2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
98 /* SECMARK reference count */
99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
104 static int __init enforcing_setup(char *str)
106 unsigned long enforcing;
107 if (!kstrtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
111 __setup("enforcing=", enforcing_setup);
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117 static int __init selinux_enabled_setup(char *str)
119 unsigned long enabled;
120 if (!kstrtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
124 __setup("selinux=", selinux_enabled_setup);
126 int selinux_enabled = 1;
129 static struct kmem_cache *sel_inode_cache;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
142 static int selinux_secmark_enabled(void)
144 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
157 static int selinux_peerlbl_enabled(void)
159 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
162 static int selinux_netcache_avc_callback(u32 event)
164 if (event == AVC_CALLBACK_RESET) {
174 * initialise the security for the init task
176 static void cred_init_security(void)
178 struct cred *cred = (struct cred *) current->real_cred;
179 struct task_security_struct *tsec;
181 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
183 panic("SELinux: Failed to initialize initial task.\n");
185 tsec->osid = tsec->sid = SECINITSID_KERNEL;
186 cred->security = tsec;
190 * get the security ID of a set of credentials
192 static inline u32 cred_sid(const struct cred *cred)
194 const struct task_security_struct *tsec;
196 tsec = cred->security;
201 * get the objective security ID of a task
203 static inline u32 task_sid(const struct task_struct *task)
208 sid = cred_sid(__task_cred(task));
214 * get the subjective security ID of the current task
216 static inline u32 current_sid(void)
218 const struct task_security_struct *tsec = current_security();
223 /* Allocate and free functions for each kind of security blob. */
225 static int inode_alloc_security(struct inode *inode)
227 struct inode_security_struct *isec;
228 u32 sid = current_sid();
230 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
234 mutex_init(&isec->lock);
235 INIT_LIST_HEAD(&isec->list);
237 isec->sid = SECINITSID_UNLABELED;
238 isec->sclass = SECCLASS_FILE;
239 isec->task_sid = sid;
240 inode->i_security = isec;
245 static void inode_free_rcu(struct rcu_head *head)
247 struct inode_security_struct *isec;
249 isec = container_of(head, struct inode_security_struct, rcu);
250 kmem_cache_free(sel_inode_cache, isec);
253 static void inode_free_security(struct inode *inode)
255 struct inode_security_struct *isec = inode->i_security;
256 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
258 spin_lock(&sbsec->isec_lock);
259 if (!list_empty(&isec->list))
260 list_del_init(&isec->list);
261 spin_unlock(&sbsec->isec_lock);
264 * The inode may still be referenced in a path walk and
265 * a call to selinux_inode_permission() can be made
266 * after inode_free_security() is called. Ideally, the VFS
267 * wouldn't do this, but fixing that is a much harder
268 * job. For now, simply free the i_security via RCU, and
269 * leave the current inode->i_security pointer intact.
270 * The inode will be freed after the RCU grace period too.
272 call_rcu(&isec->rcu, inode_free_rcu);
275 static int file_alloc_security(struct file *file)
277 struct file_security_struct *fsec;
278 u32 sid = current_sid();
280 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
285 fsec->fown_sid = sid;
286 file->f_security = fsec;
291 static void file_free_security(struct file *file)
293 struct file_security_struct *fsec = file->f_security;
294 file->f_security = NULL;
298 static int superblock_alloc_security(struct super_block *sb)
300 struct superblock_security_struct *sbsec;
302 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
306 mutex_init(&sbsec->lock);
307 INIT_LIST_HEAD(&sbsec->isec_head);
308 spin_lock_init(&sbsec->isec_lock);
310 sbsec->sid = SECINITSID_UNLABELED;
311 sbsec->def_sid = SECINITSID_FILE;
312 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
313 sb->s_security = sbsec;
318 static void superblock_free_security(struct super_block *sb)
320 struct superblock_security_struct *sbsec = sb->s_security;
321 sb->s_security = NULL;
325 /* The file system's label must be initialized prior to use. */
327 static const char *labeling_behaviors[7] = {
329 "uses transition SIDs",
331 "uses genfs_contexts",
332 "not configured for labeling",
333 "uses mountpoint labeling",
334 "uses native labeling",
337 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
339 static inline int inode_doinit(struct inode *inode)
341 return inode_doinit_with_dentry(inode, NULL);
350 Opt_labelsupport = 5,
354 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
356 static const match_table_t tokens = {
357 {Opt_context, CONTEXT_STR "%s"},
358 {Opt_fscontext, FSCONTEXT_STR "%s"},
359 {Opt_defcontext, DEFCONTEXT_STR "%s"},
360 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
361 {Opt_labelsupport, LABELSUPP_STR},
365 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
367 static int may_context_mount_sb_relabel(u32 sid,
368 struct superblock_security_struct *sbsec,
369 const struct cred *cred)
371 const struct task_security_struct *tsec = cred->security;
374 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
375 FILESYSTEM__RELABELFROM, NULL);
379 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
380 FILESYSTEM__RELABELTO, NULL);
384 static int may_context_mount_inode_relabel(u32 sid,
385 struct superblock_security_struct *sbsec,
386 const struct cred *cred)
388 const struct task_security_struct *tsec = cred->security;
390 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
391 FILESYSTEM__RELABELFROM, NULL);
395 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
396 FILESYSTEM__ASSOCIATE, NULL);
400 static int selinux_is_sblabel_mnt(struct super_block *sb)
402 struct superblock_security_struct *sbsec = sb->s_security;
404 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
405 sbsec->behavior == SECURITY_FS_USE_TRANS ||
406 sbsec->behavior == SECURITY_FS_USE_TASK ||
407 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
408 /* Special handling. Genfs but also in-core setxattr handler */
409 !strcmp(sb->s_type->name, "sysfs") ||
410 !strcmp(sb->s_type->name, "pstore") ||
411 !strcmp(sb->s_type->name, "debugfs") ||
412 !strcmp(sb->s_type->name, "rootfs");
415 static int sb_finish_set_opts(struct super_block *sb)
417 struct superblock_security_struct *sbsec = sb->s_security;
418 struct dentry *root = sb->s_root;
419 struct inode *root_inode = root->d_inode;
422 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
423 /* Make sure that the xattr handler exists and that no
424 error other than -ENODATA is returned by getxattr on
425 the root directory. -ENODATA is ok, as this may be
426 the first boot of the SELinux kernel before we have
427 assigned xattr values to the filesystem. */
428 if (!root_inode->i_op->getxattr) {
429 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
430 "xattr support\n", sb->s_id, sb->s_type->name);
434 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
435 if (rc < 0 && rc != -ENODATA) {
436 if (rc == -EOPNOTSUPP)
437 printk(KERN_WARNING "SELinux: (dev %s, type "
438 "%s) has no security xattr handler\n",
439 sb->s_id, sb->s_type->name);
441 printk(KERN_WARNING "SELinux: (dev %s, type "
442 "%s) getxattr errno %d\n", sb->s_id,
443 sb->s_type->name, -rc);
448 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
449 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
450 sb->s_id, sb->s_type->name);
452 sbsec->flags |= SE_SBINITIALIZED;
453 if (selinux_is_sblabel_mnt(sb))
454 sbsec->flags |= SBLABEL_MNT;
456 /* Initialize the root inode. */
457 rc = inode_doinit_with_dentry(root_inode, root);
459 /* Initialize any other inodes associated with the superblock, e.g.
460 inodes created prior to initial policy load or inodes created
461 during get_sb by a pseudo filesystem that directly
463 spin_lock(&sbsec->isec_lock);
465 if (!list_empty(&sbsec->isec_head)) {
466 struct inode_security_struct *isec =
467 list_entry(sbsec->isec_head.next,
468 struct inode_security_struct, list);
469 struct inode *inode = isec->inode;
470 list_del_init(&isec->list);
471 spin_unlock(&sbsec->isec_lock);
472 inode = igrab(inode);
474 if (!IS_PRIVATE(inode))
478 spin_lock(&sbsec->isec_lock);
481 spin_unlock(&sbsec->isec_lock);
487 * This function should allow an FS to ask what it's mount security
488 * options were so it can use those later for submounts, displaying
489 * mount options, or whatever.
491 static int selinux_get_mnt_opts(const struct super_block *sb,
492 struct security_mnt_opts *opts)
495 struct superblock_security_struct *sbsec = sb->s_security;
496 char *context = NULL;
500 security_init_mnt_opts(opts);
502 if (!(sbsec->flags & SE_SBINITIALIZED))
508 /* make sure we always check enough bits to cover the mask */
509 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
511 tmp = sbsec->flags & SE_MNTMASK;
512 /* count the number of mount options for this sb */
513 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
515 opts->num_mnt_opts++;
518 /* Check if the Label support flag is set */
519 if (sbsec->flags & SBLABEL_MNT)
520 opts->num_mnt_opts++;
522 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
523 if (!opts->mnt_opts) {
528 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
529 if (!opts->mnt_opts_flags) {
535 if (sbsec->flags & FSCONTEXT_MNT) {
536 rc = security_sid_to_context(sbsec->sid, &context, &len);
539 opts->mnt_opts[i] = context;
540 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
542 if (sbsec->flags & CONTEXT_MNT) {
543 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
546 opts->mnt_opts[i] = context;
547 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
549 if (sbsec->flags & DEFCONTEXT_MNT) {
550 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
553 opts->mnt_opts[i] = context;
554 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
556 if (sbsec->flags & ROOTCONTEXT_MNT) {
557 struct inode *root = sbsec->sb->s_root->d_inode;
558 struct inode_security_struct *isec = root->i_security;
560 rc = security_sid_to_context(isec->sid, &context, &len);
563 opts->mnt_opts[i] = context;
564 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
566 if (sbsec->flags & SBLABEL_MNT) {
567 opts->mnt_opts[i] = NULL;
568 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
571 BUG_ON(i != opts->num_mnt_opts);
576 security_free_mnt_opts(opts);
580 static int bad_option(struct superblock_security_struct *sbsec, char flag,
581 u32 old_sid, u32 new_sid)
583 char mnt_flags = sbsec->flags & SE_MNTMASK;
585 /* check if the old mount command had the same options */
586 if (sbsec->flags & SE_SBINITIALIZED)
587 if (!(sbsec->flags & flag) ||
588 (old_sid != new_sid))
591 /* check if we were passed the same options twice,
592 * aka someone passed context=a,context=b
594 if (!(sbsec->flags & SE_SBINITIALIZED))
595 if (mnt_flags & flag)
601 * Allow filesystems with binary mount data to explicitly set mount point
602 * labeling information.
604 static int selinux_set_mnt_opts(struct super_block *sb,
605 struct security_mnt_opts *opts,
606 unsigned long kern_flags,
607 unsigned long *set_kern_flags)
609 const struct cred *cred = current_cred();
611 struct superblock_security_struct *sbsec = sb->s_security;
612 const char *name = sb->s_type->name;
613 struct inode *inode = sbsec->sb->s_root->d_inode;
614 struct inode_security_struct *root_isec = inode->i_security;
615 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
616 u32 defcontext_sid = 0;
617 char **mount_options = opts->mnt_opts;
618 int *flags = opts->mnt_opts_flags;
619 int num_opts = opts->num_mnt_opts;
621 mutex_lock(&sbsec->lock);
623 if (!ss_initialized) {
625 /* Defer initialization until selinux_complete_init,
626 after the initial policy is loaded and the security
627 server is ready to handle calls. */
631 printk(KERN_WARNING "SELinux: Unable to set superblock options "
632 "before the security server is initialized\n");
635 if (kern_flags && !set_kern_flags) {
636 /* Specifying internal flags without providing a place to
637 * place the results is not allowed */
643 * Binary mount data FS will come through this function twice. Once
644 * from an explicit call and once from the generic calls from the vfs.
645 * Since the generic VFS calls will not contain any security mount data
646 * we need to skip the double mount verification.
648 * This does open a hole in which we will not notice if the first
649 * mount using this sb set explict options and a second mount using
650 * this sb does not set any security options. (The first options
651 * will be used for both mounts)
653 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
658 * parse the mount options, check if they are valid sids.
659 * also check if someone is trying to mount the same sb more
660 * than once with different security options.
662 for (i = 0; i < num_opts; i++) {
665 if (flags[i] == SBLABEL_MNT)
667 rc = security_context_to_sid(mount_options[i],
668 strlen(mount_options[i]), &sid, GFP_KERNEL);
670 printk(KERN_WARNING "SELinux: security_context_to_sid"
671 "(%s) failed for (dev %s, type %s) errno=%d\n",
672 mount_options[i], sb->s_id, name, rc);
679 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
681 goto out_double_mount;
683 sbsec->flags |= FSCONTEXT_MNT;
688 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
690 goto out_double_mount;
692 sbsec->flags |= CONTEXT_MNT;
694 case ROOTCONTEXT_MNT:
695 rootcontext_sid = sid;
697 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
699 goto out_double_mount;
701 sbsec->flags |= ROOTCONTEXT_MNT;
705 defcontext_sid = sid;
707 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
709 goto out_double_mount;
711 sbsec->flags |= DEFCONTEXT_MNT;
720 if (sbsec->flags & SE_SBINITIALIZED) {
721 /* previously mounted with options, but not on this attempt? */
722 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
723 goto out_double_mount;
728 if (strcmp(sb->s_type->name, "proc") == 0)
729 sbsec->flags |= SE_SBPROC;
731 if (!sbsec->behavior) {
733 * Determine the labeling behavior to use for this
736 rc = security_fs_use(sb);
739 "%s: security_fs_use(%s) returned %d\n",
740 __func__, sb->s_type->name, rc);
744 /* sets the context of the superblock for the fs being mounted. */
746 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
750 sbsec->sid = fscontext_sid;
754 * Switch to using mount point labeling behavior.
755 * sets the label used on all file below the mountpoint, and will set
756 * the superblock context if not already set.
758 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
759 sbsec->behavior = SECURITY_FS_USE_NATIVE;
760 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
764 if (!fscontext_sid) {
765 rc = may_context_mount_sb_relabel(context_sid, sbsec,
769 sbsec->sid = context_sid;
771 rc = may_context_mount_inode_relabel(context_sid, sbsec,
776 if (!rootcontext_sid)
777 rootcontext_sid = context_sid;
779 sbsec->mntpoint_sid = context_sid;
780 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
783 if (rootcontext_sid) {
784 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
789 root_isec->sid = rootcontext_sid;
790 root_isec->initialized = 1;
793 if (defcontext_sid) {
794 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
795 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
797 printk(KERN_WARNING "SELinux: defcontext option is "
798 "invalid for this filesystem type\n");
802 if (defcontext_sid != sbsec->def_sid) {
803 rc = may_context_mount_inode_relabel(defcontext_sid,
809 sbsec->def_sid = defcontext_sid;
812 rc = sb_finish_set_opts(sb);
814 mutex_unlock(&sbsec->lock);
818 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
819 "security settings for (dev %s, type %s)\n", sb->s_id, name);
823 static int selinux_cmp_sb_context(const struct super_block *oldsb,
824 const struct super_block *newsb)
826 struct superblock_security_struct *old = oldsb->s_security;
827 struct superblock_security_struct *new = newsb->s_security;
828 char oldflags = old->flags & SE_MNTMASK;
829 char newflags = new->flags & SE_MNTMASK;
831 if (oldflags != newflags)
833 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
835 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
837 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
839 if (oldflags & ROOTCONTEXT_MNT) {
840 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
841 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
842 if (oldroot->sid != newroot->sid)
847 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
848 "different security settings for (dev %s, "
849 "type %s)\n", newsb->s_id, newsb->s_type->name);
853 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
854 struct super_block *newsb)
856 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
857 struct superblock_security_struct *newsbsec = newsb->s_security;
859 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
860 int set_context = (oldsbsec->flags & CONTEXT_MNT);
861 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
864 * if the parent was able to be mounted it clearly had no special lsm
865 * mount options. thus we can safely deal with this superblock later
870 /* how can we clone if the old one wasn't set up?? */
871 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
873 /* if fs is reusing a sb, make sure that the contexts match */
874 if (newsbsec->flags & SE_SBINITIALIZED)
875 return selinux_cmp_sb_context(oldsb, newsb);
877 mutex_lock(&newsbsec->lock);
879 newsbsec->flags = oldsbsec->flags;
881 newsbsec->sid = oldsbsec->sid;
882 newsbsec->def_sid = oldsbsec->def_sid;
883 newsbsec->behavior = oldsbsec->behavior;
886 u32 sid = oldsbsec->mntpoint_sid;
890 if (!set_rootcontext) {
891 struct inode *newinode = newsb->s_root->d_inode;
892 struct inode_security_struct *newisec = newinode->i_security;
895 newsbsec->mntpoint_sid = sid;
897 if (set_rootcontext) {
898 const struct inode *oldinode = oldsb->s_root->d_inode;
899 const struct inode_security_struct *oldisec = oldinode->i_security;
900 struct inode *newinode = newsb->s_root->d_inode;
901 struct inode_security_struct *newisec = newinode->i_security;
903 newisec->sid = oldisec->sid;
906 sb_finish_set_opts(newsb);
907 mutex_unlock(&newsbsec->lock);
911 static int selinux_parse_opts_str(char *options,
912 struct security_mnt_opts *opts)
915 char *context = NULL, *defcontext = NULL;
916 char *fscontext = NULL, *rootcontext = NULL;
917 int rc, num_mnt_opts = 0;
919 opts->num_mnt_opts = 0;
921 /* Standard string-based options. */
922 while ((p = strsep(&options, "|")) != NULL) {
924 substring_t args[MAX_OPT_ARGS];
929 token = match_token(p, tokens, args);
933 if (context || defcontext) {
935 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
938 context = match_strdup(&args[0]);
948 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
951 fscontext = match_strdup(&args[0]);
958 case Opt_rootcontext:
961 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
964 rootcontext = match_strdup(&args[0]);
972 if (context || defcontext) {
974 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
977 defcontext = match_strdup(&args[0]);
983 case Opt_labelsupport:
987 printk(KERN_WARNING "SELinux: unknown mount option\n");
994 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
998 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
999 if (!opts->mnt_opts_flags) {
1000 kfree(opts->mnt_opts);
1005 opts->mnt_opts[num_mnt_opts] = fscontext;
1006 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1009 opts->mnt_opts[num_mnt_opts] = context;
1010 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1013 opts->mnt_opts[num_mnt_opts] = rootcontext;
1014 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1017 opts->mnt_opts[num_mnt_opts] = defcontext;
1018 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1021 opts->num_mnt_opts = num_mnt_opts;
1032 * string mount options parsing and call set the sbsec
1034 static int superblock_doinit(struct super_block *sb, void *data)
1037 char *options = data;
1038 struct security_mnt_opts opts;
1040 security_init_mnt_opts(&opts);
1045 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1047 rc = selinux_parse_opts_str(options, &opts);
1052 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1055 security_free_mnt_opts(&opts);
1059 static void selinux_write_opts(struct seq_file *m,
1060 struct security_mnt_opts *opts)
1065 for (i = 0; i < opts->num_mnt_opts; i++) {
1068 if (opts->mnt_opts[i])
1069 has_comma = strchr(opts->mnt_opts[i], ',');
1073 switch (opts->mnt_opts_flags[i]) {
1075 prefix = CONTEXT_STR;
1078 prefix = FSCONTEXT_STR;
1080 case ROOTCONTEXT_MNT:
1081 prefix = ROOTCONTEXT_STR;
1083 case DEFCONTEXT_MNT:
1084 prefix = DEFCONTEXT_STR;
1088 seq_puts(m, LABELSUPP_STR);
1094 /* we need a comma before each option */
1096 seq_puts(m, prefix);
1099 seq_puts(m, opts->mnt_opts[i]);
1105 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1107 struct security_mnt_opts opts;
1110 rc = selinux_get_mnt_opts(sb, &opts);
1112 /* before policy load we may get EINVAL, don't show anything */
1118 selinux_write_opts(m, &opts);
1120 security_free_mnt_opts(&opts);
1125 static inline u16 inode_mode_to_security_class(umode_t mode)
1127 switch (mode & S_IFMT) {
1129 return SECCLASS_SOCK_FILE;
1131 return SECCLASS_LNK_FILE;
1133 return SECCLASS_FILE;
1135 return SECCLASS_BLK_FILE;
1137 return SECCLASS_DIR;
1139 return SECCLASS_CHR_FILE;
1141 return SECCLASS_FIFO_FILE;
1145 return SECCLASS_FILE;
1148 static inline int default_protocol_stream(int protocol)
1150 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1153 static inline int default_protocol_dgram(int protocol)
1155 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1158 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1164 case SOCK_SEQPACKET:
1165 return SECCLASS_UNIX_STREAM_SOCKET;
1167 return SECCLASS_UNIX_DGRAM_SOCKET;
1174 if (default_protocol_stream(protocol))
1175 return SECCLASS_TCP_SOCKET;
1177 return SECCLASS_RAWIP_SOCKET;
1179 if (default_protocol_dgram(protocol))
1180 return SECCLASS_UDP_SOCKET;
1182 return SECCLASS_RAWIP_SOCKET;
1184 return SECCLASS_DCCP_SOCKET;
1186 return SECCLASS_RAWIP_SOCKET;
1192 return SECCLASS_NETLINK_ROUTE_SOCKET;
1193 case NETLINK_FIREWALL:
1194 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1195 case NETLINK_SOCK_DIAG:
1196 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1198 return SECCLASS_NETLINK_NFLOG_SOCKET;
1200 return SECCLASS_NETLINK_XFRM_SOCKET;
1201 case NETLINK_SELINUX:
1202 return SECCLASS_NETLINK_SELINUX_SOCKET;
1204 return SECCLASS_NETLINK_AUDIT_SOCKET;
1205 case NETLINK_IP6_FW:
1206 return SECCLASS_NETLINK_IP6FW_SOCKET;
1207 case NETLINK_DNRTMSG:
1208 return SECCLASS_NETLINK_DNRT_SOCKET;
1209 case NETLINK_KOBJECT_UEVENT:
1210 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1212 return SECCLASS_NETLINK_SOCKET;
1215 return SECCLASS_PACKET_SOCKET;
1217 return SECCLASS_KEY_SOCKET;
1219 return SECCLASS_APPLETALK_SOCKET;
1222 return SECCLASS_SOCKET;
1225 #ifdef CONFIG_PROC_FS
1226 static int selinux_proc_get_sid(struct dentry *dentry,
1231 char *buffer, *path;
1233 buffer = (char *)__get_free_page(GFP_KERNEL);
1237 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241 /* each process gets a /proc/PID/ entry. Strip off the
1242 * PID part to get a valid selinux labeling.
1243 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1244 while (path[1] >= '0' && path[1] <= '9') {
1248 rc = security_genfs_sid("proc", path, tclass, sid);
1250 free_page((unsigned long)buffer);
1254 static int selinux_proc_get_sid(struct dentry *dentry,
1262 /* The inode's security attributes must be initialized before first use. */
1263 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1265 struct superblock_security_struct *sbsec = NULL;
1266 struct inode_security_struct *isec = inode->i_security;
1268 struct dentry *dentry;
1269 #define INITCONTEXTLEN 255
1270 char *context = NULL;
1274 if (isec->initialized)
1277 mutex_lock(&isec->lock);
1278 if (isec->initialized)
1281 sbsec = inode->i_sb->s_security;
1282 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1283 /* Defer initialization until selinux_complete_init,
1284 after the initial policy is loaded and the security
1285 server is ready to handle calls. */
1286 spin_lock(&sbsec->isec_lock);
1287 if (list_empty(&isec->list))
1288 list_add(&isec->list, &sbsec->isec_head);
1289 spin_unlock(&sbsec->isec_lock);
1293 switch (sbsec->behavior) {
1294 case SECURITY_FS_USE_NATIVE:
1296 case SECURITY_FS_USE_XATTR:
1297 if (!inode->i_op->getxattr) {
1298 isec->sid = sbsec->def_sid;
1302 /* Need a dentry, since the xattr API requires one.
1303 Life would be simpler if we could just pass the inode. */
1305 /* Called from d_instantiate or d_splice_alias. */
1306 dentry = dget(opt_dentry);
1308 /* Called from selinux_complete_init, try to find a dentry. */
1309 dentry = d_find_alias(inode);
1313 * this is can be hit on boot when a file is accessed
1314 * before the policy is loaded. When we load policy we
1315 * may find inodes that have no dentry on the
1316 * sbsec->isec_head list. No reason to complain as these
1317 * will get fixed up the next time we go through
1318 * inode_doinit with a dentry, before these inodes could
1319 * be used again by userspace.
1324 len = INITCONTEXTLEN;
1325 context = kmalloc(len+1, GFP_NOFS);
1331 context[len] = '\0';
1332 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1334 if (rc == -ERANGE) {
1337 /* Need a larger buffer. Query for the right size. */
1338 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1345 context = kmalloc(len+1, GFP_NOFS);
1351 context[len] = '\0';
1352 rc = inode->i_op->getxattr(dentry,
1358 if (rc != -ENODATA) {
1359 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1360 "%d for dev=%s ino=%ld\n", __func__,
1361 -rc, inode->i_sb->s_id, inode->i_ino);
1365 /* Map ENODATA to the default file SID */
1366 sid = sbsec->def_sid;
1369 rc = security_context_to_sid_default(context, rc, &sid,
1373 char *dev = inode->i_sb->s_id;
1374 unsigned long ino = inode->i_ino;
1376 if (rc == -EINVAL) {
1377 if (printk_ratelimit())
1378 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1379 "context=%s. This indicates you may need to relabel the inode or the "
1380 "filesystem in question.\n", ino, dev, context);
1382 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1383 "returned %d for dev=%s ino=%ld\n",
1384 __func__, context, -rc, dev, ino);
1387 /* Leave with the unlabeled SID */
1395 case SECURITY_FS_USE_TASK:
1396 isec->sid = isec->task_sid;
1398 case SECURITY_FS_USE_TRANS:
1399 /* Default to the fs SID. */
1400 isec->sid = sbsec->sid;
1402 /* Try to obtain a transition SID. */
1403 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1404 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1405 isec->sclass, NULL, &sid);
1410 case SECURITY_FS_USE_MNTPOINT:
1411 isec->sid = sbsec->mntpoint_sid;
1414 /* Default to the fs superblock SID. */
1415 isec->sid = sbsec->sid;
1417 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1418 /* We must have a dentry to determine the label on
1421 /* Called from d_instantiate or
1422 * d_splice_alias. */
1423 dentry = dget(opt_dentry);
1425 /* Called from selinux_complete_init, try to
1427 dentry = d_find_alias(inode);
1429 * This can be hit on boot when a file is accessed
1430 * before the policy is loaded. When we load policy we
1431 * may find inodes that have no dentry on the
1432 * sbsec->isec_head list. No reason to complain as
1433 * these will get fixed up the next time we go through
1434 * inode_doinit() with a dentry, before these inodes
1435 * could be used again by userspace.
1439 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1440 rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1449 isec->initialized = 1;
1452 mutex_unlock(&isec->lock);
1454 if (isec->sclass == SECCLASS_FILE)
1455 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1459 /* Convert a Linux signal to an access vector. */
1460 static inline u32 signal_to_av(int sig)
1466 /* Commonly granted from child to parent. */
1467 perm = PROCESS__SIGCHLD;
1470 /* Cannot be caught or ignored */
1471 perm = PROCESS__SIGKILL;
1474 /* Cannot be caught or ignored */
1475 perm = PROCESS__SIGSTOP;
1478 /* All other signals. */
1479 perm = PROCESS__SIGNAL;
1487 * Check permission between a pair of credentials
1488 * fork check, ptrace check, etc.
1490 static int cred_has_perm(const struct cred *actor,
1491 const struct cred *target,
1494 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1496 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1500 * Check permission between a pair of tasks, e.g. signal checks,
1501 * fork check, ptrace check, etc.
1502 * tsk1 is the actor and tsk2 is the target
1503 * - this uses the default subjective creds of tsk1
1505 static int task_has_perm(const struct task_struct *tsk1,
1506 const struct task_struct *tsk2,
1509 const struct task_security_struct *__tsec1, *__tsec2;
1513 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1514 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1516 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1520 * Check permission between current and another task, e.g. signal checks,
1521 * fork check, ptrace check, etc.
1522 * current is the actor and tsk2 is the target
1523 * - this uses current's subjective creds
1525 static int current_has_perm(const struct task_struct *tsk,
1530 sid = current_sid();
1531 tsid = task_sid(tsk);
1532 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1535 #if CAP_LAST_CAP > 63
1536 #error Fix SELinux to handle capabilities > 63.
1539 /* Check whether a task is allowed to use a capability. */
1540 static int cred_has_capability(const struct cred *cred,
1543 struct common_audit_data ad;
1544 struct av_decision avd;
1546 u32 sid = cred_sid(cred);
1547 u32 av = CAP_TO_MASK(cap);
1550 ad.type = LSM_AUDIT_DATA_CAP;
1553 switch (CAP_TO_INDEX(cap)) {
1555 sclass = SECCLASS_CAPABILITY;
1558 sclass = SECCLASS_CAPABILITY2;
1562 "SELinux: out of range capability %d\n", cap);
1567 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1568 if (audit == SECURITY_CAP_AUDIT) {
1569 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1576 /* Check whether a task is allowed to use a system operation. */
1577 static int task_has_system(struct task_struct *tsk,
1580 u32 sid = task_sid(tsk);
1582 return avc_has_perm(sid, SECINITSID_KERNEL,
1583 SECCLASS_SYSTEM, perms, NULL);
1586 /* Check whether a task has a particular permission to an inode.
1587 The 'adp' parameter is optional and allows other audit
1588 data to be passed (e.g. the dentry). */
1589 static int inode_has_perm(const struct cred *cred,
1590 struct inode *inode,
1592 struct common_audit_data *adp)
1594 struct inode_security_struct *isec;
1597 validate_creds(cred);
1599 if (unlikely(IS_PRIVATE(inode)))
1602 sid = cred_sid(cred);
1603 isec = inode->i_security;
1605 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1608 /* Same as inode_has_perm, but pass explicit audit data containing
1609 the dentry to help the auditing code to more easily generate the
1610 pathname if needed. */
1611 static inline int dentry_has_perm(const struct cred *cred,
1612 struct dentry *dentry,
1615 struct inode *inode = dentry->d_inode;
1616 struct common_audit_data ad;
1618 ad.type = LSM_AUDIT_DATA_DENTRY;
1619 ad.u.dentry = dentry;
1620 return inode_has_perm(cred, inode, av, &ad);
1623 /* Same as inode_has_perm, but pass explicit audit data containing
1624 the path to help the auditing code to more easily generate the
1625 pathname if needed. */
1626 static inline int path_has_perm(const struct cred *cred,
1630 struct inode *inode = path->dentry->d_inode;
1631 struct common_audit_data ad;
1633 ad.type = LSM_AUDIT_DATA_PATH;
1635 return inode_has_perm(cred, inode, av, &ad);
1638 /* Same as path_has_perm, but uses the inode from the file struct. */
1639 static inline int file_path_has_perm(const struct cred *cred,
1643 struct common_audit_data ad;
1645 ad.type = LSM_AUDIT_DATA_PATH;
1646 ad.u.path = file->f_path;
1647 return inode_has_perm(cred, file_inode(file), av, &ad);
1650 /* Check whether a task can use an open file descriptor to
1651 access an inode in a given way. Check access to the
1652 descriptor itself, and then use dentry_has_perm to
1653 check a particular permission to the file.
1654 Access to the descriptor is implicitly granted if it
1655 has the same SID as the process. If av is zero, then
1656 access to the file is not checked, e.g. for cases
1657 where only the descriptor is affected like seek. */
1658 static int file_has_perm(const struct cred *cred,
1662 struct file_security_struct *fsec = file->f_security;
1663 struct inode *inode = file_inode(file);
1664 struct common_audit_data ad;
1665 u32 sid = cred_sid(cred);
1668 ad.type = LSM_AUDIT_DATA_PATH;
1669 ad.u.path = file->f_path;
1671 if (sid != fsec->sid) {
1672 rc = avc_has_perm(sid, fsec->sid,
1680 /* av is zero if only checking access to the descriptor. */
1683 rc = inode_has_perm(cred, inode, av, &ad);
1689 /* Check whether a task can create a file. */
1690 static int may_create(struct inode *dir,
1691 struct dentry *dentry,
1694 const struct task_security_struct *tsec = current_security();
1695 struct inode_security_struct *dsec;
1696 struct superblock_security_struct *sbsec;
1698 struct common_audit_data ad;
1701 dsec = dir->i_security;
1702 sbsec = dir->i_sb->s_security;
1705 newsid = tsec->create_sid;
1707 ad.type = LSM_AUDIT_DATA_DENTRY;
1708 ad.u.dentry = dentry;
1710 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1711 DIR__ADD_NAME | DIR__SEARCH,
1716 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1717 rc = security_transition_sid(sid, dsec->sid, tclass,
1718 &dentry->d_name, &newsid);
1723 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1727 return avc_has_perm(newsid, sbsec->sid,
1728 SECCLASS_FILESYSTEM,
1729 FILESYSTEM__ASSOCIATE, &ad);
1732 /* Check whether a task can create a key. */
1733 static int may_create_key(u32 ksid,
1734 struct task_struct *ctx)
1736 u32 sid = task_sid(ctx);
1738 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1742 #define MAY_UNLINK 1
1745 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1746 static int may_link(struct inode *dir,
1747 struct dentry *dentry,
1751 struct inode_security_struct *dsec, *isec;
1752 struct common_audit_data ad;
1753 u32 sid = current_sid();
1757 dsec = dir->i_security;
1758 isec = dentry->d_inode->i_security;
1760 ad.type = LSM_AUDIT_DATA_DENTRY;
1761 ad.u.dentry = dentry;
1764 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1765 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1780 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1785 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1789 static inline int may_rename(struct inode *old_dir,
1790 struct dentry *old_dentry,
1791 struct inode *new_dir,
1792 struct dentry *new_dentry)
1794 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1795 struct common_audit_data ad;
1796 u32 sid = current_sid();
1798 int old_is_dir, new_is_dir;
1801 old_dsec = old_dir->i_security;
1802 old_isec = old_dentry->d_inode->i_security;
1803 old_is_dir = d_is_dir(old_dentry);
1804 new_dsec = new_dir->i_security;
1806 ad.type = LSM_AUDIT_DATA_DENTRY;
1808 ad.u.dentry = old_dentry;
1809 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1810 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1813 rc = avc_has_perm(sid, old_isec->sid,
1814 old_isec->sclass, FILE__RENAME, &ad);
1817 if (old_is_dir && new_dir != old_dir) {
1818 rc = avc_has_perm(sid, old_isec->sid,
1819 old_isec->sclass, DIR__REPARENT, &ad);
1824 ad.u.dentry = new_dentry;
1825 av = DIR__ADD_NAME | DIR__SEARCH;
1826 if (d_is_positive(new_dentry))
1827 av |= DIR__REMOVE_NAME;
1828 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1831 if (d_is_positive(new_dentry)) {
1832 new_isec = new_dentry->d_inode->i_security;
1833 new_is_dir = d_is_dir(new_dentry);
1834 rc = avc_has_perm(sid, new_isec->sid,
1836 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1844 /* Check whether a task can perform a filesystem operation. */
1845 static int superblock_has_perm(const struct cred *cred,
1846 struct super_block *sb,
1848 struct common_audit_data *ad)
1850 struct superblock_security_struct *sbsec;
1851 u32 sid = cred_sid(cred);
1853 sbsec = sb->s_security;
1854 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1857 /* Convert a Linux mode and permission mask to an access vector. */
1858 static inline u32 file_mask_to_av(int mode, int mask)
1862 if (!S_ISDIR(mode)) {
1863 if (mask & MAY_EXEC)
1864 av |= FILE__EXECUTE;
1865 if (mask & MAY_READ)
1868 if (mask & MAY_APPEND)
1870 else if (mask & MAY_WRITE)
1874 if (mask & MAY_EXEC)
1876 if (mask & MAY_WRITE)
1878 if (mask & MAY_READ)
1885 /* Convert a Linux file to an access vector. */
1886 static inline u32 file_to_av(struct file *file)
1890 if (file->f_mode & FMODE_READ)
1892 if (file->f_mode & FMODE_WRITE) {
1893 if (file->f_flags & O_APPEND)
1900 * Special file opened with flags 3 for ioctl-only use.
1909 * Convert a file to an access vector and include the correct open
1912 static inline u32 open_file_to_av(struct file *file)
1914 u32 av = file_to_av(file);
1916 if (selinux_policycap_openperm)
1922 /* Hook functions begin here. */
1924 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1926 u32 mysid = current_sid();
1927 u32 mgrsid = task_sid(mgr);
1929 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1930 BINDER__SET_CONTEXT_MGR, NULL);
1933 static int selinux_binder_transaction(struct task_struct *from,
1934 struct task_struct *to)
1936 u32 mysid = current_sid();
1937 u32 fromsid = task_sid(from);
1938 u32 tosid = task_sid(to);
1941 if (mysid != fromsid) {
1942 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1943 BINDER__IMPERSONATE, NULL);
1948 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1952 static int selinux_binder_transfer_binder(struct task_struct *from,
1953 struct task_struct *to)
1955 u32 fromsid = task_sid(from);
1956 u32 tosid = task_sid(to);
1958 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1962 static int selinux_binder_transfer_file(struct task_struct *from,
1963 struct task_struct *to,
1966 u32 sid = task_sid(to);
1967 struct file_security_struct *fsec = file->f_security;
1968 struct inode *inode = file->f_path.dentry->d_inode;
1969 struct inode_security_struct *isec = inode->i_security;
1970 struct common_audit_data ad;
1973 ad.type = LSM_AUDIT_DATA_PATH;
1974 ad.u.path = file->f_path;
1976 if (sid != fsec->sid) {
1977 rc = avc_has_perm(sid, fsec->sid,
1985 if (unlikely(IS_PRIVATE(inode)))
1988 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1992 static int selinux_ptrace_access_check(struct task_struct *child,
1997 rc = cap_ptrace_access_check(child, mode);
2001 if (mode & PTRACE_MODE_READ) {
2002 u32 sid = current_sid();
2003 u32 csid = task_sid(child);
2004 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2007 return current_has_perm(child, PROCESS__PTRACE);
2010 static int selinux_ptrace_traceme(struct task_struct *parent)
2014 rc = cap_ptrace_traceme(parent);
2018 return task_has_perm(parent, current, PROCESS__PTRACE);
2021 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2022 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2026 error = current_has_perm(target, PROCESS__GETCAP);
2030 return cap_capget(target, effective, inheritable, permitted);
2033 static int selinux_capset(struct cred *new, const struct cred *old,
2034 const kernel_cap_t *effective,
2035 const kernel_cap_t *inheritable,
2036 const kernel_cap_t *permitted)
2040 error = cap_capset(new, old,
2041 effective, inheritable, permitted);
2045 return cred_has_perm(old, new, PROCESS__SETCAP);
2049 * (This comment used to live with the selinux_task_setuid hook,
2050 * which was removed).
2052 * Since setuid only affects the current process, and since the SELinux
2053 * controls are not based on the Linux identity attributes, SELinux does not
2054 * need to control this operation. However, SELinux does control the use of
2055 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2058 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2063 rc = cap_capable(cred, ns, cap, audit);
2067 return cred_has_capability(cred, cap, audit);
2070 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2072 const struct cred *cred = current_cred();
2084 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2089 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2092 rc = 0; /* let the kernel handle invalid cmds */
2098 static int selinux_quota_on(struct dentry *dentry)
2100 const struct cred *cred = current_cred();
2102 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2105 static int selinux_syslog(int type)
2110 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2111 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2112 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2114 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2115 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2116 /* Set level of messages printed to console */
2117 case SYSLOG_ACTION_CONSOLE_LEVEL:
2118 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2120 case SYSLOG_ACTION_CLOSE: /* Close log */
2121 case SYSLOG_ACTION_OPEN: /* Open log */
2122 case SYSLOG_ACTION_READ: /* Read from log */
2123 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2124 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2126 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2133 * Check that a process has enough memory to allocate a new virtual
2134 * mapping. 0 means there is enough memory for the allocation to
2135 * succeed and -ENOMEM implies there is not.
2137 * Do not audit the selinux permission check, as this is applied to all
2138 * processes that allocate mappings.
2140 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2142 int rc, cap_sys_admin = 0;
2144 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2145 SECURITY_CAP_NOAUDIT);
2149 return __vm_enough_memory(mm, pages, cap_sys_admin);
2152 /* binprm security operations */
2154 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2155 const struct task_security_struct *old_tsec,
2156 const struct task_security_struct *new_tsec)
2158 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2159 int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2162 if (!nnp && !nosuid)
2163 return 0; /* neither NNP nor nosuid */
2165 if (new_tsec->sid == old_tsec->sid)
2166 return 0; /* No change in credentials */
2169 * The only transitions we permit under NNP or nosuid
2170 * are transitions to bounded SIDs, i.e. SIDs that are
2171 * guaranteed to only be allowed a subset of the permissions
2172 * of the current SID.
2174 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2177 * On failure, preserve the errno values for NNP vs nosuid.
2178 * NNP: Operation not permitted for caller.
2179 * nosuid: Permission denied to file.
2189 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2191 const struct task_security_struct *old_tsec;
2192 struct task_security_struct *new_tsec;
2193 struct inode_security_struct *isec;
2194 struct common_audit_data ad;
2195 struct inode *inode = file_inode(bprm->file);
2198 rc = cap_bprm_set_creds(bprm);
2202 /* SELinux context only depends on initial program or script and not
2203 * the script interpreter */
2204 if (bprm->cred_prepared)
2207 old_tsec = current_security();
2208 new_tsec = bprm->cred->security;
2209 isec = inode->i_security;
2211 /* Default to the current task SID. */
2212 new_tsec->sid = old_tsec->sid;
2213 new_tsec->osid = old_tsec->sid;
2215 /* Reset fs, key, and sock SIDs on execve. */
2216 new_tsec->create_sid = 0;
2217 new_tsec->keycreate_sid = 0;
2218 new_tsec->sockcreate_sid = 0;
2220 if (old_tsec->exec_sid) {
2221 new_tsec->sid = old_tsec->exec_sid;
2222 /* Reset exec SID on execve. */
2223 new_tsec->exec_sid = 0;
2225 /* Fail on NNP or nosuid if not an allowed transition. */
2226 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2230 /* Check for a default transition on this program. */
2231 rc = security_transition_sid(old_tsec->sid, isec->sid,
2232 SECCLASS_PROCESS, NULL,
2238 * Fallback to old SID on NNP or nosuid if not an allowed
2241 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2243 new_tsec->sid = old_tsec->sid;
2246 ad.type = LSM_AUDIT_DATA_PATH;
2247 ad.u.path = bprm->file->f_path;
2249 if (new_tsec->sid == old_tsec->sid) {
2250 rc = avc_has_perm(old_tsec->sid, isec->sid,
2251 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2255 /* Check permissions for the transition. */
2256 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2257 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2261 rc = avc_has_perm(new_tsec->sid, isec->sid,
2262 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2266 /* Check for shared state */
2267 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2268 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2269 SECCLASS_PROCESS, PROCESS__SHARE,
2275 /* Make sure that anyone attempting to ptrace over a task that
2276 * changes its SID has the appropriate permit */
2278 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2279 struct task_struct *tracer;
2280 struct task_security_struct *sec;
2284 tracer = ptrace_parent(current);
2285 if (likely(tracer != NULL)) {
2286 sec = __task_cred(tracer)->security;
2292 rc = avc_has_perm(ptsid, new_tsec->sid,
2294 PROCESS__PTRACE, NULL);
2300 /* Clear any possibly unsafe personality bits on exec: */
2301 bprm->per_clear |= PER_CLEAR_ON_SETID;
2307 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2309 const struct task_security_struct *tsec = current_security();
2317 /* Enable secure mode for SIDs transitions unless
2318 the noatsecure permission is granted between
2319 the two SIDs, i.e. ahp returns 0. */
2320 atsecure = avc_has_perm(osid, sid,
2322 PROCESS__NOATSECURE, NULL);
2325 return (atsecure || cap_bprm_secureexec(bprm));
2328 static int match_file(const void *p, struct file *file, unsigned fd)
2330 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2333 /* Derived from fs/exec.c:flush_old_files. */
2334 static inline void flush_unauthorized_files(const struct cred *cred,
2335 struct files_struct *files)
2337 struct file *file, *devnull = NULL;
2338 struct tty_struct *tty;
2342 tty = get_current_tty();
2344 spin_lock(&tty_files_lock);
2345 if (!list_empty(&tty->tty_files)) {
2346 struct tty_file_private *file_priv;
2348 /* Revalidate access to controlling tty.
2349 Use file_path_has_perm on the tty path directly
2350 rather than using file_has_perm, as this particular
2351 open file may belong to another process and we are
2352 only interested in the inode-based check here. */
2353 file_priv = list_first_entry(&tty->tty_files,
2354 struct tty_file_private, list);
2355 file = file_priv->file;
2356 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2359 spin_unlock(&tty_files_lock);
2362 /* Reset controlling tty. */
2366 /* Revalidate access to inherited open files. */
2367 n = iterate_fd(files, 0, match_file, cred);
2368 if (!n) /* none found? */
2371 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2372 if (IS_ERR(devnull))
2374 /* replace all the matching ones with this */
2376 replace_fd(n - 1, devnull, 0);
2377 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2383 * Prepare a process for imminent new credential changes due to exec
2385 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2387 struct task_security_struct *new_tsec;
2388 struct rlimit *rlim, *initrlim;
2391 new_tsec = bprm->cred->security;
2392 if (new_tsec->sid == new_tsec->osid)
2395 /* Close files for which the new task SID is not authorized. */
2396 flush_unauthorized_files(bprm->cred, current->files);
2398 /* Always clear parent death signal on SID transitions. */
2399 current->pdeath_signal = 0;
2401 /* Check whether the new SID can inherit resource limits from the old
2402 * SID. If not, reset all soft limits to the lower of the current
2403 * task's hard limit and the init task's soft limit.
2405 * Note that the setting of hard limits (even to lower them) can be
2406 * controlled by the setrlimit check. The inclusion of the init task's
2407 * soft limit into the computation is to avoid resetting soft limits
2408 * higher than the default soft limit for cases where the default is
2409 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2411 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2412 PROCESS__RLIMITINH, NULL);
2414 /* protect against do_prlimit() */
2416 for (i = 0; i < RLIM_NLIMITS; i++) {
2417 rlim = current->signal->rlim + i;
2418 initrlim = init_task.signal->rlim + i;
2419 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2421 task_unlock(current);
2422 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2427 * Clean up the process immediately after the installation of new credentials
2430 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2432 const struct task_security_struct *tsec = current_security();
2433 struct itimerval itimer;
2443 /* Check whether the new SID can inherit signal state from the old SID.
2444 * If not, clear itimers to avoid subsequent signal generation and
2445 * flush and unblock signals.
2447 * This must occur _after_ the task SID has been updated so that any
2448 * kill done after the flush will be checked against the new SID.
2450 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2452 memset(&itimer, 0, sizeof itimer);
2453 for (i = 0; i < 3; i++)
2454 do_setitimer(i, &itimer, NULL);
2455 spin_lock_irq(¤t->sighand->siglock);
2456 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2457 __flush_signals(current);
2458 flush_signal_handlers(current, 1);
2459 sigemptyset(¤t->blocked);
2461 spin_unlock_irq(¤t->sighand->siglock);
2464 /* Wake up the parent if it is waiting so that it can recheck
2465 * wait permission to the new task SID. */
2466 read_lock(&tasklist_lock);
2467 __wake_up_parent(current, current->real_parent);
2468 read_unlock(&tasklist_lock);
2471 /* superblock security operations */
2473 static int selinux_sb_alloc_security(struct super_block *sb)
2475 return superblock_alloc_security(sb);
2478 static void selinux_sb_free_security(struct super_block *sb)
2480 superblock_free_security(sb);
2483 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2488 return !memcmp(prefix, option, plen);
2491 static inline int selinux_option(char *option, int len)
2493 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2494 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2495 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2496 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2497 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2500 static inline void take_option(char **to, char *from, int *first, int len)
2507 memcpy(*to, from, len);
2511 static inline void take_selinux_option(char **to, char *from, int *first,
2514 int current_size = 0;
2522 while (current_size < len) {
2532 static int selinux_sb_copy_data(char *orig, char *copy)
2534 int fnosec, fsec, rc = 0;
2535 char *in_save, *in_curr, *in_end;
2536 char *sec_curr, *nosec_save, *nosec;
2542 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2550 in_save = in_end = orig;
2554 open_quote = !open_quote;
2555 if ((*in_end == ',' && open_quote == 0) ||
2557 int len = in_end - in_curr;
2559 if (selinux_option(in_curr, len))
2560 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2562 take_option(&nosec, in_curr, &fnosec, len);
2564 in_curr = in_end + 1;
2566 } while (*in_end++);
2568 strcpy(in_save, nosec_save);
2569 free_page((unsigned long)nosec_save);
2574 static int selinux_sb_remount(struct super_block *sb, void *data)
2577 struct security_mnt_opts opts;
2578 char *secdata, **mount_options;
2579 struct superblock_security_struct *sbsec = sb->s_security;
2581 if (!(sbsec->flags & SE_SBINITIALIZED))
2587 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2590 security_init_mnt_opts(&opts);
2591 secdata = alloc_secdata();
2594 rc = selinux_sb_copy_data(data, secdata);
2596 goto out_free_secdata;
2598 rc = selinux_parse_opts_str(secdata, &opts);
2600 goto out_free_secdata;
2602 mount_options = opts.mnt_opts;
2603 flags = opts.mnt_opts_flags;
2605 for (i = 0; i < opts.num_mnt_opts; i++) {
2609 if (flags[i] == SBLABEL_MNT)
2611 len = strlen(mount_options[i]);
2612 rc = security_context_to_sid(mount_options[i], len, &sid,
2615 printk(KERN_WARNING "SELinux: security_context_to_sid"
2616 "(%s) failed for (dev %s, type %s) errno=%d\n",
2617 mount_options[i], sb->s_id, sb->s_type->name, rc);
2623 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2624 goto out_bad_option;
2627 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2628 goto out_bad_option;
2630 case ROOTCONTEXT_MNT: {
2631 struct inode_security_struct *root_isec;
2632 root_isec = sb->s_root->d_inode->i_security;
2634 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2635 goto out_bad_option;
2638 case DEFCONTEXT_MNT:
2639 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2640 goto out_bad_option;
2649 security_free_mnt_opts(&opts);
2651 free_secdata(secdata);
2654 printk(KERN_WARNING "SELinux: unable to change security options "
2655 "during remount (dev %s, type=%s)\n", sb->s_id,
2660 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2662 const struct cred *cred = current_cred();
2663 struct common_audit_data ad;
2666 rc = superblock_doinit(sb, data);
2670 /* Allow all mounts performed by the kernel */
2671 if (flags & MS_KERNMOUNT)
2674 ad.type = LSM_AUDIT_DATA_DENTRY;
2675 ad.u.dentry = sb->s_root;
2676 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2679 static int selinux_sb_statfs(struct dentry *dentry)
2681 const struct cred *cred = current_cred();
2682 struct common_audit_data ad;
2684 ad.type = LSM_AUDIT_DATA_DENTRY;
2685 ad.u.dentry = dentry->d_sb->s_root;
2686 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2689 static int selinux_mount(const char *dev_name,
2692 unsigned long flags,
2695 const struct cred *cred = current_cred();
2697 if (flags & MS_REMOUNT)
2698 return superblock_has_perm(cred, path->dentry->d_sb,
2699 FILESYSTEM__REMOUNT, NULL);
2701 return path_has_perm(cred, path, FILE__MOUNTON);
2704 static int selinux_umount(struct vfsmount *mnt, int flags)
2706 const struct cred *cred = current_cred();
2708 return superblock_has_perm(cred, mnt->mnt_sb,
2709 FILESYSTEM__UNMOUNT, NULL);
2712 /* inode security operations */
2714 static int selinux_inode_alloc_security(struct inode *inode)
2716 return inode_alloc_security(inode);
2719 static void selinux_inode_free_security(struct inode *inode)
2721 inode_free_security(inode);
2724 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2725 struct qstr *name, void **ctx,
2728 const struct cred *cred = current_cred();
2729 struct task_security_struct *tsec;
2730 struct inode_security_struct *dsec;
2731 struct superblock_security_struct *sbsec;
2732 struct inode *dir = dentry->d_parent->d_inode;
2736 tsec = cred->security;
2737 dsec = dir->i_security;
2738 sbsec = dir->i_sb->s_security;
2740 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2741 newsid = tsec->create_sid;
2743 rc = security_transition_sid(tsec->sid, dsec->sid,
2744 inode_mode_to_security_class(mode),
2749 "%s: security_transition_sid failed, rc=%d\n",
2755 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2758 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2759 const struct qstr *qstr,
2761 void **value, size_t *len)
2763 const struct task_security_struct *tsec = current_security();
2764 struct inode_security_struct *dsec;
2765 struct superblock_security_struct *sbsec;
2766 u32 sid, newsid, clen;
2770 dsec = dir->i_security;
2771 sbsec = dir->i_sb->s_security;
2774 newsid = tsec->create_sid;
2776 if ((sbsec->flags & SE_SBINITIALIZED) &&
2777 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2778 newsid = sbsec->mntpoint_sid;
2779 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2780 rc = security_transition_sid(sid, dsec->sid,
2781 inode_mode_to_security_class(inode->i_mode),
2784 printk(KERN_WARNING "%s: "
2785 "security_transition_sid failed, rc=%d (dev=%s "
2788 -rc, inode->i_sb->s_id, inode->i_ino);
2793 /* Possibly defer initialization to selinux_complete_init. */
2794 if (sbsec->flags & SE_SBINITIALIZED) {
2795 struct inode_security_struct *isec = inode->i_security;
2796 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2798 isec->initialized = 1;
2801 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2805 *name = XATTR_SELINUX_SUFFIX;
2808 rc = security_sid_to_context_force(newsid, &context, &clen);
2818 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2820 return may_create(dir, dentry, SECCLASS_FILE);
2823 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2825 return may_link(dir, old_dentry, MAY_LINK);
2828 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2830 return may_link(dir, dentry, MAY_UNLINK);
2833 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2835 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2838 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2840 return may_create(dir, dentry, SECCLASS_DIR);
2843 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2845 return may_link(dir, dentry, MAY_RMDIR);
2848 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2850 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2853 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2854 struct inode *new_inode, struct dentry *new_dentry)
2856 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2859 static int selinux_inode_readlink(struct dentry *dentry)
2861 const struct cred *cred = current_cred();
2863 return dentry_has_perm(cred, dentry, FILE__READ);
2866 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2868 const struct cred *cred = current_cred();
2870 return dentry_has_perm(cred, dentry, FILE__READ);
2873 static noinline int audit_inode_permission(struct inode *inode,
2874 u32 perms, u32 audited, u32 denied,
2878 struct common_audit_data ad;
2879 struct inode_security_struct *isec = inode->i_security;
2882 ad.type = LSM_AUDIT_DATA_INODE;
2885 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2886 audited, denied, result, &ad, flags);
2892 static int selinux_inode_permission(struct inode *inode, int mask)
2894 const struct cred *cred = current_cred();
2897 unsigned flags = mask & MAY_NOT_BLOCK;
2898 struct inode_security_struct *isec;
2900 struct av_decision avd;
2902 u32 audited, denied;
2904 from_access = mask & MAY_ACCESS;
2905 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2907 /* No permission to check. Existence test. */
2911 validate_creds(cred);
2913 if (unlikely(IS_PRIVATE(inode)))
2916 perms = file_mask_to_av(inode->i_mode, mask);
2918 sid = cred_sid(cred);
2919 isec = inode->i_security;
2921 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2922 audited = avc_audit_required(perms, &avd, rc,
2923 from_access ? FILE__AUDIT_ACCESS : 0,
2925 if (likely(!audited))
2928 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2934 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2936 const struct cred *cred = current_cred();
2937 unsigned int ia_valid = iattr->ia_valid;
2938 __u32 av = FILE__WRITE;
2940 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2941 if (ia_valid & ATTR_FORCE) {
2942 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2948 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2949 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2950 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2952 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2955 return dentry_has_perm(cred, dentry, av);
2958 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2960 const struct cred *cred = current_cred();
2963 path.dentry = dentry;
2966 return path_has_perm(cred, &path, FILE__GETATTR);
2969 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2971 const struct cred *cred = current_cred();
2973 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2974 sizeof XATTR_SECURITY_PREFIX - 1)) {
2975 if (!strcmp(name, XATTR_NAME_CAPS)) {
2976 if (!capable(CAP_SETFCAP))
2978 } else if (!capable(CAP_SYS_ADMIN)) {
2979 /* A different attribute in the security namespace.
2980 Restrict to administrator. */
2985 /* Not an attribute we recognize, so just check the
2986 ordinary setattr permission. */
2987 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2990 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2991 const void *value, size_t size, int flags)
2993 struct inode *inode = dentry->d_inode;
2994 struct inode_security_struct *isec = inode->i_security;
2995 struct superblock_security_struct *sbsec;
2996 struct common_audit_data ad;
2997 u32 newsid, sid = current_sid();
3000 if (strcmp(name, XATTR_NAME_SELINUX))
3001 return selinux_inode_setotherxattr(dentry, name);
3003 sbsec = inode->i_sb->s_security;
3004 if (!(sbsec->flags & SBLABEL_MNT))
3007 if (!inode_owner_or_capable(inode))
3010 ad.type = LSM_AUDIT_DATA_DENTRY;
3011 ad.u.dentry = dentry;
3013 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3014 FILE__RELABELFROM, &ad);
3018 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3019 if (rc == -EINVAL) {
3020 if (!capable(CAP_MAC_ADMIN)) {
3021 struct audit_buffer *ab;
3025 /* We strip a nul only if it is at the end, otherwise the
3026 * context contains a nul and we should audit that */
3029 if (str[size - 1] == '\0')
3030 audit_size = size - 1;
3037 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3038 audit_log_format(ab, "op=setxattr invalid_context=");
3039 audit_log_n_untrustedstring(ab, value, audit_size);
3044 rc = security_context_to_sid_force(value, size, &newsid);
3049 rc = avc_has_perm(sid, newsid, isec->sclass,
3050 FILE__RELABELTO, &ad);
3054 rc = security_validate_transition(isec->sid, newsid, sid,
3059 return avc_has_perm(newsid,
3061 SECCLASS_FILESYSTEM,
3062 FILESYSTEM__ASSOCIATE,
3066 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3067 const void *value, size_t size,
3070 struct inode *inode = dentry->d_inode;
3071 struct inode_security_struct *isec = inode->i_security;
3075 if (strcmp(name, XATTR_NAME_SELINUX)) {
3076 /* Not an attribute we recognize, so nothing to do. */
3080 rc = security_context_to_sid_force(value, size, &newsid);
3082 printk(KERN_ERR "SELinux: unable to map context to SID"
3083 "for (%s, %lu), rc=%d\n",
3084 inode->i_sb->s_id, inode->i_ino, -rc);
3088 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3090 isec->initialized = 1;
3095 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3097 const struct cred *cred = current_cred();
3099 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3102 static int selinux_inode_listxattr(struct dentry *dentry)
3104 const struct cred *cred = current_cred();
3106 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3109 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3111 if (strcmp(name, XATTR_NAME_SELINUX))
3112 return selinux_inode_setotherxattr(dentry, name);
3114 /* No one is allowed to remove a SELinux security label.
3115 You can change the label, but all data must be labeled. */
3120 * Copy the inode security context value to the user.
3122 * Permission check is handled by selinux_inode_getxattr hook.
3124 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3128 char *context = NULL;
3129 struct inode_security_struct *isec = inode->i_security;
3131 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3135 * If the caller has CAP_MAC_ADMIN, then get the raw context
3136 * value even if it is not defined by current policy; otherwise,
3137 * use the in-core value under current policy.
3138 * Use the non-auditing forms of the permission checks since
3139 * getxattr may be called by unprivileged processes commonly
3140 * and lack of permission just means that we fall back to the
3141 * in-core context value, not a denial.
3143 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3144 SECURITY_CAP_NOAUDIT);
3146 error = security_sid_to_context_force(isec->sid, &context,
3149 error = security_sid_to_context(isec->sid, &context, &size);
3162 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3163 const void *value, size_t size, int flags)
3165 struct inode_security_struct *isec = inode->i_security;
3169 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3172 if (!value || !size)
3175 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3179 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3181 isec->initialized = 1;
3185 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3187 const int len = sizeof(XATTR_NAME_SELINUX);
3188 if (buffer && len <= buffer_size)
3189 memcpy(buffer, XATTR_NAME_SELINUX, len);
3193 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3195 struct inode_security_struct *isec = inode->i_security;
3199 /* file security operations */
3201 static int selinux_revalidate_file_permission(struct file *file, int mask)
3203 const struct cred *cred = current_cred();
3204 struct inode *inode = file_inode(file);
3206 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3207 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3210 return file_has_perm(cred, file,
3211 file_mask_to_av(inode->i_mode, mask));
3214 static int selinux_file_permission(struct file *file, int mask)
3216 struct inode *inode = file_inode(file);
3217 struct file_security_struct *fsec = file->f_security;
3218 struct inode_security_struct *isec = inode->i_security;
3219 u32 sid = current_sid();
3222 /* No permission to check. Existence test. */
3225 if (sid == fsec->sid && fsec->isid == isec->sid &&
3226 fsec->pseqno == avc_policy_seqno())
3227 /* No change since file_open check. */
3230 return selinux_revalidate_file_permission(file, mask);
3233 static int selinux_file_alloc_security(struct file *file)
3235 return file_alloc_security(file);
3238 static void selinux_file_free_security(struct file *file)
3240 file_free_security(file);
3243 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3246 const struct cred *cred = current_cred();
3256 case FS_IOC_GETFLAGS:
3258 case FS_IOC_GETVERSION:
3259 error = file_has_perm(cred, file, FILE__GETATTR);
3262 case FS_IOC_SETFLAGS:
3264 case FS_IOC_SETVERSION:
3265 error = file_has_perm(cred, file, FILE__SETATTR);
3268 /* sys_ioctl() checks */
3272 error = file_has_perm(cred, file, 0);
3277 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3278 SECURITY_CAP_AUDIT);
3281 /* default case assumes that the command will go
3282 * to the file's ioctl() function.
3285 error = file_has_perm(cred, file, FILE__IOCTL);
3290 static int default_noexec;
3292 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3294 const struct cred *cred = current_cred();
3297 if (default_noexec &&
3298 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3300 * We are making executable an anonymous mapping or a
3301 * private file mapping that will also be writable.
3302 * This has an additional check.
3304 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3310 /* read access is always possible with a mapping */
3311 u32 av = FILE__READ;
3313 /* write access only matters if the mapping is shared */
3314 if (shared && (prot & PROT_WRITE))
3317 if (prot & PROT_EXEC)
3318 av |= FILE__EXECUTE;
3320 return file_has_perm(cred, file, av);
3327 static int selinux_mmap_addr(unsigned long addr)
3331 /* do DAC check on address space usage */
3332 rc = cap_mmap_addr(addr);
3336 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3337 u32 sid = current_sid();
3338 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3339 MEMPROTECT__MMAP_ZERO, NULL);
3345 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3346 unsigned long prot, unsigned long flags)
3348 if (selinux_checkreqprot)
3351 return file_map_prot_check(file, prot,
3352 (flags & MAP_TYPE) == MAP_SHARED);
3355 static int selinux_file_mprotect(struct vm_area_struct *vma,
3356 unsigned long reqprot,
3359 const struct cred *cred = current_cred();
3361 if (selinux_checkreqprot)
3364 if (default_noexec &&
3365 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3367 if (vma->vm_start >= vma->vm_mm->start_brk &&
3368 vma->vm_end <= vma->vm_mm->brk) {
3369 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3370 } else if (!vma->vm_file &&
3371 vma->vm_start <= vma->vm_mm->start_stack &&
3372 vma->vm_end >= vma->vm_mm->start_stack) {
3373 rc = current_has_perm(current, PROCESS__EXECSTACK);
3374 } else if (vma->vm_file && vma->anon_vma) {
3376 * We are making executable a file mapping that has
3377 * had some COW done. Since pages might have been
3378 * written, check ability to execute the possibly
3379 * modified content. This typically should only
3380 * occur for text relocations.
3382 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3388 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3391 static int selinux_file_lock(struct file *file, unsigned int cmd)
3393 const struct cred *cred = current_cred();
3395 return file_has_perm(cred, file, FILE__LOCK);
3398 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3401 const struct cred *cred = current_cred();
3406 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3407 err = file_has_perm(cred, file, FILE__WRITE);
3416 case F_GETOWNER_UIDS:
3417 /* Just check FD__USE permission */
3418 err = file_has_perm(cred, file, 0);
3426 #if BITS_PER_LONG == 32
3431 err = file_has_perm(cred, file, FILE__LOCK);
3438 static void selinux_file_set_fowner(struct file *file)
3440 struct file_security_struct *fsec;
3442 fsec = file->f_security;
3443 fsec->fown_sid = current_sid();
3446 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3447 struct fown_struct *fown, int signum)
3450 u32 sid = task_sid(tsk);
3452 struct file_security_struct *fsec;
3454 /* struct fown_struct is never outside the context of a struct file */
3455 file = container_of(fown, struct file, f_owner);
3457 fsec = file->f_security;
3460 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3462 perm = signal_to_av(signum);
3464 return avc_has_perm(fsec->fown_sid, sid,
3465 SECCLASS_PROCESS, perm, NULL);
3468 static int selinux_file_receive(struct file *file)
3470 const struct cred *cred = current_cred();
3472 return file_has_perm(cred, file, file_to_av(file));
3475 static int selinux_file_open(struct file *file, const struct cred *cred)
3477 struct file_security_struct *fsec;
3478 struct inode_security_struct *isec;
3480 fsec = file->f_security;
3481 isec = file_inode(file)->i_security;
3483 * Save inode label and policy sequence number
3484 * at open-time so that selinux_file_permission
3485 * can determine whether revalidation is necessary.
3486 * Task label is already saved in the file security
3487 * struct as its SID.
3489 fsec->isid = isec->sid;
3490 fsec->pseqno = avc_policy_seqno();
3492 * Since the inode label or policy seqno may have changed
3493 * between the selinux_inode_permission check and the saving
3494 * of state above, recheck that access is still permitted.
3495 * Otherwise, access might never be revalidated against the
3496 * new inode label or new policy.
3497 * This check is not redundant - do not remove.
3499 return file_path_has_perm(cred, file, open_file_to_av(file));
3502 /* task security operations */
3504 static int selinux_task_create(unsigned long clone_flags)
3506 return current_has_perm(current, PROCESS__FORK);
3510 * allocate the SELinux part of blank credentials
3512 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3514 struct task_security_struct *tsec;
3516 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3520 cred->security = tsec;
3525 * detach and free the LSM part of a set of credentials
3527 static void selinux_cred_free(struct cred *cred)
3529 struct task_security_struct *tsec = cred->security;
3532 * cred->security == NULL if security_cred_alloc_blank() or
3533 * security_prepare_creds() returned an error.
3535 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3536 cred->security = (void *) 0x7UL;
3541 * prepare a new set of credentials for modification
3543 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3546 const struct task_security_struct *old_tsec;
3547 struct task_security_struct *tsec;
3549 old_tsec = old->security;
3551 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3555 new->security = tsec;
3560 * transfer the SELinux data to a blank set of creds
3562 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3564 const struct task_security_struct *old_tsec = old->security;
3565 struct task_security_struct *tsec = new->security;
3571 * set the security data for a kernel service
3572 * - all the creation contexts are set to unlabelled
3574 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3576 struct task_security_struct *tsec = new->security;
3577 u32 sid = current_sid();
3580 ret = avc_has_perm(sid, secid,
3581 SECCLASS_KERNEL_SERVICE,
3582 KERNEL_SERVICE__USE_AS_OVERRIDE,
3586 tsec->create_sid = 0;
3587 tsec->keycreate_sid = 0;
3588 tsec->sockcreate_sid = 0;
3594 * set the file creation context in a security record to the same as the
3595 * objective context of the specified inode
3597 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3599 struct inode_security_struct *isec = inode->i_security;
3600 struct task_security_struct *tsec = new->security;
3601 u32 sid = current_sid();
3604 ret = avc_has_perm(sid, isec->sid,
3605 SECCLASS_KERNEL_SERVICE,
3606 KERNEL_SERVICE__CREATE_FILES_AS,
3610 tsec->create_sid = isec->sid;
3614 static int selinux_kernel_module_request(char *kmod_name)
3617 struct common_audit_data ad;
3619 sid = task_sid(current);
3621 ad.type = LSM_AUDIT_DATA_KMOD;
3622 ad.u.kmod_name = kmod_name;
3624 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3625 SYSTEM__MODULE_REQUEST, &ad);
3628 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3630 return current_has_perm(p, PROCESS__SETPGID);
3633 static int selinux_task_getpgid(struct task_struct *p)
3635 return current_has_perm(p, PROCESS__GETPGID);
3638 static int selinux_task_getsid(struct task_struct *p)
3640 return current_has_perm(p, PROCESS__GETSESSION);
3643 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3645 *secid = task_sid(p);
3648 static int selinux_task_setnice(struct task_struct *p, int nice)
3652 rc = cap_task_setnice(p, nice);
3656 return current_has_perm(p, PROCESS__SETSCHED);
3659 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3663 rc = cap_task_setioprio(p, ioprio);
3667 return current_has_perm(p, PROCESS__SETSCHED);
3670 static int selinux_task_getioprio(struct task_struct *p)
3672 return current_has_perm(p, PROCESS__GETSCHED);
3675 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3676 struct rlimit *new_rlim)
3678 struct rlimit *old_rlim = p->signal->rlim + resource;
3680 /* Control the ability to change the hard limit (whether
3681 lowering or raising it), so that the hard limit can
3682 later be used as a safe reset point for the soft limit
3683 upon context transitions. See selinux_bprm_committing_creds. */
3684 if (old_rlim->rlim_max != new_rlim->rlim_max)
3685 return current_has_perm(p, PROCESS__SETRLIMIT);
3690 static int selinux_task_setscheduler(struct task_struct *p)
3694 rc = cap_task_setscheduler(p);
3698 return current_has_perm(p, PROCESS__SETSCHED);
3701 static int selinux_task_getscheduler(struct task_struct *p)
3703 return current_has_perm(p, PROCESS__GETSCHED);
3706 static int selinux_task_movememory(struct task_struct *p)
3708 return current_has_perm(p, PROCESS__SETSCHED);
3711 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3718 perm = PROCESS__SIGNULL; /* null signal; existence test */
3720 perm = signal_to_av(sig);
3722 rc = avc_has_perm(secid, task_sid(p),
3723 SECCLASS_PROCESS, perm, NULL);
3725 rc = current_has_perm(p, perm);
3729 static int selinux_task_wait(struct task_struct *p)
3731 return task_has_perm(p, current, PROCESS__SIGCHLD);
3734 static void selinux_task_to_inode(struct task_struct *p,
3735 struct inode *inode)
3737 struct inode_security_struct *isec = inode->i_security;
3738 u32 sid = task_sid(p);
3741 isec->initialized = 1;
3744 /* Returns error only if unable to parse addresses */
3745 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3746 struct common_audit_data *ad, u8 *proto)
3748 int offset, ihlen, ret = -EINVAL;
3749 struct iphdr _iph, *ih;
3751 offset = skb_network_offset(skb);
3752 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3756 ihlen = ih->ihl * 4;
3757 if (ihlen < sizeof(_iph))
3760 ad->u.net->v4info.saddr = ih->saddr;
3761 ad->u.net->v4info.daddr = ih->daddr;
3765 *proto = ih->protocol;
3767 switch (ih->protocol) {
3769 struct tcphdr _tcph, *th;
3771 if (ntohs(ih->frag_off) & IP_OFFSET)
3775 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3779 ad->u.net->sport = th->source;
3780 ad->u.net->dport = th->dest;
3785 struct udphdr _udph, *uh;
3787 if (ntohs(ih->frag_off) & IP_OFFSET)
3791 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3795 ad->u.net->sport = uh->source;
3796 ad->u.net->dport = uh->dest;
3800 case IPPROTO_DCCP: {
3801 struct dccp_hdr _dccph, *dh;
3803 if (ntohs(ih->frag_off) & IP_OFFSET)
3807 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3811 ad->u.net->sport = dh->dccph_sport;
3812 ad->u.net->dport = dh->dccph_dport;
3823 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3825 /* Returns error only if unable to parse addresses */
3826 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3827 struct common_audit_data *ad, u8 *proto)
3830 int ret = -EINVAL, offset;
3831 struct ipv6hdr _ipv6h, *ip6;
3834 offset = skb_network_offset(skb);
3835 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3839 ad->u.net->v6info.saddr = ip6->saddr;
3840 ad->u.net->v6info.daddr = ip6->daddr;
3843 nexthdr = ip6->nexthdr;
3844 offset += sizeof(_ipv6h);
3845 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3854 struct tcphdr _tcph, *th;
3856 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3860 ad->u.net->sport = th->source;
3861 ad->u.net->dport = th->dest;
3866 struct udphdr _udph, *uh;
3868 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3872 ad->u.net->sport = uh->source;
3873 ad->u.net->dport = uh->dest;
3877 case IPPROTO_DCCP: {
3878 struct dccp_hdr _dccph, *dh;
3880 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3884 ad->u.net->sport = dh->dccph_sport;
3885 ad->u.net->dport = dh->dccph_dport;
3889 /* includes fragments */
3899 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3900 char **_addrp, int src, u8 *proto)
3905 switch (ad->u.net->family) {
3907 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3910 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3911 &ad->u.net->v4info.daddr);
3914 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3916 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3919 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3920 &ad->u.net->v6info.daddr);
3930 "SELinux: failure in selinux_parse_skb(),"
3931 " unable to parse packet\n");
3941 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3943 * @family: protocol family
3944 * @sid: the packet's peer label SID
3947 * Check the various different forms of network peer labeling and determine
3948 * the peer label/SID for the packet; most of the magic actually occurs in
3949 * the security server function security_net_peersid_cmp(). The function
3950 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3951 * or -EACCES if @sid is invalid due to inconsistencies with the different
3955 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3962 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3965 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3969 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3970 if (unlikely(err)) {
3972 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3973 " unable to determine packet's peer label\n");
3981 * selinux_conn_sid - Determine the child socket label for a connection
3982 * @sk_sid: the parent socket's SID
3983 * @skb_sid: the packet's SID
3984 * @conn_sid: the resulting connection SID
3986 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3987 * combined with the MLS information from @skb_sid in order to create
3988 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3989 * of @sk_sid. Returns zero on success, negative values on failure.
3992 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3996 if (skb_sid != SECSID_NULL)
3997 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4004 /* socket security operations */
4006 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4007 u16 secclass, u32 *socksid)
4009 if (tsec->sockcreate_sid > SECSID_NULL) {
4010 *socksid = tsec->sockcreate_sid;
4014 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4018 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4020 struct sk_security_struct *sksec = sk->sk_security;
4021 struct common_audit_data ad;
4022 struct lsm_network_audit net = {0,};
4023 u32 tsid = task_sid(task);
4025 if (sksec->sid == SECINITSID_KERNEL)
4028 ad.type = LSM_AUDIT_DATA_NET;
4032 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4035 static int selinux_socket_create(int family, int type,
4036 int protocol, int kern)
4038 const struct task_security_struct *tsec = current_security();
4046 secclass = socket_type_to_security_class(family, type, protocol);
4047 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4051 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4054 static int selinux_socket_post_create(struct socket *sock, int family,
4055 int type, int protocol, int kern)
4057 const struct task_security_struct *tsec = current_security();
4058 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4059 struct sk_security_struct *sksec;
4062 isec->sclass = socket_type_to_security_class(family, type, protocol);
4065 isec->sid = SECINITSID_KERNEL;
4067 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4072 isec->initialized = 1;
4075 sksec = sock->sk->sk_security;
4076 sksec->sid = isec->sid;
4077 sksec->sclass = isec->sclass;
4078 err = selinux_netlbl_socket_post_create(sock->sk, family);
4084 /* Range of port numbers used to automatically bind.
4085 Need to determine whether we should perform a name_bind
4086 permission check between the socket and the port number. */
4088 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4090 struct sock *sk = sock->sk;
4094 err = sock_has_perm(current, sk, SOCKET__BIND);
4099 * If PF_INET or PF_INET6, check name_bind permission for the port.
4100 * Multiple address binding for SCTP is not supported yet: we just
4101 * check the first address now.
4103 family = sk->sk_family;
4104 if (family == PF_INET || family == PF_INET6) {
4106 struct sk_security_struct *sksec = sk->sk_security;
4107 struct common_audit_data ad;
4108 struct lsm_network_audit net = {0,};
4109 struct sockaddr_in *addr4 = NULL;
4110 struct sockaddr_in6 *addr6 = NULL;
4111 unsigned short snum;
4114 if (family == PF_INET) {
4115 addr4 = (struct sockaddr_in *)address;
4116 snum = ntohs(addr4->sin_port);
4117 addrp = (char *)&addr4->sin_addr.s_addr;
4119 addr6 = (struct sockaddr_in6 *)address;
4120 snum = ntohs(addr6->sin6_port);
4121 addrp = (char *)&addr6->sin6_addr.s6_addr;
4127 inet_get_local_port_range(sock_net(sk), &low, &high);
4129 if (snum < max(PROT_SOCK, low) || snum > high) {
4130 err = sel_netport_sid(sk->sk_protocol,
4134 ad.type = LSM_AUDIT_DATA_NET;
4136 ad.u.net->sport = htons(snum);
4137 ad.u.net->family = family;
4138 err = avc_has_perm(sksec->sid, sid,
4140 SOCKET__NAME_BIND, &ad);
4146 switch (sksec->sclass) {
4147 case SECCLASS_TCP_SOCKET:
4148 node_perm = TCP_SOCKET__NODE_BIND;
4151 case SECCLASS_UDP_SOCKET:
4152 node_perm = UDP_SOCKET__NODE_BIND;
4155 case SECCLASS_DCCP_SOCKET:
4156 node_perm = DCCP_SOCKET__NODE_BIND;
4160 node_perm = RAWIP_SOCKET__NODE_BIND;
4164 err = sel_netnode_sid(addrp, family, &sid);
4168 ad.type = LSM_AUDIT_DATA_NET;
4170 ad.u.net->sport = htons(snum);
4171 ad.u.net->family = family;
4173 if (family == PF_INET)
4174 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4176 ad.u.net->v6info.saddr = addr6->sin6_addr;
4178 err = avc_has_perm(sksec->sid, sid,
4179 sksec->sclass, node_perm, &ad);
4187 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4189 struct sock *sk = sock->sk;
4190 struct sk_security_struct *sksec = sk->sk_security;
4193 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4198 * If a TCP or DCCP socket, check name_connect permission for the port.
4200 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4201 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4202 struct common_audit_data ad;
4203 struct lsm_network_audit net = {0,};
4204 struct sockaddr_in *addr4 = NULL;
4205 struct sockaddr_in6 *addr6 = NULL;
4206 unsigned short snum;
4209 if (sk->sk_family == PF_INET) {
4210 addr4 = (struct sockaddr_in *)address;
4211 if (addrlen < sizeof(struct sockaddr_in))
4213 snum = ntohs(addr4->sin_port);
4215 addr6 = (struct sockaddr_in6 *)address;
4216 if (addrlen < SIN6_LEN_RFC2133)
4218 snum = ntohs(addr6->sin6_port);
4221 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4225 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4226 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4228 ad.type = LSM_AUDIT_DATA_NET;
4230 ad.u.net->dport = htons(snum);
4231 ad.u.net->family = sk->sk_family;
4232 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4237 err = selinux_netlbl_socket_connect(sk, address);
4243 static int selinux_socket_listen(struct socket *sock, int backlog)
4245 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4248 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4251 struct inode_security_struct *isec;
4252 struct inode_security_struct *newisec;
4254 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4258 newisec = SOCK_INODE(newsock)->i_security;
4260 isec = SOCK_INODE(sock)->i_security;
4261 newisec->sclass = isec->sclass;
4262 newisec->sid = isec->sid;
4263 newisec->initialized = 1;
4268 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4271 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4274 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4275 int size, int flags)
4277 return sock_has_perm(current, sock->sk, SOCKET__READ);
4280 static int selinux_socket_getsockname(struct socket *sock)
4282 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4285 static int selinux_socket_getpeername(struct socket *sock)
4287 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4290 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4294 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4298 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4301 static int selinux_socket_getsockopt(struct socket *sock, int level,
4304 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4307 static int selinux_socket_shutdown(struct socket *sock, int how)
4309 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4312 static int selinux_socket_unix_stream_connect(struct sock *sock,
4316 struct sk_security_struct *sksec_sock = sock->sk_security;
4317 struct sk_security_struct *sksec_other = other->sk_security;
4318 struct sk_security_struct *sksec_new = newsk->sk_security;
4319 struct common_audit_data ad;
4320 struct lsm_network_audit net = {0,};
4323 ad.type = LSM_AUDIT_DATA_NET;
4325 ad.u.net->sk = other;
4327 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4328 sksec_other->sclass,
4329 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4333 /* server child socket */
4334 sksec_new->peer_sid = sksec_sock->sid;
4335 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4340 /* connecting socket */
4341 sksec_sock->peer_sid = sksec_new->sid;
4346 static int selinux_socket_unix_may_send(struct socket *sock,
4347 struct socket *other)
4349 struct sk_security_struct *ssec = sock->sk->sk_security;
4350 struct sk_security_struct *osec = other->sk->sk_security;
4351 struct common_audit_data ad;
4352 struct lsm_network_audit net = {0,};
4354 ad.type = LSM_AUDIT_DATA_NET;
4356 ad.u.net->sk = other->sk;
4358 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4362 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4363 char *addrp, u16 family, u32 peer_sid,
4364 struct common_audit_data *ad)
4370 err = sel_netif_sid(ns, ifindex, &if_sid);
4373 err = avc_has_perm(peer_sid, if_sid,
4374 SECCLASS_NETIF, NETIF__INGRESS, ad);
4378 err = sel_netnode_sid(addrp, family, &node_sid);
4381 return avc_has_perm(peer_sid, node_sid,
4382 SECCLASS_NODE, NODE__RECVFROM, ad);
4385 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4389 struct sk_security_struct *sksec = sk->sk_security;
4390 u32 sk_sid = sksec->sid;
4391 struct common_audit_data ad;
4392 struct lsm_network_audit net = {0,};
4395 ad.type = LSM_AUDIT_DATA_NET;
4397 ad.u.net->netif = skb->skb_iif;
4398 ad.u.net->family = family;
4399 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4403 if (selinux_secmark_enabled()) {
4404 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4410 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4413 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4418 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4421 struct sk_security_struct *sksec = sk->sk_security;
4422 u16 family = sk->sk_family;
4423 u32 sk_sid = sksec->sid;
4424 struct common_audit_data ad;
4425 struct lsm_network_audit net = {0,};
4430 if (family != PF_INET && family != PF_INET6)
4433 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4434 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4437 /* If any sort of compatibility mode is enabled then handoff processing
4438 * to the selinux_sock_rcv_skb_compat() function to deal with the
4439 * special handling. We do this in an attempt to keep this function
4440 * as fast and as clean as possible. */
4441 if (!selinux_policycap_netpeer)
4442 return selinux_sock_rcv_skb_compat(sk, skb, family);
4444 secmark_active = selinux_secmark_enabled();
4445 peerlbl_active = selinux_peerlbl_enabled();
4446 if (!secmark_active && !peerlbl_active)
4449 ad.type = LSM_AUDIT_DATA_NET;
4451 ad.u.net->netif = skb->skb_iif;
4452 ad.u.net->family = family;
4453 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4457 if (peerlbl_active) {
4460 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4463 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4464 addrp, family, peer_sid, &ad);
4466 selinux_netlbl_err(skb, err, 0);
4469 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4472 selinux_netlbl_err(skb, err, 0);
4477 if (secmark_active) {
4478 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4487 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4488 int __user *optlen, unsigned len)
4493 struct sk_security_struct *sksec = sock->sk->sk_security;
4494 u32 peer_sid = SECSID_NULL;
4496 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4497 sksec->sclass == SECCLASS_TCP_SOCKET)
4498 peer_sid = sksec->peer_sid;
4499 if (peer_sid == SECSID_NULL)
4500 return -ENOPROTOOPT;
4502 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4506 if (scontext_len > len) {
4511 if (copy_to_user(optval, scontext, scontext_len))
4515 if (put_user(scontext_len, optlen))
4521 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4523 u32 peer_secid = SECSID_NULL;
4526 if (skb && skb->protocol == htons(ETH_P_IP))
4528 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4531 family = sock->sk->sk_family;
4535 if (sock && family == PF_UNIX)
4536 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4538 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4541 *secid = peer_secid;
4542 if (peer_secid == SECSID_NULL)
4547 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4549 struct sk_security_struct *sksec;
4551 sksec = kzalloc(sizeof(*sksec), priority);
4555 sksec->peer_sid = SECINITSID_UNLABELED;
4556 sksec->sid = SECINITSID_UNLABELED;
4557 selinux_netlbl_sk_security_reset(sksec);
4558 sk->sk_security = sksec;
4563 static void selinux_sk_free_security(struct sock *sk)
4565 struct sk_security_struct *sksec = sk->sk_security;
4567 sk->sk_security = NULL;
4568 selinux_netlbl_sk_security_free(sksec);
4572 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4574 struct sk_security_struct *sksec = sk->sk_security;
4575 struct sk_security_struct *newsksec = newsk->sk_security;
4577 newsksec->sid = sksec->sid;
4578 newsksec->peer_sid = sksec->peer_sid;
4579 newsksec->sclass = sksec->sclass;
4581 selinux_netlbl_sk_security_reset(newsksec);
4584 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4587 *secid = SECINITSID_ANY_SOCKET;
4589 struct sk_security_struct *sksec = sk->sk_security;
4591 *secid = sksec->sid;
4595 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4597 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4598 struct sk_security_struct *sksec = sk->sk_security;
4600 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4601 sk->sk_family == PF_UNIX)
4602 isec->sid = sksec->sid;
4603 sksec->sclass = isec->sclass;
4606 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4607 struct request_sock *req)
4609 struct sk_security_struct *sksec = sk->sk_security;
4611 u16 family = req->rsk_ops->family;
4615 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4618 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4621 req->secid = connsid;
4622 req->peer_secid = peersid;
4624 return selinux_netlbl_inet_conn_request(req, family);
4627 static void selinux_inet_csk_clone(struct sock *newsk,
4628 const struct request_sock *req)
4630 struct sk_security_struct *newsksec = newsk->sk_security;
4632 newsksec->sid = req->secid;
4633 newsksec->peer_sid = req->peer_secid;
4634 /* NOTE: Ideally, we should also get the isec->sid for the
4635 new socket in sync, but we don't have the isec available yet.
4636 So we will wait until sock_graft to do it, by which
4637 time it will have been created and available. */
4639 /* We don't need to take any sort of lock here as we are the only
4640 * thread with access to newsksec */
4641 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4644 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4646 u16 family = sk->sk_family;
4647 struct sk_security_struct *sksec = sk->sk_security;
4649 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4650 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4653 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4656 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4658 skb_set_owner_w(skb, sk);
4661 static int selinux_secmark_relabel_packet(u32 sid)
4663 const struct task_security_struct *__tsec;
4666 __tsec = current_security();
4669 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4672 static void selinux_secmark_refcount_inc(void)
4674 atomic_inc(&selinux_secmark_refcount);
4677 static void selinux_secmark_refcount_dec(void)
4679 atomic_dec(&selinux_secmark_refcount);
4682 static void selinux_req_classify_flow(const struct request_sock *req,
4685 fl->flowi_secid = req->secid;
4688 static int selinux_tun_dev_alloc_security(void **security)
4690 struct tun_security_struct *tunsec;
4692 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4695 tunsec->sid = current_sid();
4701 static void selinux_tun_dev_free_security(void *security)
4706 static int selinux_tun_dev_create(void)
4708 u32 sid = current_sid();
4710 /* we aren't taking into account the "sockcreate" SID since the socket
4711 * that is being created here is not a socket in the traditional sense,
4712 * instead it is a private sock, accessible only to the kernel, and
4713 * representing a wide range of network traffic spanning multiple
4714 * connections unlike traditional sockets - check the TUN driver to
4715 * get a better understanding of why this socket is special */
4717 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4721 static int selinux_tun_dev_attach_queue(void *security)
4723 struct tun_security_struct *tunsec = security;
4725 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4726 TUN_SOCKET__ATTACH_QUEUE, NULL);
4729 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4731 struct tun_security_struct *tunsec = security;
4732 struct sk_security_struct *sksec = sk->sk_security;
4734 /* we don't currently perform any NetLabel based labeling here and it
4735 * isn't clear that we would want to do so anyway; while we could apply
4736 * labeling without the support of the TUN user the resulting labeled
4737 * traffic from the other end of the connection would almost certainly
4738 * cause confusion to the TUN user that had no idea network labeling
4739 * protocols were being used */
4741 sksec->sid = tunsec->sid;
4742 sksec->sclass = SECCLASS_TUN_SOCKET;
4747 static int selinux_tun_dev_open(void *security)
4749 struct tun_security_struct *tunsec = security;
4750 u32 sid = current_sid();
4753 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4754 TUN_SOCKET__RELABELFROM, NULL);
4757 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4758 TUN_SOCKET__RELABELTO, NULL);
4766 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4770 struct nlmsghdr *nlh;
4771 struct sk_security_struct *sksec = sk->sk_security;
4773 if (skb->len < NLMSG_HDRLEN) {
4777 nlh = nlmsg_hdr(skb);
4779 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4781 if (err == -EINVAL) {
4783 "SELinux: unrecognized netlink message:"
4784 " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
4785 sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4786 if (!selinux_enforcing || security_get_allow_unknown())
4796 err = sock_has_perm(current, sk, perm);
4801 #ifdef CONFIG_NETFILTER
4803 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4804 const struct net_device *indev,
4810 struct common_audit_data ad;
4811 struct lsm_network_audit net = {0,};
4816 if (!selinux_policycap_netpeer)
4819 secmark_active = selinux_secmark_enabled();
4820 netlbl_active = netlbl_enabled();
4821 peerlbl_active = selinux_peerlbl_enabled();
4822 if (!secmark_active && !peerlbl_active)
4825 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4828 ad.type = LSM_AUDIT_DATA_NET;
4830 ad.u.net->netif = indev->ifindex;
4831 ad.u.net->family = family;
4832 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4835 if (peerlbl_active) {
4836 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4837 addrp, family, peer_sid, &ad);
4839 selinux_netlbl_err(skb, err, 1);
4845 if (avc_has_perm(peer_sid, skb->secmark,
4846 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4850 /* we do this in the FORWARD path and not the POST_ROUTING
4851 * path because we want to make sure we apply the necessary
4852 * labeling before IPsec is applied so we can leverage AH
4854 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4860 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4861 struct sk_buff *skb,
4862 const struct net_device *in,
4863 const struct net_device *out,
4864 int (*okfn)(struct sk_buff *))
4866 return selinux_ip_forward(skb, in, PF_INET);
4869 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4870 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4871 struct sk_buff *skb,
4872 const struct net_device *in,
4873 const struct net_device *out,
4874 int (*okfn)(struct sk_buff *))
4876 return selinux_ip_forward(skb, in, PF_INET6);
4880 static unsigned int selinux_ip_output(struct sk_buff *skb,
4886 if (!netlbl_enabled())
4889 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4890 * because we want to make sure we apply the necessary labeling
4891 * before IPsec is applied so we can leverage AH protection */
4894 struct sk_security_struct *sksec;
4896 if (sk->sk_state == TCP_LISTEN)
4897 /* if the socket is the listening state then this
4898 * packet is a SYN-ACK packet which means it needs to
4899 * be labeled based on the connection/request_sock and
4900 * not the parent socket. unfortunately, we can't
4901 * lookup the request_sock yet as it isn't queued on
4902 * the parent socket until after the SYN-ACK is sent.
4903 * the "solution" is to simply pass the packet as-is
4904 * as any IP option based labeling should be copied
4905 * from the initial connection request (in the IP
4906 * layer). it is far from ideal, but until we get a
4907 * security label in the packet itself this is the
4908 * best we can do. */
4911 /* standard practice, label using the parent socket */
4912 sksec = sk->sk_security;
4915 sid = SECINITSID_KERNEL;
4916 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4922 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4923 struct sk_buff *skb,
4924 const struct net_device *in,
4925 const struct net_device *out,
4926 int (*okfn)(struct sk_buff *))
4928 return selinux_ip_output(skb, PF_INET);
4931 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4935 struct sock *sk = skb->sk;
4936 struct sk_security_struct *sksec;
4937 struct common_audit_data ad;
4938 struct lsm_network_audit net = {0,};
4944 sksec = sk->sk_security;
4946 ad.type = LSM_AUDIT_DATA_NET;
4948 ad.u.net->netif = ifindex;
4949 ad.u.net->family = family;
4950 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4953 if (selinux_secmark_enabled())
4954 if (avc_has_perm(sksec->sid, skb->secmark,
4955 SECCLASS_PACKET, PACKET__SEND, &ad))
4956 return NF_DROP_ERR(-ECONNREFUSED);
4958 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4959 return NF_DROP_ERR(-ECONNREFUSED);
4964 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4965 const struct net_device *outdev,
4970 int ifindex = outdev->ifindex;
4972 struct common_audit_data ad;
4973 struct lsm_network_audit net = {0,};
4978 /* If any sort of compatibility mode is enabled then handoff processing
4979 * to the selinux_ip_postroute_compat() function to deal with the
4980 * special handling. We do this in an attempt to keep this function
4981 * as fast and as clean as possible. */
4982 if (!selinux_policycap_netpeer)
4983 return selinux_ip_postroute_compat(skb, ifindex, family);
4985 secmark_active = selinux_secmark_enabled();
4986 peerlbl_active = selinux_peerlbl_enabled();
4987 if (!secmark_active && !peerlbl_active)
4993 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4994 * packet transformation so allow the packet to pass without any checks
4995 * since we'll have another chance to perform access control checks
4996 * when the packet is on it's final way out.
4997 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4998 * is NULL, in this case go ahead and apply access control.
4999 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5000 * TCP listening state we cannot wait until the XFRM processing
5001 * is done as we will miss out on the SA label if we do;
5002 * unfortunately, this means more work, but it is only once per
5004 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5005 !(sk != NULL && sk->sk_state == TCP_LISTEN))
5010 /* Without an associated socket the packet is either coming
5011 * from the kernel or it is being forwarded; check the packet
5012 * to determine which and if the packet is being forwarded
5013 * query the packet directly to determine the security label. */
5015 secmark_perm = PACKET__FORWARD_OUT;
5016 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5019 secmark_perm = PACKET__SEND;
5020 peer_sid = SECINITSID_KERNEL;
5022 } else if (sk->sk_state == TCP_LISTEN) {
5023 /* Locally generated packet but the associated socket is in the
5024 * listening state which means this is a SYN-ACK packet. In
5025 * this particular case the correct security label is assigned
5026 * to the connection/request_sock but unfortunately we can't
5027 * query the request_sock as it isn't queued on the parent
5028 * socket until after the SYN-ACK packet is sent; the only
5029 * viable choice is to regenerate the label like we do in
5030 * selinux_inet_conn_request(). See also selinux_ip_output()
5031 * for similar problems. */
5033 struct sk_security_struct *sksec = sk->sk_security;
5034 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5036 /* At this point, if the returned skb peerlbl is SECSID_NULL
5037 * and the packet has been through at least one XFRM
5038 * transformation then we must be dealing with the "final"
5039 * form of labeled IPsec packet; since we've already applied
5040 * all of our access controls on this packet we can safely
5041 * pass the packet. */
5042 if (skb_sid == SECSID_NULL) {
5045 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5049 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5053 return NF_DROP_ERR(-ECONNREFUSED);
5056 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5058 secmark_perm = PACKET__SEND;
5060 /* Locally generated packet, fetch the security label from the
5061 * associated socket. */
5062 struct sk_security_struct *sksec = sk->sk_security;
5063 peer_sid = sksec->sid;
5064 secmark_perm = PACKET__SEND;
5067 ad.type = LSM_AUDIT_DATA_NET;
5069 ad.u.net->netif = ifindex;
5070 ad.u.net->family = family;
5071 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5075 if (avc_has_perm(peer_sid, skb->secmark,
5076 SECCLASS_PACKET, secmark_perm, &ad))
5077 return NF_DROP_ERR(-ECONNREFUSED);
5079 if (peerlbl_active) {
5083 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5085 if (avc_has_perm(peer_sid, if_sid,
5086 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5087 return NF_DROP_ERR(-ECONNREFUSED);
5089 if (sel_netnode_sid(addrp, family, &node_sid))
5091 if (avc_has_perm(peer_sid, node_sid,
5092 SECCLASS_NODE, NODE__SENDTO, &ad))
5093 return NF_DROP_ERR(-ECONNREFUSED);
5099 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5100 struct sk_buff *skb,
5101 const struct net_device *in,
5102 const struct net_device *out,
5103 int (*okfn)(struct sk_buff *))
5105 return selinux_ip_postroute(skb, out, PF_INET);
5108 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5109 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5110 struct sk_buff *skb,
5111 const struct net_device *in,
5112 const struct net_device *out,
5113 int (*okfn)(struct sk_buff *))
5115 return selinux_ip_postroute(skb, out, PF_INET6);
5119 #endif /* CONFIG_NETFILTER */
5121 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5125 err = cap_netlink_send(sk, skb);
5129 return selinux_nlmsg_perm(sk, skb);
5132 static int ipc_alloc_security(struct task_struct *task,
5133 struct kern_ipc_perm *perm,
5136 struct ipc_security_struct *isec;
5139 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5143 sid = task_sid(task);
5144 isec->sclass = sclass;
5146 perm->security = isec;
5151 static void ipc_free_security(struct kern_ipc_perm *perm)
5153 struct ipc_security_struct *isec = perm->security;
5154 perm->security = NULL;
5158 static int msg_msg_alloc_security(struct msg_msg *msg)
5160 struct msg_security_struct *msec;
5162 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5166 msec->sid = SECINITSID_UNLABELED;
5167 msg->security = msec;
5172 static void msg_msg_free_security(struct msg_msg *msg)
5174 struct msg_security_struct *msec = msg->security;
5176 msg->security = NULL;
5180 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5183 struct ipc_security_struct *isec;
5184 struct common_audit_data ad;
5185 u32 sid = current_sid();
5187 isec = ipc_perms->security;
5189 ad.type = LSM_AUDIT_DATA_IPC;
5190 ad.u.ipc_id = ipc_perms->key;
5192 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5195 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5197 return msg_msg_alloc_security(msg);
5200 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5202 msg_msg_free_security(msg);
5205 /* message queue security operations */
5206 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5208 struct ipc_security_struct *isec;
5209 struct common_audit_data ad;
5210 u32 sid = current_sid();
5213 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5217 isec = msq->q_perm.security;
5219 ad.type = LSM_AUDIT_DATA_IPC;
5220 ad.u.ipc_id = msq->q_perm.key;
5222 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5225 ipc_free_security(&msq->q_perm);
5231 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5233 ipc_free_security(&msq->q_perm);
5236 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5238 struct ipc_security_struct *isec;
5239 struct common_audit_data ad;
5240 u32 sid = current_sid();
5242 isec = msq->q_perm.security;
5244 ad.type = LSM_AUDIT_DATA_IPC;
5245 ad.u.ipc_id = msq->q_perm.key;
5247 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5248 MSGQ__ASSOCIATE, &ad);
5251 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5259 /* No specific object, just general system-wide information. */
5260 return task_has_system(current, SYSTEM__IPC_INFO);
5263 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5266 perms = MSGQ__SETATTR;
5269 perms = MSGQ__DESTROY;
5275 err = ipc_has_perm(&msq->q_perm, perms);
5279 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5281 struct ipc_security_struct *isec;
5282 struct msg_security_struct *msec;
5283 struct common_audit_data ad;
5284 u32 sid = current_sid();
5287 isec = msq->q_perm.security;
5288 msec = msg->security;
5291 * First time through, need to assign label to the message
5293 if (msec->sid == SECINITSID_UNLABELED) {
5295 * Compute new sid based on current process and
5296 * message queue this message will be stored in
5298 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5304 ad.type = LSM_AUDIT_DATA_IPC;
5305 ad.u.ipc_id = msq->q_perm.key;
5307 /* Can this process write to the queue? */
5308 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5311 /* Can this process send the message */
5312 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5315 /* Can the message be put in the queue? */
5316 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5317 MSGQ__ENQUEUE, &ad);
5322 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5323 struct task_struct *target,
5324 long type, int mode)
5326 struct ipc_security_struct *isec;
5327 struct msg_security_struct *msec;
5328 struct common_audit_data ad;
5329 u32 sid = task_sid(target);
5332 isec = msq->q_perm.security;
5333 msec = msg->security;
5335 ad.type = LSM_AUDIT_DATA_IPC;
5336 ad.u.ipc_id = msq->q_perm.key;
5338 rc = avc_has_perm(sid, isec->sid,
5339 SECCLASS_MSGQ, MSGQ__READ, &ad);
5341 rc = avc_has_perm(sid, msec->sid,
5342 SECCLASS_MSG, MSG__RECEIVE, &ad);
5346 /* Shared Memory security operations */
5347 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5349 struct ipc_security_struct *isec;
5350 struct common_audit_data ad;
5351 u32 sid = current_sid();
5354 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5358 isec = shp->shm_perm.security;
5360 ad.type = LSM_AUDIT_DATA_IPC;
5361 ad.u.ipc_id = shp->shm_perm.key;
5363 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5366 ipc_free_security(&shp->shm_perm);
5372 static void selinux_shm_free_security(struct shmid_kernel *shp)
5374 ipc_free_security(&shp->shm_perm);
5377 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5379 struct ipc_security_struct *isec;
5380 struct common_audit_data ad;
5381 u32 sid = current_sid();
5383 isec = shp->shm_perm.security;
5385 ad.type = LSM_AUDIT_DATA_IPC;
5386 ad.u.ipc_id = shp->shm_perm.key;
5388 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5389 SHM__ASSOCIATE, &ad);
5392 /* Note, at this point, shp is locked down */
5393 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5401 /* No specific object, just general system-wide information. */
5402 return task_has_system(current, SYSTEM__IPC_INFO);
5405 perms = SHM__GETATTR | SHM__ASSOCIATE;
5408 perms = SHM__SETATTR;
5415 perms = SHM__DESTROY;
5421 err = ipc_has_perm(&shp->shm_perm, perms);
5425 static int selinux_shm_shmat(struct shmid_kernel *shp,
5426 char __user *shmaddr, int shmflg)
5430 if (shmflg & SHM_RDONLY)
5433 perms = SHM__READ | SHM__WRITE;
5435 return ipc_has_perm(&shp->shm_perm, perms);
5438 /* Semaphore security operations */
5439 static int selinux_sem_alloc_security(struct sem_array *sma)
5441 struct ipc_security_struct *isec;
5442 struct common_audit_data ad;
5443 u32 sid = current_sid();
5446 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5450 isec = sma->sem_perm.security;
5452 ad.type = LSM_AUDIT_DATA_IPC;
5453 ad.u.ipc_id = sma->sem_perm.key;
5455 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5458 ipc_free_security(&sma->sem_perm);
5464 static void selinux_sem_free_security(struct sem_array *sma)
5466 ipc_free_security(&sma->sem_perm);
5469 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5471 struct ipc_security_struct *isec;
5472 struct common_audit_data ad;
5473 u32 sid = current_sid();
5475 isec = sma->sem_perm.security;
5477 ad.type = LSM_AUDIT_DATA_IPC;
5478 ad.u.ipc_id = sma->sem_perm.key;
5480 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5481 SEM__ASSOCIATE, &ad);
5484 /* Note, at this point, sma is locked down */
5485 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5493 /* No specific object, just general system-wide information. */
5494 return task_has_system(current, SYSTEM__IPC_INFO);
5498 perms = SEM__GETATTR;
5509 perms = SEM__DESTROY;
5512 perms = SEM__SETATTR;
5516 perms = SEM__GETATTR | SEM__ASSOCIATE;
5522 err = ipc_has_perm(&sma->sem_perm, perms);
5526 static int selinux_sem_semop(struct sem_array *sma,
5527 struct sembuf *sops, unsigned nsops, int alter)
5532 perms = SEM__READ | SEM__WRITE;
5536 return ipc_has_perm(&sma->sem_perm, perms);
5539 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5545 av |= IPC__UNIX_READ;
5547 av |= IPC__UNIX_WRITE;
5552 return ipc_has_perm(ipcp, av);
5555 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5557 struct ipc_security_struct *isec = ipcp->security;
5561 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5564 inode_doinit_with_dentry(inode, dentry);
5567 static int selinux_getprocattr(struct task_struct *p,
5568 char *name, char **value)
5570 const struct task_security_struct *__tsec;
5576 error = current_has_perm(p, PROCESS__GETATTR);
5582 __tsec = __task_cred(p)->security;
5584 if (!strcmp(name, "current"))
5586 else if (!strcmp(name, "prev"))
5588 else if (!strcmp(name, "exec"))
5589 sid = __tsec->exec_sid;
5590 else if (!strcmp(name, "fscreate"))
5591 sid = __tsec->create_sid;
5592 else if (!strcmp(name, "keycreate"))
5593 sid = __tsec->keycreate_sid;
5594 else if (!strcmp(name, "sockcreate"))
5595 sid = __tsec->sockcreate_sid;
5603 error = security_sid_to_context(sid, value, &len);
5613 static int selinux_setprocattr(struct task_struct *p,
5614 char *name, void *value, size_t size)
5616 struct task_security_struct *tsec;
5617 struct task_struct *tracer;
5624 /* SELinux only allows a process to change its own
5625 security attributes. */
5630 * Basic control over ability to set these attributes at all.
5631 * current == p, but we'll pass them separately in case the
5632 * above restriction is ever removed.
5634 if (!strcmp(name, "exec"))
5635 error = current_has_perm(p, PROCESS__SETEXEC);
5636 else if (!strcmp(name, "fscreate"))
5637 error = current_has_perm(p, PROCESS__SETFSCREATE);
5638 else if (!strcmp(name, "keycreate"))
5639 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5640 else if (!strcmp(name, "sockcreate"))
5641 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5642 else if (!strcmp(name, "current"))
5643 error = current_has_perm(p, PROCESS__SETCURRENT);
5649 /* Obtain a SID for the context, if one was specified. */
5650 if (size && str[1] && str[1] != '\n') {
5651 if (str[size-1] == '\n') {
5655 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5656 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5657 if (!capable(CAP_MAC_ADMIN)) {
5658 struct audit_buffer *ab;
5661 /* We strip a nul only if it is at the end, otherwise the
5662 * context contains a nul and we should audit that */
5663 if (str[size - 1] == '\0')
5664 audit_size = size - 1;
5667 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5668 audit_log_format(ab, "op=fscreate invalid_context=");
5669 audit_log_n_untrustedstring(ab, value, audit_size);
5674 error = security_context_to_sid_force(value, size,
5681 new = prepare_creds();
5685 /* Permission checking based on the specified context is
5686 performed during the actual operation (execve,
5687 open/mkdir/...), when we know the full context of the
5688 operation. See selinux_bprm_set_creds for the execve
5689 checks and may_create for the file creation checks. The
5690 operation will then fail if the context is not permitted. */
5691 tsec = new->security;
5692 if (!strcmp(name, "exec")) {
5693 tsec->exec_sid = sid;
5694 } else if (!strcmp(name, "fscreate")) {
5695 tsec->create_sid = sid;
5696 } else if (!strcmp(name, "keycreate")) {
5697 error = may_create_key(sid, p);
5700 tsec->keycreate_sid = sid;
5701 } else if (!strcmp(name, "sockcreate")) {
5702 tsec->sockcreate_sid = sid;
5703 } else if (!strcmp(name, "current")) {
5708 /* Only allow single threaded processes to change context */
5710 if (!current_is_single_threaded()) {
5711 error = security_bounded_transition(tsec->sid, sid);
5716 /* Check permissions for the transition. */
5717 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5718 PROCESS__DYNTRANSITION, NULL);
5722 /* Check for ptracing, and update the task SID if ok.
5723 Otherwise, leave SID unchanged and fail. */
5726 tracer = ptrace_parent(p);
5728 ptsid = task_sid(tracer);
5732 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5733 PROCESS__PTRACE, NULL);
5752 static int selinux_ismaclabel(const char *name)
5754 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5757 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5759 return security_sid_to_context(secid, secdata, seclen);
5762 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5764 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5767 static void selinux_release_secctx(char *secdata, u32 seclen)
5773 * called with inode->i_mutex locked
5775 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5777 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5781 * called with inode->i_mutex locked
5783 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5785 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5788 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5791 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5800 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5801 unsigned long flags)
5803 const struct task_security_struct *tsec;
5804 struct key_security_struct *ksec;
5806 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5810 tsec = cred->security;
5811 if (tsec->keycreate_sid)
5812 ksec->sid = tsec->keycreate_sid;
5814 ksec->sid = tsec->sid;
5820 static void selinux_key_free(struct key *k)
5822 struct key_security_struct *ksec = k->security;
5828 static int selinux_key_permission(key_ref_t key_ref,
5829 const struct cred *cred,
5833 struct key_security_struct *ksec;
5836 /* if no specific permissions are requested, we skip the
5837 permission check. No serious, additional covert channels
5838 appear to be created. */
5842 sid = cred_sid(cred);
5844 key = key_ref_to_ptr(key_ref);
5845 ksec = key->security;
5847 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5850 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5852 struct key_security_struct *ksec = key->security;
5853 char *context = NULL;
5857 rc = security_sid_to_context(ksec->sid, &context, &len);
5866 static struct security_operations selinux_ops = {
5869 .binder_set_context_mgr = selinux_binder_set_context_mgr,
5870 .binder_transaction = selinux_binder_transaction,
5871 .binder_transfer_binder = selinux_binder_transfer_binder,
5872 .binder_transfer_file = selinux_binder_transfer_file,
5874 .ptrace_access_check = selinux_ptrace_access_check,
5875 .ptrace_traceme = selinux_ptrace_traceme,
5876 .capget = selinux_capget,
5877 .capset = selinux_capset,
5878 .capable = selinux_capable,
5879 .quotactl = selinux_quotactl,
5880 .quota_on = selinux_quota_on,
5881 .syslog = selinux_syslog,
5882 .vm_enough_memory = selinux_vm_enough_memory,
5884 .netlink_send = selinux_netlink_send,
5886 .bprm_set_creds = selinux_bprm_set_creds,
5887 .bprm_committing_creds = selinux_bprm_committing_creds,
5888 .bprm_committed_creds = selinux_bprm_committed_creds,
5889 .bprm_secureexec = selinux_bprm_secureexec,
5891 .sb_alloc_security = selinux_sb_alloc_security,
5892 .sb_free_security = selinux_sb_free_security,
5893 .sb_copy_data = selinux_sb_copy_data,
5894 .sb_remount = selinux_sb_remount,
5895 .sb_kern_mount = selinux_sb_kern_mount,
5896 .sb_show_options = selinux_sb_show_options,
5897 .sb_statfs = selinux_sb_statfs,
5898 .sb_mount = selinux_mount,
5899 .sb_umount = selinux_umount,
5900 .sb_set_mnt_opts = selinux_set_mnt_opts,
5901 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5902 .sb_parse_opts_str = selinux_parse_opts_str,
5904 .dentry_init_security = selinux_dentry_init_security,
5906 .inode_alloc_security = selinux_inode_alloc_security,
5907 .inode_free_security = selinux_inode_free_security,
5908 .inode_init_security = selinux_inode_init_security,
5909 .inode_create = selinux_inode_create,
5910 .inode_link = selinux_inode_link,
5911 .inode_unlink = selinux_inode_unlink,
5912 .inode_symlink = selinux_inode_symlink,
5913 .inode_mkdir = selinux_inode_mkdir,
5914 .inode_rmdir = selinux_inode_rmdir,
5915 .inode_mknod = selinux_inode_mknod,
5916 .inode_rename = selinux_inode_rename,
5917 .inode_readlink = selinux_inode_readlink,
5918 .inode_follow_link = selinux_inode_follow_link,
5919 .inode_permission = selinux_inode_permission,
5920 .inode_setattr = selinux_inode_setattr,
5921 .inode_getattr = selinux_inode_getattr,
5922 .inode_setxattr = selinux_inode_setxattr,
5923 .inode_post_setxattr = selinux_inode_post_setxattr,
5924 .inode_getxattr = selinux_inode_getxattr,
5925 .inode_listxattr = selinux_inode_listxattr,
5926 .inode_removexattr = selinux_inode_removexattr,
5927 .inode_getsecurity = selinux_inode_getsecurity,
5928 .inode_setsecurity = selinux_inode_setsecurity,
5929 .inode_listsecurity = selinux_inode_listsecurity,
5930 .inode_getsecid = selinux_inode_getsecid,
5932 .file_permission = selinux_file_permission,
5933 .file_alloc_security = selinux_file_alloc_security,
5934 .file_free_security = selinux_file_free_security,
5935 .file_ioctl = selinux_file_ioctl,
5936 .mmap_file = selinux_mmap_file,
5937 .mmap_addr = selinux_mmap_addr,
5938 .file_mprotect = selinux_file_mprotect,
5939 .file_lock = selinux_file_lock,
5940 .file_fcntl = selinux_file_fcntl,
5941 .file_set_fowner = selinux_file_set_fowner,
5942 .file_send_sigiotask = selinux_file_send_sigiotask,
5943 .file_receive = selinux_file_receive,
5945 .file_open = selinux_file_open,
5947 .task_create = selinux_task_create,
5948 .cred_alloc_blank = selinux_cred_alloc_blank,
5949 .cred_free = selinux_cred_free,
5950 .cred_prepare = selinux_cred_prepare,
5951 .cred_transfer = selinux_cred_transfer,
5952 .kernel_act_as = selinux_kernel_act_as,
5953 .kernel_create_files_as = selinux_kernel_create_files_as,
5954 .kernel_module_request = selinux_kernel_module_request,
5955 .task_setpgid = selinux_task_setpgid,
5956 .task_getpgid = selinux_task_getpgid,
5957 .task_getsid = selinux_task_getsid,
5958 .task_getsecid = selinux_task_getsecid,
5959 .task_setnice = selinux_task_setnice,
5960 .task_setioprio = selinux_task_setioprio,
5961 .task_getioprio = selinux_task_getioprio,
5962 .task_setrlimit = selinux_task_setrlimit,
5963 .task_setscheduler = selinux_task_setscheduler,
5964 .task_getscheduler = selinux_task_getscheduler,
5965 .task_movememory = selinux_task_movememory,
5966 .task_kill = selinux_task_kill,
5967 .task_wait = selinux_task_wait,
5968 .task_to_inode = selinux_task_to_inode,
5970 .ipc_permission = selinux_ipc_permission,
5971 .ipc_getsecid = selinux_ipc_getsecid,
5973 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5974 .msg_msg_free_security = selinux_msg_msg_free_security,
5976 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5977 .msg_queue_free_security = selinux_msg_queue_free_security,
5978 .msg_queue_associate = selinux_msg_queue_associate,
5979 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5980 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5981 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5983 .shm_alloc_security = selinux_shm_alloc_security,
5984 .shm_free_security = selinux_shm_free_security,
5985 .shm_associate = selinux_shm_associate,
5986 .shm_shmctl = selinux_shm_shmctl,
5987 .shm_shmat = selinux_shm_shmat,
5989 .sem_alloc_security = selinux_sem_alloc_security,
5990 .sem_free_security = selinux_sem_free_security,
5991 .sem_associate = selinux_sem_associate,
5992 .sem_semctl = selinux_sem_semctl,
5993 .sem_semop = selinux_sem_semop,
5995 .d_instantiate = selinux_d_instantiate,
5997 .getprocattr = selinux_getprocattr,
5998 .setprocattr = selinux_setprocattr,
6000 .ismaclabel = selinux_ismaclabel,
6001 .secid_to_secctx = selinux_secid_to_secctx,
6002 .secctx_to_secid = selinux_secctx_to_secid,
6003 .release_secctx = selinux_release_secctx,
6004 .inode_notifysecctx = selinux_inode_notifysecctx,
6005 .inode_setsecctx = selinux_inode_setsecctx,
6006 .inode_getsecctx = selinux_inode_getsecctx,
6008 .unix_stream_connect = selinux_socket_unix_stream_connect,
6009 .unix_may_send = selinux_socket_unix_may_send,
6011 .socket_create = selinux_socket_create,
6012 .socket_post_create = selinux_socket_post_create,
6013 .socket_bind = selinux_socket_bind,
6014 .socket_connect = selinux_socket_connect,
6015 .socket_listen = selinux_socket_listen,
6016 .socket_accept = selinux_socket_accept,
6017 .socket_sendmsg = selinux_socket_sendmsg,
6018 .socket_recvmsg = selinux_socket_recvmsg,
6019 .socket_getsockname = selinux_socket_getsockname,
6020 .socket_getpeername = selinux_socket_getpeername,
6021 .socket_getsockopt = selinux_socket_getsockopt,
6022 .socket_setsockopt = selinux_socket_setsockopt,
6023 .socket_shutdown = selinux_socket_shutdown,
6024 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
6025 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
6026 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
6027 .sk_alloc_security = selinux_sk_alloc_security,
6028 .sk_free_security = selinux_sk_free_security,
6029 .sk_clone_security = selinux_sk_clone_security,
6030 .sk_getsecid = selinux_sk_getsecid,
6031 .sock_graft = selinux_sock_graft,
6032 .inet_conn_request = selinux_inet_conn_request,
6033 .inet_csk_clone = selinux_inet_csk_clone,
6034 .inet_conn_established = selinux_inet_conn_established,
6035 .secmark_relabel_packet = selinux_secmark_relabel_packet,
6036 .secmark_refcount_inc = selinux_secmark_refcount_inc,
6037 .secmark_refcount_dec = selinux_secmark_refcount_dec,
6038 .req_classify_flow = selinux_req_classify_flow,
6039 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
6040 .tun_dev_free_security = selinux_tun_dev_free_security,
6041 .tun_dev_create = selinux_tun_dev_create,
6042 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
6043 .tun_dev_attach = selinux_tun_dev_attach,
6044 .tun_dev_open = selinux_tun_dev_open,
6045 .skb_owned_by = selinux_skb_owned_by,
6047 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6048 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
6049 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
6050 .xfrm_policy_free_security = selinux_xfrm_policy_free,
6051 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
6052 .xfrm_state_alloc = selinux_xfrm_state_alloc,
6053 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
6054 .xfrm_state_free_security = selinux_xfrm_state_free,
6055 .xfrm_state_delete_security = selinux_xfrm_state_delete,
6056 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
6057 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
6058 .xfrm_decode_session = selinux_xfrm_decode_session,
6062 .key_alloc = selinux_key_alloc,
6063 .key_free = selinux_key_free,
6064 .key_permission = selinux_key_permission,
6065 .key_getsecurity = selinux_key_getsecurity,
6069 .audit_rule_init = selinux_audit_rule_init,
6070 .audit_rule_known = selinux_audit_rule_known,
6071 .audit_rule_match = selinux_audit_rule_match,
6072 .audit_rule_free = selinux_audit_rule_free,
6076 static __init int selinux_init(void)
6078 if (!security_module_enable(&selinux_ops)) {
6079 selinux_enabled = 0;
6083 if (!selinux_enabled) {
6084 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6088 printk(KERN_INFO "SELinux: Initializing.\n");
6090 /* Set the security state for the initial task. */
6091 cred_init_security();
6093 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6095 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6096 sizeof(struct inode_security_struct),
6097 0, SLAB_PANIC, NULL);
6100 if (register_security(&selinux_ops))
6101 panic("SELinux: Unable to register with kernel.\n");
6103 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6104 panic("SELinux: Unable to register AVC netcache callback\n");
6106 if (selinux_enforcing)
6107 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6109 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6114 static void delayed_superblock_init(struct super_block *sb, void *unused)
6116 superblock_doinit(sb, NULL);
6119 void selinux_complete_init(void)
6121 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6123 /* Set up any superblocks initialized prior to the policy load. */
6124 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6125 iterate_supers(delayed_superblock_init, NULL);
6128 /* SELinux requires early initialization in order to label
6129 all processes and objects when they are created. */
6130 security_initcall(selinux_init);
6132 #if defined(CONFIG_NETFILTER)
6134 static struct nf_hook_ops selinux_nf_ops[] = {
6136 .hook = selinux_ipv4_postroute,
6137 .owner = THIS_MODULE,
6139 .hooknum = NF_INET_POST_ROUTING,
6140 .priority = NF_IP_PRI_SELINUX_LAST,
6143 .hook = selinux_ipv4_forward,
6144 .owner = THIS_MODULE,
6146 .hooknum = NF_INET_FORWARD,
6147 .priority = NF_IP_PRI_SELINUX_FIRST,
6150 .hook = selinux_ipv4_output,
6151 .owner = THIS_MODULE,
6153 .hooknum = NF_INET_LOCAL_OUT,
6154 .priority = NF_IP_PRI_SELINUX_FIRST,
6156 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6158 .hook = selinux_ipv6_postroute,
6159 .owner = THIS_MODULE,
6161 .hooknum = NF_INET_POST_ROUTING,
6162 .priority = NF_IP6_PRI_SELINUX_LAST,
6165 .hook = selinux_ipv6_forward,
6166 .owner = THIS_MODULE,
6168 .hooknum = NF_INET_FORWARD,
6169 .priority = NF_IP6_PRI_SELINUX_FIRST,
6174 static int __init selinux_nf_ip_init(void)
6178 if (!selinux_enabled)
6181 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6183 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6185 panic("SELinux: nf_register_hooks: error %d\n", err);
6190 __initcall(selinux_nf_ip_init);
6192 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6193 static void selinux_nf_ip_exit(void)
6195 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6197 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6201 #else /* CONFIG_NETFILTER */
6203 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6204 #define selinux_nf_ip_exit()
6207 #endif /* CONFIG_NETFILTER */
6209 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6210 static int selinux_disabled;
6212 int selinux_disable(void)
6214 if (ss_initialized) {
6215 /* Not permitted after initial policy load. */
6219 if (selinux_disabled) {
6220 /* Only do this once. */
6224 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6226 selinux_disabled = 1;
6227 selinux_enabled = 0;
6229 reset_security_ops();
6231 /* Try to destroy the avc node cache */
6234 /* Unregister netfilter hooks. */
6235 selinux_nf_ip_exit();
6237 /* Unregister selinuxfs. */