
2783 struct file_security_struct *fsec = file->f_security;
2784 struct inode_security_struct *isec = inode->i_security;
2785
2786 if (!mask) {
2787 /* No permission to check. Existence test. */
2788 return 0;
2789 }
2790
2791 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2792 && fsec->pseqno == avc_policy_seqno())
2793 return selinux_netlbl_inode_permission(inode, mask);
2794
2795 return selinux_revalidate_file_permission(file, mask);
2796 }
2797
2798 static int selinux_file_alloc_security(struct file *file)
2799 {
2800 return file_alloc_security(file);
2801 }
2802
2803 static void selinux_file_free_security(struct file *file)
2804 {
2805 file_free_security(file);
2806 }
2807
2808 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2809 unsigned long arg)
2810 {
2811 int error = 0;
2812
2813 switch (cmd) {
2814 case FIONREAD:
2815 /* fall through */
2816 case FIBMAP:
2817 /* fall through */
2818 case FIGETBSZ:
2819 /* fall through */
2820 case EXT2_IOC_GETFLAGS:
2821 /* fall through */
2822 case EXT2_IOC_GETVERSION:
2823 error = file_has_perm(current, file, FILE__GETATTR);
2824 break;
2825
2826 case EXT2_IOC_SETFLAGS:
2827 /* fall through */
2828 case EXT2_IOC_SETVERSION:
2829 error = file_has_perm(current, file, FILE__SETATTR);
2830 break;
2831
2832 /* sys_ioctl() checks */
2833 case FIONBIO:
2834 /* fall through */
2835 case FIOASYNC:
2836 error = file_has_perm(current, file, 0);
2837 break;
2838
2839 case KDSKBENT:
2840 case KDSKBSENT:
2841 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2842 break;
2843
2844 /* default case assumes that the command will go
2845 * to the file's ioctl() function.
2846 */
2847 default:
2848 error = file_has_perm(current, file, FILE__IOCTL);
2849
2850 }
2851 return error;
2852 }
2853
2854 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2855 {
2856 #ifndef CONFIG_PPC32
2857 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2858 /*
2859 * We are making executable an anonymous mapping or a
2860 * private file mapping that will also be writable.
2861 * This has an additional check.
2862 */
2863 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2864 if (rc)
2865 return rc;
2866 }
2867 #endif
2868
2869 if (file) {
2870 /* read access is always possible with a mapping */
2871 u32 av = FILE__READ;
2872
2873 /* write access only matters if the mapping is shared */
2874 if (shared && (prot & PROT_WRITE))
2875 av |= FILE__WRITE;
2876
2877 if (prot & PROT_EXEC)
2878 av |= FILE__EXECUTE;
2879
2880 return file_has_perm(current, file, av);
2881 }
2882 return 0;
2883 }
2884
2885 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2886 unsigned long prot, unsigned long flags,
2887 unsigned long addr, unsigned long addr_only)
2888 {
2889 int rc = 0;
2890 u32 sid = ((struct task_security_struct*)(current->security))->sid;
2891
2892 if (addr < mmap_min_addr)
2893 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2894 MEMPROTECT__MMAP_ZERO, NULL);
2895 if (rc || addr_only)
2896 return rc;
2897
2898 if (selinux_checkreqprot)
2899 prot = reqprot;
2900
2901 return file_map_prot_check(file, prot,
2902 (flags & MAP_TYPE) == MAP_SHARED);
2903 }
2904
2905 static int selinux_file_mprotect(struct vm_area_struct *vma,
2906 unsigned long reqprot,
2907 unsigned long prot)
2908 {
2909 int rc;
2910
2911 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2912 if (rc)
2913 return rc;
2914
2915 if (selinux_checkreqprot)
2916 prot = reqprot;
2917
2918 #ifndef CONFIG_PPC32
2919 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2920 rc = 0;
2921 if (vma->vm_start >= vma->vm_mm->start_brk &&
2922 vma->vm_end <= vma->vm_mm->brk) {
2923 rc = task_has_perm(current, current,
2924 PROCESS__EXECHEAP);
2925 } else if (!vma->vm_file &&
2926 vma->vm_start <= vma->vm_mm->start_stack &&
2927 vma->vm_end >= vma->vm_mm->start_stack) {
2928 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2929 } else if (vma->vm_file && vma->anon_vma) {
2930 /*
2931 * We are making executable a file mapping that has
2932 * had some COW done. Since pages might have been
2933 * written, check ability to execute the possibly
2934 * modified content. This typically should only
2935 * occur for text relocations.
2936 */
2937 rc = file_has_perm(current, vma->vm_file,
2938 FILE__EXECMOD);
2939 }
2940 if (rc)
2941 return rc;
2942 }
2943 #endif
2944
2945 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2946 }
2947
2948 static int selinux_file_lock(struct file *file, unsigned int cmd)
2949 {
2950 return file_has_perm(current, file, FILE__LOCK);
2951 }
2952
2953 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2954 unsigned long arg)
2955 {
2956 int err = 0;
2957
2958 switch (cmd) {
2959 case F_SETFL:
2960 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2961 err = -EINVAL;
2962 break;
2963 }
2964
2965 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2966 err = file_has_perm(current, file,FILE__WRITE);
2967 break;
2968 }
2969 /* fall through */
2970 case F_SETOWN:
2971 case F_SETSIG:
2972 case F_GETFL:
2973 case F_GETOWN:
2974 case F_GETSIG:
2975 /* Just check FD__USE permission */
2976 err = file_has_perm(current, file, 0);
2977 break;
2978 case F_GETLK:
2979 case F_SETLK:
2980 case F_SETLKW:
2981 #if BITS_PER_LONG == 32
2982 case F_GETLK64:
2983 case F_SETLK64:
2984 case F_SETLKW64:
2985 #endif
2986 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2987 err = -EINVAL;
2988 break;
2989 }
2990 err = file_has_perm(current, file, FILE__LOCK);
2991 break;
2992 }
2993
2994 return err;
2995 }
2996
2997 static int selinux_file_set_fowner(struct file *file)
2998 {
2999 struct task_security_struct *tsec;
3000 struct file_security_struct *fsec;
3001
3002 tsec = current->security;
3003 fsec = file->f_security;
3004 fsec->fown_sid = tsec->sid;
3005
3006 return 0;
3007 }
3008
3009 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3010 struct fown_struct *fown, int signum)
3011 {
3012 struct file *file;
3013 u32 perm;
3014 struct task_security_struct *tsec;
3015 struct file_security_struct *fsec;
3016
3017 /* struct fown_struct is never outside the context of a struct file */
3018 file = container_of(fown, struct file, f_owner);
3019
3020 tsec = tsk->security;
3021 fsec = file->f_security;
3022
3023 if (!signum)
3024 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3025 else
3026 perm = signal_to_av(signum);
3027
3028 return avc_has_perm(fsec->fown_sid, tsec->sid,
3029 SECCLASS_PROCESS, perm, NULL);
3030 }
3031
3032 static int selinux_file_receive(struct file *file)
3033 {
3034 return file_has_perm(current, file, file_to_av(file));
3035 }
3036
3037 static int selinux_dentry_open(struct file *file)
3038 {
3039 struct file_security_struct *fsec;
3040 struct inode *inode;
3041 struct inode_security_struct *isec;
3042 inode = file->f_path.dentry->d_inode;
3043 fsec = file->f_security;
3044 isec = inode->i_security;
3045 /*
3046 * Save inode label and policy sequence number
3047 * at open-time so that selinux_file_permission
3048 * can determine whether revalidation is necessary.
3049 * Task label is already saved in the file security
3050 * struct as its SID.
3051 */
3052 fsec->isid = isec->sid;
3053 fsec->pseqno = avc_policy_seqno();
3054 /*
3055 * Since the inode label or policy seqno may have changed
3056 * between the selinux_inode_permission check and the saving
3057 * of state above, recheck that access is still permitted.
3058 * Otherwise, access might never be revalidated against the
3059 * new inode label or new policy.
3060 * This check is not redundant - do not remove.
3061 */
3062 return inode_has_perm(current, inode, file_to_av(file), NULL);
3063 }
3064
3065 /* task security operations */
3066
3067 static int selinux_task_create(unsigned long clone_flags)
3068 {
3069 int rc;
3070
3071 rc = secondary_ops->task_create(clone_flags);
3072 if (rc)
3073 return rc;
3074
3075 return task_has_perm(current, current, PROCESS__FORK);
3076 }
3077
3078 static int selinux_task_alloc_security(struct task_struct *tsk)
3079 {
3080 struct task_security_struct *tsec1, *tsec2;
3081 int rc;
3082
3083 tsec1 = current->security;
3084
3085 rc = task_alloc_security(tsk);
3086 if (rc)
3087 return rc;
3088 tsec2 = tsk->security;
3089
3090 tsec2->osid = tsec1->osid;
3091 tsec2->sid = tsec1->sid;
3092
3093 /* Retain the exec, fs, key, and sock SIDs across fork */
3094 tsec2->exec_sid = tsec1->exec_sid;
3095 tsec2->create_sid = tsec1->create_sid;
3096 tsec2->keycreate_sid = tsec1->keycreate_sid;
3097 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3098
3099 /* Retain ptracer SID across fork, if any.
3100 This will be reset by the ptrace hook upon any
3101 subsequent ptrace_attach operations. */
3102 tsec2->ptrace_sid = tsec1->ptrace_sid;
3103
3104 return 0;
3105 }
3106
3107 static void selinux_task_free_security(struct task_struct *tsk)
3108 {
3109 task_free_security(tsk);
3110 }
3111
3112 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3113 {
3114 /* Since setuid only affects the current process, and
3115 since the SELinux controls are not based on the Linux
3116 identity attributes, SELinux does not need to control
3117 this operation. However, SELinux does control the use
3118 of the CAP_SETUID and CAP_SETGID capabilities using the
3119 capable hook. */
3120 return 0;
3121 }
3122
3123 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3124 {
3125 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3126 }
3127
3128 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3129 {
3130 /* See the comment for setuid above. */
3131 return 0;
3132 }
3133
3134 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3135 {
3136 return task_has_perm(current, p, PROCESS__SETPGID);
3137 }
3138
3139 static int selinux_task_getpgid(struct task_struct *p)
3140 {
3141 return task_has_perm(current, p, PROCESS__GETPGID);
3142 }
3143
3144 static int selinux_task_getsid(struct task_struct *p)
3145 {
3146 return task_has_perm(current, p, PROCESS__GETSESSION);
3147 }
3148
3149 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3150 {
3151 selinux_get_task_sid(p, secid);
3152 }
3153
3154 static int selinux_task_setgroups(struct group_info *group_info)
3155 {
3156 /* See the comment for setuid above. */
3157 return 0;
3158 }
3159
3160 static int selinux_task_setnice(struct task_struct *p, int nice)
3161 {
3162 int rc;
3163
3164 rc = secondary_ops->task_setnice(p, nice);
3165 if (rc)
3166 return rc;
3167
3168 return task_has_perm(current,p, PROCESS__SETSCHED);
3169 }
3170
3171 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3172 {
3173 int rc;
3174
3175 rc = secondary_ops->task_setioprio(p, ioprio);
3176 if (rc)
3177 return rc;
3178
3179 return task_has_perm(current, p, PROCESS__SETSCHED);
3180 }
3181
3182 static int selinux_task_getioprio(struct task_struct *p)
3183 {
3184 return task_has_perm(current, p, PROCESS__GETSCHED);
3185 }
3186
3187 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3188 {
3189 struct rlimit *old_rlim = current->signal->rlim + resource;
3190 int rc;
3191
3192 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3193 if (rc)
3194 return rc;
3195
3196 /* Control the ability to change the hard limit (whether
3197 lowering or raising it), so that the hard limit can
3198 later be used as a safe reset point for the soft limit
3199 upon context transitions. See selinux_bprm_apply_creds. */
3200 if (old_rlim->rlim_max != new_rlim->rlim_max)
3201 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3202
3203 return 0;
3204 }
3205
3206 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3207 {
3208 int rc;
3209
3210 rc = secondary_ops->task_setscheduler(p, policy, lp);
3211 if (rc)
3212 return rc;
3213
3214 return task_has_perm(current, p, PROCESS__SETSCHED);
3215 }
3216
3217 static int selinux_task_getscheduler(struct task_struct *p)
3218 {
3219 return task_has_perm(current, p, PROCESS__GETSCHED);
3220 }
3221
3222 static int selinux_task_movememory(struct task_struct *p)
3223 {
3224 return task_has_perm(current, p, PROCESS__SETSCHED);
3225 }
3226
3227 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3228 int sig, u32 secid)
3229 {
3230 u32 perm;
3231 int rc;
3232 struct task_security_struct *tsec;
3233
3234 rc = secondary_ops->task_kill(p, info, sig, secid);
3235 if (rc)
3236 return rc;
3237
3238 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3239 return 0;
3240
3241 if (!sig)
3242 perm = PROCESS__SIGNULL; /* null signal; existence test */
3243 else
3244 perm = signal_to_av(sig);
3245 tsec = p->security;
3246 if (secid)
3247 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3248 else
3249 rc = task_has_perm(current, p, perm);
3250 return rc;
3251 }
3252
3253 static int selinux_task_prctl(int option,
3254 unsigned long arg2,
3255 unsigned long arg3,
3256 unsigned long arg4,
3257 unsigned long arg5)
3258 {
3259 /* The current prctl operations do not appear to require
3260 any SELinux controls since they merely observe or modify
3261 the state of the current process. */
3262 return 0;
3263 }
3264
3265 static int selinux_task_wait(struct task_struct *p)
3266 {
3267 return task_has_perm(p, current, PROCESS__SIGCHLD);
3268 }
3269
3270 static void selinux_task_reparent_to_init(struct task_struct *p)
3271 {
3272 struct task_security_struct *tsec;
3273
3274 secondary_ops->task_reparent_to_init(p);
3275
3276 tsec = p->security;
3277 tsec->osid = tsec->sid;
3278 tsec->sid = SECINITSID_KERNEL;
3279 return;
3280 }
3281
3282 static void selinux_task_to_inode(struct task_struct *p,
3283 struct inode *inode)
3284 {
3285 struct task_security_struct *tsec = p->security;
3286 struct inode_security_struct *isec = inode->i_security;
3287
3288 isec->sid = tsec->sid;
3289 isec->initialized = 1;
3290 return;
3291 }
3292
3293 /* Returns error only if unable to parse addresses */
3294 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3295 struct avc_audit_data *ad, u8 *proto)
3296 {
3297 int offset, ihlen, ret = -EINVAL;
3298 struct iphdr _iph, *ih;
3299
3300 offset = skb_network_offset(skb);
3301 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3302 if (ih == NULL)
3303 goto out;
3304
3305 ihlen = ih->ihl * 4;
3306 if (ihlen < sizeof(_iph))
3307 goto out;
3308
3309 ad->u.net.v4info.saddr = ih->saddr;
3310 ad->u.net.v4info.daddr = ih->daddr;
3311 ret = 0;
3312
3313 if (proto)
3314 *proto = ih->protocol;
3315
3316 switch (ih->protocol) {
3317 case IPPROTO_TCP: {
3318 struct tcphdr _tcph, *th;
3319
3320 if (ntohs(ih->frag_off) & IP_OFFSET)
3321 break;
3322
3323 offset += ihlen;
3324 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3325 if (th == NULL)
3326 break;
3327
3328 ad->u.net.sport = th->source;
3329 ad->u.net.dport = th->dest;
3330 break;
3331 }
3332
3333 case IPPROTO_UDP: {
3334 struct udphdr _udph, *uh;
3335
3336 if (ntohs(ih->frag_off) & IP_OFFSET)
3337 break;
3338
3339 offset += ihlen;
3340 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3341 if (uh == NULL)
3342 break;
3343
3344 ad->u.net.sport = uh->source;
3345 ad->u.net.dport = uh->dest;
3346 break;
3347 }
3348
3349 case IPPROTO_DCCP: {
3350 struct dccp_hdr _dccph, *dh;
3351
3352 if (ntohs(ih->frag_off) & IP_OFFSET)
3353 break;
3354
3355 offset += ihlen;
3356 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3357 if (dh == NULL)
3358 break;
3359
3360 ad->u.net.sport = dh->dccph_sport;
3361 ad->u.net.dport = dh->dccph_dport;
3362 break;
3363 }
3364
3365 default:
3366 break;
3367 }
3368 out:
3369 return ret;
3370 }
3371
3372 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3373
3374 /* Returns error only if unable to parse addresses */
3375 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3376 struct avc_audit_data *ad, u8 *proto)
3377 {
3378 u8 nexthdr;
3379 int ret = -EINVAL, offset;
3380 struct ipv6hdr _ipv6h, *ip6;
3381
3382 offset = skb_network_offset(skb);
3383 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3384 if (ip6 == NULL)
3385 goto out;
3386
3387 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3388 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3389 ret = 0;
3390
3391 nexthdr = ip6->nexthdr;
3392 offset += sizeof(_ipv6h);
3393 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3394 if (offset < 0)
3395 goto out;
3396
3397 if (proto)
3398 *proto = nexthdr;
3399
3400 switch (nexthdr) {
3401 case IPPROTO_TCP: {
3402 struct tcphdr _tcph, *th;
3403
3404 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3405 if (th == NULL)
3406 break;
3407
3408 ad->u.net.sport = th->source;
3409 ad->u.net.dport = th->dest;
3410 break;
3411 }
3412
3413 case IPPROTO_UDP: {
3414 struct udphdr _udph, *uh;
3415
3416 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3417 if (uh == NULL)
3418 break;
3419
3420 ad->u.net.sport = uh->source;
3421 ad->u.net.dport = uh->dest;
3422 break;
3423 }
3424
3425 case IPPROTO_DCCP: {
3426 struct dccp_hdr _dccph, *dh;
3427
3428 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3429 if (dh == NULL)
3430 break;
3431
3432 ad->u.net.sport = dh->dccph_sport;
3433 ad->u.net.dport = dh->dccph_dport;
3434 break;
3435 }
3436
3437 /* includes fragments */
3438 default:
3439 break;
3440 }
3441 out:
3442 return ret;
3443 }
3444
3445 #endif /* IPV6 */
3446
3447 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3448 char **addrp, int src, u8 *proto)
3449 {
3450 int ret = 0;
3451
3452 switch (ad->u.net.family) {
3453 case PF_INET:
3454 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3455 if (ret || !addrp)
3456 break;
3457 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3458 &ad->u.net.v4info.daddr);
3459 break;
3460
3461 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3462 case PF_INET6:
3463 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3464 if (ret || !addrp)
3465 break;
3466 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3467 &ad->u.net.v6info.daddr);
3468 break;
3469 #endif /* IPV6 */
3470 default:
3471 break;
3472 }
3473
3474 if (unlikely(ret))
3475 printk(KERN_WARNING
3476 "SELinux: failure in selinux_parse_skb(),"
3477 " unable to parse packet\n");
3478
3479 return ret;
3480 }
3481
3482 /**
3483 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3484 * @skb: the packet
3485 * @family: protocol family
3486 * @sid: the packet's peer label SID
3487 *
3488 * Description:
3489 * Check the various different forms of network peer labeling and determine
3490 * the peer label/SID for the packet; most of the magic actually occurs in
3491 * the security server function security_net_peersid_cmp(). The function
3492 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3493 * or -EACCES if @sid is invalid due to inconsistencies with the different
3494 * peer labels.
3495 *
3496 */
3497 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3498 {
3499 int err;
3500 u32 xfrm_sid;
3501 u32 nlbl_sid;
3502 u32 nlbl_type;
3503
3504 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3505 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3506
3507 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3508 if (unlikely(err)) {
3509 printk(KERN_WARNING
3510 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3511 " unable to determine packet's peer label\n");
3512 return -EACCES;
3513 }
3514
3515 return 0;
3516 }
3517
3518 /* socket security operations */
3519 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3520 u32 perms)
3521 {
3522 struct inode_security_struct *isec;
3523 struct task_security_struct *tsec;
3524 struct avc_audit_data ad;
3525 int err = 0;
3526
3527 tsec = task->security;
3528 isec = SOCK_INODE(sock)->i_security;
3529
3530 if (isec->sid == SECINITSID_KERNEL)
3531 goto out;
3532
3533 AVC_AUDIT_DATA_INIT(&ad,NET);
3534 ad.u.net.sk = sock->sk;
3535 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3536
3537 out:
3538 return err;
3539 }
3540
3541 static int selinux_socket_create(int family, int type,
3542 int protocol, int kern)
3543 {
3544 int err = 0;
3545 struct task_security_struct *tsec;
3546 u32 newsid;
3547
3548 if (kern)
3549 goto out;
3550
3551 tsec = current->security;
3552 newsid = tsec->sockcreate_sid ? : tsec->sid;
3553 err = avc_has_perm(tsec->sid, newsid,
3554 socket_type_to_security_class(family, type,
3555 protocol), SOCKET__CREATE, NULL);
3556
3557 out:
3558 return err;
3559 }
3560
3561 static int selinux_socket_post_create(struct socket *sock, int family,
3562 int type, int protocol, int kern)
3563 {
3564 int err = 0;
3565 struct inode_security_struct *isec;
3566 struct task_security_struct *tsec;
3567 struct sk_security_struct *sksec;
3568 u32 newsid;
3569
3570 isec = SOCK_INODE(sock)->i_security;
3571
3572 tsec = current->security;
3573 newsid = tsec->sockcreate_sid ? : tsec->sid;
3574 isec->sclass = socket_type_to_security_class(family, type, protocol);
3575 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3576 isec->initialized = 1;
3577
3578 if (sock->sk) {
3579 sksec = sock->sk->sk_security;
3580 sksec->sid = isec->sid;
3581 sksec->sclass = isec->sclass;
3582 err = selinux_netlbl_socket_post_create(sock);
3583 }
3584
3585 return err;
3586 }
3587
3588 /* Range of port numbers used to automatically bind.
3589 Need to determine whether we should perform a name_bind
3590 permission check between the socket and the port number. */
3591
3592 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3593 {
3594 u16 family;
3595 int err;
3596
3597 err = socket_has_perm(current, sock, SOCKET__BIND);
3598 if (err)
3599 goto out;
3600
3601 /*
3602 * If PF_INET or PF_INET6, check name_bind permission for the port.
3603 * Multiple address binding for SCTP is not supported yet: we just
3604 * check the first address now.
3605 */
3606 family = sock->sk->sk_family;
3607 if (family == PF_INET || family == PF_INET6) {
3608 char *addrp;
3609 struct inode_security_struct *isec;
3610 struct task_security_struct *tsec;
3611 struct avc_audit_data ad;
3612 struct sockaddr_in *addr4 = NULL;
3613 struct sockaddr_in6 *addr6 = NULL;
3614 unsigned short snum;
3615 struct sock *sk = sock->sk;
3616 u32 sid, node_perm, addrlen;
3617
3618 tsec = current->security;
3619 isec = SOCK_INODE(sock)->i_security;
3620
3621 if (family == PF_INET) {
3622 addr4 = (struct sockaddr_in *)address;
3623 snum = ntohs(addr4->sin_port);
3624 addrlen = sizeof(addr4->sin_addr.s_addr);
3625 addrp = (char *)&addr4->sin_addr.s_addr;
3626 } else {
3627 addr6 = (struct sockaddr_in6 *)address;
3628 snum = ntohs(addr6->sin6_port);
3629 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3630 addrp = (char *)&addr6->sin6_addr.s6_addr;
3631 }
3632
3633 if (snum) {
3634 int low, high;
3635
3636 inet_get_local_port_range(&low, &high);
3637
3638 if (snum < max(PROT_SOCK, low) || snum > high) {
3639 err = security_port_sid(sk->sk_family,
3640 sk->sk_type,
3641 sk->sk_protocol, snum,
3642 &sid);
3643 if (err)
3644 goto out;
3645 AVC_AUDIT_DATA_INIT(&ad,NET);
3646 ad.u.net.sport = htons(snum);
3647 ad.u.net.family = family;
3648 err = avc_has_perm(isec->sid, sid,
3649 isec->sclass,
3650 SOCKET__NAME_BIND, &ad);
3651 if (err)
3652 goto out;
3653 }
3654 }
3655
3656 switch(isec->sclass) {
3657 case SECCLASS_TCP_SOCKET:
3658 node_perm = TCP_SOCKET__NODE_BIND;
3659 break;
3660
3661 case SECCLASS_UDP_SOCKET:
3662 node_perm = UDP_SOCKET__NODE_BIND;
3663 break;
3664
3665 case SECCLASS_DCCP_SOCKET:
3666 node_perm = DCCP_SOCKET__NODE_BIND;
3667 break;
3668
3669 default:
3670 node_perm = RAWIP_SOCKET__NODE_BIND;
3671 break;
3672 }
3673
3674 err = sel_netnode_sid(addrp, family, &sid);
3675 if (err)
3676 goto out;
3677
3678 AVC_AUDIT_DATA_INIT(&ad,NET);
3679 ad.u.net.sport = htons(snum);
3680 ad.u.net.family = family;
3681
3682 if (family == PF_INET)
3683 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3684 else
3685 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3686
3687 err = avc_has_perm(isec->sid, sid,
3688 isec->sclass, node_perm, &ad);
3689 if (err)
3690 goto out;
3691 }
3692 out:
3693 return err;
3694 }
3695
3696 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3697 {
3698 struct inode_security_struct *isec;
3699 int err;
3700
3701 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3702 if (err)
3703 return err;
3704
3705 /*
3706 * If a TCP or DCCP socket, check name_connect permission for the port.
3707 */
3708 isec = SOCK_INODE(sock)->i_security;
3709 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3710 isec->sclass == SECCLASS_DCCP_SOCKET) {
3711 struct sock *sk = sock->sk;
3712 struct avc_audit_data ad;
3713 struct sockaddr_in *addr4 = NULL;
3714 struct sockaddr_in6 *addr6 = NULL;
3715 unsigned short snum;
3716 u32 sid, perm;
3717
3718 if (sk->sk_family == PF_INET) {
3719 addr4 = (struct sockaddr_in *)address;
3720 if (addrlen < sizeof(struct sockaddr_in))
3721 return -EINVAL;
3722 snum = ntohs(addr4->sin_port);
3723 } else {
3724 addr6 = (struct sockaddr_in6 *)address;
3725 if (addrlen < SIN6_LEN_RFC2133)
3726 return -EINVAL;
3727 snum = ntohs(addr6->sin6_port);
3728 }
3729
3730 err = security_port_sid(sk->sk_family, sk->sk_type,
3731 sk->sk_protocol, snum, &sid);
3732 if (err)
3733 goto out;
3734
3735 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3736 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3737
3738 AVC_AUDIT_DATA_INIT(&ad,NET);
3739 ad.u.net.dport = htons(snum);
3740 ad.u.net.family = sk->sk_family;
3741 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3742 if (err)
3743 goto out;
3744 }
3745
3746 out:
3747 return err;
3748 }
3749
3750 static int selinux_socket_listen(struct socket *sock, int backlog)
3751 {
3752 return socket_has_perm(current, sock, SOCKET__LISTEN);
3753 }
3754
3755 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3756 {
3757 int err;
3758 struct inode_security_struct *isec;
3759 struct inode_security_struct *newisec;
3760
3761 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3762 if (err)
3763 return err;
3764
3765 newisec = SOCK_INODE(newsock)->i_security;
3766
3767 isec = SOCK_INODE(sock)->i_security;
3768 newisec->sclass = isec->sclass;
3769 newisec->sid = isec->sid;
3770 newisec->initialized = 1;
3771
3772 return 0;
3773 }
3774
3775 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3776 int size)
3777 {
3778 int rc;
3779
3780 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3781 if (rc)
3782 return rc;
3783
3784 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3785 }
3786
3787 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3788 int size, int flags)
3789 {
3790 return socket_has_perm(current, sock, SOCKET__READ);
3791 }
3792
3793 static int selinux_socket_getsockname(struct socket *sock)
3794 {
3795 return socket_has_perm(current, sock, SOCKET__GETATTR);
3796 }
3797
3798 static int selinux_socket_getpeername(struct socket *sock)
3799 {
3800 return socket_has_perm(current, sock, SOCKET__GETATTR);
3801 }
3802
3803 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3804 {
3805 int err;
3806
3807 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3808 if (err)
3809 return err;
3810
3811 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3812 }
3813
3814 static int selinux_socket_getsockopt(struct socket *sock, int level,
3815 int optname)
3816 {
3817 return socket_has_perm(current, sock, SOCKET__GETOPT);
3818 }
3819
3820 static int selinux_socket_shutdown(struct socket *sock, int how)
3821 {
3822 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3823 }
3824
3825 static int selinux_socket_unix_stream_connect(struct socket *sock,
3826 struct socket *other,
3827 struct sock *newsk)
3828 {
3829 struct sk_security_struct *ssec;
3830 struct inode_security_struct *isec;
3831 struct inode_security_struct *other_isec;
3832 struct avc_audit_data ad;
3833 int err;
3834
3835 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3836 if (err)
3837 return err;
3838
3839 isec = SOCK_INODE(sock)->i_security;
3840 other_isec = SOCK_INODE(other)->i_security;
3841
3842 AVC_AUDIT_DATA_INIT(&ad,NET);
3843 ad.u.net.sk = other->sk;
3844
3845 err = avc_has_perm(isec->sid, other_isec->sid,
3846 isec->sclass,
3847 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3848 if (err)
3849 return err;
3850
3851 /* connecting socket */
3852 ssec = sock->sk->sk_security;
3853 ssec->peer_sid = other_isec->sid;
3854
3855 /* server child socket */
3856 ssec = newsk->sk_security;
3857 ssec->peer_sid = isec->sid;
3858 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3859
3860 return err;
3861 }
3862
3863 static int selinux_socket_unix_may_send(struct socket *sock,
3864 struct socket *other)
3865 {
3866 struct inode_security_struct *isec;
3867 struct inode_security_struct *other_isec;
3868 struct avc_audit_data ad;
3869 int err;
3870
3871 isec = SOCK_INODE(sock)->i_security;
3872 other_isec = SOCK_INODE(other)->i_security;
3873
3874 AVC_AUDIT_DATA_INIT(&ad,NET);
3875 ad.u.net.sk = other->sk;
3876
3877 err = avc_has_perm(isec->sid, other_isec->sid,
3878 isec->sclass, SOCKET__SENDTO, &ad);
3879 if (err)
3880 return err;
3881
3882 return 0;
3883 }
3884
3885 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3886 u32 peer_sid,
3887 struct avc_audit_data *ad)
3888 {
3889 int err;
3890 u32 if_sid;
3891 u32 node_sid;
3892
3893 err = sel_netif_sid(ifindex, &if_sid);
3894 if (err)
3895 return err;
3896 err = avc_has_perm(peer_sid, if_sid,
3897 SECCLASS_NETIF, NETIF__INGRESS, ad);
3898 if (err)
3899 return err;
3900
3901 err = sel_netnode_sid(addrp, family, &node_sid);
3902 if (err)
3903 return err;
3904 return avc_has_perm(peer_sid, node_sid,
3905 SECCLASS_NODE, NODE__RECVFROM, ad);
3906 }
3907
3908 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3909 struct sk_buff *skb,
3910 struct avc_audit_data *ad,
3911 u16 family,
3912 char *addrp)
3913 {
3914 int err;
3915 struct sk_security_struct *sksec = sk->sk_security;
3916 u16 sk_class;
3917 u32 netif_perm, node_perm, recv_perm;
3918 u32 port_sid, node_sid, if_sid, sk_sid;
3919
3920 sk_sid = sksec->sid;
3921 sk_class = sksec->sclass;
3922
3923 switch (sk_class) {
3924 case SECCLASS_UDP_SOCKET:
3925 netif_perm = NETIF__UDP_RECV;
3926 node_perm = NODE__UDP_RECV;
3927 recv_perm = UDP_SOCKET__RECV_MSG;
3928 break;
3929 case SECCLASS_TCP_SOCKET:
3930 netif_perm = NETIF__TCP_RECV;
3931 node_perm = NODE__TCP_RECV;
3932 recv_perm = TCP_SOCKET__RECV_MSG;
3933 break;
3934 case SECCLASS_DCCP_SOCKET:
3935 netif_perm = NETIF__DCCP_RECV;
3936 node_perm = NODE__DCCP_RECV;
3937 recv_perm = DCCP_SOCKET__RECV_MSG;
3938 break;
3939 default:
3940 netif_perm = NETIF__RAWIP_RECV;
3941 node_perm = NODE__RAWIP_RECV;
3942 recv_perm = 0;
3943 break;
3944 }
3945
3946 err = sel_netif_sid(skb->iif, &if_sid);
3947 if (err)
3948 return err;
3949 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3950 if (err)
3951 return err;
3952
3953 err = sel_netnode_sid(addrp, family, &node_sid);
3954 if (err)
3955 return err;
3956 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3957 if (err)
3958 return err;
3959
3960 if (!recv_perm)
3961 return 0;
3962 err = security_port_sid(sk->sk_family, sk->sk_type,
3963 sk->sk_protocol, ntohs(ad->u.net.sport),
3964 &port_sid);
3965 if (unlikely(err)) {
3966 printk(KERN_WARNING
3967 "SELinux: failure in"
3968 " selinux_sock_rcv_skb_iptables_compat(),"
3969 " network port label not found\n");
3970 return err;
3971 }
3972 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
3973 }
3974
3975 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3976 struct avc_audit_data *ad,
3977 u16 family, char *addrp)
3978 {
3979 int err;
3980 struct sk_security_struct *sksec = sk->sk_security;
3981 u32 peer_sid;
3982 u32 sk_sid = sksec->sid;
3983
3984 if (selinux_compat_net)
3985 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
3986 family, addrp);
3987 else
3988 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
3989 PACKET__RECV, ad);
3990 if (err)
3991 return err;
3992
3993 if (selinux_policycap_netpeer) {
3994 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
3995 if (err)
3996 return err;
3997 err = avc_has_perm(sk_sid, peer_sid,
3998 SECCLASS_PEER, PEER__RECV, ad);
3999 } else {
4000 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4001 if (err)
4002 return err;
4003 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4004 }
4005
4006 return err;
4007 }
4008
4009 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4010 {
4011 int err;
4012 struct sk_security_struct *sksec = sk->sk_security;
4013 u16 family = sk->sk_family;
4014 u32 sk_sid = sksec->sid;
4015 struct avc_audit_data ad;
4016 char *addrp;
4017
4018 if (family != PF_INET && family != PF_INET6)
4019 return 0;
4020
4021 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4022 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4023 family = PF_INET;
4024
4025 AVC_AUDIT_DATA_INIT(&ad, NET);
4026 ad.u.net.netif = skb->iif;
4027 ad.u.net.family = family;
4028 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4029 if (err)
4030 return err;
4031
4032 /* If any sort of compatibility mode is enabled then handoff processing
4033 * to the selinux_sock_rcv_skb_compat() function to deal with the
4034 * special handling. We do this in an attempt to keep this function
4035 * as fast and as clean as possible. */
4036 if (selinux_compat_net || !selinux_policycap_netpeer)
4037 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4038 family, addrp);
4039
4040 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4041 u32 peer_sid;
4042
4043 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4044 if (err)
4045 return err;
4046 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4047 peer_sid, &ad);
4048 if (err)
4049 return err;
4050 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4051 PEER__RECV, &ad);
4052 }
4053
4054 if (selinux_secmark_enabled()) {
4055 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4056 PACKET__RECV, &ad);
4057 if (err)
4058 return err;
4059 }
4060
4061 return err;
4062 }
4063
4064 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4065 int __user *optlen, unsigned len)
4066 {
4067 int err = 0;
4068 char *scontext;
4069 u32 scontext_len;
4070 struct sk_security_struct *ssec;
4071 struct inode_security_struct *isec;
4072 u32 peer_sid = SECSID_NULL;
4073
4074 isec = SOCK_INODE(sock)->i_security;
4075
4076 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4077 isec->sclass == SECCLASS_TCP_SOCKET) {
4078 ssec = sock->sk->sk_security;
4079 peer_sid = ssec->peer_sid;
4080 }
4081 if (peer_sid == SECSID_NULL) {
4082 err = -ENOPROTOOPT;
4083 goto out;
4084 }
4085
4086 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4087
4088 if (err)
4089 goto out;
4090
4091 if (scontext_len > len) {
4092 err = -ERANGE;
4093 goto out_len;
4094 }
4095
4096 if (copy_to_user(optval, scontext, scontext_len))
4097 err = -EFAULT;
4098
4099 out_len:
4100 if (put_user(scontext_len, optlen))
4101 err = -EFAULT;
4102
4103 kfree(scontext);
4104 out:
4105 return err;
4106 }
4107
4108 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4109 {
4110 u32 peer_secid = SECSID_NULL;
4111 u16 family;
4112
4113 if (sock)
4114 family = sock->sk->sk_family;
4115 else if (skb && skb->sk)
4116 family = skb->sk->sk_family;
4117 else
4118 goto out;
4119
4120 if (sock && family == PF_UNIX)
4121 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
4122 else if (skb)
4123 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4124
4125 out:
4126 *secid = peer_secid;
4127 if (peer_secid == SECSID_NULL)
4128 return -EINVAL;
4129 return 0;
4130 }
4131
4132 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4133 {
4134 return sk_alloc_security(sk, family, priority);
4135 }
4136
4137 static void selinux_sk_free_security(struct sock *sk)
4138 {
4139 sk_free_security(sk);
4140 }
4141
4142 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4143 {
4144 struct sk_security_struct *ssec = sk->sk_security;
4145 struct sk_security_struct *newssec = newsk->sk_security;
4146
4147 newssec->sid = ssec->sid;
4148 newssec->peer_sid = ssec->peer_sid;
4149 newssec->sclass = ssec->sclass;
4150
4151 selinux_netlbl_sk_security_clone(ssec, newssec);
4152 }
4153
4154 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4155 {
4156 if (!sk)
4157 *secid = SECINITSID_ANY_SOCKET;
4158 else {
4159 struct sk_security_struct *sksec = sk->sk_security;
4160
4161 *secid = sksec->sid;
4162 }
4163 }
4164
4165 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4166 {
4167 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4168 struct sk_security_struct *sksec = sk->sk_security;
4169
4170 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4171 sk->sk_family == PF_UNIX)
4172 isec->sid = sksec->sid;
4173 sksec->sclass = isec->sclass;
4174
4175 selinux_netlbl_sock_graft(sk, parent);
4176 }
4177
4178 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4179 struct request_sock *req)
4180 {
4181 struct sk_security_struct *sksec = sk->sk_security;
4182 int err;
4183 u32 newsid;
4184 u32 peersid;
4185
4186 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4187 if (err)
4188 return err;
4189 if (peersid == SECSID_NULL) {
4190 req->secid = sksec->sid;
4191 req->peer_secid = SECSID_NULL;
4192 return 0;
4193 }
4194
4195 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4196 if (err)
4197 return err;
4198
4199 req->secid = newsid;
4200 req->peer_secid = peersid;
4201 return 0;
4202 }
4203
4204 static void selinux_inet_csk_clone(struct sock *newsk,
4205 const struct request_sock *req)
4206 {
4207 struct sk_security_struct *newsksec = newsk->sk_security;
4208
4209 newsksec->sid = req->secid;
4210 newsksec->peer_sid = req->peer_secid;
4211 /* NOTE: Ideally, we should also get the isec->sid for the
4212 new socket in sync, but we don't have the isec available yet.
4213 So we will wait until sock_graft to do it, by which
4214 time it will have been created and available. */
4215
4216 /* We don't need to take any sort of lock here as we are the only
4217 * thread with access to newsksec */
4218 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4219 }
4220
4221 static void selinux_inet_conn_established(struct sock *sk,
4222 struct sk_buff *skb)
4223 {
4224 struct sk_security_struct *sksec = sk->sk_security;
4225
4226 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4227 }
4228
4229 static void selinux_req_classify_flow(const struct request_sock *req,
4230 struct flowi *fl)
4231 {
4232 fl->secid = req->secid;
4233 }
4234
4235 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4236 {
4237 int err = 0;
4238 u32 perm;
4239 struct nlmsghdr *nlh;
4240 struct socket *sock = sk->sk_socket;
4241 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4242
4243 if (skb->len < NLMSG_SPACE(0)) {
4244 err = -EINVAL;
4245 goto out;
4246 }
4247 nlh = nlmsg_hdr(skb);
4248
4249 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4250 if (err) {
4251 if (err == -EINVAL) {
4252 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4253 "SELinux: unrecognized netlink message"
4254 " type=%hu for sclass=%hu\n",
4255 nlh->nlmsg_type, isec->sclass);
4256 if (!selinux_enforcing)
4257 err = 0;
4258 }
4259
4260 /* Ignore */
4261 if (err == -ENOENT)
4262 err = 0;
4263 goto out;
4264 }
4265
4266 err = socket_has_perm(current, sock, perm);
4267 out:
4268 return err;
4269 }
4270
4271 #ifdef CONFIG_NETFILTER
4272
4273 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4274 u16 family)
4275 {
4276 char *addrp;
4277 u32 peer_sid;
4278 struct avc_audit_data ad;
4279 u8 secmark_active;
4280 u8 peerlbl_active;
4281
4282 if (!selinux_policycap_netpeer)
4283 return NF_ACCEPT;
4284
4285 secmark_active = selinux_secmark_enabled();
4286 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4287 if (!secmark_active && !peerlbl_active)
4288 return NF_ACCEPT;
4289
4290 AVC_AUDIT_DATA_INIT(&ad, NET);
4291 ad.u.net.netif = ifindex;
4292 ad.u.net.family = family;
4293 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4294 return NF_DROP;
4295
4296 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4297 return NF_DROP;
4298
4299 if (peerlbl_active)
4300 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4301 peer_sid, &ad) != 0)
4302 return NF_DROP;
4303
4304 if (secmark_active)
4305 if (avc_has_perm(peer_sid, skb->secmark,
4306 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4307 return NF_DROP;
4308
4309 return NF_ACCEPT;
4310 }
4311
4312 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4313 struct sk_buff *skb,
4314 const struct net_device *in,
4315 const struct net_device *out,
4316 int (*okfn)(struct sk_buff *))
4317 {
4318 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4319 }
4320
4321 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4322 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4323 struct sk_buff *skb,
4324 const struct net_device *in,
4325 const struct net_device *out,
4326 int (*okfn)(struct sk_buff *))
4327 {
4328 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4329 }
4330 #endif /* IPV6 */
4331
4332 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4333 int ifindex,
4334 struct avc_audit_data *ad,
4335 u16 family, char *addrp)
4336 {
4337 int err;
4338 struct sk_security_struct *sksec = sk->sk_security;
4339 u16 sk_class;
4340 u32 netif_perm, node_perm, send_perm;
4341 u32 port_sid, node_sid, if_sid, sk_sid;
4342
4343 sk_sid = sksec->sid;
4344 sk_class = sksec->sclass;
4345
4346 switch (sk_class) {
4347 case SECCLASS_UDP_SOCKET:
4348 netif_perm = NETIF__UDP_SEND;
4349 node_perm = NODE__UDP_SEND;
4350 send_perm = UDP_SOCKET__SEND_MSG;
4351 break;
4352 case SECCLASS_TCP_SOCKET:
4353 netif_perm = NETIF__TCP_SEND;
4354 node_perm = NODE__TCP_SEND;
4355 send_perm = TCP_SOCKET__SEND_MSG;
4356 break;
4357 case SECCLASS_DCCP_SOCKET:
4358 netif_perm = NETIF__DCCP_SEND;
4359 node_perm = NODE__DCCP_SEND;
4360 send_perm = DCCP_SOCKET__SEND_MSG;
4361 break;
4362 default:
4363 netif_perm = NETIF__RAWIP_SEND;
4364 node_perm = NODE__RAWIP_SEND;
4365 send_perm = 0;
4366 break;
4367 }
4368
4369 err = sel_netif_sid(ifindex, &if_sid);
4370 if (err)
4371 return err;
4372 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4373 return err;
4374
4375 err = sel_netnode_sid(addrp, family, &node_sid);
4376 if (err)
4377 return err;
4378 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4379 if (err)
4380 return err;
4381
4382 if (send_perm != 0)
4383 return 0;
4384
4385 err = security_port_sid(sk->sk_family, sk->sk_type,
4386 sk->sk_protocol, ntohs(ad->u.net.dport),
4387 &port_sid);
4388 if (unlikely(err)) {
4389 printk(KERN_WARNING
4390 "SELinux: failure in"
4391 " selinux_ip_postroute_iptables_compat(),"
4392 " network port label not found\n");
4393 return err;
4394 }
4395 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4396 }
4397
4398 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4399 int ifindex,
4400 struct avc_audit_data *ad,
4401 u16 family,
4402 char *addrp,
4403 u8 proto)
4404 {
4405 struct sock *sk = skb->sk;
4406 struct sk_security_struct *sksec;
4407
4408 if (sk == NULL)
4409 return NF_ACCEPT;
4410 sksec = sk->sk_security;
4411
4412 if (selinux_compat_net) {
4413 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4414 ad, family, addrp))
4415 return NF_DROP;
4416 } else {
4417 if (avc_has_perm(sksec->sid, skb->secmark,
4418 SECCLASS_PACKET, PACKET__SEND, ad))
4419 return NF_DROP;
4420 }
4421
4422 if (selinux_policycap_netpeer)
4423 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4424 return NF_DROP;
4425
4426 return NF_ACCEPT;
4427 }
4428
4429 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4430 u16 family)
4431 {
4432 u32 secmark_perm;
4433 u32 peer_sid;
4434 struct sock *sk;
4435 struct avc_audit_data ad;
4436 char *addrp;
4437 u8 proto;
4438 u8 secmark_active;
4439 u8 peerlbl_active;
4440
4441 AVC_AUDIT_DATA_INIT(&ad, NET);
4442 ad.u.net.netif = ifindex;
4443 ad.u.net.family = family;
4444 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4445 return NF_DROP;
4446
4447 /* If any sort of compatibility mode is enabled then handoff processing
4448 * to the selinux_ip_postroute_compat() function to deal with the
4449 * special handling. We do this in an attempt to keep this function
4450 * as fast and as clean as possible. */
4451 if (selinux_compat_net || !selinux_policycap_netpeer)
4452 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4453 family, addrp, proto);
4454
4455 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4456 * packet transformation so allow the packet to pass without any checks
4457 * since we'll have another chance to perform access control checks
4458 * when the packet is on it's final way out.
4459 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4460 * is NULL, in this case go ahead and apply access control. */
4461 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4462 return NF_ACCEPT;
4463
4464 secmark_active = selinux_secmark_enabled();
4465 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4466 if (!secmark_active && !peerlbl_active)
4467 return NF_ACCEPT;
4468
4469 /* if the packet is locally generated (skb->sk != NULL) then use the
4470 * socket's label as the peer label, otherwise the packet is being
4471 * forwarded through this system and we need to fetch the peer label
4472 * directly from the packet */
4473 sk = skb->sk;
4474 if (sk) {
4475 struct sk_security_struct *sksec = sk->sk_security;
4476 peer_sid = sksec->sid;
4477 secmark_perm = PACKET__SEND;
4478 } else {
4479 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4480 return NF_DROP;
4481 secmark_perm = PACKET__FORWARD_OUT;
4482 }
4483
4484 if (secmark_active)
4485 if (avc_has_perm(peer_sid, skb->secmark,
4486 SECCLASS_PACKET, secmark_perm, &ad))
4487 return NF_DROP;
4488
4489 if (peerlbl_active) {
4490 u32 if_sid;
4491 u32 node_sid;
4492
4493 if (sel_netif_sid(ifindex, &if_sid))
4494 return NF_DROP;
4495 if (avc_has_perm(peer_sid, if_sid,
4496 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4497 return NF_DROP;
4498
4499 if (sel_netnode_sid(addrp, family, &node_sid))
4500 return NF_DROP;
4501 if (avc_has_perm(peer_sid, node_sid,
4502 SECCLASS_NODE, NODE__SENDTO, &ad))
4503 return NF_DROP;
4504 }
4505
4506 return NF_ACCEPT;
4507 }
4508
4509 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4510 struct sk_buff *skb,
4511 const struct net_device *in,
4512 const struct net_device *out,
4513 int (*okfn)(struct sk_buff *))
4514 {
4515 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4516 }
4517
4518 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4519 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4520 struct sk_buff *skb,
4521 const struct net_device *in,
4522 const struct net_device *out,
4523 int (*okfn)(struct sk_buff *))
4524 {
4525 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4526 }
4527 #endif /* IPV6 */
4528
4529 #endif /* CONFIG_NETFILTER */
4530
4531 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4532 {
4533 int err;
4534
4535 err = secondary_ops->netlink_send(sk, skb);
4536 if (err)
4537 return err;
4538
4539 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4540 err = selinux_nlmsg_perm(sk, skb);
4541
4542 return err;
4543 }
4544
4545 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4546 {
4547 int err;
4548 struct avc_audit_data ad;
4549
4550 err = secondary_ops->netlink_recv(skb, capability);
4551 if (err)
4552 return err;
4553
4554 AVC_AUDIT_DATA_INIT(&ad, CAP);
4555 ad.u.cap = capability;
4556
4557 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4558 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4559 }
4560
4561 static int ipc_alloc_security(struct task_struct *task,
4562 struct kern_ipc_perm *perm,
4563 u16 sclass)
4564 {
4565 struct task_security_struct *tsec = task->security;
4566 struct ipc_security_struct *isec;
4567
4568 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4569 if (!isec)
4570 return -ENOMEM;
4571
4572 isec->sclass = sclass;
4573 isec->ipc_perm = perm;
4574 isec->sid = tsec->sid;
4575 perm->security = isec;
4576
4577 return 0;
4578 }
4579
4580 static void ipc_free_security(struct kern_ipc_perm *perm)
4581 {
4582 struct ipc_security_struct *isec = perm->security;
4583 perm->security = NULL;
4584 kfree(isec);
4585 }
4586
4587 static int msg_msg_alloc_security(struct msg_msg *msg)
4588 {
4589 struct msg_security_struct *msec;
4590
4591 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4592 if (!msec)
4593 return -ENOMEM;
4594
4595 msec->msg = msg;
4596 msec->sid = SECINITSID_UNLABELED;
4597 msg->security = msec;
4598
4599 return 0;
4600 }
4601
4602 static void msg_msg_free_security(struct msg_msg *msg)
4603 {
4604 struct msg_security_struct *msec = msg->security;
4605
4606 msg->security = NULL;
4607 kfree(msec);
4608 }
4609
4610 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4611 u32 perms)
4612 {
4613 struct task_security_struct *tsec;
4614 struct ipc_security_struct *isec;
4615 struct avc_audit_data ad;
4616
4617 tsec = current->security;
4618 isec = ipc_perms->security;
4619
4620 AVC_AUDIT_DATA_INIT(&ad, IPC);
4621 ad.u.ipc_id = ipc_perms->key;
4622
4623 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4624 }
4625
4626 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4627 {
4628 return msg_msg_alloc_security(msg);
4629 }
4630
4631 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4632 {
4633 msg_msg_free_security(msg);
4634 }
4635
4636 /* message queue security operations */
4637 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4638 {
4639 struct task_security_struct *tsec;
4640 struct ipc_security_struct *isec;
4641 struct avc_audit_data ad;
4642 int rc;
4643
4644 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4645 if (rc)
4646 return rc;
4647
4648 tsec = current->security;
4649 isec = msq->q_perm.security;
4650
4651 AVC_AUDIT_DATA_INIT(&ad, IPC);
4652 ad.u.ipc_id = msq->q_perm.key;
4653
4654 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4655 MSGQ__CREATE, &ad);
4656 if (rc) {
4657 ipc_free_security(&msq->q_perm);
4658 return rc;
4659 }
4660 return 0;
4661 }
4662
4663 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4664 {
4665 ipc_free_security(&msq->q_perm);
4666 }
4667
4668 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4669 {
4670 struct task_security_struct *tsec;
4671 struct ipc_security_struct *isec;
4672 struct avc_audit_data ad;
4673
4674 tsec = current->security;
4675 isec = msq->q_perm.security;
4676
4677 AVC_AUDIT_DATA_INIT(&ad, IPC);
4678 ad.u.ipc_id = msq->q_perm.key;
4679
4680 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4681 MSGQ__ASSOCIATE, &ad);
4682 }
4683
4684 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4685 {
4686 int err;
4687 int perms;
4688
4689 switch(cmd) {
4690 case IPC_INFO:
4691 case MSG_INFO:
4692 /* No specific object, just general system-wide information. */
4693 return task_has_system(current, SYSTEM__IPC_INFO);
4694 case IPC_STAT:
4695 case MSG_STAT:
4696 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4697 break;
4698 case IPC_SET:
4699 perms = MSGQ__SETATTR;
4700 break;
4701 case IPC_RMID:
4702 perms = MSGQ__DESTROY;
4703 break;
4704 default:
4705 return 0;
4706 }
4707
4708 err = ipc_has_perm(&msq->q_perm, perms);
4709 return err;
4710 }
4711
4712 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4713 {
4714 struct task_security_struct *tsec;
4715 struct ipc_security_struct *isec;
4716 struct msg_security_struct *msec;
4717 struct avc_audit_data ad;
4718 int rc;
4719
4720 tsec = current->security;
4721 isec = msq->q_perm.security;
4722 msec = msg->security;
4723
4724 /*
4725 * First time through, need to assign label to the message
4726 */
4727 if (msec->sid == SECINITSID_UNLABELED) {
4728 /*
4729 * Compute new sid based on current process and
4730 * message queue this message will be stored in
4731 */
4732 rc = security_transition_sid(tsec->sid,
4733 isec->sid,
4734 SECCLASS_MSG,
4735 &msec->sid);
4736 if (rc)
4737 return rc;
4738 }
4739
4740 AVC_AUDIT_DATA_INIT(&ad, IPC);
4741 ad.u.ipc_id = msq->q_perm.key;
4742
4743 /* Can this process write to the queue? */
4744 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4745 MSGQ__WRITE, &ad);
4746 if (!rc)
4747 /* Can this process send the message */
4748 rc = avc_has_perm(tsec->sid, msec->sid,
4749 SECCLASS_MSG, MSG__SEND, &ad);
4750 if (!rc)
4751 /* Can the message be put in the queue? */
4752 rc = avc_has_perm(msec->sid, isec->sid,
4753 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4754
4755 return rc;
4756 }
4757
4758 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4759 struct task_struct *target,
4760 long type, int mode)
4761 {
4762 struct task_security_struct *tsec;
4763 struct ipc_security_struct *isec;
4764 struct msg_security_struct *msec;
4765 struct avc_audit_data ad;
4766 int rc;
4767
4768 tsec = target->security;
4769 isec = msq->q_perm.security;
4770 msec = msg->security;
4771
4772 AVC_AUDIT_DATA_INIT(&ad, IPC);
4773 ad.u.ipc_id = msq->q_perm.key;
4774
4775 rc = avc_has_perm(tsec->sid, isec->sid,
4776 SECCLASS_MSGQ, MSGQ__READ, &ad);
4777 if (!rc)
4778 rc = avc_has_perm(tsec->sid, msec->sid,
4779 SECCLASS_MSG, MSG__RECEIVE, &ad);
4780 return rc;
4781 }
4782
4783 /* Shared Memory security operations */
4784 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4785 {
4786 struct task_security_struct *tsec;
4787 struct ipc_security_struct *isec;
4788 struct avc_audit_data ad;
4789 int rc;
4790
4791 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4792 if (rc)
4793 return rc;
4794
4795 tsec = current->security;
4796 isec = shp->shm_perm.security;
4797
4798 AVC_AUDIT_DATA_INIT(&ad, IPC);
4799 ad.u.ipc_id = shp->shm_perm.key;
4800
4801 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4802 SHM__CREATE, &ad);
4803 if (rc) {
4804 ipc_free_security(&shp->shm_perm);
4805 return rc;
4806 }
4807 return 0;
4808 }
4809
4810 static void selinux_shm_free_security(struct shmid_kernel *shp)
4811 {
4812 ipc_free_security(&shp->shm_perm);
4813 }
4814
4815 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4816 {
4817 struct task_security_struct *tsec;
4818 struct ipc_security_struct *isec;
4819 struct avc_audit_data ad;
4820
4821 tsec = current->security;
4822 isec = shp->shm_perm.security;
4823
4824 AVC_AUDIT_DATA_INIT(&ad, IPC);
4825 ad.u.ipc_id = shp->shm_perm.key;
4826
4827 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4828 SHM__ASSOCIATE, &ad);
4829 }
4830
4831 /* Note, at this point, shp is locked down */
4832 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4833 {
4834 int perms;
4835 int err;
4836
4837 switch(cmd) {
4838 case IPC_INFO:
4839 case SHM_INFO:
4840 /* No specific object, just general system-wide information. */
4841 return task_has_system(current, SYSTEM__IPC_INFO);
4842 case IPC_STAT:
4843 case SHM_STAT:
4844 perms = SHM__GETATTR | SHM__ASSOCIATE;
4845 break;
4846 case IPC_SET:
4847 perms = SHM__SETATTR;
4848 break;
4849 case SHM_LOCK:
4850 case SHM_UNLOCK:
4851 perms = SHM__LOCK;
4852 break;
4853 case IPC_RMID:
4854 perms = SHM__DESTROY;
4855 break;
4856 default:
4857 return 0;
4858 }
4859
4860 err = ipc_has_perm(&shp->shm_perm, perms);
4861 return err;
4862 }
4863
4864 static int selinux_shm_shmat(struct shmid_kernel *shp,
4865 char __user *shmaddr, int shmflg)
4866 {
4867 u32 perms;
4868 int rc;
4869
4870 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4871 if (rc)
4872 return rc;
4873
4874 if (shmflg & SHM_RDONLY)
4875 perms = SHM__READ;
4876 else
4877 perms = SHM__READ | SHM__WRITE;
4878
4879 return ipc_has_perm(&shp->shm_perm, perms);
4880 }
4881
4882 /* Semaphore security operations */
4883 static int selinux_sem_alloc_security(struct sem_array *sma)
4884 {
4885 struct task_security_struct *tsec;
4886 struct ipc_security_struct *isec;
4887 struct avc_audit_data ad;
4888 int rc;
4889
4890 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4891 if (rc)
4892 return rc;
4893
4894 tsec = current->security;
4895 isec = sma->sem_perm.security;
4896
4897 AVC_AUDIT_DATA_INIT(&ad, IPC);
4898 ad.u.ipc_id = sma->sem_perm.key;
4899
4900 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4901 SEM__CREATE, &ad);
4902 if (rc) {
4903 ipc_free_security(&sma->sem_perm);
4904 return rc;
4905 }
4906 return 0;
4907 }
4908
4909 static void selinux_sem_free_security(struct sem_array *sma)
4910 {
4911 ipc_free_security(&sma->sem_perm);
4912 }
4913
4914 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4915 {
4916 struct task_security_struct *tsec;
4917 struct ipc_security_struct *isec;
4918 struct avc_audit_data ad;
4919
4920 tsec = current->security;
4921 isec = sma->sem_perm.security;
4922
4923 AVC_AUDIT_DATA_INIT(&ad, IPC);
4924 ad.u.ipc_id = sma->sem_perm.key;
4925
4926 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4927 SEM__ASSOCIATE, &ad);
4928 }
4929
4930 /* Note, at this point, sma is locked down */
4931 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4932 {
4933 int err;
4934 u32 perms;
4935
4936 switch(cmd) {
4937 case IPC_INFO:
4938 case SEM_INFO:
4939 /* No specific object, just general system-wide information. */
4940 return task_has_system(current, SYSTEM__IPC_INFO);
4941 case GETPID:
4942 case GETNCNT:
4943 case GETZCNT:
4944 perms = SEM__GETATTR;
4945 break;
4946 case GETVAL:
4947 case GETALL:
4948 perms = SEM__READ;
4949 break;
4950 case SETVAL:
4951 case SETALL:
4952 perms = SEM__WRITE;
4953 break;
4954 case IPC_RMID:
4955 perms = SEM__DESTROY;
4956 break;
4957 case IPC_SET:
4958 perms = SEM__SETATTR;
4959 break;
4960 case IPC_STAT:
4961 case SEM_STAT:
4962 perms = SEM__GETATTR | SEM__ASSOCIATE;
4963 break;
4964 default:
4965 return 0;
4966 }
4967
4968 err = ipc_has_perm(&sma->sem_perm, perms);
4969 return err;
4970 }
4971
4972 static int selinux_sem_semop(struct sem_array *sma,
4973 struct sembuf *sops, unsigned nsops, int alter)
4974 {
4975 u32 perms;
4976
4977 if (alter)
4978 perms = SEM__READ | SEM__WRITE;
4979 else
4980 perms = SEM__READ;
4981
4982 return ipc_has_perm(&sma->sem_perm, perms);
4983 }
4984
4985 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4986 {
4987 u32 av = 0;
4988
4989 av = 0;
4990 if (flag & S_IRUGO)
4991 av |= IPC__UNIX_READ;
4992 if (flag & S_IWUGO)
4993 av |= IPC__UNIX_WRITE;
4994
4995 if (av == 0)
4996 return 0;
4997
4998 return ipc_has_perm(ipcp, av);
4999 }
5000
5001 /* module stacking operations */
5002 static int selinux_register_security (const char *name, struct security_operations *ops)
5003 {
5004 if (secondary_ops != original_ops) {
5005 printk(KERN_ERR "%s: There is already a secondary security "
5006 "module registered.\n", __FUNCTION__);
5007 return -EINVAL;
5008 }
5009
5010 secondary_ops = ops;
5011
5012 printk(KERN_INFO "%s: Registering secondary module %s\n",
5013 __FUNCTION__,
5014 name);
5015
5016 return 0;
5017 }
5018
5019 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5020 {
5021 if (inode)
5022 inode_doinit_with_dentry(inode, dentry);
5023 }
5024
5025 static int selinux_getprocattr(struct task_struct *p,
5026 char *name, char **value)
5027 {
5028 struct task_security_struct *tsec;
5029 u32 sid;
5030 int error;
5031 unsigned len;
5032
5033 if (current != p) {
5034 error = task_has_perm(current, p, PROCESS__GETATTR);
5035 if (error)
5036 return error;
5037 }
5038
5039 tsec = p->security;
5040
5041 if (!strcmp(name, "current"))
5042 sid = tsec->sid;
5043 else if (!strcmp(name, "prev"))
5044 sid = tsec->osid;
5045 else if (!strcmp(name, "exec"))
5046 sid = tsec->exec_sid;
5047 else if (!strcmp(name, "fscreate"))
5048 sid = tsec->create_sid;
5049 else if (!strcmp(name, "keycreate"))
5050 sid = tsec->keycreate_sid;
5051 else if (!strcmp(name, "sockcreate"))
5052 sid = tsec->sockcreate_sid;
5053 else
5054 return -EINVAL;
5055
5056 if (!sid)
5057 return 0;
5058
5059 error = security_sid_to_context(sid, value, &len);
5060 if (error)
5061 return error;
5062 return len;
5063 }
5064
5065 static int selinux_setprocattr(struct task_struct *p,
5066 char *name, void *value, size_t size)
5067 {
5068 struct task_security_struct *tsec;
5069 u32 sid = 0;
5070 int error;
5071 char *str = value;
5072
5073 if (current != p) {
5074 /* SELinux only allows a process to change its own
5075 security attributes. */
5076 return -EACCES;
5077 }
5078
5079 /*
5080 * Basic control over ability to set these attributes at all.
5081 * current == p, but we'll pass them separately in case the
5082 * above restriction is ever removed.
5083 */
5084 if (!strcmp(name, "exec"))
5085 error = task_has_perm(current, p, PROCESS__SETEXEC);
5086 else if (!strcmp(name, "fscreate"))
5087 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5088 else if (!strcmp(name, "keycreate"))
5089 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5090 else if (!strcmp(name, "sockcreate"))
5091 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5092 else if (!strcmp(name, "current"))
5093 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5094 else
5095 error = -EINVAL;
5096 if (error)
5097 return error;
5098
5099 /* Obtain a SID for the context, if one was specified. */
5100 if (size && str[1] && str[1] != '\n') {
5101 if (str[size-1] == '\n') {
5102 str[size-1] = 0;
5103 size--;
5104 }
5105 error = security_context_to_sid(value, size, &sid);
5106 if (error)
5107 return error;
5108 }
5109
5110 /* Permission checking based on the specified context is
5111 performed during the actual operation (execve,
5112 open/mkdir/...), when we know the full context of the
5113 operation. See selinux_bprm_set_security for the execve
5114 checks and may_create for the file creation checks. The
5115 operation will then fail if the context is not permitted. */
5116 tsec = p->security;
5117 if (!strcmp(name, "exec"))
5118 tsec->exec_sid = sid;
5119 else if (!strcmp(name, "fscreate"))
5120 tsec->create_sid = sid;
5121 else if (!strcmp(name, "keycreate")) {
5122 error = may_create_key(sid, p);
5123 if (error)
5124 return error;
5125 tsec->keycreate_sid = sid;
5126 } else if (!strcmp(name, "sockcreate"))
5127 tsec->sockcreate_sid = sid;
5128 else if (!strcmp(name, "current")) {
5129 struct av_decision avd;
5130
5131 if (sid == 0)
5132 return -EINVAL;
5133
5134 /* Only allow single threaded processes to change context */
5135 if (atomic_read(&p->mm->mm_users) != 1) {
5136 struct task_struct *g, *t;
5137 struct mm_struct *mm = p->mm;
5138 read_lock(&tasklist_lock);
5139 do_each_thread(g, t)
5140 if (t->mm == mm && t != p) {
5141 read_unlock(&tasklist_lock);
5142 return -EPERM;
5143 }
5144 while_each_thread(g, t);
5145 read_unlock(&tasklist_lock);
5146 }
5147
5148 /* Check permissions for the transition. */
5149 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5150 PROCESS__DYNTRANSITION, NULL);
5151 if (error)
5152 return error;
5153
5154 /* Check for ptracing, and update the task SID if ok.
5155 Otherwise, leave SID unchanged and fail. */
5156 task_lock(p);
5157 if (p->ptrace & PT_PTRACED) {
5158 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
5159 SECCLASS_PROCESS,
5160 PROCESS__PTRACE, 0, &avd);
5161 if (!error)
5162 tsec->sid = sid;
5163 task_unlock(p);
5164 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
5165 PROCESS__PTRACE, &avd, error, NULL);
5166 if (error)
5167 return error;
5168 } else {
5169 tsec->sid = sid;
5170 task_unlock(p);
5171 }
5172 }
5173 else
5174 return -EINVAL;
5175
5176 return size;
5177 }
5178
5179 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5180 {
5181 return security_sid_to_context(secid, secdata, seclen);
5182 }
5183
5184 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5185 {
5186 return security_context_to_sid(secdata, seclen, secid);
5187 }
5188
5189 static void selinux_release_secctx(char *secdata, u32 seclen)
5190 {
5191 kfree(secdata);
5192 }
5193
5194 #ifdef CONFIG_KEYS
5195
5196 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5197 unsigned long flags)
5198 {
5199 struct task_security_struct *tsec = tsk->security;
5200 struct key_security_struct *ksec;
5201
5202 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5203 if (!ksec)
5204 return -ENOMEM;
5205
5206 ksec->obj = k;
5207 if (tsec->keycreate_sid)
5208 ksec->sid = tsec->keycreate_sid;
5209 else
5210 ksec->sid = tsec->sid;
5211 k->security = ksec;
5212
5213 return 0;
5214 }
5215
5216 static void selinux_key_free(struct key *k)
5217 {
5218 struct key_security_struct *ksec = k->security;
5219
5220 k->security = NULL;
5221 kfree(ksec);
5222 }
5223
5224 static int selinux_key_permission(key_ref_t key_ref,
5225 struct task_struct *ctx,
5226 key_perm_t perm)
5227 {
5228 struct key *key;
5229 struct task_security_struct *tsec;
5230 struct key_security_struct *ksec;
5231
5232 key = key_ref_to_ptr(key_ref);
5233
5234 tsec = ctx->security;
5235 ksec = key->security;
5236
5237 /* if no specific permissions are requested, we skip the
5238 permission check. No serious, additional covert channels
5239 appear to be created. */
5240 if (perm == 0)
5241 return 0;
5242
5243 return avc_has_perm(tsec->sid, ksec->sid,
5244 SECCLASS_KEY, perm, NULL);
5245 }
5246
5247 #endif
5248
5249 static struct security_operations selinux_ops = {
5250 .ptrace = selinux_ptrace,
5251 .capget = selinux_capget,
5252 .capset_check = selinux_capset_check,
5253 .capset_set = selinux_capset_set,
5254 .sysctl = selinux_sysctl,
5255 .capable = selinux_capable,
5256 .quotactl = selinux_quotactl,
5257 .quota_on = selinux_quota_on,
5258 .syslog = selinux_syslog,
5259 .vm_enough_memory = selinux_vm_enough_memory,
5260
5261 .netlink_send = selinux_netlink_send,
5262 .netlink_recv = selinux_netlink_recv,
5263
5264 .bprm_alloc_security = selinux_bprm_alloc_security,
5265 .bprm_free_security = selinux_bprm_free_security,
5266 .bprm_apply_creds = selinux_bprm_apply_creds,
5267 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5268 .bprm_set_security = selinux_bprm_set_security,
5269 .bprm_check_security = selinux_bprm_check_security,
5270 .bprm_secureexec = selinux_bprm_secureexec,
5271
5272 .sb_alloc_security = selinux_sb_alloc_security,
5273 .sb_free_security = selinux_sb_free_security,
5274 .sb_copy_data = selinux_sb_copy_data,
5275 .sb_kern_mount = selinux_sb_kern_mount,
5276 .sb_statfs = selinux_sb_statfs,
5277 .sb_mount = selinux_mount,
5278 .sb_umount = selinux_umount,
5279 .sb_get_mnt_opts = selinux_get_mnt_opts,
5280 .sb_set_mnt_opts = selinux_set_mnt_opts,
5281 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5282 .sb_parse_opts_str = selinux_parse_opts_str,
5283
5284
5285 .inode_alloc_security = selinux_inode_alloc_security,
5286 .inode_free_security = selinux_inode_free_security,
5287 .inode_init_security = selinux_inode_init_security,
5288 .inode_create = selinux_inode_create,
5289 .inode_link = selinux_inode_link,
5290 .inode_unlink = selinux_inode_unlink,
5291 .inode_symlink = selinux_inode_symlink,
5292 .inode_mkdir = selinux_inode_mkdir,
5293 .inode_rmdir = selinux_inode_rmdir,
5294 .inode_mknod = selinux_inode_mknod,
5295 .inode_rename = selinux_inode_rename,
5296 .inode_readlink = selinux_inode_readlink,
5297 .inode_follow_link = selinux_inode_follow_link,
5298 .inode_permission = selinux_inode_permission,
5299 .inode_setattr = selinux_inode_setattr,
5300 .inode_getattr = selinux_inode_getattr,
5301 .inode_setxattr = selinux_inode_setxattr,
5302 .inode_post_setxattr = selinux_inode_post_setxattr,
5303 .inode_getxattr = selinux_inode_getxattr,
5304 .inode_listxattr = selinux_inode_listxattr,
5305 .inode_removexattr = selinux_inode_removexattr,
5306 .inode_getsecurity = selinux_inode_getsecurity,
5307 .inode_setsecurity = selinux_inode_setsecurity,
5308 .inode_listsecurity = selinux_inode_listsecurity,
5309 .inode_need_killpriv = selinux_inode_need_killpriv,
5310 .inode_killpriv = selinux_inode_killpriv,
5311
5312 .file_permission = selinux_file_permission,
5313 .file_alloc_security = selinux_file_alloc_security,
5314 .file_free_security = selinux_file_free_security,
5315 .file_ioctl = selinux_file_ioctl,
5316 .file_mmap = selinux_file_mmap,
5317 .file_mprotect = selinux_file_mprotect,
5318 .file_lock = selinux_file_lock,
5319 .file_fcntl = selinux_file_fcntl,
5320 .file_set_fowner = selinux_file_set_fowner,
5321 .file_send_sigiotask = selinux_file_send_sigiotask,
5322 .file_receive = selinux_file_receive,
5323
5324 .dentry_open = selinux_dentry_open,
5325
5326 .task_create = selinux_task_create,
5327 .task_alloc_security = selinux_task_alloc_security,
5328 .task_free_security = selinux_task_free_security,
5329 .task_setuid = selinux_task_setuid,
5330 .task_post_setuid = selinux_task_post_setuid,
5331 .task_setgid = selinux_task_setgid,
5332 .task_setpgid = selinux_task_setpgid,
5333 .task_getpgid = selinux_task_getpgid,
5334 .task_getsid = selinux_task_getsid,
5335 .task_getsecid = selinux_task_getsecid,
5336 .task_setgroups = selinux_task_setgroups,
5337 .task_setnice = selinux_task_setnice,
5338 .task_setioprio = selinux_task_setioprio,
5339 .task_getioprio = selinux_task_getioprio,
5340 .task_setrlimit = selinux_task_setrlimit,
5341 .task_setscheduler = selinux_task_setscheduler,
5342 .task_getscheduler = selinux_task_getscheduler,
5343 .task_movememory = selinux_task_movememory,
5344 .task_kill = selinux_task_kill,
5345 .task_wait = selinux_task_wait,
5346 .task_prctl = selinux_task_prctl,
5347 .task_reparent_to_init = selinux_task_reparent_to_init,
5348 .task_to_inode = selinux_task_to_inode,
5349
5350 .ipc_permission = selinux_ipc_permission,
5351
5352 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5353 .msg_msg_free_security = selinux_msg_msg_free_security,
5354
5355 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5356 .msg_queue_free_security = selinux_msg_queue_free_security,
5357 .msg_queue_associate = selinux_msg_queue_associate,
5358 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5359 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5360 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5361
5362 .shm_alloc_security = selinux_shm_alloc_security,
5363 .shm_free_security = selinux_shm_free_security,
5364 .shm_associate = selinux_shm_associate,
5365 .shm_shmctl = selinux_shm_shmctl,
5366 .shm_shmat = selinux_shm_shmat,
5367
5368 .sem_alloc_security = selinux_sem_alloc_security,
5369 .sem_free_security = selinux_sem_free_security,
5370 .sem_associate = selinux_sem_associate,
5371 .sem_semctl = selinux_sem_semctl,
5372 .sem_semop = selinux_sem_semop,
5373
5374 .register_security = selinux_register_security,
5375
5376 .d_instantiate = selinux_d_instantiate,
5377
5378 .getprocattr = selinux_getprocattr,
5379 .setprocattr = selinux_setprocattr,
5380
5381 .secid_to_secctx = selinux_secid_to_secctx,
5382 .secctx_to_secid = selinux_secctx_to_secid,
5383 .release_secctx = selinux_release_secctx,
5384
5385 .unix_stream_connect = selinux_socket_unix_stream_connect,
5386 .unix_may_send = selinux_socket_unix_may_send,
5387
5388 .socket_create = selinux_socket_create,
5389 .socket_post_create = selinux_socket_post_create,
5390 .socket_bind = selinux_socket_bind,
5391 .socket_connect = selinux_socket_connect,
5392 .socket_listen = selinux_socket_listen,
5393 .socket_accept = selinux_socket_accept,
5394 .socket_sendmsg = selinux_socket_sendmsg,
5395 .socket_recvmsg = selinux_socket_recvmsg,
5396 .socket_getsockname = selinux_socket_getsockname,
5397 .socket_getpeername = selinux_socket_getpeername,
5398 .socket_getsockopt = selinux_socket_getsockopt,
5399 .socket_setsockopt = selinux_socket_setsockopt,
5400 .socket_shutdown = selinux_socket_shutdown,
5401 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5402 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5403 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5404 .sk_alloc_security = selinux_sk_alloc_security,
5405 .sk_free_security = selinux_sk_free_security,
5406 .sk_clone_security = selinux_sk_clone_security,
5407 .sk_getsecid = selinux_sk_getsecid,
5408 .sock_graft = selinux_sock_graft,
5409 .inet_conn_request = selinux_inet_conn_request,
5410 .inet_csk_clone = selinux_inet_csk_clone,
5411 .inet_conn_established = selinux_inet_conn_established,
5412 .req_classify_flow = selinux_req_classify_flow,
5413
5414 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5415 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5416 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5417 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5418 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5419 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5420 .xfrm_state_free_security = selinux_xfrm_state_free,
5421 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5422 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5423 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5424 .xfrm_decode_session = selinux_xfrm_decode_session,
5425 #endif
5426
5427 #ifdef CONFIG_KEYS
5428 .key_alloc = selinux_key_alloc,
5429 .key_free = selinux_key_free,
5430 .key_permission = selinux_key_permission,
5431 #endif
5432 };
5433
5434 static __init int selinux_init(void)
5435 {
5436 struct task_security_struct *tsec;
5437
5438 if (!selinux_enabled) {
5439 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5440 return 0;
5441 }
5442
5443 printk(KERN_INFO "SELinux: Initializing.\n");
5444
5445 /* Set the security state for the initial task. */
5446 if (task_alloc_security(current))
5447 panic("SELinux: Failed to initialize initial task.\n");
5448 tsec = current->security;
5449 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5450
5451 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5452 sizeof(struct inode_security_struct),
5453 0, SLAB_PANIC, NULL);
5454 avc_init();
5455
5456 original_ops = secondary_ops = security_ops;
5457 if (!secondary_ops)
5458 panic ("SELinux: No initial security operations\n");
5459 if (register_security (&selinux_ops))
5460 panic("SELinux: Unable to register with kernel.\n");
5461
5462 if (selinux_enforcing) {
5463 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5464 } else {
5465 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5466 }
5467
5468 #ifdef CONFIG_KEYS
5469 /* Add security information to initial keyrings */
5470 selinux_key_alloc(&root_user_keyring, current,
5471 KEY_ALLOC_NOT_IN_QUOTA);
5472 selinux_key_alloc(&root_session_keyring, current,
5473 KEY_ALLOC_NOT_IN_QUOTA);
5474 #endif
5475
5476 return 0;
5477 }
5478
5479 void selinux_complete_init(void)
5480 {
5481 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5482
5483 /* Set up any superblocks initialized prior to the policy load. */
5484 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5485 spin_lock(&sb_lock);
5486 spin_lock(&sb_security_lock);
5487 next_sb:
5488 if (!list_empty(&superblock_security_head)) {
5489 struct superblock_security_struct *sbsec =
5490 list_entry(superblock_security_head.next,
5491 struct superblock_security_struct,
5492 list);
5493 struct super_block *sb = sbsec->sb;
5494 sb->s_count++;
5495 spin_unlock(&sb_security_lock);
5496 spin_unlock(&sb_lock);
5497 down_read(&sb->s_umount);
5498 if (sb->s_root)
5499 superblock_doinit(sb, NULL);
5500 drop_super(sb);
5501 spin_lock(&sb_lock);
5502 spin_lock(&sb_security_lock);
5503 list_del_init(&sbsec->list);
5504 goto next_sb;
5505 }
5506 spin_unlock(&sb_security_lock);
5507 spin_unlock(&sb_lock);
5508 }
5509
5510 /* SELinux requires early initialization in order to label
5511 all processes and objects when they are created. */
5512 security_initcall(selinux_init);
5513
5514 #if defined(CONFIG_NETFILTER)
5515
5516 static struct nf_hook_ops selinux_ipv4_ops[] = {
5517 {
5518 .hook = selinux_ipv4_postroute,
5519 .owner = THIS_MODULE,
5520 .pf = PF_INET,
5521 .hooknum = NF_INET_POST_ROUTING,
5522 .priority = NF_IP_PRI_SELINUX_LAST,
5523 },
5524 {
5525 .hook = selinux_ipv4_forward,
5526 .owner = THIS_MODULE,
5527 .pf = PF_INET,
5528 .hooknum = NF_INET_FORWARD,
5529 .priority = NF_IP_PRI_SELINUX_FIRST,
5530 }
5531 };
5532
5533 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5534
5535 static struct nf_hook_ops selinux_ipv6_ops[] = {
5536 {
5537 .hook = selinux_ipv6_postroute,
5538 .owner = THIS_MODULE,
5539 .pf = PF_INET6,
5540 .hooknum = NF_INET_POST_ROUTING,
5541 .priority = NF_IP6_PRI_SELINUX_LAST,
5542 },
5543 {
5544 .hook = selinux_ipv6_forward,
5545 .owner = THIS_MODULE,
5546 .pf = PF_INET6,
5547 .hooknum = NF_INET_FORWARD,
5548 .priority = NF_IP6_PRI_SELINUX_FIRST,
5549 }
5550 };
5551
5552 #endif /* IPV6 */
5553
5554 static int __init selinux_nf_ip_init(void)
5555 {
5556 int err = 0;
5557 u32 iter;
5558
5559 if (!selinux_enabled)
5560 goto out;
5561
5562 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5563
5564 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5565 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5566 if (err)
5567 panic("SELinux: nf_register_hook for IPv4: error %d\n",
5568 err);
5569 }
5570
5571 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5572 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5573 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5574 if (err)
5575 panic("SELinux: nf_register_hook for IPv6: error %d\n",
5576 err);
5577 }
5578 #endif /* IPV6 */
5579
5580 out:
5581 return err;
5582 }
5583
5584 __initcall(selinux_nf_ip_init);
5585
5586 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5587 static void selinux_nf_ip_exit(void)
5588 {
5589 u32 iter;
5590
5591 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5592
5593 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5594 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5595 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5596 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5597 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5598 #endif /* IPV6 */
5599 }
5600 #endif
5601
5602 #else /* CONFIG_NETFILTER */
5603
5604 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5605 #define selinux_nf_ip_exit()
5606 #endif
5607
5608 #endif /* CONFIG_NETFILTER */
5609
5610 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5611 int selinux_disable(void)
5612 {
5613 extern void exit_sel_fs(void);
5614 static int selinux_disabled = 0;
5615
5616 if (ss_initialized) {
5617 /* Not permitted after initial policy load. */
5618 return -EINVAL;
5619 }
5620
5621 if (selinux_disabled) {
5622 /* Only do this once. */
5623 return -EINVAL;
5624 }
5625
5626 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5627
5628 selinux_disabled = 1;
5629 selinux_enabled = 0;
5630
5631 /* Reset security_ops to the secondary module, dummy or capability. */
5632 security_ops = secondary_ops;
5633
5634 /* Unregister netfilter hooks. */
5635 selinux_nf_ip_exit();
5636
5637 /* Unregister selinuxfs. */
5638 exit_sel_fs();
5639
5640 return 0;
5641 }
5642 #endif
5643
5644
mah project overlay