1 /* 2 * NSA Security-Enhanced Linux (SELinux) security module 3 * 4 * This file contains the SELinux hook function implementations. 5 * 6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil> 7 * Chris Vance, <cvance@nai.com> 8 * Wayne Salamon, <wsalamon@nai.com> 9 * James Morris <jmorris@redhat.com> 10 * 11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com> 13 * Eric Paris <eparis@redhat.com> 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc. 15 * <dgoeddel@trustedcs.com> 16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P. 17 * Paul Moore <paul@paul-moore.com> 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd. 19 * Yuichi Nakamura <ynakam@hitachisoft.jp> 20 * 21 * This program is free software; you can redistribute it and/or modify 22 * it under the terms of the GNU General Public License version 2, 23 * as published by the Free Software Foundation. 24 */ 25 26 #include <linux/init.h> 27 #include <linux/kd.h> 28 #include <linux/kernel.h> 29 #include <linux/tracehook.h> 30 #include <linux/errno.h> 31 #include <linux/sched.h> 32 #include <linux/lsm_hooks.h> 33 #include <linux/xattr.h> 34 #include <linux/capability.h> 35 #include <linux/unistd.h> 36 #include <linux/mm.h> 37 #include <linux/mman.h> 38 #include <linux/slab.h> 39 #include <linux/pagemap.h> 40 #include <linux/proc_fs.h> 41 #include <linux/swap.h> 42 #include <linux/spinlock.h> 43 #include <linux/syscalls.h> 44 #include <linux/dcache.h> 45 #include <linux/file.h> 46 #include <linux/fdtable.h> 47 #include <linux/namei.h> 48 #include <linux/mount.h> 49 #include <linux/netfilter_ipv4.h> 50 #include <linux/netfilter_ipv6.h> 51 #include <linux/tty.h> 52 #include <net/icmp.h> 53 #include <net/ip.h> /* for local_port_range[] */ 54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */ 55 #include <net/inet_connection_sock.h> 56 #include <net/net_namespace.h> 57 #include <net/netlabel.h> 58 #include <linux/uaccess.h> 59 #include <asm/ioctls.h> 60 #include <linux/atomic.h> 61 #include <linux/bitops.h> 62 #include <linux/interrupt.h> 63 #include <linux/netdevice.h> /* for network interface checks */ 64 #include <net/netlink.h> 65 #include <linux/tcp.h> 66 #include <linux/udp.h> 67 #include <linux/dccp.h> 68 #include <linux/quota.h> 69 #include <linux/un.h> /* for Unix socket types */ 70 #include <net/af_unix.h> /* for Unix socket types */ 71 #include <linux/parser.h> 72 #include <linux/nfs_mount.h> 73 #include <net/ipv6.h> 74 #include <linux/hugetlb.h> 75 #include <linux/personality.h> 76 #include <linux/audit.h> 77 #include <linux/string.h> 78 #include <linux/selinux.h> 79 #include <linux/mutex.h> 80 #include <linux/posix-timers.h> 81 #include <linux/syslog.h> 82 #include <linux/user_namespace.h> 83 #include <linux/export.h> 84 #include <linux/msg.h> 85 #include <linux/shm.h> 86 87 #include "avc.h" 88 #include "objsec.h" 89 #include "netif.h" 90 #include "netnode.h" 91 #include "netport.h" 92 #include "xfrm.h" 93 #include "netlabel.h" 94 #include "audit.h" 95 #include "avc_ss.h" 96 97 /* SECMARK reference count */ 98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0); 99 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP 101 int selinux_enforcing; 102 103 static int __init enforcing_setup(char *str) 104 { 105 unsigned long enforcing; 106 if (!kstrtoul(str, 0, &enforcing)) 107 selinux_enforcing = enforcing ? 1 : 0; 108 return 1; 109 } 110 __setup("enforcing=", enforcing_setup); 111 #endif 112 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE; 115 116 static int __init selinux_enabled_setup(char *str) 117 { 118 unsigned long enabled; 119 if (!kstrtoul(str, 0, &enabled)) 120 selinux_enabled = enabled ? 1 : 0; 121 return 1; 122 } 123 __setup("selinux=", selinux_enabled_setup); 124 #else 125 int selinux_enabled = 1; 126 #endif 127 128 static struct kmem_cache *sel_inode_cache; 129 static struct kmem_cache *file_security_cache; 130 131 /** 132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled 133 * 134 * Description: 135 * This function checks the SECMARK reference counter to see if any SECMARK 136 * targets are currently configured, if the reference counter is greater than 137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is 138 * enabled, false (0) if SECMARK is disabled. If the always_check_network 139 * policy capability is enabled, SECMARK is always considered enabled. 140 * 141 */ 142 static int selinux_secmark_enabled(void) 143 { 144 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount)); 145 } 146 147 /** 148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled 149 * 150 * Description: 151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true 152 * (1) if any are enabled or false (0) if neither are enabled. If the 153 * always_check_network policy capability is enabled, peer labeling 154 * is always considered enabled. 155 * 156 */ 157 static int selinux_peerlbl_enabled(void) 158 { 159 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled()); 160 } 161 162 static int selinux_netcache_avc_callback(u32 event) 163 { 164 if (event == AVC_CALLBACK_RESET) { 165 sel_netif_flush(); 166 sel_netnode_flush(); 167 sel_netport_flush(); 168 synchronize_net(); 169 } 170 return 0; 171 } 172 173 /* 174 * initialise the security for the init task 175 */ 176 static void cred_init_security(void) 177 { 178 struct cred *cred = (struct cred *) current->real_cred; 179 struct task_security_struct *tsec; 180 181 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL); 182 if (!tsec) 183 panic("SELinux: Failed to initialize initial task.\n"); 184 185 tsec->osid = tsec->sid = SECINITSID_KERNEL; 186 cred->security = tsec; 187 } 188 189 /* 190 * get the security ID of a set of credentials 191 */ 192 static inline u32 cred_sid(const struct cred *cred) 193 { 194 const struct task_security_struct *tsec; 195 196 tsec = cred->security; 197 return tsec->sid; 198 } 199 200 /* 201 * get the objective security ID of a task 202 */ 203 static inline u32 task_sid(const struct task_struct *task) 204 { 205 u32 sid; 206 207 rcu_read_lock(); 208 sid = cred_sid(__task_cred(task)); 209 rcu_read_unlock(); 210 return sid; 211 } 212 213 /* 214 * get the subjective security ID of the current task 215 */ 216 static inline u32 current_sid(void) 217 { 218 const struct task_security_struct *tsec = current_security(); 219 220 return tsec->sid; 221 } 222 223 /* Allocate and free functions for each kind of security blob. */ 224 225 static int inode_alloc_security(struct inode *inode) 226 { 227 struct inode_security_struct *isec; 228 u32 sid = current_sid(); 229 230 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS); 231 if (!isec) 232 return -ENOMEM; 233 234 mutex_init(&isec->lock); 235 INIT_LIST_HEAD(&isec->list); 236 isec->inode = inode; 237 isec->sid = SECINITSID_UNLABELED; 238 isec->sclass = SECCLASS_FILE; 239 isec->task_sid = sid; 240 inode->i_security = isec; 241 242 return 0; 243 } 244 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry); 246 247 /* 248 * Try reloading inode security labels that have been marked as invalid. The 249 * @may_sleep parameter indicates when sleeping and thus reloading labels is 250 * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is 251 * invalid. The @opt_dentry parameter should be set to a dentry of the inode; 252 * when no dentry is available, set it to NULL instead. 253 */ 254 static int __inode_security_revalidate(struct inode *inode, 255 struct dentry *opt_dentry, 256 bool may_sleep) 257 { 258 struct inode_security_struct *isec = inode->i_security; 259 260 might_sleep_if(may_sleep); 261 262 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) { 263 if (!may_sleep) 264 return -ECHILD; 265 266 /* 267 * Try reloading the inode security label. This will fail if 268 * @opt_dentry is NULL and no dentry for this inode can be 269 * found; in that case, continue using the old label. 270 */ 271 inode_doinit_with_dentry(inode, opt_dentry); 272 } 273 return 0; 274 } 275 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode) 277 { 278 return inode->i_security; 279 } 280 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu) 282 { 283 int error; 284 285 error = __inode_security_revalidate(inode, NULL, !rcu); 286 if (error) 287 return ERR_PTR(error); 288 return inode->i_security; 289 } 290 291 /* 292 * Get the security label of an inode. 293 */ 294 static struct inode_security_struct *inode_security(struct inode *inode) 295 { 296 __inode_security_revalidate(inode, NULL, true); 297 return inode->i_security; 298 } 299 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry) 301 { 302 struct inode *inode = d_backing_inode(dentry); 303 304 return inode->i_security; 305 } 306 307 /* 308 * Get the security label of a dentry's backing inode. 309 */ 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry) 311 { 312 struct inode *inode = d_backing_inode(dentry); 313 314 __inode_security_revalidate(inode, dentry, true); 315 return inode->i_security; 316 } 317 318 static void inode_free_rcu(struct rcu_head *head) 319 { 320 struct inode_security_struct *isec; 321 322 isec = container_of(head, struct inode_security_struct, rcu); 323 kmem_cache_free(sel_inode_cache, isec); 324 } 325 326 static void inode_free_security(struct inode *inode) 327 { 328 struct inode_security_struct *isec = inode->i_security; 329 struct superblock_security_struct *sbsec = inode->i_sb->s_security; 330 331 /* 332 * As not all inode security structures are in a list, we check for 333 * empty list outside of the lock to make sure that we won't waste 334 * time taking a lock doing nothing. 335 * 336 * The list_del_init() function can be safely called more than once. 337 * It should not be possible for this function to be called with 338 * concurrent list_add(), but for better safety against future changes 339 * in the code, we use list_empty_careful() here. 340 */ 341 if (!list_empty_careful(&isec->list)) { 342 spin_lock(&sbsec->isec_lock); 343 list_del_init(&isec->list); 344 spin_unlock(&sbsec->isec_lock); 345 } 346 347 /* 348 * The inode may still be referenced in a path walk and 349 * a call to selinux_inode_permission() can be made 350 * after inode_free_security() is called. Ideally, the VFS 351 * wouldn't do this, but fixing that is a much harder 352 * job. For now, simply free the i_security via RCU, and 353 * leave the current inode->i_security pointer intact. 354 * The inode will be freed after the RCU grace period too. 355 */ 356 call_rcu(&isec->rcu, inode_free_rcu); 357 } 358 359 static int file_alloc_security(struct file *file) 360 { 361 struct file_security_struct *fsec; 362 u32 sid = current_sid(); 363 364 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL); 365 if (!fsec) 366 return -ENOMEM; 367 368 fsec->sid = sid; 369 fsec->fown_sid = sid; 370 file->f_security = fsec; 371 372 return 0; 373 } 374 375 static void file_free_security(struct file *file) 376 { 377 struct file_security_struct *fsec = file->f_security; 378 file->f_security = NULL; 379 kmem_cache_free(file_security_cache, fsec); 380 } 381 382 static int superblock_alloc_security(struct super_block *sb) 383 { 384 struct superblock_security_struct *sbsec; 385 386 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL); 387 if (!sbsec) 388 return -ENOMEM; 389 390 mutex_init(&sbsec->lock); 391 INIT_LIST_HEAD(&sbsec->isec_head); 392 spin_lock_init(&sbsec->isec_lock); 393 sbsec->sb = sb; 394 sbsec->sid = SECINITSID_UNLABELED; 395 sbsec->def_sid = SECINITSID_FILE; 396 sbsec->mntpoint_sid = SECINITSID_UNLABELED; 397 sb->s_security = sbsec; 398 399 return 0; 400 } 401 402 static void superblock_free_security(struct super_block *sb) 403 { 404 struct superblock_security_struct *sbsec = sb->s_security; 405 sb->s_security = NULL; 406 kfree(sbsec); 407 } 408 409 /* The file system's label must be initialized prior to use. */ 410 411 static const char *labeling_behaviors[7] = { 412 "uses xattr", 413 "uses transition SIDs", 414 "uses task SIDs", 415 "uses genfs_contexts", 416 "not configured for labeling", 417 "uses mountpoint labeling", 418 "uses native labeling", 419 }; 420 421 static inline int inode_doinit(struct inode *inode) 422 { 423 return inode_doinit_with_dentry(inode, NULL); 424 } 425 426 enum { 427 Opt_error = -1, 428 Opt_context = 1, 429 Opt_fscontext = 2, 430 Opt_defcontext = 3, 431 Opt_rootcontext = 4, 432 Opt_labelsupport = 5, 433 Opt_nextmntopt = 6, 434 }; 435 436 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1) 437 438 static const match_table_t tokens = { 439 {Opt_context, CONTEXT_STR "%s"}, 440 {Opt_fscontext, FSCONTEXT_STR "%s"}, 441 {Opt_defcontext, DEFCONTEXT_STR "%s"}, 442 {Opt_rootcontext, ROOTCONTEXT_STR "%s"}, 443 {Opt_labelsupport, LABELSUPP_STR}, 444 {Opt_error, NULL}, 445 }; 446 447 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n" 448 449 static int may_context_mount_sb_relabel(u32 sid, 450 struct superblock_security_struct *sbsec, 451 const struct cred *cred) 452 { 453 const struct task_security_struct *tsec = cred->security; 454 int rc; 455 456 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, 457 FILESYSTEM__RELABELFROM, NULL); 458 if (rc) 459 return rc; 460 461 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM, 462 FILESYSTEM__RELABELTO, NULL); 463 return rc; 464 } 465 466 static int may_context_mount_inode_relabel(u32 sid, 467 struct superblock_security_struct *sbsec, 468 const struct cred *cred) 469 { 470 const struct task_security_struct *tsec = cred->security; 471 int rc; 472 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, 473 FILESYSTEM__RELABELFROM, NULL); 474 if (rc) 475 return rc; 476 477 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, 478 FILESYSTEM__ASSOCIATE, NULL); 479 return rc; 480 } 481 482 static int selinux_is_sblabel_mnt(struct super_block *sb) 483 { 484 struct superblock_security_struct *sbsec = sb->s_security; 485 486 return sbsec->behavior == SECURITY_FS_USE_XATTR || 487 sbsec->behavior == SECURITY_FS_USE_TRANS || 488 sbsec->behavior == SECURITY_FS_USE_TASK || 489 sbsec->behavior == SECURITY_FS_USE_NATIVE || 490 /* Special handling. Genfs but also in-core setxattr handler */ 491 !strcmp(sb->s_type->name, "sysfs") || 492 !strcmp(sb->s_type->name, "pstore") || 493 !strcmp(sb->s_type->name, "debugfs") || 494 !strcmp(sb->s_type->name, "rootfs"); 495 } 496 497 static int sb_finish_set_opts(struct super_block *sb) 498 { 499 struct superblock_security_struct *sbsec = sb->s_security; 500 struct dentry *root = sb->s_root; 501 struct inode *root_inode = d_backing_inode(root); 502 int rc = 0; 503 504 if (sbsec->behavior == SECURITY_FS_USE_XATTR) { 505 /* Make sure that the xattr handler exists and that no 506 error other than -ENODATA is returned by getxattr on 507 the root directory. -ENODATA is ok, as this may be 508 the first boot of the SELinux kernel before we have 509 assigned xattr values to the filesystem. */ 510 if (!root_inode->i_op->getxattr) { 511 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no " 512 "xattr support\n", sb->s_id, sb->s_type->name); 513 rc = -EOPNOTSUPP; 514 goto out; 515 } 516 rc = root_inode->i_op->getxattr(root, root_inode, 517 XATTR_NAME_SELINUX, NULL, 0); 518 if (rc < 0 && rc != -ENODATA) { 519 if (rc == -EOPNOTSUPP) 520 printk(KERN_WARNING "SELinux: (dev %s, type " 521 "%s) has no security xattr handler\n", 522 sb->s_id, sb->s_type->name); 523 else 524 printk(KERN_WARNING "SELinux: (dev %s, type " 525 "%s) getxattr errno %d\n", sb->s_id, 526 sb->s_type->name, -rc); 527 goto out; 528 } 529 } 530 531 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) 532 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n", 533 sb->s_id, sb->s_type->name); 534 535 sbsec->flags |= SE_SBINITIALIZED; 536 if (selinux_is_sblabel_mnt(sb)) 537 sbsec->flags |= SBLABEL_MNT; 538 539 /* Initialize the root inode. */ 540 rc = inode_doinit_with_dentry(root_inode, root); 541 542 /* Initialize any other inodes associated with the superblock, e.g. 543 inodes created prior to initial policy load or inodes created 544 during get_sb by a pseudo filesystem that directly 545 populates itself. */ 546 spin_lock(&sbsec->isec_lock); 547 next_inode: 548 if (!list_empty(&sbsec->isec_head)) { 549 struct inode_security_struct *isec = 550 list_entry(sbsec->isec_head.next, 551 struct inode_security_struct, list); 552 struct inode *inode = isec->inode; 553 list_del_init(&isec->list); 554 spin_unlock(&sbsec->isec_lock); 555 inode = igrab(inode); 556 if (inode) { 557 if (!IS_PRIVATE(inode)) 558 inode_doinit(inode); 559 iput(inode); 560 } 561 spin_lock(&sbsec->isec_lock); 562 goto next_inode; 563 } 564 spin_unlock(&sbsec->isec_lock); 565 out: 566 return rc; 567 } 568 569 /* 570 * This function should allow an FS to ask what it's mount security 571 * options were so it can use those later for submounts, displaying 572 * mount options, or whatever. 573 */ 574 static int selinux_get_mnt_opts(const struct super_block *sb, 575 struct security_mnt_opts *opts) 576 { 577 int rc = 0, i; 578 struct superblock_security_struct *sbsec = sb->s_security; 579 char *context = NULL; 580 u32 len; 581 char tmp; 582 583 security_init_mnt_opts(opts); 584 585 if (!(sbsec->flags & SE_SBINITIALIZED)) 586 return -EINVAL; 587 588 if (!ss_initialized) 589 return -EINVAL; 590 591 /* make sure we always check enough bits to cover the mask */ 592 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS)); 593 594 tmp = sbsec->flags & SE_MNTMASK; 595 /* count the number of mount options for this sb */ 596 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) { 597 if (tmp & 0x01) 598 opts->num_mnt_opts++; 599 tmp >>= 1; 600 } 601 /* Check if the Label support flag is set */ 602 if (sbsec->flags & SBLABEL_MNT) 603 opts->num_mnt_opts++; 604 605 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC); 606 if (!opts->mnt_opts) { 607 rc = -ENOMEM; 608 goto out_free; 609 } 610 611 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC); 612 if (!opts->mnt_opts_flags) { 613 rc = -ENOMEM; 614 goto out_free; 615 } 616 617 i = 0; 618 if (sbsec->flags & FSCONTEXT_MNT) { 619 rc = security_sid_to_context(sbsec->sid, &context, &len); 620 if (rc) 621 goto out_free; 622 opts->mnt_opts[i] = context; 623 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT; 624 } 625 if (sbsec->flags & CONTEXT_MNT) { 626 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len); 627 if (rc) 628 goto out_free; 629 opts->mnt_opts[i] = context; 630 opts->mnt_opts_flags[i++] = CONTEXT_MNT; 631 } 632 if (sbsec->flags & DEFCONTEXT_MNT) { 633 rc = security_sid_to_context(sbsec->def_sid, &context, &len); 634 if (rc) 635 goto out_free; 636 opts->mnt_opts[i] = context; 637 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT; 638 } 639 if (sbsec->flags & ROOTCONTEXT_MNT) { 640 struct dentry *root = sbsec->sb->s_root; 641 struct inode_security_struct *isec = backing_inode_security(root); 642 643 rc = security_sid_to_context(isec->sid, &context, &len); 644 if (rc) 645 goto out_free; 646 opts->mnt_opts[i] = context; 647 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT; 648 } 649 if (sbsec->flags & SBLABEL_MNT) { 650 opts->mnt_opts[i] = NULL; 651 opts->mnt_opts_flags[i++] = SBLABEL_MNT; 652 } 653 654 BUG_ON(i != opts->num_mnt_opts); 655 656 return 0; 657 658 out_free: 659 security_free_mnt_opts(opts); 660 return rc; 661 } 662 663 static int bad_option(struct superblock_security_struct *sbsec, char flag, 664 u32 old_sid, u32 new_sid) 665 { 666 char mnt_flags = sbsec->flags & SE_MNTMASK; 667 668 /* check if the old mount command had the same options */ 669 if (sbsec->flags & SE_SBINITIALIZED) 670 if (!(sbsec->flags & flag) || 671 (old_sid != new_sid)) 672 return 1; 673 674 /* check if we were passed the same options twice, 675 * aka someone passed context=a,context=b 676 */ 677 if (!(sbsec->flags & SE_SBINITIALIZED)) 678 if (mnt_flags & flag) 679 return 1; 680 return 0; 681 } 682 683 /* 684 * Allow filesystems with binary mount data to explicitly set mount point 685 * labeling information. 686 */ 687 static int selinux_set_mnt_opts(struct super_block *sb, 688 struct security_mnt_opts *opts, 689 unsigned long kern_flags, 690 unsigned long *set_kern_flags) 691 { 692 const struct cred *cred = current_cred(); 693 int rc = 0, i; 694 struct superblock_security_struct *sbsec = sb->s_security; 695 const char *name = sb->s_type->name; 696 struct dentry *root = sbsec->sb->s_root; 697 struct inode_security_struct *root_isec; 698 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0; 699 u32 defcontext_sid = 0; 700 char **mount_options = opts->mnt_opts; 701 int *flags = opts->mnt_opts_flags; 702 int num_opts = opts->num_mnt_opts; 703 704 mutex_lock(&sbsec->lock); 705 706 if (!ss_initialized) { 707 if (!num_opts) { 708 /* Defer initialization until selinux_complete_init, 709 after the initial policy is loaded and the security 710 server is ready to handle calls. */ 711 goto out; 712 } 713 rc = -EINVAL; 714 printk(KERN_WARNING "SELinux: Unable to set superblock options " 715 "before the security server is initialized\n"); 716 goto out; 717 } 718 if (kern_flags && !set_kern_flags) { 719 /* Specifying internal flags without providing a place to 720 * place the results is not allowed */ 721 rc = -EINVAL; 722 goto out; 723 } 724 725 /* 726 * Binary mount data FS will come through this function twice. Once 727 * from an explicit call and once from the generic calls from the vfs. 728 * Since the generic VFS calls will not contain any security mount data 729 * we need to skip the double mount verification. 730 * 731 * This does open a hole in which we will not notice if the first 732 * mount using this sb set explict options and a second mount using 733 * this sb does not set any security options. (The first options 734 * will be used for both mounts) 735 */ 736 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) 737 && (num_opts == 0)) 738 goto out; 739 740 root_isec = backing_inode_security_novalidate(root); 741 742 /* 743 * parse the mount options, check if they are valid sids. 744 * also check if someone is trying to mount the same sb more 745 * than once with different security options. 746 */ 747 for (i = 0; i < num_opts; i++) { 748 u32 sid; 749 750 if (flags[i] == SBLABEL_MNT) 751 continue; 752 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL); 753 if (rc) { 754 printk(KERN_WARNING "SELinux: security_context_str_to_sid" 755 "(%s) failed for (dev %s, type %s) errno=%d\n", 756 mount_options[i], sb->s_id, name, rc); 757 goto out; 758 } 759 switch (flags[i]) { 760 case FSCONTEXT_MNT: 761 fscontext_sid = sid; 762 763 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, 764 fscontext_sid)) 765 goto out_double_mount; 766 767 sbsec->flags |= FSCONTEXT_MNT; 768 break; 769 case CONTEXT_MNT: 770 context_sid = sid; 771 772 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, 773 context_sid)) 774 goto out_double_mount; 775 776 sbsec->flags |= CONTEXT_MNT; 777 break; 778 case ROOTCONTEXT_MNT: 779 rootcontext_sid = sid; 780 781 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, 782 rootcontext_sid)) 783 goto out_double_mount; 784 785 sbsec->flags |= ROOTCONTEXT_MNT; 786 787 break; 788 case DEFCONTEXT_MNT: 789 defcontext_sid = sid; 790 791 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, 792 defcontext_sid)) 793 goto out_double_mount; 794 795 sbsec->flags |= DEFCONTEXT_MNT; 796 797 break; 798 default: 799 rc = -EINVAL; 800 goto out; 801 } 802 } 803 804 if (sbsec->flags & SE_SBINITIALIZED) { 805 /* previously mounted with options, but not on this attempt? */ 806 if ((sbsec->flags & SE_MNTMASK) && !num_opts) 807 goto out_double_mount; 808 rc = 0; 809 goto out; 810 } 811 812 if (strcmp(sb->s_type->name, "proc") == 0) 813 sbsec->flags |= SE_SBPROC | SE_SBGENFS; 814 815 if (!strcmp(sb->s_type->name, "debugfs") || 816 !strcmp(sb->s_type->name, "sysfs") || 817 !strcmp(sb->s_type->name, "pstore")) 818 sbsec->flags |= SE_SBGENFS; 819 820 if (!sbsec->behavior) { 821 /* 822 * Determine the labeling behavior to use for this 823 * filesystem type. 824 */ 825 rc = security_fs_use(sb); 826 if (rc) { 827 printk(KERN_WARNING 828 "%s: security_fs_use(%s) returned %d\n", 829 __func__, sb->s_type->name, rc); 830 goto out; 831 } 832 } 833 834 /* 835 * If this is a user namespace mount, no contexts are allowed 836 * on the command line and security labels must be ignored. 837 */ 838 if (sb->s_user_ns != &init_user_ns) { 839 if (context_sid || fscontext_sid || rootcontext_sid || 840 defcontext_sid) { 841 rc = -EACCES; 842 goto out; 843 } 844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) { 845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT; 846 rc = security_transition_sid(current_sid(), current_sid(), 847 SECCLASS_FILE, NULL, 848 &sbsec->mntpoint_sid); 849 if (rc) 850 goto out; 851 } 852 goto out_set_opts; 853 } 854 855 /* sets the context of the superblock for the fs being mounted. */ 856 if (fscontext_sid) { 857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred); 858 if (rc) 859 goto out; 860 861 sbsec->sid = fscontext_sid; 862 } 863 864 /* 865 * Switch to using mount point labeling behavior. 866 * sets the label used on all file below the mountpoint, and will set 867 * the superblock context if not already set. 868 */ 869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) { 870 sbsec->behavior = SECURITY_FS_USE_NATIVE; 871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS; 872 } 873 874 if (context_sid) { 875 if (!fscontext_sid) { 876 rc = may_context_mount_sb_relabel(context_sid, sbsec, 877 cred); 878 if (rc) 879 goto out; 880 sbsec->sid = context_sid; 881 } else { 882 rc = may_context_mount_inode_relabel(context_sid, sbsec, 883 cred); 884 if (rc) 885 goto out; 886 } 887 if (!rootcontext_sid) 888 rootcontext_sid = context_sid; 889 890 sbsec->mntpoint_sid = context_sid; 891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT; 892 } 893 894 if (rootcontext_sid) { 895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, 896 cred); 897 if (rc) 898 goto out; 899 900 root_isec->sid = rootcontext_sid; 901 root_isec->initialized = LABEL_INITIALIZED; 902 } 903 904 if (defcontext_sid) { 905 if (sbsec->behavior != SECURITY_FS_USE_XATTR && 906 sbsec->behavior != SECURITY_FS_USE_NATIVE) { 907 rc = -EINVAL; 908 printk(KERN_WARNING "SELinux: defcontext option is " 909 "invalid for this filesystem type\n"); 910 goto out; 911 } 912 913 if (defcontext_sid != sbsec->def_sid) { 914 rc = may_context_mount_inode_relabel(defcontext_sid, 915 sbsec, cred); 916 if (rc) 917 goto out; 918 } 919 920 sbsec->def_sid = defcontext_sid; 921 } 922 923 out_set_opts: 924 rc = sb_finish_set_opts(sb); 925 out: 926 mutex_unlock(&sbsec->lock); 927 return rc; 928 out_double_mount: 929 rc = -EINVAL; 930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different " 931 "security settings for (dev %s, type %s)\n", sb->s_id, name); 932 goto out; 933 } 934 935 static int selinux_cmp_sb_context(const struct super_block *oldsb, 936 const struct super_block *newsb) 937 { 938 struct superblock_security_struct *old = oldsb->s_security; 939 struct superblock_security_struct *new = newsb->s_security; 940 char oldflags = old->flags & SE_MNTMASK; 941 char newflags = new->flags & SE_MNTMASK; 942 943 if (oldflags != newflags) 944 goto mismatch; 945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid) 946 goto mismatch; 947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid) 948 goto mismatch; 949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid) 950 goto mismatch; 951 if (oldflags & ROOTCONTEXT_MNT) { 952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root); 953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root); 954 if (oldroot->sid != newroot->sid) 955 goto mismatch; 956 } 957 return 0; 958 mismatch: 959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, " 960 "different security settings for (dev %s, " 961 "type %s)\n", newsb->s_id, newsb->s_type->name); 962 return -EBUSY; 963 } 964 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, 966 struct super_block *newsb) 967 { 968 const struct superblock_security_struct *oldsbsec = oldsb->s_security; 969 struct superblock_security_struct *newsbsec = newsb->s_security; 970 971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT); 972 int set_context = (oldsbsec->flags & CONTEXT_MNT); 973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT); 974 975 /* 976 * if the parent was able to be mounted it clearly had no special lsm 977 * mount options. thus we can safely deal with this superblock later 978 */ 979 if (!ss_initialized) 980 return 0; 981 982 /* how can we clone if the old one wasn't set up?? */ 983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED)); 984 985 /* if fs is reusing a sb, make sure that the contexts match */ 986 if (newsbsec->flags & SE_SBINITIALIZED) 987 return selinux_cmp_sb_context(oldsb, newsb); 988 989 mutex_lock(&newsbsec->lock); 990 991 newsbsec->flags = oldsbsec->flags; 992 993 newsbsec->sid = oldsbsec->sid; 994 newsbsec->def_sid = oldsbsec->def_sid; 995 newsbsec->behavior = oldsbsec->behavior; 996 997 if (set_context) { 998 u32 sid = oldsbsec->mntpoint_sid; 999 1000 if (!set_fscontext) 1001 newsbsec->sid = sid; 1002 if (!set_rootcontext) { 1003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root); 1004 newisec->sid = sid; 1005 } 1006 newsbsec->mntpoint_sid = sid; 1007 } 1008 if (set_rootcontext) { 1009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root); 1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root); 1011 1012 newisec->sid = oldisec->sid; 1013 } 1014 1015 sb_finish_set_opts(newsb); 1016 mutex_unlock(&newsbsec->lock); 1017 return 0; 1018 } 1019 1020 static int selinux_parse_opts_str(char *options, 1021 struct security_mnt_opts *opts) 1022 { 1023 char *p; 1024 char *context = NULL, *defcontext = NULL; 1025 char *fscontext = NULL, *rootcontext = NULL; 1026 int rc, num_mnt_opts = 0; 1027 1028 opts->num_mnt_opts = 0; 1029 1030 /* Standard string-based options. */ 1031 while ((p = strsep(&options, "|")) != NULL) { 1032 int token; 1033 substring_t args[MAX_OPT_ARGS]; 1034 1035 if (!*p) 1036 continue; 1037 1038 token = match_token(p, tokens, args); 1039 1040 switch (token) { 1041 case Opt_context: 1042 if (context || defcontext) { 1043 rc = -EINVAL; 1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1045 goto out_err; 1046 } 1047 context = match_strdup(&args[0]); 1048 if (!context) { 1049 rc = -ENOMEM; 1050 goto out_err; 1051 } 1052 break; 1053 1054 case Opt_fscontext: 1055 if (fscontext) { 1056 rc = -EINVAL; 1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1058 goto out_err; 1059 } 1060 fscontext = match_strdup(&args[0]); 1061 if (!fscontext) { 1062 rc = -ENOMEM; 1063 goto out_err; 1064 } 1065 break; 1066 1067 case Opt_rootcontext: 1068 if (rootcontext) { 1069 rc = -EINVAL; 1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1071 goto out_err; 1072 } 1073 rootcontext = match_strdup(&args[0]); 1074 if (!rootcontext) { 1075 rc = -ENOMEM; 1076 goto out_err; 1077 } 1078 break; 1079 1080 case Opt_defcontext: 1081 if (context || defcontext) { 1082 rc = -EINVAL; 1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1084 goto out_err; 1085 } 1086 defcontext = match_strdup(&args[0]); 1087 if (!defcontext) { 1088 rc = -ENOMEM; 1089 goto out_err; 1090 } 1091 break; 1092 case Opt_labelsupport: 1093 break; 1094 default: 1095 rc = -EINVAL; 1096 printk(KERN_WARNING "SELinux: unknown mount option\n"); 1097 goto out_err; 1098 1099 } 1100 } 1101 1102 rc = -ENOMEM; 1103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC); 1104 if (!opts->mnt_opts) 1105 goto out_err; 1106 1107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC); 1108 if (!opts->mnt_opts_flags) { 1109 kfree(opts->mnt_opts); 1110 goto out_err; 1111 } 1112 1113 if (fscontext) { 1114 opts->mnt_opts[num_mnt_opts] = fscontext; 1115 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT; 1116 } 1117 if (context) { 1118 opts->mnt_opts[num_mnt_opts] = context; 1119 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT; 1120 } 1121 if (rootcontext) { 1122 opts->mnt_opts[num_mnt_opts] = rootcontext; 1123 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT; 1124 } 1125 if (defcontext) { 1126 opts->mnt_opts[num_mnt_opts] = defcontext; 1127 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT; 1128 } 1129 1130 opts->num_mnt_opts = num_mnt_opts; 1131 return 0; 1132 1133 out_err: 1134 kfree(context); 1135 kfree(defcontext); 1136 kfree(fscontext); 1137 kfree(rootcontext); 1138 return rc; 1139 } 1140 /* 1141 * string mount options parsing and call set the sbsec 1142 */ 1143 static int superblock_doinit(struct super_block *sb, void *data) 1144 { 1145 int rc = 0; 1146 char *options = data; 1147 struct security_mnt_opts opts; 1148 1149 security_init_mnt_opts(&opts); 1150 1151 if (!data) 1152 goto out; 1153 1154 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA); 1155 1156 rc = selinux_parse_opts_str(options, &opts); 1157 if (rc) 1158 goto out_err; 1159 1160 out: 1161 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL); 1162 1163 out_err: 1164 security_free_mnt_opts(&opts); 1165 return rc; 1166 } 1167 1168 static void selinux_write_opts(struct seq_file *m, 1169 struct security_mnt_opts *opts) 1170 { 1171 int i; 1172 char *prefix; 1173 1174 for (i = 0; i < opts->num_mnt_opts; i++) { 1175 char *has_comma; 1176 1177 if (opts->mnt_opts[i]) 1178 has_comma = strchr(opts->mnt_opts[i], ','); 1179 else 1180 has_comma = NULL; 1181 1182 switch (opts->mnt_opts_flags[i]) { 1183 case CONTEXT_MNT: 1184 prefix = CONTEXT_STR; 1185 break; 1186 case FSCONTEXT_MNT: 1187 prefix = FSCONTEXT_STR; 1188 break; 1189 case ROOTCONTEXT_MNT: 1190 prefix = ROOTCONTEXT_STR; 1191 break; 1192 case DEFCONTEXT_MNT: 1193 prefix = DEFCONTEXT_STR; 1194 break; 1195 case SBLABEL_MNT: 1196 seq_putc(m, ','); 1197 seq_puts(m, LABELSUPP_STR); 1198 continue; 1199 default: 1200 BUG(); 1201 return; 1202 }; 1203 /* we need a comma before each option */ 1204 seq_putc(m, ','); 1205 seq_puts(m, prefix); 1206 if (has_comma) 1207 seq_putc(m, '\"'); 1208 seq_escape(m, opts->mnt_opts[i], "\"\n\\"); 1209 if (has_comma) 1210 seq_putc(m, '\"'); 1211 } 1212 } 1213 1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb) 1215 { 1216 struct security_mnt_opts opts; 1217 int rc; 1218 1219 rc = selinux_get_mnt_opts(sb, &opts); 1220 if (rc) { 1221 /* before policy load we may get EINVAL, don't show anything */ 1222 if (rc == -EINVAL) 1223 rc = 0; 1224 return rc; 1225 } 1226 1227 selinux_write_opts(m, &opts); 1228 1229 security_free_mnt_opts(&opts); 1230 1231 return rc; 1232 } 1233 1234 static inline u16 inode_mode_to_security_class(umode_t mode) 1235 { 1236 switch (mode & S_IFMT) { 1237 case S_IFSOCK: 1238 return SECCLASS_SOCK_FILE; 1239 case S_IFLNK: 1240 return SECCLASS_LNK_FILE; 1241 case S_IFREG: 1242 return SECCLASS_FILE; 1243 case S_IFBLK: 1244 return SECCLASS_BLK_FILE; 1245 case S_IFDIR: 1246 return SECCLASS_DIR; 1247 case S_IFCHR: 1248 return SECCLASS_CHR_FILE; 1249 case S_IFIFO: 1250 return SECCLASS_FIFO_FILE; 1251 1252 } 1253 1254 return SECCLASS_FILE; 1255 } 1256 1257 static inline int default_protocol_stream(int protocol) 1258 { 1259 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP); 1260 } 1261 1262 static inline int default_protocol_dgram(int protocol) 1263 { 1264 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP); 1265 } 1266 1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol) 1268 { 1269 switch (family) { 1270 case PF_UNIX: 1271 switch (type) { 1272 case SOCK_STREAM: 1273 case SOCK_SEQPACKET: 1274 return SECCLASS_UNIX_STREAM_SOCKET; 1275 case SOCK_DGRAM: 1276 return SECCLASS_UNIX_DGRAM_SOCKET; 1277 } 1278 break; 1279 case PF_INET: 1280 case PF_INET6: 1281 switch (type) { 1282 case SOCK_STREAM: 1283 if (default_protocol_stream(protocol)) 1284 return SECCLASS_TCP_SOCKET; 1285 else 1286 return SECCLASS_RAWIP_SOCKET; 1287 case SOCK_DGRAM: 1288 if (default_protocol_dgram(protocol)) 1289 return SECCLASS_UDP_SOCKET; 1290 else 1291 return SECCLASS_RAWIP_SOCKET; 1292 case SOCK_DCCP: 1293 return SECCLASS_DCCP_SOCKET; 1294 default: 1295 return SECCLASS_RAWIP_SOCKET; 1296 } 1297 break; 1298 case PF_NETLINK: 1299 switch (protocol) { 1300 case NETLINK_ROUTE: 1301 return SECCLASS_NETLINK_ROUTE_SOCKET; 1302 case NETLINK_SOCK_DIAG: 1303 return SECCLASS_NETLINK_TCPDIAG_SOCKET; 1304 case NETLINK_NFLOG: 1305 return SECCLASS_NETLINK_NFLOG_SOCKET; 1306 case NETLINK_XFRM: 1307 return SECCLASS_NETLINK_XFRM_SOCKET; 1308 case NETLINK_SELINUX: 1309 return SECCLASS_NETLINK_SELINUX_SOCKET; 1310 case NETLINK_ISCSI: 1311 return SECCLASS_NETLINK_ISCSI_SOCKET; 1312 case NETLINK_AUDIT: 1313 return SECCLASS_NETLINK_AUDIT_SOCKET; 1314 case NETLINK_FIB_LOOKUP: 1315 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET; 1316 case NETLINK_CONNECTOR: 1317 return SECCLASS_NETLINK_CONNECTOR_SOCKET; 1318 case NETLINK_NETFILTER: 1319 return SECCLASS_NETLINK_NETFILTER_SOCKET; 1320 case NETLINK_DNRTMSG: 1321 return SECCLASS_NETLINK_DNRT_SOCKET; 1322 case NETLINK_KOBJECT_UEVENT: 1323 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET; 1324 case NETLINK_GENERIC: 1325 return SECCLASS_NETLINK_GENERIC_SOCKET; 1326 case NETLINK_SCSITRANSPORT: 1327 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET; 1328 case NETLINK_RDMA: 1329 return SECCLASS_NETLINK_RDMA_SOCKET; 1330 case NETLINK_CRYPTO: 1331 return SECCLASS_NETLINK_CRYPTO_SOCKET; 1332 default: 1333 return SECCLASS_NETLINK_SOCKET; 1334 } 1335 case PF_PACKET: 1336 return SECCLASS_PACKET_SOCKET; 1337 case PF_KEY: 1338 return SECCLASS_KEY_SOCKET; 1339 case PF_APPLETALK: 1340 return SECCLASS_APPLETALK_SOCKET; 1341 } 1342 1343 return SECCLASS_SOCKET; 1344 } 1345 1346 static int selinux_genfs_get_sid(struct dentry *dentry, 1347 u16 tclass, 1348 u16 flags, 1349 u32 *sid) 1350 { 1351 int rc; 1352 struct super_block *sb = dentry->d_sb; 1353 char *buffer, *path; 1354 1355 buffer = (char *)__get_free_page(GFP_KERNEL); 1356 if (!buffer) 1357 return -ENOMEM; 1358 1359 path = dentry_path_raw(dentry, buffer, PAGE_SIZE); 1360 if (IS_ERR(path)) 1361 rc = PTR_ERR(path); 1362 else { 1363 if (flags & SE_SBPROC) { 1364 /* each process gets a /proc/PID/ entry. Strip off the 1365 * PID part to get a valid selinux labeling. 1366 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */ 1367 while (path[1] >= '0' && path[1] <= '9') { 1368 path[1] = '/'; 1369 path++; 1370 } 1371 } 1372 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid); 1373 } 1374 free_page((unsigned long)buffer); 1375 return rc; 1376 } 1377 1378 /* The inode's security attributes must be initialized before first use. */ 1379 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry) 1380 { 1381 struct superblock_security_struct *sbsec = NULL; 1382 struct inode_security_struct *isec = inode->i_security; 1383 u32 sid; 1384 struct dentry *dentry; 1385 #define INITCONTEXTLEN 255 1386 char *context = NULL; 1387 unsigned len = 0; 1388 int rc = 0; 1389 1390 if (isec->initialized == LABEL_INITIALIZED) 1391 goto out; 1392 1393 mutex_lock(&isec->lock); 1394 if (isec->initialized == LABEL_INITIALIZED) 1395 goto out_unlock; 1396 1397 sbsec = inode->i_sb->s_security; 1398 if (!(sbsec->flags & SE_SBINITIALIZED)) { 1399 /* Defer initialization until selinux_complete_init, 1400 after the initial policy is loaded and the security 1401 server is ready to handle calls. */ 1402 spin_lock(&sbsec->isec_lock); 1403 if (list_empty(&isec->list)) 1404 list_add(&isec->list, &sbsec->isec_head); 1405 spin_unlock(&sbsec->isec_lock); 1406 goto out_unlock; 1407 } 1408 1409 switch (sbsec->behavior) { 1410 case SECURITY_FS_USE_NATIVE: 1411 break; 1412 case SECURITY_FS_USE_XATTR: 1413 if (!inode->i_op->getxattr) { 1414 isec->sid = sbsec->def_sid; 1415 break; 1416 } 1417 1418 /* Need a dentry, since the xattr API requires one. 1419 Life would be simpler if we could just pass the inode. */ 1420 if (opt_dentry) { 1421 /* Called from d_instantiate or d_splice_alias. */ 1422 dentry = dget(opt_dentry); 1423 } else { 1424 /* Called from selinux_complete_init, try to find a dentry. */ 1425 dentry = d_find_alias(inode); 1426 } 1427 if (!dentry) { 1428 /* 1429 * this is can be hit on boot when a file is accessed 1430 * before the policy is loaded. When we load policy we 1431 * may find inodes that have no dentry on the 1432 * sbsec->isec_head list. No reason to complain as these 1433 * will get fixed up the next time we go through 1434 * inode_doinit with a dentry, before these inodes could 1435 * be used again by userspace. 1436 */ 1437 goto out_unlock; 1438 } 1439 1440 len = INITCONTEXTLEN; 1441 context = kmalloc(len+1, GFP_NOFS); 1442 if (!context) { 1443 rc = -ENOMEM; 1444 dput(dentry); 1445 goto out_unlock; 1446 } 1447 context[len] = '\0'; 1448 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX, 1449 context, len); 1450 if (rc == -ERANGE) { 1451 kfree(context); 1452 1453 /* Need a larger buffer. Query for the right size. */ 1454 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX, 1455 NULL, 0); 1456 if (rc < 0) { 1457 dput(dentry); 1458 goto out_unlock; 1459 } 1460 len = rc; 1461 context = kmalloc(len+1, GFP_NOFS); 1462 if (!context) { 1463 rc = -ENOMEM; 1464 dput(dentry); 1465 goto out_unlock; 1466 } 1467 context[len] = '\0'; 1468 rc = inode->i_op->getxattr(dentry, inode, 1469 XATTR_NAME_SELINUX, 1470 context, len); 1471 } 1472 dput(dentry); 1473 if (rc < 0) { 1474 if (rc != -ENODATA) { 1475 printk(KERN_WARNING "SELinux: %s: getxattr returned " 1476 "%d for dev=%s ino=%ld\n", __func__, 1477 -rc, inode->i_sb->s_id, inode->i_ino); 1478 kfree(context); 1479 goto out_unlock; 1480 } 1481 /* Map ENODATA to the default file SID */ 1482 sid = sbsec->def_sid; 1483 rc = 0; 1484 } else { 1485 rc = security_context_to_sid_default(context, rc, &sid, 1486 sbsec->def_sid, 1487 GFP_NOFS); 1488 if (rc) { 1489 char *dev = inode->i_sb->s_id; 1490 unsigned long ino = inode->i_ino; 1491 1492 if (rc == -EINVAL) { 1493 if (printk_ratelimit()) 1494 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid " 1495 "context=%s. This indicates you may need to relabel the inode or the " 1496 "filesystem in question.\n", ino, dev, context); 1497 } else { 1498 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) " 1499 "returned %d for dev=%s ino=%ld\n", 1500 __func__, context, -rc, dev, ino); 1501 } 1502 kfree(context); 1503 /* Leave with the unlabeled SID */ 1504 rc = 0; 1505 break; 1506 } 1507 } 1508 kfree(context); 1509 isec->sid = sid; 1510 break; 1511 case SECURITY_FS_USE_TASK: 1512 isec->sid = isec->task_sid; 1513 break; 1514 case SECURITY_FS_USE_TRANS: 1515 /* Default to the fs SID. */ 1516 isec->sid = sbsec->sid; 1517 1518 /* Try to obtain a transition SID. */ 1519 isec->sclass = inode_mode_to_security_class(inode->i_mode); 1520 rc = security_transition_sid(isec->task_sid, sbsec->sid, 1521 isec->sclass, NULL, &sid); 1522 if (rc) 1523 goto out_unlock; 1524 isec->sid = sid; 1525 break; 1526 case SECURITY_FS_USE_MNTPOINT: 1527 isec->sid = sbsec->mntpoint_sid; 1528 break; 1529 default: 1530 /* Default to the fs superblock SID. */ 1531 isec->sid = sbsec->sid; 1532 1533 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) { 1534 /* We must have a dentry to determine the label on 1535 * procfs inodes */ 1536 if (opt_dentry) 1537 /* Called from d_instantiate or 1538 * d_splice_alias. */ 1539 dentry = dget(opt_dentry); 1540 else 1541 /* Called from selinux_complete_init, try to 1542 * find a dentry. */ 1543 dentry = d_find_alias(inode); 1544 /* 1545 * This can be hit on boot when a file is accessed 1546 * before the policy is loaded. When we load policy we 1547 * may find inodes that have no dentry on the 1548 * sbsec->isec_head list. No reason to complain as 1549 * these will get fixed up the next time we go through 1550 * inode_doinit() with a dentry, before these inodes 1551 * could be used again by userspace. 1552 */ 1553 if (!dentry) 1554 goto out_unlock; 1555 isec->sclass = inode_mode_to_security_class(inode->i_mode); 1556 rc = selinux_genfs_get_sid(dentry, isec->sclass, 1557 sbsec->flags, &sid); 1558 dput(dentry); 1559 if (rc) 1560 goto out_unlock; 1561 isec->sid = sid; 1562 } 1563 break; 1564 } 1565 1566 isec->initialized = LABEL_INITIALIZED; 1567 1568 out_unlock: 1569 mutex_unlock(&isec->lock); 1570 out: 1571 if (isec->sclass == SECCLASS_FILE) 1572 isec->sclass = inode_mode_to_security_class(inode->i_mode); 1573 return rc; 1574 } 1575 1576 /* Convert a Linux signal to an access vector. */ 1577 static inline u32 signal_to_av(int sig) 1578 { 1579 u32 perm = 0; 1580 1581 switch (sig) { 1582 case SIGCHLD: 1583 /* Commonly granted from child to parent. */ 1584 perm = PROCESS__SIGCHLD; 1585 break; 1586 case SIGKILL: 1587 /* Cannot be caught or ignored */ 1588 perm = PROCESS__SIGKILL; 1589 break; 1590 case SIGSTOP: 1591 /* Cannot be caught or ignored */ 1592 perm = PROCESS__SIGSTOP; 1593 break; 1594 default: 1595 /* All other signals. */ 1596 perm = PROCESS__SIGNAL; 1597 break; 1598 } 1599 1600 return perm; 1601 } 1602 1603 /* 1604 * Check permission between a pair of credentials 1605 * fork check, ptrace check, etc. 1606 */ 1607 static int cred_has_perm(const struct cred *actor, 1608 const struct cred *target, 1609 u32 perms) 1610 { 1611 u32 asid = cred_sid(actor), tsid = cred_sid(target); 1612 1613 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL); 1614 } 1615 1616 /* 1617 * Check permission between a pair of tasks, e.g. signal checks, 1618 * fork check, ptrace check, etc. 1619 * tsk1 is the actor and tsk2 is the target 1620 * - this uses the default subjective creds of tsk1 1621 */ 1622 static int task_has_perm(const struct task_struct *tsk1, 1623 const struct task_struct *tsk2, 1624 u32 perms) 1625 { 1626 const struct task_security_struct *__tsec1, *__tsec2; 1627 u32 sid1, sid2; 1628 1629 rcu_read_lock(); 1630 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid; 1631 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid; 1632 rcu_read_unlock(); 1633 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL); 1634 } 1635 1636 /* 1637 * Check permission between current and another task, e.g. signal checks, 1638 * fork check, ptrace check, etc. 1639 * current is the actor and tsk2 is the target 1640 * - this uses current's subjective creds 1641 */ 1642 static int current_has_perm(const struct task_struct *tsk, 1643 u32 perms) 1644 { 1645 u32 sid, tsid; 1646 1647 sid = current_sid(); 1648 tsid = task_sid(tsk); 1649 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL); 1650 } 1651 1652 #if CAP_LAST_CAP > 63 1653 #error Fix SELinux to handle capabilities > 63. 1654 #endif 1655 1656 /* Check whether a task is allowed to use a capability. */ 1657 static int cred_has_capability(const struct cred *cred, 1658 int cap, int audit, bool initns) 1659 { 1660 struct common_audit_data ad; 1661 struct av_decision avd; 1662 u16 sclass; 1663 u32 sid = cred_sid(cred); 1664 u32 av = CAP_TO_MASK(cap); 1665 int rc; 1666 1667 ad.type = LSM_AUDIT_DATA_CAP; 1668 ad.u.cap = cap; 1669 1670 switch (CAP_TO_INDEX(cap)) { 1671 case 0: 1672 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS; 1673 break; 1674 case 1: 1675 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS; 1676 break; 1677 default: 1678 printk(KERN_ERR 1679 "SELinux: out of range capability %d\n", cap); 1680 BUG(); 1681 return -EINVAL; 1682 } 1683 1684 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd); 1685 if (audit == SECURITY_CAP_AUDIT) { 1686 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0); 1687 if (rc2) 1688 return rc2; 1689 } 1690 return rc; 1691 } 1692 1693 /* Check whether a task is allowed to use a system operation. */ 1694 static int task_has_system(struct task_struct *tsk, 1695 u32 perms) 1696 { 1697 u32 sid = task_sid(tsk); 1698 1699 return avc_has_perm(sid, SECINITSID_KERNEL, 1700 SECCLASS_SYSTEM, perms, NULL); 1701 } 1702 1703 /* Check whether a task has a particular permission to an inode. 1704 The 'adp' parameter is optional and allows other audit 1705 data to be passed (e.g. the dentry). */ 1706 static int inode_has_perm(const struct cred *cred, 1707 struct inode *inode, 1708 u32 perms, 1709 struct common_audit_data *adp) 1710 { 1711 struct inode_security_struct *isec; 1712 u32 sid; 1713 1714 validate_creds(cred); 1715 1716 if (unlikely(IS_PRIVATE(inode))) 1717 return 0; 1718 1719 sid = cred_sid(cred); 1720 isec = inode->i_security; 1721 1722 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp); 1723 } 1724 1725 /* Same as inode_has_perm, but pass explicit audit data containing 1726 the dentry to help the auditing code to more easily generate the 1727 pathname if needed. */ 1728 static inline int dentry_has_perm(const struct cred *cred, 1729 struct dentry *dentry, 1730 u32 av) 1731 { 1732 struct inode *inode = d_backing_inode(dentry); 1733 struct common_audit_data ad; 1734 1735 ad.type = LSM_AUDIT_DATA_DENTRY; 1736 ad.u.dentry = dentry; 1737 __inode_security_revalidate(inode, dentry, true); 1738 return inode_has_perm(cred, inode, av, &ad); 1739 } 1740 1741 /* Same as inode_has_perm, but pass explicit audit data containing 1742 the path to help the auditing code to more easily generate the 1743 pathname if needed. */ 1744 static inline int path_has_perm(const struct cred *cred, 1745 const struct path *path, 1746 u32 av) 1747 { 1748 struct inode *inode = d_backing_inode(path->dentry); 1749 struct common_audit_data ad; 1750 1751 ad.type = LSM_AUDIT_DATA_PATH; 1752 ad.u.path = *path; 1753 __inode_security_revalidate(inode, path->dentry, true); 1754 return inode_has_perm(cred, inode, av, &ad); 1755 } 1756 1757 /* Same as path_has_perm, but uses the inode from the file struct. */ 1758 static inline int file_path_has_perm(const struct cred *cred, 1759 struct file *file, 1760 u32 av) 1761 { 1762 struct common_audit_data ad; 1763 1764 ad.type = LSM_AUDIT_DATA_PATH; 1765 ad.u.path = file->f_path; 1766 return inode_has_perm(cred, file_inode(file), av, &ad); 1767 } 1768 1769 /* Check whether a task can use an open file descriptor to 1770 access an inode in a given way. Check access to the 1771 descriptor itself, and then use dentry_has_perm to 1772 check a particular permission to the file. 1773 Access to the descriptor is implicitly granted if it 1774 has the same SID as the process. If av is zero, then 1775 access to the file is not checked, e.g. for cases 1776 where only the descriptor is affected like seek. */ 1777 static int file_has_perm(const struct cred *cred, 1778 struct file *file, 1779 u32 av) 1780 { 1781 struct file_security_struct *fsec = file->f_security; 1782 struct inode *inode = file_inode(file); 1783 struct common_audit_data ad; 1784 u32 sid = cred_sid(cred); 1785 int rc; 1786 1787 ad.type = LSM_AUDIT_DATA_PATH; 1788 ad.u.path = file->f_path; 1789 1790 if (sid != fsec->sid) { 1791 rc = avc_has_perm(sid, fsec->sid, 1792 SECCLASS_FD, 1793 FD__USE, 1794 &ad); 1795 if (rc) 1796 goto out; 1797 } 1798 1799 /* av is zero if only checking access to the descriptor. */ 1800 rc = 0; 1801 if (av) 1802 rc = inode_has_perm(cred, inode, av, &ad); 1803 1804 out: 1805 return rc; 1806 } 1807 1808 /* 1809 * Determine the label for an inode that might be unioned. 1810 */ 1811 static int selinux_determine_inode_label(struct inode *dir, 1812 const struct qstr *name, 1813 u16 tclass, 1814 u32 *_new_isid) 1815 { 1816 const struct superblock_security_struct *sbsec = dir->i_sb->s_security; 1817 const struct task_security_struct *tsec = current_security(); 1818 1819 if ((sbsec->flags & SE_SBINITIALIZED) && 1820 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) { 1821 *_new_isid = sbsec->mntpoint_sid; 1822 } else if ((sbsec->flags & SBLABEL_MNT) && 1823 tsec->create_sid) { 1824 *_new_isid = tsec->create_sid; 1825 } else { 1826 const struct inode_security_struct *dsec = inode_security(dir); 1827 return security_transition_sid(tsec->sid, dsec->sid, tclass, 1828 name, _new_isid); 1829 } 1830 1831 return 0; 1832 } 1833 1834 /* Check whether a task can create a file. */ 1835 static int may_create(struct inode *dir, 1836 struct dentry *dentry, 1837 u16 tclass) 1838 { 1839 const struct task_security_struct *tsec = current_security(); 1840 struct inode_security_struct *dsec; 1841 struct superblock_security_struct *sbsec; 1842 u32 sid, newsid; 1843 struct common_audit_data ad; 1844 int rc; 1845 1846 dsec = inode_security(dir); 1847 sbsec = dir->i_sb->s_security; 1848 1849 sid = tsec->sid; 1850 1851 ad.type = LSM_AUDIT_DATA_DENTRY; 1852 ad.u.dentry = dentry; 1853 1854 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, 1855 DIR__ADD_NAME | DIR__SEARCH, 1856 &ad); 1857 if (rc) 1858 return rc; 1859 1860 rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass, 1861 &newsid); 1862 if (rc) 1863 return rc; 1864 1865 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad); 1866 if (rc) 1867 return rc; 1868 1869 return avc_has_perm(newsid, sbsec->sid, 1870 SECCLASS_FILESYSTEM, 1871 FILESYSTEM__ASSOCIATE, &ad); 1872 } 1873 1874 /* Check whether a task can create a key. */ 1875 static int may_create_key(u32 ksid, 1876 struct task_struct *ctx) 1877 { 1878 u32 sid = task_sid(ctx); 1879 1880 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL); 1881 } 1882 1883 #define MAY_LINK 0 1884 #define MAY_UNLINK 1 1885 #define MAY_RMDIR 2 1886 1887 /* Check whether a task can link, unlink, or rmdir a file/directory. */ 1888 static int may_link(struct inode *dir, 1889 struct dentry *dentry, 1890 int kind) 1891 1892 { 1893 struct inode_security_struct *dsec, *isec; 1894 struct common_audit_data ad; 1895 u32 sid = current_sid(); 1896 u32 av; 1897 int rc; 1898 1899 dsec = inode_security(dir); 1900 isec = backing_inode_security(dentry); 1901 1902 ad.type = LSM_AUDIT_DATA_DENTRY; 1903 ad.u.dentry = dentry; 1904 1905 av = DIR__SEARCH; 1906 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME); 1907 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad); 1908 if (rc) 1909 return rc; 1910 1911 switch (kind) { 1912 case MAY_LINK: 1913 av = FILE__LINK; 1914 break; 1915 case MAY_UNLINK: 1916 av = FILE__UNLINK; 1917 break; 1918 case MAY_RMDIR: 1919 av = DIR__RMDIR; 1920 break; 1921 default: 1922 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n", 1923 __func__, kind); 1924 return 0; 1925 } 1926 1927 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad); 1928 return rc; 1929 } 1930 1931 static inline int may_rename(struct inode *old_dir, 1932 struct dentry *old_dentry, 1933 struct inode *new_dir, 1934 struct dentry *new_dentry) 1935 { 1936 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec; 1937 struct common_audit_data ad; 1938 u32 sid = current_sid(); 1939 u32 av; 1940 int old_is_dir, new_is_dir; 1941 int rc; 1942 1943 old_dsec = inode_security(old_dir); 1944 old_isec = backing_inode_security(old_dentry); 1945 old_is_dir = d_is_dir(old_dentry); 1946 new_dsec = inode_security(new_dir); 1947 1948 ad.type = LSM_AUDIT_DATA_DENTRY; 1949 1950 ad.u.dentry = old_dentry; 1951 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR, 1952 DIR__REMOVE_NAME | DIR__SEARCH, &ad); 1953 if (rc) 1954 return rc; 1955 rc = avc_has_perm(sid, old_isec->sid, 1956 old_isec->sclass, FILE__RENAME, &ad); 1957 if (rc) 1958 return rc; 1959 if (old_is_dir && new_dir != old_dir) { 1960 rc = avc_has_perm(sid, old_isec->sid, 1961 old_isec->sclass, DIR__REPARENT, &ad); 1962 if (rc) 1963 return rc; 1964 } 1965 1966 ad.u.dentry = new_dentry; 1967 av = DIR__ADD_NAME | DIR__SEARCH; 1968 if (d_is_positive(new_dentry)) 1969 av |= DIR__REMOVE_NAME; 1970 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad); 1971 if (rc) 1972 return rc; 1973 if (d_is_positive(new_dentry)) { 1974 new_isec = backing_inode_security(new_dentry); 1975 new_is_dir = d_is_dir(new_dentry); 1976 rc = avc_has_perm(sid, new_isec->sid, 1977 new_isec->sclass, 1978 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad); 1979 if (rc) 1980 return rc; 1981 } 1982 1983 return 0; 1984 } 1985 1986 /* Check whether a task can perform a filesystem operation. */ 1987 static int superblock_has_perm(const struct cred *cred, 1988 struct super_block *sb, 1989 u32 perms, 1990 struct common_audit_data *ad) 1991 { 1992 struct superblock_security_struct *sbsec; 1993 u32 sid = cred_sid(cred); 1994 1995 sbsec = sb->s_security; 1996 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad); 1997 } 1998 1999 /* Convert a Linux mode and permission mask to an access vector. */ 2000 static inline u32 file_mask_to_av(int mode, int mask) 2001 { 2002 u32 av = 0; 2003 2004 if (!S_ISDIR(mode)) { 2005 if (mask & MAY_EXEC) 2006 av |= FILE__EXECUTE; 2007 if (mask & MAY_READ) 2008 av |= FILE__READ; 2009 2010 if (mask & MAY_APPEND) 2011 av |= FILE__APPEND; 2012 else if (mask & MAY_WRITE) 2013 av |= FILE__WRITE; 2014 2015 } else { 2016 if (mask & MAY_EXEC) 2017 av |= DIR__SEARCH; 2018 if (mask & MAY_WRITE) 2019 av |= DIR__WRITE; 2020 if (mask & MAY_READ) 2021 av |= DIR__READ; 2022 } 2023 2024 return av; 2025 } 2026 2027 /* Convert a Linux file to an access vector. */ 2028 static inline u32 file_to_av(struct file *file) 2029 { 2030 u32 av = 0; 2031 2032 if (file->f_mode & FMODE_READ) 2033 av |= FILE__READ; 2034 if (file->f_mode & FMODE_WRITE) { 2035 if (file->f_flags & O_APPEND) 2036 av |= FILE__APPEND; 2037 else 2038 av |= FILE__WRITE; 2039 } 2040 if (!av) { 2041 /* 2042 * Special file opened with flags 3 for ioctl-only use. 2043 */ 2044 av = FILE__IOCTL; 2045 } 2046 2047 return av; 2048 } 2049 2050 /* 2051 * Convert a file to an access vector and include the correct open 2052 * open permission. 2053 */ 2054 static inline u32 open_file_to_av(struct file *file) 2055 { 2056 u32 av = file_to_av(file); 2057 2058 if (selinux_policycap_openperm) 2059 av |= FILE__OPEN; 2060 2061 return av; 2062 } 2063 2064 /* Hook functions begin here. */ 2065 2066 static int selinux_binder_set_context_mgr(struct task_struct *mgr) 2067 { 2068 u32 mysid = current_sid(); 2069 u32 mgrsid = task_sid(mgr); 2070 2071 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, 2072 BINDER__SET_CONTEXT_MGR, NULL); 2073 } 2074 2075 static int selinux_binder_transaction(struct task_struct *from, 2076 struct task_struct *to) 2077 { 2078 u32 mysid = current_sid(); 2079 u32 fromsid = task_sid(from); 2080 u32 tosid = task_sid(to); 2081 int rc; 2082 2083 if (mysid != fromsid) { 2084 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, 2085 BINDER__IMPERSONATE, NULL); 2086 if (rc) 2087 return rc; 2088 } 2089 2090 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, 2091 NULL); 2092 } 2093 2094 static int selinux_binder_transfer_binder(struct task_struct *from, 2095 struct task_struct *to) 2096 { 2097 u32 fromsid = task_sid(from); 2098 u32 tosid = task_sid(to); 2099 2100 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, 2101 NULL); 2102 } 2103 2104 static int selinux_binder_transfer_file(struct task_struct *from, 2105 struct task_struct *to, 2106 struct file *file) 2107 { 2108 u32 sid = task_sid(to); 2109 struct file_security_struct *fsec = file->f_security; 2110 struct dentry *dentry = file->f_path.dentry; 2111 struct inode_security_struct *isec; 2112 struct common_audit_data ad; 2113 int rc; 2114 2115 ad.type = LSM_AUDIT_DATA_PATH; 2116 ad.u.path = file->f_path; 2117 2118 if (sid != fsec->sid) { 2119 rc = avc_has_perm(sid, fsec->sid, 2120 SECCLASS_FD, 2121 FD__USE, 2122 &ad); 2123 if (rc) 2124 return rc; 2125 } 2126 2127 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 2128 return 0; 2129 2130 isec = backing_inode_security(dentry); 2131 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file), 2132 &ad); 2133 } 2134 2135 static int selinux_ptrace_access_check(struct task_struct *child, 2136 unsigned int mode) 2137 { 2138 if (mode & PTRACE_MODE_READ) { 2139 u32 sid = current_sid(); 2140 u32 csid = task_sid(child); 2141 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL); 2142 } 2143 2144 return current_has_perm(child, PROCESS__PTRACE); 2145 } 2146 2147 static int selinux_ptrace_traceme(struct task_struct *parent) 2148 { 2149 return task_has_perm(parent, current, PROCESS__PTRACE); 2150 } 2151 2152 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective, 2153 kernel_cap_t *inheritable, kernel_cap_t *permitted) 2154 { 2155 return current_has_perm(target, PROCESS__GETCAP); 2156 } 2157 2158 static int selinux_capset(struct cred *new, const struct cred *old, 2159 const kernel_cap_t *effective, 2160 const kernel_cap_t *inheritable, 2161 const kernel_cap_t *permitted) 2162 { 2163 return cred_has_perm(old, new, PROCESS__SETCAP); 2164 } 2165 2166 /* 2167 * (This comment used to live with the selinux_task_setuid hook, 2168 * which was removed). 2169 * 2170 * Since setuid only affects the current process, and since the SELinux 2171 * controls are not based on the Linux identity attributes, SELinux does not 2172 * need to control this operation. However, SELinux does control the use of 2173 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook. 2174 */ 2175 2176 static int selinux_capable(const struct cred *cred, struct user_namespace *ns, 2177 int cap, int audit) 2178 { 2179 return cred_has_capability(cred, cap, audit, ns == &init_user_ns); 2180 } 2181 2182 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb) 2183 { 2184 const struct cred *cred = current_cred(); 2185 int rc = 0; 2186 2187 if (!sb) 2188 return 0; 2189 2190 switch (cmds) { 2191 case Q_SYNC: 2192 case Q_QUOTAON: 2193 case Q_QUOTAOFF: 2194 case Q_SETINFO: 2195 case Q_SETQUOTA: 2196 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL); 2197 break; 2198 case Q_GETFMT: 2199 case Q_GETINFO: 2200 case Q_GETQUOTA: 2201 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL); 2202 break; 2203 default: 2204 rc = 0; /* let the kernel handle invalid cmds */ 2205 break; 2206 } 2207 return rc; 2208 } 2209 2210 static int selinux_quota_on(struct dentry *dentry) 2211 { 2212 const struct cred *cred = current_cred(); 2213 2214 return dentry_has_perm(cred, dentry, FILE__QUOTAON); 2215 } 2216 2217 static int selinux_syslog(int type) 2218 { 2219 int rc; 2220 2221 switch (type) { 2222 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */ 2223 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */ 2224 rc = task_has_system(current, SYSTEM__SYSLOG_READ); 2225 break; 2226 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */ 2227 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */ 2228 /* Set level of messages printed to console */ 2229 case SYSLOG_ACTION_CONSOLE_LEVEL: 2230 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE); 2231 break; 2232 case SYSLOG_ACTION_CLOSE: /* Close log */ 2233 case SYSLOG_ACTION_OPEN: /* Open log */ 2234 case SYSLOG_ACTION_READ: /* Read from log */ 2235 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */ 2236 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */ 2237 default: 2238 rc = task_has_system(current, SYSTEM__SYSLOG_MOD); 2239 break; 2240 } 2241 return rc; 2242 } 2243 2244 /* 2245 * Check that a process has enough memory to allocate a new virtual 2246 * mapping. 0 means there is enough memory for the allocation to 2247 * succeed and -ENOMEM implies there is not. 2248 * 2249 * Do not audit the selinux permission check, as this is applied to all 2250 * processes that allocate mappings. 2251 */ 2252 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages) 2253 { 2254 int rc, cap_sys_admin = 0; 2255 2256 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN, 2257 SECURITY_CAP_NOAUDIT, true); 2258 if (rc == 0) 2259 cap_sys_admin = 1; 2260 2261 return cap_sys_admin; 2262 } 2263 2264 /* binprm security operations */ 2265 2266 static u32 ptrace_parent_sid(struct task_struct *task) 2267 { 2268 u32 sid = 0; 2269 struct task_struct *tracer; 2270 2271 rcu_read_lock(); 2272 tracer = ptrace_parent(task); 2273 if (tracer) 2274 sid = task_sid(tracer); 2275 rcu_read_unlock(); 2276 2277 return sid; 2278 } 2279 2280 static int check_nnp_nosuid(const struct linux_binprm *bprm, 2281 const struct task_security_struct *old_tsec, 2282 const struct task_security_struct *new_tsec) 2283 { 2284 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS); 2285 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt); 2286 int rc; 2287 2288 if (!nnp && !nosuid) 2289 return 0; /* neither NNP nor nosuid */ 2290 2291 if (new_tsec->sid == old_tsec->sid) 2292 return 0; /* No change in credentials */ 2293 2294 /* 2295 * The only transitions we permit under NNP or nosuid 2296 * are transitions to bounded SIDs, i.e. SIDs that are 2297 * guaranteed to only be allowed a subset of the permissions 2298 * of the current SID. 2299 */ 2300 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid); 2301 if (rc) { 2302 /* 2303 * On failure, preserve the errno values for NNP vs nosuid. 2304 * NNP: Operation not permitted for caller. 2305 * nosuid: Permission denied to file. 2306 */ 2307 if (nnp) 2308 return -EPERM; 2309 else 2310 return -EACCES; 2311 } 2312 return 0; 2313 } 2314 2315 static int selinux_bprm_set_creds(struct linux_binprm *bprm) 2316 { 2317 const struct task_security_struct *old_tsec; 2318 struct task_security_struct *new_tsec; 2319 struct inode_security_struct *isec; 2320 struct common_audit_data ad; 2321 struct inode *inode = file_inode(bprm->file); 2322 int rc; 2323 2324 /* SELinux context only depends on initial program or script and not 2325 * the script interpreter */ 2326 if (bprm->cred_prepared) 2327 return 0; 2328 2329 old_tsec = current_security(); 2330 new_tsec = bprm->cred->security; 2331 isec = inode_security(inode); 2332 2333 /* Default to the current task SID. */ 2334 new_tsec->sid = old_tsec->sid; 2335 new_tsec->osid = old_tsec->sid; 2336 2337 /* Reset fs, key, and sock SIDs on execve. */ 2338 new_tsec->create_sid = 0; 2339 new_tsec->keycreate_sid = 0; 2340 new_tsec->sockcreate_sid = 0; 2341 2342 if (old_tsec->exec_sid) { 2343 new_tsec->sid = old_tsec->exec_sid; 2344 /* Reset exec SID on execve. */ 2345 new_tsec->exec_sid = 0; 2346 2347 /* Fail on NNP or nosuid if not an allowed transition. */ 2348 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec); 2349 if (rc) 2350 return rc; 2351 } else { 2352 /* Check for a default transition on this program. */ 2353 rc = security_transition_sid(old_tsec->sid, isec->sid, 2354 SECCLASS_PROCESS, NULL, 2355 &new_tsec->sid); 2356 if (rc) 2357 return rc; 2358 2359 /* 2360 * Fallback to old SID on NNP or nosuid if not an allowed 2361 * transition. 2362 */ 2363 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec); 2364 if (rc) 2365 new_tsec->sid = old_tsec->sid; 2366 } 2367 2368 ad.type = LSM_AUDIT_DATA_PATH; 2369 ad.u.path = bprm->file->f_path; 2370 2371 if (new_tsec->sid == old_tsec->sid) { 2372 rc = avc_has_perm(old_tsec->sid, isec->sid, 2373 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad); 2374 if (rc) 2375 return rc; 2376 } else { 2377 /* Check permissions for the transition. */ 2378 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, 2379 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad); 2380 if (rc) 2381 return rc; 2382 2383 rc = avc_has_perm(new_tsec->sid, isec->sid, 2384 SECCLASS_FILE, FILE__ENTRYPOINT, &ad); 2385 if (rc) 2386 return rc; 2387 2388 /* Check for shared state */ 2389 if (bprm->unsafe & LSM_UNSAFE_SHARE) { 2390 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, 2391 SECCLASS_PROCESS, PROCESS__SHARE, 2392 NULL); 2393 if (rc) 2394 return -EPERM; 2395 } 2396 2397 /* Make sure that anyone attempting to ptrace over a task that 2398 * changes its SID has the appropriate permit */ 2399 if (bprm->unsafe & 2400 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { 2401 u32 ptsid = ptrace_parent_sid(current); 2402 if (ptsid != 0) { 2403 rc = avc_has_perm(ptsid, new_tsec->sid, 2404 SECCLASS_PROCESS, 2405 PROCESS__PTRACE, NULL); 2406 if (rc) 2407 return -EPERM; 2408 } 2409 } 2410 2411 /* Clear any possibly unsafe personality bits on exec: */ 2412 bprm->per_clear |= PER_CLEAR_ON_SETID; 2413 } 2414 2415 return 0; 2416 } 2417 2418 static int selinux_bprm_secureexec(struct linux_binprm *bprm) 2419 { 2420 const struct task_security_struct *tsec = current_security(); 2421 u32 sid, osid; 2422 int atsecure = 0; 2423 2424 sid = tsec->sid; 2425 osid = tsec->osid; 2426 2427 if (osid != sid) { 2428 /* Enable secure mode for SIDs transitions unless 2429 the noatsecure permission is granted between 2430 the two SIDs, i.e. ahp returns 0. */ 2431 atsecure = avc_has_perm(osid, sid, 2432 SECCLASS_PROCESS, 2433 PROCESS__NOATSECURE, NULL); 2434 } 2435 2436 return !!atsecure; 2437 } 2438 2439 static int match_file(const void *p, struct file *file, unsigned fd) 2440 { 2441 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0; 2442 } 2443 2444 /* Derived from fs/exec.c:flush_old_files. */ 2445 static inline void flush_unauthorized_files(const struct cred *cred, 2446 struct files_struct *files) 2447 { 2448 struct file *file, *devnull = NULL; 2449 struct tty_struct *tty; 2450 int drop_tty = 0; 2451 unsigned n; 2452 2453 tty = get_current_tty(); 2454 if (tty) { 2455 spin_lock(&tty->files_lock); 2456 if (!list_empty(&tty->tty_files)) { 2457 struct tty_file_private *file_priv; 2458 2459 /* Revalidate access to controlling tty. 2460 Use file_path_has_perm on the tty path directly 2461 rather than using file_has_perm, as this particular 2462 open file may belong to another process and we are 2463 only interested in the inode-based check here. */ 2464 file_priv = list_first_entry(&tty->tty_files, 2465 struct tty_file_private, list); 2466 file = file_priv->file; 2467 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE)) 2468 drop_tty = 1; 2469 } 2470 spin_unlock(&tty->files_lock); 2471 tty_kref_put(tty); 2472 } 2473 /* Reset controlling tty. */ 2474 if (drop_tty) 2475 no_tty(); 2476 2477 /* Revalidate access to inherited open files. */ 2478 n = iterate_fd(files, 0, match_file, cred); 2479 if (!n) /* none found? */ 2480 return; 2481 2482 devnull = dentry_open(&selinux_null, O_RDWR, cred); 2483 if (IS_ERR(devnull)) 2484 devnull = NULL; 2485 /* replace all the matching ones with this */ 2486 do { 2487 replace_fd(n - 1, devnull, 0); 2488 } while ((n = iterate_fd(files, n, match_file, cred)) != 0); 2489 if (devnull) 2490 fput(devnull); 2491 } 2492 2493 /* 2494 * Prepare a process for imminent new credential changes due to exec 2495 */ 2496 static void selinux_bprm_committing_creds(struct linux_binprm *bprm) 2497 { 2498 struct task_security_struct *new_tsec; 2499 struct rlimit *rlim, *initrlim; 2500 int rc, i; 2501 2502 new_tsec = bprm->cred->security; 2503 if (new_tsec->sid == new_tsec->osid) 2504 return; 2505 2506 /* Close files for which the new task SID is not authorized. */ 2507 flush_unauthorized_files(bprm->cred, current->files); 2508 2509 /* Always clear parent death signal on SID transitions. */ 2510 current->pdeath_signal = 0; 2511 2512 /* Check whether the new SID can inherit resource limits from the old 2513 * SID. If not, reset all soft limits to the lower of the current 2514 * task's hard limit and the init task's soft limit. 2515 * 2516 * Note that the setting of hard limits (even to lower them) can be 2517 * controlled by the setrlimit check. The inclusion of the init task's 2518 * soft limit into the computation is to avoid resetting soft limits 2519 * higher than the default soft limit for cases where the default is 2520 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK. 2521 */ 2522 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS, 2523 PROCESS__RLIMITINH, NULL); 2524 if (rc) { 2525 /* protect against do_prlimit() */ 2526 task_lock(current); 2527 for (i = 0; i < RLIM_NLIMITS; i++) { 2528 rlim = current->signal->rlim + i; 2529 initrlim = init_task.signal->rlim + i; 2530 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur); 2531 } 2532 task_unlock(current); 2533 update_rlimit_cpu(current, rlimit(RLIMIT_CPU)); 2534 } 2535 } 2536 2537 /* 2538 * Clean up the process immediately after the installation of new credentials 2539 * due to exec 2540 */ 2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm) 2542 { 2543 const struct task_security_struct *tsec = current_security(); 2544 struct itimerval itimer; 2545 u32 osid, sid; 2546 int rc, i; 2547 2548 osid = tsec->osid; 2549 sid = tsec->sid; 2550 2551 if (sid == osid) 2552 return; 2553 2554 /* Check whether the new SID can inherit signal state from the old SID. 2555 * If not, clear itimers to avoid subsequent signal generation and 2556 * flush and unblock signals. 2557 * 2558 * This must occur _after_ the task SID has been updated so that any 2559 * kill done after the flush will be checked against the new SID. 2560 */ 2561 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL); 2562 if (rc) { 2563 memset(&itimer, 0, sizeof itimer); 2564 for (i = 0; i < 3; i++) 2565 do_setitimer(i, &itimer, NULL); 2566 spin_lock_irq(¤t->sighand->siglock); 2567 if (!fatal_signal_pending(current)) { 2568 flush_sigqueue(¤t->pending); 2569 flush_sigqueue(¤t->signal->shared_pending); 2570 flush_signal_handlers(current, 1); 2571 sigemptyset(¤t->blocked); 2572 recalc_sigpending(); 2573 } 2574 spin_unlock_irq(¤t->sighand->siglock); 2575 } 2576 2577 /* Wake up the parent if it is waiting so that it can recheck 2578 * wait permission to the new task SID. */ 2579 read_lock(&tasklist_lock); 2580 __wake_up_parent(current, current->real_parent); 2581 read_unlock(&tasklist_lock); 2582 } 2583 2584 /* superblock security operations */ 2585 2586 static int selinux_sb_alloc_security(struct super_block *sb) 2587 { 2588 return superblock_alloc_security(sb); 2589 } 2590 2591 static void selinux_sb_free_security(struct super_block *sb) 2592 { 2593 superblock_free_security(sb); 2594 } 2595 2596 static inline int match_prefix(char *prefix, int plen, char *option, int olen) 2597 { 2598 if (plen > olen) 2599 return 0; 2600 2601 return !memcmp(prefix, option, plen); 2602 } 2603 2604 static inline int selinux_option(char *option, int len) 2605 { 2606 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) || 2607 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) || 2608 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) || 2609 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) || 2610 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len)); 2611 } 2612 2613 static inline void take_option(char **to, char *from, int *first, int len) 2614 { 2615 if (!*first) { 2616 **to = ','; 2617 *to += 1; 2618 } else 2619 *first = 0; 2620 memcpy(*to, from, len); 2621 *to += len; 2622 } 2623 2624 static inline void take_selinux_option(char **to, char *from, int *first, 2625 int len) 2626 { 2627 int current_size = 0; 2628 2629 if (!*first) { 2630 **to = '|'; 2631 *to += 1; 2632 } else 2633 *first = 0; 2634 2635 while (current_size < len) { 2636 if (*from != '"') { 2637 **to = *from; 2638 *to += 1; 2639 } 2640 from += 1; 2641 current_size += 1; 2642 } 2643 } 2644 2645 static int selinux_sb_copy_data(char *orig, char *copy) 2646 { 2647 int fnosec, fsec, rc = 0; 2648 char *in_save, *in_curr, *in_end; 2649 char *sec_curr, *nosec_save, *nosec; 2650 int open_quote = 0; 2651 2652 in_curr = orig; 2653 sec_curr = copy; 2654 2655 nosec = (char *)get_zeroed_page(GFP_KERNEL); 2656 if (!nosec) { 2657 rc = -ENOMEM; 2658 goto out; 2659 } 2660 2661 nosec_save = nosec; 2662 fnosec = fsec = 1; 2663 in_save = in_end = orig; 2664 2665 do { 2666 if (*in_end == '"') 2667 open_quote = !open_quote; 2668 if ((*in_end == ',' && open_quote == 0) || 2669 *in_end == '\0') { 2670 int len = in_end - in_curr; 2671 2672 if (selinux_option(in_curr, len)) 2673 take_selinux_option(&sec_curr, in_curr, &fsec, len); 2674 else 2675 take_option(&nosec, in_curr, &fnosec, len); 2676 2677 in_curr = in_end + 1; 2678 } 2679 } while (*in_end++); 2680 2681 strcpy(in_save, nosec_save); 2682 free_page((unsigned long)nosec_save); 2683 out: 2684 return rc; 2685 } 2686 2687 static int selinux_sb_remount(struct super_block *sb, void *data) 2688 { 2689 int rc, i, *flags; 2690 struct security_mnt_opts opts; 2691 char *secdata, **mount_options; 2692 struct superblock_security_struct *sbsec = sb->s_security; 2693 2694 if (!(sbsec->flags & SE_SBINITIALIZED)) 2695 return 0; 2696 2697 if (!data) 2698 return 0; 2699 2700 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) 2701 return 0; 2702 2703 security_init_mnt_opts(&opts); 2704 secdata = alloc_secdata(); 2705 if (!secdata) 2706 return -ENOMEM; 2707 rc = selinux_sb_copy_data(data, secdata); 2708 if (rc) 2709 goto out_free_secdata; 2710 2711 rc = selinux_parse_opts_str(secdata, &opts); 2712 if (rc) 2713 goto out_free_secdata; 2714 2715 mount_options = opts.mnt_opts; 2716 flags = opts.mnt_opts_flags; 2717 2718 for (i = 0; i < opts.num_mnt_opts; i++) { 2719 u32 sid; 2720 2721 if (flags[i] == SBLABEL_MNT) 2722 continue; 2723 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL); 2724 if (rc) { 2725 printk(KERN_WARNING "SELinux: security_context_str_to_sid" 2726 "(%s) failed for (dev %s, type %s) errno=%d\n", 2727 mount_options[i], sb->s_id, sb->s_type->name, rc); 2728 goto out_free_opts; 2729 } 2730 rc = -EINVAL; 2731 switch (flags[i]) { 2732 case FSCONTEXT_MNT: 2733 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid)) 2734 goto out_bad_option; 2735 break; 2736 case CONTEXT_MNT: 2737 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid)) 2738 goto out_bad_option; 2739 break; 2740 case ROOTCONTEXT_MNT: { 2741 struct inode_security_struct *root_isec; 2742 root_isec = backing_inode_security(sb->s_root); 2743 2744 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid)) 2745 goto out_bad_option; 2746 break; 2747 } 2748 case DEFCONTEXT_MNT: 2749 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid)) 2750 goto out_bad_option; 2751 break; 2752 default: 2753 goto out_free_opts; 2754 } 2755 } 2756 2757 rc = 0; 2758 out_free_opts: 2759 security_free_mnt_opts(&opts); 2760 out_free_secdata: 2761 free_secdata(secdata); 2762 return rc; 2763 out_bad_option: 2764 printk(KERN_WARNING "SELinux: unable to change security options " 2765 "during remount (dev %s, type=%s)\n", sb->s_id, 2766 sb->s_type->name); 2767 goto out_free_opts; 2768 } 2769 2770 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data) 2771 { 2772 const struct cred *cred = current_cred(); 2773 struct common_audit_data ad; 2774 int rc; 2775 2776 rc = superblock_doinit(sb, data); 2777 if (rc) 2778 return rc; 2779 2780 /* Allow all mounts performed by the kernel */ 2781 if (flags & MS_KERNMOUNT) 2782 return 0; 2783 2784 ad.type = LSM_AUDIT_DATA_DENTRY; 2785 ad.u.dentry = sb->s_root; 2786 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad); 2787 } 2788 2789 static int selinux_sb_statfs(struct dentry *dentry) 2790 { 2791 const struct cred *cred = current_cred(); 2792 struct common_audit_data ad; 2793 2794 ad.type = LSM_AUDIT_DATA_DENTRY; 2795 ad.u.dentry = dentry->d_sb->s_root; 2796 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad); 2797 } 2798 2799 static int selinux_mount(const char *dev_name, 2800 const struct path *path, 2801 const char *type, 2802 unsigned long flags, 2803 void *data) 2804 { 2805 const struct cred *cred = current_cred(); 2806 2807 if (flags & MS_REMOUNT) 2808 return superblock_has_perm(cred, path->dentry->d_sb, 2809 FILESYSTEM__REMOUNT, NULL); 2810 else 2811 return path_has_perm(cred, path, FILE__MOUNTON); 2812 } 2813 2814 static int selinux_umount(struct vfsmount *mnt, int flags) 2815 { 2816 const struct cred *cred = current_cred(); 2817 2818 return superblock_has_perm(cred, mnt->mnt_sb, 2819 FILESYSTEM__UNMOUNT, NULL); 2820 } 2821 2822 /* inode security operations */ 2823 2824 static int selinux_inode_alloc_security(struct inode *inode) 2825 { 2826 return inode_alloc_security(inode); 2827 } 2828 2829 static void selinux_inode_free_security(struct inode *inode) 2830 { 2831 inode_free_security(inode); 2832 } 2833 2834 static int selinux_dentry_init_security(struct dentry *dentry, int mode, 2835 const struct qstr *name, void **ctx, 2836 u32 *ctxlen) 2837 { 2838 u32 newsid; 2839 int rc; 2840 2841 rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name, 2842 inode_mode_to_security_class(mode), 2843 &newsid); 2844 if (rc) 2845 return rc; 2846 2847 return security_sid_to_context(newsid, (char **)ctx, ctxlen); 2848 } 2849 2850 static int selinux_inode_init_security(struct inode *inode, struct inode *dir, 2851 const struct qstr *qstr, 2852 const char **name, 2853 void **value, size_t *len) 2854 { 2855 const struct task_security_struct *tsec = current_security(); 2856 struct superblock_security_struct *sbsec; 2857 u32 sid, newsid, clen; 2858 int rc; 2859 char *context; 2860 2861 sbsec = dir->i_sb->s_security; 2862 2863 sid = tsec->sid; 2864 newsid = tsec->create_sid; 2865 2866 rc = selinux_determine_inode_label( 2867 dir, qstr, 2868 inode_mode_to_security_class(inode->i_mode), 2869 &newsid); 2870 if (rc) 2871 return rc; 2872 2873 /* Possibly defer initialization to selinux_complete_init. */ 2874 if (sbsec->flags & SE_SBINITIALIZED) { 2875 struct inode_security_struct *isec = inode->i_security; 2876 isec->sclass = inode_mode_to_security_class(inode->i_mode); 2877 isec->sid = newsid; 2878 isec->initialized = LABEL_INITIALIZED; 2879 } 2880 2881 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT)) 2882 return -EOPNOTSUPP; 2883 2884 if (name) 2885 *name = XATTR_SELINUX_SUFFIX; 2886 2887 if (value && len) { 2888 rc = security_sid_to_context_force(newsid, &context, &clen); 2889 if (rc) 2890 return rc; 2891 *value = context; 2892 *len = clen; 2893 } 2894 2895 return 0; 2896 } 2897 2898 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode) 2899 { 2900 return may_create(dir, dentry, SECCLASS_FILE); 2901 } 2902 2903 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) 2904 { 2905 return may_link(dir, old_dentry, MAY_LINK); 2906 } 2907 2908 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry) 2909 { 2910 return may_link(dir, dentry, MAY_UNLINK); 2911 } 2912 2913 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name) 2914 { 2915 return may_create(dir, dentry, SECCLASS_LNK_FILE); 2916 } 2917 2918 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask) 2919 { 2920 return may_create(dir, dentry, SECCLASS_DIR); 2921 } 2922 2923 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry) 2924 { 2925 return may_link(dir, dentry, MAY_RMDIR); 2926 } 2927 2928 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 2929 { 2930 return may_create(dir, dentry, inode_mode_to_security_class(mode)); 2931 } 2932 2933 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry, 2934 struct inode *new_inode, struct dentry *new_dentry) 2935 { 2936 return may_rename(old_inode, old_dentry, new_inode, new_dentry); 2937 } 2938 2939 static int selinux_inode_readlink(struct dentry *dentry) 2940 { 2941 const struct cred *cred = current_cred(); 2942 2943 return dentry_has_perm(cred, dentry, FILE__READ); 2944 } 2945 2946 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode, 2947 bool rcu) 2948 { 2949 const struct cred *cred = current_cred(); 2950 struct common_audit_data ad; 2951 struct inode_security_struct *isec; 2952 u32 sid; 2953 2954 validate_creds(cred); 2955 2956 ad.type = LSM_AUDIT_DATA_DENTRY; 2957 ad.u.dentry = dentry; 2958 sid = cred_sid(cred); 2959 isec = inode_security_rcu(inode, rcu); 2960 if (IS_ERR(isec)) 2961 return PTR_ERR(isec); 2962 2963 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad, 2964 rcu ? MAY_NOT_BLOCK : 0); 2965 } 2966 2967 static noinline int audit_inode_permission(struct inode *inode, 2968 u32 perms, u32 audited, u32 denied, 2969 int result, 2970 unsigned flags) 2971 { 2972 struct common_audit_data ad; 2973 struct inode_security_struct *isec = inode->i_security; 2974 int rc; 2975 2976 ad.type = LSM_AUDIT_DATA_INODE; 2977 ad.u.inode = inode; 2978 2979 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms, 2980 audited, denied, result, &ad, flags); 2981 if (rc) 2982 return rc; 2983 return 0; 2984 } 2985 2986 static int selinux_inode_permission(struct inode *inode, int mask) 2987 { 2988 const struct cred *cred = current_cred(); 2989 u32 perms; 2990 bool from_access; 2991 unsigned flags = mask & MAY_NOT_BLOCK; 2992 struct inode_security_struct *isec; 2993 u32 sid; 2994 struct av_decision avd; 2995 int rc, rc2; 2996 u32 audited, denied; 2997 2998 from_access = mask & MAY_ACCESS; 2999 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 3000 3001 /* No permission to check. Existence test. */ 3002 if (!mask) 3003 return 0; 3004 3005 validate_creds(cred); 3006 3007 if (unlikely(IS_PRIVATE(inode))) 3008 return 0; 3009 3010 perms = file_mask_to_av(inode->i_mode, mask); 3011 3012 sid = cred_sid(cred); 3013 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK); 3014 if (IS_ERR(isec)) 3015 return PTR_ERR(isec); 3016 3017 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd); 3018 audited = avc_audit_required(perms, &avd, rc, 3019 from_access ? FILE__AUDIT_ACCESS : 0, 3020 &denied); 3021 if (likely(!audited)) 3022 return rc; 3023 3024 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags); 3025 if (rc2) 3026 return rc2; 3027 return rc; 3028 } 3029 3030 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) 3031 { 3032 const struct cred *cred = current_cred(); 3033 unsigned int ia_valid = iattr->ia_valid; 3034 __u32 av = FILE__WRITE; 3035 3036 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */ 3037 if (ia_valid & ATTR_FORCE) { 3038 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE | 3039 ATTR_FORCE); 3040 if (!ia_valid) 3041 return 0; 3042 } 3043 3044 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | 3045 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) 3046 return dentry_has_perm(cred, dentry, FILE__SETATTR); 3047 3048 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE) 3049 && !(ia_valid & ATTR_FILE)) 3050 av |= FILE__OPEN; 3051 3052 return dentry_has_perm(cred, dentry, av); 3053 } 3054 3055 static int selinux_inode_getattr(const struct path *path) 3056 { 3057 return path_has_perm(current_cred(), path, FILE__GETATTR); 3058 } 3059 3060 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name) 3061 { 3062 const struct cred *cred = current_cred(); 3063 3064 if (!strncmp(name, XATTR_SECURITY_PREFIX, 3065 sizeof XATTR_SECURITY_PREFIX - 1)) { 3066 if (!strcmp(name, XATTR_NAME_CAPS)) { 3067 if (!capable(CAP_SETFCAP)) 3068 return -EPERM; 3069 } else if (!capable(CAP_SYS_ADMIN)) { 3070 /* A different attribute in the security namespace. 3071 Restrict to administrator. */ 3072 return -EPERM; 3073 } 3074 } 3075 3076 /* Not an attribute we recognize, so just check the 3077 ordinary setattr permission. */ 3078 return dentry_has_perm(cred, dentry, FILE__SETATTR); 3079 } 3080 3081 static int selinux_inode_setxattr(struct dentry *dentry, const char *name, 3082 const void *value, size_t size, int flags) 3083 { 3084 struct inode *inode = d_backing_inode(dentry); 3085 struct inode_security_struct *isec; 3086 struct superblock_security_struct *sbsec; 3087 struct common_audit_data ad; 3088 u32 newsid, sid = current_sid(); 3089 int rc = 0; 3090 3091 if (strcmp(name, XATTR_NAME_SELINUX)) 3092 return selinux_inode_setotherxattr(dentry, name); 3093 3094 sbsec = inode->i_sb->s_security; 3095 if (!(sbsec->flags & SBLABEL_MNT)) 3096 return -EOPNOTSUPP; 3097 3098 if (!inode_owner_or_capable(inode)) 3099 return -EPERM; 3100 3101 ad.type = LSM_AUDIT_DATA_DENTRY; 3102 ad.u.dentry = dentry; 3103 3104 isec = backing_inode_security(dentry); 3105 rc = avc_has_perm(sid, isec->sid, isec->sclass, 3106 FILE__RELABELFROM, &ad); 3107 if (rc) 3108 return rc; 3109 3110 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL); 3111 if (rc == -EINVAL) { 3112 if (!capable(CAP_MAC_ADMIN)) { 3113 struct audit_buffer *ab; 3114 size_t audit_size; 3115 const char *str; 3116 3117 /* We strip a nul only if it is at the end, otherwise the 3118 * context contains a nul and we should audit that */ 3119 if (value) { 3120 str = value; 3121 if (str[size - 1] == '\0') 3122 audit_size = size - 1; 3123 else 3124 audit_size = size; 3125 } else { 3126 str = ""; 3127 audit_size = 0; 3128 } 3129 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR); 3130 audit_log_format(ab, "op=setxattr invalid_context="); 3131 audit_log_n_untrustedstring(ab, value, audit_size); 3132 audit_log_end(ab); 3133 3134 return rc; 3135 } 3136 rc = security_context_to_sid_force(value, size, &newsid); 3137 } 3138 if (rc) 3139 return rc; 3140 3141 rc = avc_has_perm(sid, newsid, isec->sclass, 3142 FILE__RELABELTO, &ad); 3143 if (rc) 3144 return rc; 3145 3146 rc = security_validate_transition(isec->sid, newsid, sid, 3147 isec->sclass); 3148 if (rc) 3149 return rc; 3150 3151 return avc_has_perm(newsid, 3152 sbsec->sid, 3153 SECCLASS_FILESYSTEM, 3154 FILESYSTEM__ASSOCIATE, 3155 &ad); 3156 } 3157 3158 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, 3159 const void *value, size_t size, 3160 int flags) 3161 { 3162 struct inode *inode = d_backing_inode(dentry); 3163 struct inode_security_struct *isec; 3164 u32 newsid; 3165 int rc; 3166 3167 if (strcmp(name, XATTR_NAME_SELINUX)) { 3168 /* Not an attribute we recognize, so nothing to do. */ 3169 return; 3170 } 3171 3172 rc = security_context_to_sid_force(value, size, &newsid); 3173 if (rc) { 3174 printk(KERN_ERR "SELinux: unable to map context to SID" 3175 "for (%s, %lu), rc=%d\n", 3176 inode->i_sb->s_id, inode->i_ino, -rc); 3177 return; 3178 } 3179 3180 isec = backing_inode_security(dentry); 3181 isec->sclass = inode_mode_to_security_class(inode->i_mode); 3182 isec->sid = newsid; 3183 isec->initialized = LABEL_INITIALIZED; 3184 3185 return; 3186 } 3187 3188 static int selinux_inode_getxattr(struct dentry *dentry, const char *name) 3189 { 3190 const struct cred *cred = current_cred(); 3191 3192 return dentry_has_perm(cred, dentry, FILE__GETATTR); 3193 } 3194 3195 static int selinux_inode_listxattr(struct dentry *dentry) 3196 { 3197 const struct cred *cred = current_cred(); 3198 3199 return dentry_has_perm(cred, dentry, FILE__GETATTR); 3200 } 3201 3202 static int selinux_inode_removexattr(struct dentry *dentry, const char *name) 3203 { 3204 if (strcmp(name, XATTR_NAME_SELINUX)) 3205 return selinux_inode_setotherxattr(dentry, name); 3206 3207 /* No one is allowed to remove a SELinux security label. 3208 You can change the label, but all data must be labeled. */ 3209 return -EACCES; 3210 } 3211 3212 /* 3213 * Copy the inode security context value to the user. 3214 * 3215 * Permission check is handled by selinux_inode_getxattr hook. 3216 */ 3217 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc) 3218 { 3219 u32 size; 3220 int error; 3221 char *context = NULL; 3222 struct inode_security_struct *isec; 3223 3224 if (strcmp(name, XATTR_SELINUX_SUFFIX)) 3225 return -EOPNOTSUPP; 3226 3227 /* 3228 * If the caller has CAP_MAC_ADMIN, then get the raw context 3229 * value even if it is not defined by current policy; otherwise, 3230 * use the in-core value under current policy. 3231 * Use the non-auditing forms of the permission checks since 3232 * getxattr may be called by unprivileged processes commonly 3233 * and lack of permission just means that we fall back to the 3234 * in-core context value, not a denial. 3235 */ 3236 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN, 3237 SECURITY_CAP_NOAUDIT); 3238 if (!error) 3239 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN, 3240 SECURITY_CAP_NOAUDIT, true); 3241 isec = inode_security(inode); 3242 if (!error) 3243 error = security_sid_to_context_force(isec->sid, &context, 3244 &size); 3245 else 3246 error = security_sid_to_context(isec->sid, &context, &size); 3247 if (error) 3248 return error; 3249 error = size; 3250 if (alloc) { 3251 *buffer = context; 3252 goto out_nofree; 3253 } 3254 kfree(context); 3255 out_nofree: 3256 return error; 3257 } 3258 3259 static int selinux_inode_setsecurity(struct inode *inode, const char *name, 3260 const void *value, size_t size, int flags) 3261 { 3262 struct inode_security_struct *isec = inode_security_novalidate(inode); 3263 u32 newsid; 3264 int rc; 3265 3266 if (strcmp(name, XATTR_SELINUX_SUFFIX)) 3267 return -EOPNOTSUPP; 3268 3269 if (!value || !size) 3270 return -EACCES; 3271 3272 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL); 3273 if (rc) 3274 return rc; 3275 3276 isec->sclass = inode_mode_to_security_class(inode->i_mode); 3277 isec->sid = newsid; 3278 isec->initialized = LABEL_INITIALIZED; 3279 return 0; 3280 } 3281 3282 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) 3283 { 3284 const int len = sizeof(XATTR_NAME_SELINUX); 3285 if (buffer && len <= buffer_size) 3286 memcpy(buffer, XATTR_NAME_SELINUX, len); 3287 return len; 3288 } 3289 3290 static void selinux_inode_getsecid(struct inode *inode, u32 *secid) 3291 { 3292 struct inode_security_struct *isec = inode_security_novalidate(inode); 3293 *secid = isec->sid; 3294 } 3295 3296 /* file security operations */ 3297 3298 static int selinux_revalidate_file_permission(struct file *file, int mask) 3299 { 3300 const struct cred *cred = current_cred(); 3301 struct inode *inode = file_inode(file); 3302 3303 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */ 3304 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE)) 3305 mask |= MAY_APPEND; 3306 3307 return file_has_perm(cred, file, 3308 file_mask_to_av(inode->i_mode, mask)); 3309 } 3310 3311 static int selinux_file_permission(struct file *file, int mask) 3312 { 3313 struct inode *inode = file_inode(file); 3314 struct file_security_struct *fsec = file->f_security; 3315 struct inode_security_struct *isec; 3316 u32 sid = current_sid(); 3317 3318 if (!mask) 3319 /* No permission to check. Existence test. */ 3320 return 0; 3321 3322 isec = inode_security(inode); 3323 if (sid == fsec->sid && fsec->isid == isec->sid && 3324 fsec->pseqno == avc_policy_seqno()) 3325 /* No change since file_open check. */ 3326 return 0; 3327 3328 return selinux_revalidate_file_permission(file, mask); 3329 } 3330 3331 static int selinux_file_alloc_security(struct file *file) 3332 { 3333 return file_alloc_security(file); 3334 } 3335 3336 static void selinux_file_free_security(struct file *file) 3337 { 3338 file_free_security(file); 3339 } 3340 3341 /* 3342 * Check whether a task has the ioctl permission and cmd 3343 * operation to an inode. 3344 */ 3345 static int ioctl_has_perm(const struct cred *cred, struct file *file, 3346 u32 requested, u16 cmd) 3347 { 3348 struct common_audit_data ad; 3349 struct file_security_struct *fsec = file->f_security; 3350 struct inode *inode = file_inode(file); 3351 struct inode_security_struct *isec; 3352 struct lsm_ioctlop_audit ioctl; 3353 u32 ssid = cred_sid(cred); 3354 int rc; 3355 u8 driver = cmd >> 8; 3356 u8 xperm = cmd & 0xff; 3357 3358 ad.type = LSM_AUDIT_DATA_IOCTL_OP; 3359 ad.u.op = &ioctl; 3360 ad.u.op->cmd = cmd; 3361 ad.u.op->path = file->f_path; 3362 3363 if (ssid != fsec->sid) { 3364 rc = avc_has_perm(ssid, fsec->sid, 3365 SECCLASS_FD, 3366 FD__USE, 3367 &ad); 3368 if (rc) 3369 goto out; 3370 } 3371 3372 if (unlikely(IS_PRIVATE(inode))) 3373 return 0; 3374 3375 isec = inode_security(inode); 3376 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass, 3377 requested, driver, xperm, &ad); 3378 out: 3379 return rc; 3380 } 3381 3382 static int selinux_file_ioctl(struct file *file, unsigned int cmd, 3383 unsigned long arg) 3384 { 3385 const struct cred *cred = current_cred(); 3386 int error = 0; 3387 3388 switch (cmd) { 3389 case FIONREAD: 3390 /* fall through */ 3391 case FIBMAP: 3392 /* fall through */ 3393 case FIGETBSZ: 3394 /* fall through */ 3395 case FS_IOC_GETFLAGS: 3396 /* fall through */ 3397 case FS_IOC_GETVERSION: 3398 error = file_has_perm(cred, file, FILE__GETATTR); 3399 break; 3400 3401 case FS_IOC_SETFLAGS: 3402 /* fall through */ 3403 case FS_IOC_SETVERSION: 3404 error = file_has_perm(cred, file, FILE__SETATTR); 3405 break; 3406 3407 /* sys_ioctl() checks */ 3408 case FIONBIO: 3409 /* fall through */ 3410 case FIOASYNC: 3411 error = file_has_perm(cred, file, 0); 3412 break; 3413 3414 case KDSKBENT: 3415 case KDSKBSENT: 3416 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG, 3417 SECURITY_CAP_AUDIT, true); 3418 break; 3419 3420 /* default case assumes that the command will go 3421 * to the file's ioctl() function. 3422 */ 3423 default: 3424 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd); 3425 } 3426 return error; 3427 } 3428 3429 static int default_noexec; 3430 3431 static int file_map_prot_check(struct file *file, unsigned long prot, int shared) 3432 { 3433 const struct cred *cred = current_cred(); 3434 int rc = 0; 3435 3436 if (default_noexec && 3437 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || 3438 (!shared && (prot & PROT_WRITE)))) { 3439 /* 3440 * We are making executable an anonymous mapping or a 3441 * private file mapping that will also be writable. 3442 * This has an additional check. 3443 */ 3444 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM); 3445 if (rc) 3446 goto error; 3447 } 3448 3449 if (file) { 3450 /* read access is always possible with a mapping */ 3451 u32 av = FILE__READ; 3452 3453 /* write access only matters if the mapping is shared */ 3454 if (shared && (prot & PROT_WRITE)) 3455 av |= FILE__WRITE; 3456 3457 if (prot & PROT_EXEC) 3458 av |= FILE__EXECUTE; 3459 3460 return file_has_perm(cred, file, av); 3461 } 3462 3463 error: 3464 return rc; 3465 } 3466 3467 static int selinux_mmap_addr(unsigned long addr) 3468 { 3469 int rc = 0; 3470 3471 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) { 3472 u32 sid = current_sid(); 3473 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT, 3474 MEMPROTECT__MMAP_ZERO, NULL); 3475 } 3476 3477 return rc; 3478 } 3479 3480 static int selinux_mmap_file(struct file *file, unsigned long reqprot, 3481 unsigned long prot, unsigned long flags) 3482 { 3483 if (selinux_checkreqprot) 3484 prot = reqprot; 3485 3486 return file_map_prot_check(file, prot, 3487 (flags & MAP_TYPE) == MAP_SHARED); 3488 } 3489 3490 static int selinux_file_mprotect(struct vm_area_struct *vma, 3491 unsigned long reqprot, 3492 unsigned long prot) 3493 { 3494 const struct cred *cred = current_cred(); 3495 3496 if (selinux_checkreqprot) 3497 prot = reqprot; 3498 3499 if (default_noexec && 3500 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) { 3501 int rc = 0; 3502 if (vma->vm_start >= vma->vm_mm->start_brk && 3503 vma->vm_end <= vma->vm_mm->brk) { 3504 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP); 3505 } else if (!vma->vm_file && 3506 ((vma->vm_start <= vma->vm_mm->start_stack && 3507 vma->vm_end >= vma->vm_mm->start_stack) || 3508 vma_is_stack_for_task(vma, current))) { 3509 rc = current_has_perm(current, PROCESS__EXECSTACK); 3510 } else if (vma->vm_file && vma->anon_vma) { 3511 /* 3512 * We are making executable a file mapping that has 3513 * had some COW done. Since pages might have been 3514 * written, check ability to execute the possibly 3515 * modified content. This typically should only 3516 * occur for text relocations. 3517 */ 3518 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD); 3519 } 3520 if (rc) 3521 return rc; 3522 } 3523 3524 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED); 3525 } 3526 3527 static int selinux_file_lock(struct file *file, unsigned int cmd) 3528 { 3529 const struct cred *cred = current_cred(); 3530 3531 return file_has_perm(cred, file, FILE__LOCK); 3532 } 3533 3534 static int selinux_file_fcntl(struct file *file, unsigned int cmd, 3535 unsigned long arg) 3536 { 3537 const struct cred *cred = current_cred(); 3538 int err = 0; 3539 3540 switch (cmd) { 3541 case F_SETFL: 3542 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) { 3543 err = file_has_perm(cred, file, FILE__WRITE); 3544 break; 3545 } 3546 /* fall through */ 3547 case F_SETOWN: 3548 case F_SETSIG: 3549 case F_GETFL: 3550 case F_GETOWN: 3551 case F_GETSIG: 3552 case F_GETOWNER_UIDS: 3553 /* Just check FD__USE permission */ 3554 err = file_has_perm(cred, file, 0); 3555 break; 3556 case F_GETLK: 3557 case F_SETLK: 3558 case F_SETLKW: 3559 case F_OFD_GETLK: 3560 case F_OFD_SETLK: 3561 case F_OFD_SETLKW: 3562 #if BITS_PER_LONG == 32 3563 case F_GETLK64: 3564 case F_SETLK64: 3565 case F_SETLKW64: 3566 #endif 3567 err = file_has_perm(cred, file, FILE__LOCK); 3568 break; 3569 } 3570 3571 return err; 3572 } 3573 3574 static void selinux_file_set_fowner(struct file *file) 3575 { 3576 struct file_security_struct *fsec; 3577 3578 fsec = file->f_security; 3579 fsec->fown_sid = current_sid(); 3580 } 3581 3582 static int selinux_file_send_sigiotask(struct task_struct *tsk, 3583 struct fown_struct *fown, int signum) 3584 { 3585 struct file *file; 3586 u32 sid = task_sid(tsk); 3587 u32 perm; 3588 struct file_security_struct *fsec; 3589 3590 /* struct fown_struct is never outside the context of a struct file */ 3591 file = container_of(fown, struct file, f_owner); 3592 3593 fsec = file->f_security; 3594 3595 if (!signum) 3596 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */ 3597 else 3598 perm = signal_to_av(signum); 3599 3600 return avc_has_perm(fsec->fown_sid, sid, 3601 SECCLASS_PROCESS, perm, NULL); 3602 } 3603 3604 static int selinux_file_receive(struct file *file) 3605 { 3606 const struct cred *cred = current_cred(); 3607 3608 return file_has_perm(cred, file, file_to_av(file)); 3609 } 3610 3611 static int selinux_file_open(struct file *file, const struct cred *cred) 3612 { 3613 struct file_security_struct *fsec; 3614 struct inode_security_struct *isec; 3615 3616 fsec = file->f_security; 3617 isec = inode_security(file_inode(file)); 3618 /* 3619 * Save inode label and policy sequence number 3620 * at open-time so that selinux_file_permission 3621 * can determine whether revalidation is necessary. 3622 * Task label is already saved in the file security 3623 * struct as its SID. 3624 */ 3625 fsec->isid = isec->sid; 3626 fsec->pseqno = avc_policy_seqno(); 3627 /* 3628 * Since the inode label or policy seqno may have changed 3629 * between the selinux_inode_permission check and the saving 3630 * of state above, recheck that access is still permitted. 3631 * Otherwise, access might never be revalidated against the 3632 * new inode label or new policy. 3633 * This check is not redundant - do not remove. 3634 */ 3635 return file_path_has_perm(cred, file, open_file_to_av(file)); 3636 } 3637 3638 /* task security operations */ 3639 3640 static int selinux_task_create(unsigned long clone_flags) 3641 { 3642 return current_has_perm(current, PROCESS__FORK); 3643 } 3644 3645 /* 3646 * allocate the SELinux part of blank credentials 3647 */ 3648 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp) 3649 { 3650 struct task_security_struct *tsec; 3651 3652 tsec = kzalloc(sizeof(struct task_security_struct), gfp); 3653 if (!tsec) 3654 return -ENOMEM; 3655 3656 cred->security = tsec; 3657 return 0; 3658 } 3659 3660 /* 3661 * detach and free the LSM part of a set of credentials 3662 */ 3663 static void selinux_cred_free(struct cred *cred) 3664 { 3665 struct task_security_struct *tsec = cred->security; 3666 3667 /* 3668 * cred->security == NULL if security_cred_alloc_blank() or 3669 * security_prepare_creds() returned an error. 3670 */ 3671 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE); 3672 cred->security = (void *) 0x7UL; 3673 kfree(tsec); 3674 } 3675 3676 /* 3677 * prepare a new set of credentials for modification 3678 */ 3679 static int selinux_cred_prepare(struct cred *new, const struct cred *old, 3680 gfp_t gfp) 3681 { 3682 const struct task_security_struct *old_tsec; 3683 struct task_security_struct *tsec; 3684 3685 old_tsec = old->security; 3686 3687 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp); 3688 if (!tsec) 3689 return -ENOMEM; 3690 3691 new->security = tsec; 3692 return 0; 3693 } 3694 3695 /* 3696 * transfer the SELinux data to a blank set of creds 3697 */ 3698 static void selinux_cred_transfer(struct cred *new, const struct cred *old) 3699 { 3700 const struct task_security_struct *old_tsec = old->security; 3701 struct task_security_struct *tsec = new->security; 3702 3703 *tsec = *old_tsec; 3704 } 3705 3706 /* 3707 * set the security data for a kernel service 3708 * - all the creation contexts are set to unlabelled 3709 */ 3710 static int selinux_kernel_act_as(struct cred *new, u32 secid) 3711 { 3712 struct task_security_struct *tsec = new->security; 3713 u32 sid = current_sid(); 3714 int ret; 3715 3716 ret = avc_has_perm(sid, secid, 3717 SECCLASS_KERNEL_SERVICE, 3718 KERNEL_SERVICE__USE_AS_OVERRIDE, 3719 NULL); 3720 if (ret == 0) { 3721 tsec->sid = secid; 3722 tsec->create_sid = 0; 3723 tsec->keycreate_sid = 0; 3724 tsec->sockcreate_sid = 0; 3725 } 3726 return ret; 3727 } 3728 3729 /* 3730 * set the file creation context in a security record to the same as the 3731 * objective context of the specified inode 3732 */ 3733 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode) 3734 { 3735 struct inode_security_struct *isec = inode_security(inode); 3736 struct task_security_struct *tsec = new->security; 3737 u32 sid = current_sid(); 3738 int ret; 3739 3740 ret = avc_has_perm(sid, isec->sid, 3741 SECCLASS_KERNEL_SERVICE, 3742 KERNEL_SERVICE__CREATE_FILES_AS, 3743 NULL); 3744 3745 if (ret == 0) 3746 tsec->create_sid = isec->sid; 3747 return ret; 3748 } 3749 3750 static int selinux_kernel_module_request(char *kmod_name) 3751 { 3752 u32 sid; 3753 struct common_audit_data ad; 3754 3755 sid = task_sid(current); 3756 3757 ad.type = LSM_AUDIT_DATA_KMOD; 3758 ad.u.kmod_name = kmod_name; 3759 3760 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM, 3761 SYSTEM__MODULE_REQUEST, &ad); 3762 } 3763 3764 static int selinux_kernel_module_from_file(struct file *file) 3765 { 3766 struct common_audit_data ad; 3767 struct inode_security_struct *isec; 3768 struct file_security_struct *fsec; 3769 u32 sid = current_sid(); 3770 int rc; 3771 3772 /* init_module */ 3773 if (file == NULL) 3774 return avc_has_perm(sid, sid, SECCLASS_SYSTEM, 3775 SYSTEM__MODULE_LOAD, NULL); 3776 3777 /* finit_module */ 3778 3779 ad.type = LSM_AUDIT_DATA_PATH; 3780 ad.u.path = file->f_path; 3781 3782 fsec = file->f_security; 3783 if (sid != fsec->sid) { 3784 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad); 3785 if (rc) 3786 return rc; 3787 } 3788 3789 isec = inode_security(file_inode(file)); 3790 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM, 3791 SYSTEM__MODULE_LOAD, &ad); 3792 } 3793 3794 static int selinux_kernel_read_file(struct file *file, 3795 enum kernel_read_file_id id) 3796 { 3797 int rc = 0; 3798 3799 switch (id) { 3800 case READING_MODULE: 3801 rc = selinux_kernel_module_from_file(file); 3802 break; 3803 default: 3804 break; 3805 } 3806 3807 return rc; 3808 } 3809 3810 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid) 3811 { 3812 return current_has_perm(p, PROCESS__SETPGID); 3813 } 3814 3815 static int selinux_task_getpgid(struct task_struct *p) 3816 { 3817 return current_has_perm(p, PROCESS__GETPGID); 3818 } 3819 3820 static int selinux_task_getsid(struct task_struct *p) 3821 { 3822 return current_has_perm(p, PROCESS__GETSESSION); 3823 } 3824 3825 static void selinux_task_getsecid(struct task_struct *p, u32 *secid) 3826 { 3827 *secid = task_sid(p); 3828 } 3829 3830 static int selinux_task_setnice(struct task_struct *p, int nice) 3831 { 3832 return current_has_perm(p, PROCESS__SETSCHED); 3833 } 3834 3835 static int selinux_task_setioprio(struct task_struct *p, int ioprio) 3836 { 3837 return current_has_perm(p, PROCESS__SETSCHED); 3838 } 3839 3840 static int selinux_task_getioprio(struct task_struct *p) 3841 { 3842 return current_has_perm(p, PROCESS__GETSCHED); 3843 } 3844 3845 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource, 3846 struct rlimit *new_rlim) 3847 { 3848 struct rlimit *old_rlim = p->signal->rlim + resource; 3849 3850 /* Control the ability to change the hard limit (whether 3851 lowering or raising it), so that the hard limit can 3852 later be used as a safe reset point for the soft limit 3853 upon context transitions. See selinux_bprm_committing_creds. */ 3854 if (old_rlim->rlim_max != new_rlim->rlim_max) 3855 return current_has_perm(p, PROCESS__SETRLIMIT); 3856 3857 return 0; 3858 } 3859 3860 static int selinux_task_setscheduler(struct task_struct *p) 3861 { 3862 return current_has_perm(p, PROCESS__SETSCHED); 3863 } 3864 3865 static int selinux_task_getscheduler(struct task_struct *p) 3866 { 3867 return current_has_perm(p, PROCESS__GETSCHED); 3868 } 3869 3870 static int selinux_task_movememory(struct task_struct *p) 3871 { 3872 return current_has_perm(p, PROCESS__SETSCHED); 3873 } 3874 3875 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, 3876 int sig, u32 secid) 3877 { 3878 u32 perm; 3879 int rc; 3880 3881 if (!sig) 3882 perm = PROCESS__SIGNULL; /* null signal; existence test */ 3883 else 3884 perm = signal_to_av(sig); 3885 if (secid) 3886 rc = avc_has_perm(secid, task_sid(p), 3887 SECCLASS_PROCESS, perm, NULL); 3888 else 3889 rc = current_has_perm(p, perm); 3890 return rc; 3891 } 3892 3893 static int selinux_task_wait(struct task_struct *p) 3894 { 3895 return task_has_perm(p, current, PROCESS__SIGCHLD); 3896 } 3897 3898 static void selinux_task_to_inode(struct task_struct *p, 3899 struct inode *inode) 3900 { 3901 struct inode_security_struct *isec = inode->i_security; 3902 u32 sid = task_sid(p); 3903 3904 isec->sid = sid; 3905 isec->initialized = LABEL_INITIALIZED; 3906 } 3907 3908 /* Returns error only if unable to parse addresses */ 3909 static int selinux_parse_skb_ipv4(struct sk_buff *skb, 3910 struct common_audit_data *ad, u8 *proto) 3911 { 3912 int offset, ihlen, ret = -EINVAL; 3913 struct iphdr _iph, *ih; 3914 3915 offset = skb_network_offset(skb); 3916 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph); 3917 if (ih == NULL) 3918 goto out; 3919 3920 ihlen = ih->ihl * 4; 3921 if (ihlen < sizeof(_iph)) 3922 goto out; 3923 3924 ad->u.net->v4info.saddr = ih->saddr; 3925 ad->u.net->v4info.daddr = ih->daddr; 3926 ret = 0; 3927 3928 if (proto) 3929 *proto = ih->protocol; 3930 3931 switch (ih->protocol) { 3932 case IPPROTO_TCP: { 3933 struct tcphdr _tcph, *th; 3934 3935 if (ntohs(ih->frag_off) & IP_OFFSET) 3936 break; 3937 3938 offset += ihlen; 3939 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 3940 if (th == NULL) 3941 break; 3942 3943 ad->u.net->sport = th->source; 3944 ad->u.net->dport = th->dest; 3945 break; 3946 } 3947 3948 case IPPROTO_UDP: { 3949 struct udphdr _udph, *uh; 3950 3951 if (ntohs(ih->frag_off) & IP_OFFSET) 3952 break; 3953 3954 offset += ihlen; 3955 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 3956 if (uh == NULL) 3957 break; 3958 3959 ad->u.net->sport = uh->source; 3960 ad->u.net->dport = uh->dest; 3961 break; 3962 } 3963 3964 case IPPROTO_DCCP: { 3965 struct dccp_hdr _dccph, *dh; 3966 3967 if (ntohs(ih->frag_off) & IP_OFFSET) 3968 break; 3969 3970 offset += ihlen; 3971 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); 3972 if (dh == NULL) 3973 break; 3974 3975 ad->u.net->sport = dh->dccph_sport; 3976 ad->u.net->dport = dh->dccph_dport; 3977 break; 3978 } 3979 3980 default: 3981 break; 3982 } 3983 out: 3984 return ret; 3985 } 3986 3987 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3988 3989 /* Returns error only if unable to parse addresses */ 3990 static int selinux_parse_skb_ipv6(struct sk_buff *skb, 3991 struct common_audit_data *ad, u8 *proto) 3992 { 3993 u8 nexthdr; 3994 int ret = -EINVAL, offset; 3995 struct ipv6hdr _ipv6h, *ip6; 3996 __be16 frag_off; 3997 3998 offset = skb_network_offset(skb); 3999 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h); 4000 if (ip6 == NULL) 4001 goto out; 4002 4003 ad->u.net->v6info.saddr = ip6->saddr; 4004 ad->u.net->v6info.daddr = ip6->daddr; 4005 ret = 0; 4006 4007 nexthdr = ip6->nexthdr; 4008 offset += sizeof(_ipv6h); 4009 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 4010 if (offset < 0) 4011 goto out; 4012 4013 if (proto) 4014 *proto = nexthdr; 4015 4016 switch (nexthdr) { 4017 case IPPROTO_TCP: { 4018 struct tcphdr _tcph, *th; 4019 4020 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 4021 if (th == NULL) 4022 break; 4023 4024 ad->u.net->sport = th->source; 4025 ad->u.net->dport = th->dest; 4026 break; 4027 } 4028 4029 case IPPROTO_UDP: { 4030 struct udphdr _udph, *uh; 4031 4032 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 4033 if (uh == NULL) 4034 break; 4035 4036 ad->u.net->sport = uh->source; 4037 ad->u.net->dport = uh->dest; 4038 break; 4039 } 4040 4041 case IPPROTO_DCCP: { 4042 struct dccp_hdr _dccph, *dh; 4043 4044 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); 4045 if (dh == NULL) 4046 break; 4047 4048 ad->u.net->sport = dh->dccph_sport; 4049 ad->u.net->dport = dh->dccph_dport; 4050 break; 4051 } 4052 4053 /* includes fragments */ 4054 default: 4055 break; 4056 } 4057 out: 4058 return ret; 4059 } 4060 4061 #endif /* IPV6 */ 4062 4063 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad, 4064 char **_addrp, int src, u8 *proto) 4065 { 4066 char *addrp; 4067 int ret; 4068 4069 switch (ad->u.net->family) { 4070 case PF_INET: 4071 ret = selinux_parse_skb_ipv4(skb, ad, proto); 4072 if (ret) 4073 goto parse_error; 4074 addrp = (char *)(src ? &ad->u.net->v4info.saddr : 4075 &ad->u.net->v4info.daddr); 4076 goto okay; 4077 4078 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 4079 case PF_INET6: 4080 ret = selinux_parse_skb_ipv6(skb, ad, proto); 4081 if (ret) 4082 goto parse_error; 4083 addrp = (char *)(src ? &ad->u.net->v6info.saddr : 4084 &ad->u.net->v6info.daddr); 4085 goto okay; 4086 #endif /* IPV6 */ 4087 default: 4088 addrp = NULL; 4089 goto okay; 4090 } 4091 4092 parse_error: 4093 printk(KERN_WARNING 4094 "SELinux: failure in selinux_parse_skb()," 4095 " unable to parse packet\n"); 4096 return ret; 4097 4098 okay: 4099 if (_addrp) 4100 *_addrp = addrp; 4101 return 0; 4102 } 4103 4104 /** 4105 * selinux_skb_peerlbl_sid - Determine the peer label of a packet 4106 * @skb: the packet 4107 * @family: protocol family 4108 * @sid: the packet's peer label SID 4109 * 4110 * Description: 4111 * Check the various different forms of network peer labeling and determine 4112 * the peer label/SID for the packet; most of the magic actually occurs in 4113 * the security server function security_net_peersid_cmp(). The function 4114 * returns zero if the value in @sid is valid (although it may be SECSID_NULL) 4115 * or -EACCES if @sid is invalid due to inconsistencies with the different 4116 * peer labels. 4117 * 4118 */ 4119 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid) 4120 { 4121 int err; 4122 u32 xfrm_sid; 4123 u32 nlbl_sid; 4124 u32 nlbl_type; 4125 4126 err = selinux_xfrm_skb_sid(skb, &xfrm_sid); 4127 if (unlikely(err)) 4128 return -EACCES; 4129 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid); 4130 if (unlikely(err)) 4131 return -EACCES; 4132 4133 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid); 4134 if (unlikely(err)) { 4135 printk(KERN_WARNING 4136 "SELinux: failure in selinux_skb_peerlbl_sid()," 4137 " unable to determine packet's peer label\n"); 4138 return -EACCES; 4139 } 4140 4141 return 0; 4142 } 4143 4144 /** 4145 * selinux_conn_sid - Determine the child socket label for a connection 4146 * @sk_sid: the parent socket's SID 4147 * @skb_sid: the packet's SID 4148 * @conn_sid: the resulting connection SID 4149 * 4150 * If @skb_sid is valid then the user:role:type information from @sk_sid is 4151 * combined with the MLS information from @skb_sid in order to create 4152 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy 4153 * of @sk_sid. Returns zero on success, negative values on failure. 4154 * 4155 */ 4156 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid) 4157 { 4158 int err = 0; 4159 4160 if (skb_sid != SECSID_NULL) 4161 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid); 4162 else 4163 *conn_sid = sk_sid; 4164 4165 return err; 4166 } 4167 4168 /* socket security operations */ 4169 4170 static int socket_sockcreate_sid(const struct task_security_struct *tsec, 4171 u16 secclass, u32 *socksid) 4172 { 4173 if (tsec->sockcreate_sid > SECSID_NULL) { 4174 *socksid = tsec->sockcreate_sid; 4175 return 0; 4176 } 4177 4178 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL, 4179 socksid); 4180 } 4181 4182 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms) 4183 { 4184 struct sk_security_struct *sksec = sk->sk_security; 4185 struct common_audit_data ad; 4186 struct lsm_network_audit net = {0,}; 4187 u32 tsid = task_sid(task); 4188 4189 if (sksec->sid == SECINITSID_KERNEL) 4190 return 0; 4191 4192 ad.type = LSM_AUDIT_DATA_NET; 4193 ad.u.net = &net; 4194 ad.u.net->sk = sk; 4195 4196 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad); 4197 } 4198 4199 static int selinux_socket_create(int family, int type, 4200 int protocol, int kern) 4201 { 4202 const struct task_security_struct *tsec = current_security(); 4203 u32 newsid; 4204 u16 secclass; 4205 int rc; 4206 4207 if (kern) 4208 return 0; 4209 4210 secclass = socket_type_to_security_class(family, type, protocol); 4211 rc = socket_sockcreate_sid(tsec, secclass, &newsid); 4212 if (rc) 4213 return rc; 4214 4215 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL); 4216 } 4217 4218 static int selinux_socket_post_create(struct socket *sock, int family, 4219 int type, int protocol, int kern) 4220 { 4221 const struct task_security_struct *tsec = current_security(); 4222 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock)); 4223 struct sk_security_struct *sksec; 4224 int err = 0; 4225 4226 isec->sclass = socket_type_to_security_class(family, type, protocol); 4227 4228 if (kern) 4229 isec->sid = SECINITSID_KERNEL; 4230 else { 4231 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid)); 4232 if (err) 4233 return err; 4234 } 4235 4236 isec->initialized = LABEL_INITIALIZED; 4237 4238 if (sock->sk) { 4239 sksec = sock->sk->sk_security; 4240 sksec->sid = isec->sid; 4241 sksec->sclass = isec->sclass; 4242 err = selinux_netlbl_socket_post_create(sock->sk, family); 4243 } 4244 4245 return err; 4246 } 4247 4248 /* Range of port numbers used to automatically bind. 4249 Need to determine whether we should perform a name_bind 4250 permission check between the socket and the port number. */ 4251 4252 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) 4253 { 4254 struct sock *sk = sock->sk; 4255 u16 family; 4256 int err; 4257 4258 err = sock_has_perm(current, sk, SOCKET__BIND); 4259 if (err) 4260 goto out; 4261 4262 /* 4263 * If PF_INET or PF_INET6, check name_bind permission for the port. 4264 * Multiple address binding for SCTP is not supported yet: we just 4265 * check the first address now. 4266 */ 4267 family = sk->sk_family; 4268 if (family == PF_INET || family == PF_INET6) { 4269 char *addrp; 4270 struct sk_security_struct *sksec = sk->sk_security; 4271 struct common_audit_data ad; 4272 struct lsm_network_audit net = {0,}; 4273 struct sockaddr_in *addr4 = NULL; 4274 struct sockaddr_in6 *addr6 = NULL; 4275 unsigned short snum; 4276 u32 sid, node_perm; 4277 4278 if (family == PF_INET) { 4279 addr4 = (struct sockaddr_in *)address; 4280 snum = ntohs(addr4->sin_port); 4281 addrp = (char *)&addr4->sin_addr.s_addr; 4282 } else { 4283 addr6 = (struct sockaddr_in6 *)address; 4284 snum = ntohs(addr6->sin6_port); 4285 addrp = (char *)&addr6->sin6_addr.s6_addr; 4286 } 4287 4288 if (snum) { 4289 int low, high; 4290 4291 inet_get_local_port_range(sock_net(sk), &low, &high); 4292 4293 if (snum < max(PROT_SOCK, low) || snum > high) { 4294 err = sel_netport_sid(sk->sk_protocol, 4295 snum, &sid); 4296 if (err) 4297 goto out; 4298 ad.type = LSM_AUDIT_DATA_NET; 4299 ad.u.net = &net; 4300 ad.u.net->sport = htons(snum); 4301 ad.u.net->family = family; 4302 err = avc_has_perm(sksec->sid, sid, 4303 sksec->sclass, 4304 SOCKET__NAME_BIND, &ad); 4305 if (err) 4306 goto out; 4307 } 4308 } 4309 4310 switch (sksec->sclass) { 4311 case SECCLASS_TCP_SOCKET: 4312 node_perm = TCP_SOCKET__NODE_BIND; 4313 break; 4314 4315 case SECCLASS_UDP_SOCKET: 4316 node_perm = UDP_SOCKET__NODE_BIND; 4317 break; 4318 4319 case SECCLASS_DCCP_SOCKET: 4320 node_perm = DCCP_SOCKET__NODE_BIND; 4321 break; 4322 4323 default: 4324 node_perm = RAWIP_SOCKET__NODE_BIND; 4325 break; 4326 } 4327 4328 err = sel_netnode_sid(addrp, family, &sid); 4329 if (err) 4330 goto out; 4331 4332 ad.type = LSM_AUDIT_DATA_NET; 4333 ad.u.net = &net; 4334 ad.u.net->sport = htons(snum); 4335 ad.u.net->family = family; 4336 4337 if (family == PF_INET) 4338 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr; 4339 else 4340 ad.u.net->v6info.saddr = addr6->sin6_addr; 4341 4342 err = avc_has_perm(sksec->sid, sid, 4343 sksec->sclass, node_perm, &ad); 4344 if (err) 4345 goto out; 4346 } 4347 out: 4348 return err; 4349 } 4350 4351 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen) 4352 { 4353 struct sock *sk = sock->sk; 4354 struct sk_security_struct *sksec = sk->sk_security; 4355 int err; 4356 4357 err = sock_has_perm(current, sk, SOCKET__CONNECT); 4358 if (err) 4359 return err; 4360 4361 /* 4362 * If a TCP or DCCP socket, check name_connect permission for the port. 4363 */ 4364 if (sksec->sclass == SECCLASS_TCP_SOCKET || 4365 sksec->sclass == SECCLASS_DCCP_SOCKET) { 4366 struct common_audit_data ad; 4367 struct lsm_network_audit net = {0,}; 4368 struct sockaddr_in *addr4 = NULL; 4369 struct sockaddr_in6 *addr6 = NULL; 4370 unsigned short snum; 4371 u32 sid, perm; 4372 4373 if (sk->sk_family == PF_INET) { 4374 addr4 = (struct sockaddr_in *)address; 4375 if (addrlen < sizeof(struct sockaddr_in)) 4376 return -EINVAL; 4377 snum = ntohs(addr4->sin_port); 4378 } else { 4379 addr6 = (struct sockaddr_in6 *)address; 4380 if (addrlen < SIN6_LEN_RFC2133) 4381 return -EINVAL; 4382 snum = ntohs(addr6->sin6_port); 4383 } 4384 4385 err = sel_netport_sid(sk->sk_protocol, snum, &sid); 4386 if (err) 4387 goto out; 4388 4389 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ? 4390 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT; 4391 4392 ad.type = LSM_AUDIT_DATA_NET; 4393 ad.u.net = &net; 4394 ad.u.net->dport = htons(snum); 4395 ad.u.net->family = sk->sk_family; 4396 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad); 4397 if (err) 4398 goto out; 4399 } 4400 4401 err = selinux_netlbl_socket_connect(sk, address); 4402 4403 out: 4404 return err; 4405 } 4406 4407 static int selinux_socket_listen(struct socket *sock, int backlog) 4408 { 4409 return sock_has_perm(current, sock->sk, SOCKET__LISTEN); 4410 } 4411 4412 static int selinux_socket_accept(struct socket *sock, struct socket *newsock) 4413 { 4414 int err; 4415 struct inode_security_struct *isec; 4416 struct inode_security_struct *newisec; 4417 4418 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT); 4419 if (err) 4420 return err; 4421 4422 newisec = inode_security_novalidate(SOCK_INODE(newsock)); 4423 4424 isec = inode_security_novalidate(SOCK_INODE(sock)); 4425 newisec->sclass = isec->sclass; 4426 newisec->sid = isec->sid; 4427 newisec->initialized = LABEL_INITIALIZED; 4428 4429 return 0; 4430 } 4431 4432 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg, 4433 int size) 4434 { 4435 return sock_has_perm(current, sock->sk, SOCKET__WRITE); 4436 } 4437 4438 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg, 4439 int size, int flags) 4440 { 4441 return sock_has_perm(current, sock->sk, SOCKET__READ); 4442 } 4443 4444 static int selinux_socket_getsockname(struct socket *sock) 4445 { 4446 return sock_has_perm(current, sock->sk, SOCKET__GETATTR); 4447 } 4448 4449 static int selinux_socket_getpeername(struct socket *sock) 4450 { 4451 return sock_has_perm(current, sock->sk, SOCKET__GETATTR); 4452 } 4453 4454 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname) 4455 { 4456 int err; 4457 4458 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT); 4459 if (err) 4460 return err; 4461 4462 return selinux_netlbl_socket_setsockopt(sock, level, optname); 4463 } 4464 4465 static int selinux_socket_getsockopt(struct socket *sock, int level, 4466 int optname) 4467 { 4468 return sock_has_perm(current, sock->sk, SOCKET__GETOPT); 4469 } 4470 4471 static int selinux_socket_shutdown(struct socket *sock, int how) 4472 { 4473 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN); 4474 } 4475 4476 static int selinux_socket_unix_stream_connect(struct sock *sock, 4477 struct sock *other, 4478 struct sock *newsk) 4479 { 4480 struct sk_security_struct *sksec_sock = sock->sk_security; 4481 struct sk_security_struct *sksec_other = other->sk_security; 4482 struct sk_security_struct *sksec_new = newsk->sk_security; 4483 struct common_audit_data ad; 4484 struct lsm_network_audit net = {0,}; 4485 int err; 4486 4487 ad.type = LSM_AUDIT_DATA_NET; 4488 ad.u.net = &net; 4489 ad.u.net->sk = other; 4490 4491 err = avc_has_perm(sksec_sock->sid, sksec_other->sid, 4492 sksec_other->sclass, 4493 UNIX_STREAM_SOCKET__CONNECTTO, &ad); 4494 if (err) 4495 return err; 4496 4497 /* server child socket */ 4498 sksec_new->peer_sid = sksec_sock->sid; 4499 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid, 4500 &sksec_new->sid); 4501 if (err) 4502 return err; 4503 4504 /* connecting socket */ 4505 sksec_sock->peer_sid = sksec_new->sid; 4506 4507 return 0; 4508 } 4509 4510 static int selinux_socket_unix_may_send(struct socket *sock, 4511 struct socket *other) 4512 { 4513 struct sk_security_struct *ssec = sock->sk->sk_security; 4514 struct sk_security_struct *osec = other->sk->sk_security; 4515 struct common_audit_data ad; 4516 struct lsm_network_audit net = {0,}; 4517 4518 ad.type = LSM_AUDIT_DATA_NET; 4519 ad.u.net = &net; 4520 ad.u.net->sk = other->sk; 4521 4522 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO, 4523 &ad); 4524 } 4525 4526 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex, 4527 char *addrp, u16 family, u32 peer_sid, 4528 struct common_audit_data *ad) 4529 { 4530 int err; 4531 u32 if_sid; 4532 u32 node_sid; 4533 4534 err = sel_netif_sid(ns, ifindex, &if_sid); 4535 if (err) 4536 return err; 4537 err = avc_has_perm(peer_sid, if_sid, 4538 SECCLASS_NETIF, NETIF__INGRESS, ad); 4539 if (err) 4540 return err; 4541 4542 err = sel_netnode_sid(addrp, family, &node_sid); 4543 if (err) 4544 return err; 4545 return avc_has_perm(peer_sid, node_sid, 4546 SECCLASS_NODE, NODE__RECVFROM, ad); 4547 } 4548 4549 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, 4550 u16 family) 4551 { 4552 int err = 0; 4553 struct sk_security_struct *sksec = sk->sk_security; 4554 u32 sk_sid = sksec->sid; 4555 struct common_audit_data ad; 4556 struct lsm_network_audit net = {0,}; 4557 char *addrp; 4558 4559 ad.type = LSM_AUDIT_DATA_NET; 4560 ad.u.net = &net; 4561 ad.u.net->netif = skb->skb_iif; 4562 ad.u.net->family = family; 4563 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL); 4564 if (err) 4565 return err; 4566 4567 if (selinux_secmark_enabled()) { 4568 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, 4569 PACKET__RECV, &ad); 4570 if (err) 4571 return err; 4572 } 4573 4574 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad); 4575 if (err) 4576 return err; 4577 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad); 4578 4579 return err; 4580 } 4581 4582 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 4583 { 4584 int err; 4585 struct sk_security_struct *sksec = sk->sk_security; 4586 u16 family = sk->sk_family; 4587 u32 sk_sid = sksec->sid; 4588 struct common_audit_data ad; 4589 struct lsm_network_audit net = {0,}; 4590 char *addrp; 4591 u8 secmark_active; 4592 u8 peerlbl_active; 4593 4594 if (family != PF_INET && family != PF_INET6) 4595 return 0; 4596 4597 /* Handle mapped IPv4 packets arriving via IPv6 sockets */ 4598 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 4599 family = PF_INET; 4600 4601 /* If any sort of compatibility mode is enabled then handoff processing 4602 * to the selinux_sock_rcv_skb_compat() function to deal with the 4603 * special handling. We do this in an attempt to keep this function 4604 * as fast and as clean as possible. */ 4605 if (!selinux_policycap_netpeer) 4606 return selinux_sock_rcv_skb_compat(sk, skb, family); 4607 4608 secmark_active = selinux_secmark_enabled(); 4609 peerlbl_active = selinux_peerlbl_enabled(); 4610 if (!secmark_active && !peerlbl_active) 4611 return 0; 4612 4613 ad.type = LSM_AUDIT_DATA_NET; 4614 ad.u.net = &net; 4615 ad.u.net->netif = skb->skb_iif; 4616 ad.u.net->family = family; 4617 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL); 4618 if (err) 4619 return err; 4620 4621 if (peerlbl_active) { 4622 u32 peer_sid; 4623 4624 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid); 4625 if (err) 4626 return err; 4627 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif, 4628 addrp, family, peer_sid, &ad); 4629 if (err) { 4630 selinux_netlbl_err(skb, family, err, 0); 4631 return err; 4632 } 4633 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER, 4634 PEER__RECV, &ad); 4635 if (err) { 4636 selinux_netlbl_err(skb, family, err, 0); 4637 return err; 4638 } 4639 } 4640 4641 if (secmark_active) { 4642 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, 4643 PACKET__RECV, &ad); 4644 if (err) 4645 return err; 4646 } 4647 4648 return err; 4649 } 4650 4651 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval, 4652 int __user *optlen, unsigned len) 4653 { 4654 int err = 0; 4655 char *scontext; 4656 u32 scontext_len; 4657 struct sk_security_struct *sksec = sock->sk->sk_security; 4658 u32 peer_sid = SECSID_NULL; 4659 4660 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET || 4661 sksec->sclass == SECCLASS_TCP_SOCKET) 4662 peer_sid = sksec->peer_sid; 4663 if (peer_sid == SECSID_NULL) 4664 return -ENOPROTOOPT; 4665 4666 err = security_sid_to_context(peer_sid, &scontext, &scontext_len); 4667 if (err) 4668 return err; 4669 4670 if (scontext_len > len) { 4671 err = -ERANGE; 4672 goto out_len; 4673 } 4674 4675 if (copy_to_user(optval, scontext, scontext_len)) 4676 err = -EFAULT; 4677 4678 out_len: 4679 if (put_user(scontext_len, optlen)) 4680 err = -EFAULT; 4681 kfree(scontext); 4682 return err; 4683 } 4684 4685 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) 4686 { 4687 u32 peer_secid = SECSID_NULL; 4688 u16 family; 4689 struct inode_security_struct *isec; 4690 4691 if (skb && skb->protocol == htons(ETH_P_IP)) 4692 family = PF_INET; 4693 else if (skb && skb->protocol == htons(ETH_P_IPV6)) 4694 family = PF_INET6; 4695 else if (sock) 4696 family = sock->sk->sk_family; 4697 else 4698 goto out; 4699 4700 if (sock && family == PF_UNIX) { 4701 isec = inode_security_novalidate(SOCK_INODE(sock)); 4702 peer_secid = isec->sid; 4703 } else if (skb) 4704 selinux_skb_peerlbl_sid(skb, family, &peer_secid); 4705 4706 out: 4707 *secid = peer_secid; 4708 if (peer_secid == SECSID_NULL) 4709 return -EINVAL; 4710 return 0; 4711 } 4712 4713 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority) 4714 { 4715 struct sk_security_struct *sksec; 4716 4717 sksec = kzalloc(sizeof(*sksec), priority); 4718 if (!sksec) 4719 return -ENOMEM; 4720 4721 sksec->peer_sid = SECINITSID_UNLABELED; 4722 sksec->sid = SECINITSID_UNLABELED; 4723 sksec->sclass = SECCLASS_SOCKET; 4724 selinux_netlbl_sk_security_reset(sksec); 4725 sk->sk_security = sksec; 4726 4727 return 0; 4728 } 4729 4730 static void selinux_sk_free_security(struct sock *sk) 4731 { 4732 struct sk_security_struct *sksec = sk->sk_security; 4733 4734 sk->sk_security = NULL; 4735 selinux_netlbl_sk_security_free(sksec); 4736 kfree(sksec); 4737 } 4738 4739 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk) 4740 { 4741 struct sk_security_struct *sksec = sk->sk_security; 4742 struct sk_security_struct *newsksec = newsk->sk_security; 4743 4744 newsksec->sid = sksec->sid; 4745 newsksec->peer_sid = sksec->peer_sid; 4746 newsksec->sclass = sksec->sclass; 4747 4748 selinux_netlbl_sk_security_reset(newsksec); 4749 } 4750 4751 static void selinux_sk_getsecid(struct sock *sk, u32 *secid) 4752 { 4753 if (!sk) 4754 *secid = SECINITSID_ANY_SOCKET; 4755 else { 4756 struct sk_security_struct *sksec = sk->sk_security; 4757 4758 *secid = sksec->sid; 4759 } 4760 } 4761 4762 static void selinux_sock_graft(struct sock *sk, struct socket *parent) 4763 { 4764 struct inode_security_struct *isec = 4765 inode_security_novalidate(SOCK_INODE(parent)); 4766 struct sk_security_struct *sksec = sk->sk_security; 4767 4768 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 || 4769 sk->sk_family == PF_UNIX) 4770 isec->sid = sksec->sid; 4771 sksec->sclass = isec->sclass; 4772 } 4773 4774 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb, 4775 struct request_sock *req) 4776 { 4777 struct sk_security_struct *sksec = sk->sk_security; 4778 int err; 4779 u16 family = req->rsk_ops->family; 4780 u32 connsid; 4781 u32 peersid; 4782 4783 err = selinux_skb_peerlbl_sid(skb, family, &peersid); 4784 if (err) 4785 return err; 4786 err = selinux_conn_sid(sksec->sid, peersid, &connsid); 4787 if (err) 4788 return err; 4789 req->secid = connsid; 4790 req->peer_secid = peersid; 4791 4792 return selinux_netlbl_inet_conn_request(req, family); 4793 } 4794 4795 static void selinux_inet_csk_clone(struct sock *newsk, 4796 const struct request_sock *req) 4797 { 4798 struct sk_security_struct *newsksec = newsk->sk_security; 4799 4800 newsksec->sid = req->secid; 4801 newsksec->peer_sid = req->peer_secid; 4802 /* NOTE: Ideally, we should also get the isec->sid for the 4803 new socket in sync, but we don't have the isec available yet. 4804 So we will wait until sock_graft to do it, by which 4805 time it will have been created and available. */ 4806 4807 /* We don't need to take any sort of lock here as we are the only 4808 * thread with access to newsksec */ 4809 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family); 4810 } 4811 4812 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb) 4813 { 4814 u16 family = sk->sk_family; 4815 struct sk_security_struct *sksec = sk->sk_security; 4816 4817 /* handle mapped IPv4 packets arriving via IPv6 sockets */ 4818 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 4819 family = PF_INET; 4820 4821 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid); 4822 } 4823 4824 static int selinux_secmark_relabel_packet(u32 sid) 4825 { 4826 const struct task_security_struct *__tsec; 4827 u32 tsid; 4828 4829 __tsec = current_security(); 4830 tsid = __tsec->sid; 4831 4832 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL); 4833 } 4834 4835 static void selinux_secmark_refcount_inc(void) 4836 { 4837 atomic_inc(&selinux_secmark_refcount); 4838 } 4839 4840 static void selinux_secmark_refcount_dec(void) 4841 { 4842 atomic_dec(&selinux_secmark_refcount); 4843 } 4844 4845 static void selinux_req_classify_flow(const struct request_sock *req, 4846 struct flowi *fl) 4847 { 4848 fl->flowi_secid = req->secid; 4849 } 4850 4851 static int selinux_tun_dev_alloc_security(void **security) 4852 { 4853 struct tun_security_struct *tunsec; 4854 4855 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL); 4856 if (!tunsec) 4857 return -ENOMEM; 4858 tunsec->sid = current_sid(); 4859 4860 *security = tunsec; 4861 return 0; 4862 } 4863 4864 static void selinux_tun_dev_free_security(void *security) 4865 { 4866 kfree(security); 4867 } 4868 4869 static int selinux_tun_dev_create(void) 4870 { 4871 u32 sid = current_sid(); 4872 4873 /* we aren't taking into account the "sockcreate" SID since the socket 4874 * that is being created here is not a socket in the traditional sense, 4875 * instead it is a private sock, accessible only to the kernel, and 4876 * representing a wide range of network traffic spanning multiple 4877 * connections unlike traditional sockets - check the TUN driver to 4878 * get a better understanding of why this socket is special */ 4879 4880 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE, 4881 NULL); 4882 } 4883 4884 static int selinux_tun_dev_attach_queue(void *security) 4885 { 4886 struct tun_security_struct *tunsec = security; 4887 4888 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET, 4889 TUN_SOCKET__ATTACH_QUEUE, NULL); 4890 } 4891 4892 static int selinux_tun_dev_attach(struct sock *sk, void *security) 4893 { 4894 struct tun_security_struct *tunsec = security; 4895 struct sk_security_struct *sksec = sk->sk_security; 4896 4897 /* we don't currently perform any NetLabel based labeling here and it 4898 * isn't clear that we would want to do so anyway; while we could apply 4899 * labeling without the support of the TUN user the resulting labeled 4900 * traffic from the other end of the connection would almost certainly 4901 * cause confusion to the TUN user that had no idea network labeling 4902 * protocols were being used */ 4903 4904 sksec->sid = tunsec->sid; 4905 sksec->sclass = SECCLASS_TUN_SOCKET; 4906 4907 return 0; 4908 } 4909 4910 static int selinux_tun_dev_open(void *security) 4911 { 4912 struct tun_security_struct *tunsec = security; 4913 u32 sid = current_sid(); 4914 int err; 4915 4916 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET, 4917 TUN_SOCKET__RELABELFROM, NULL); 4918 if (err) 4919 return err; 4920 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, 4921 TUN_SOCKET__RELABELTO, NULL); 4922 if (err) 4923 return err; 4924 tunsec->sid = sid; 4925 4926 return 0; 4927 } 4928 4929 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) 4930 { 4931 int err = 0; 4932 u32 perm; 4933 struct nlmsghdr *nlh; 4934 struct sk_security_struct *sksec = sk->sk_security; 4935 4936 if (skb->len < NLMSG_HDRLEN) { 4937 err = -EINVAL; 4938 goto out; 4939 } 4940 nlh = nlmsg_hdr(skb); 4941 4942 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm); 4943 if (err) { 4944 if (err == -EINVAL) { 4945 pr_warn_ratelimited("SELinux: unrecognized netlink" 4946 " message: protocol=%hu nlmsg_type=%hu sclass=%s" 4947 " pig=%d comm=%s\n", 4948 sk->sk_protocol, nlh->nlmsg_type, 4949 secclass_map[sksec->sclass - 1].name, 4950 task_pid_nr(current), current->comm); 4951 if (!selinux_enforcing || security_get_allow_unknown()) 4952 err = 0; 4953 } 4954 4955 /* Ignore */ 4956 if (err == -ENOENT) 4957 err = 0; 4958 goto out; 4959 } 4960 4961 err = sock_has_perm(current, sk, perm); 4962 out: 4963 return err; 4964 } 4965 4966 #ifdef CONFIG_NETFILTER 4967 4968 static unsigned int selinux_ip_forward(struct sk_buff *skb, 4969 const struct net_device *indev, 4970 u16 family) 4971 { 4972 int err; 4973 char *addrp; 4974 u32 peer_sid; 4975 struct common_audit_data ad; 4976 struct lsm_network_audit net = {0,}; 4977 u8 secmark_active; 4978 u8 netlbl_active; 4979 u8 peerlbl_active; 4980 4981 if (!selinux_policycap_netpeer) 4982 return NF_ACCEPT; 4983 4984 secmark_active = selinux_secmark_enabled(); 4985 netlbl_active = netlbl_enabled(); 4986 peerlbl_active = selinux_peerlbl_enabled(); 4987 if (!secmark_active && !peerlbl_active) 4988 return NF_ACCEPT; 4989 4990 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0) 4991 return NF_DROP; 4992 4993 ad.type = LSM_AUDIT_DATA_NET; 4994 ad.u.net = &net; 4995 ad.u.net->netif = indev->ifindex; 4996 ad.u.net->family = family; 4997 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0) 4998 return NF_DROP; 4999 5000 if (peerlbl_active) { 5001 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex, 5002 addrp, family, peer_sid, &ad); 5003 if (err) { 5004 selinux_netlbl_err(skb, family, err, 1); 5005 return NF_DROP; 5006 } 5007 } 5008 5009 if (secmark_active) 5010 if (avc_has_perm(peer_sid, skb->secmark, 5011 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) 5012 return NF_DROP; 5013 5014 if (netlbl_active) 5015 /* we do this in the FORWARD path and not the POST_ROUTING 5016 * path because we want to make sure we apply the necessary 5017 * labeling before IPsec is applied so we can leverage AH 5018 * protection */ 5019 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0) 5020 return NF_DROP; 5021 5022 return NF_ACCEPT; 5023 } 5024 5025 static unsigned int selinux_ipv4_forward(void *priv, 5026 struct sk_buff *skb, 5027 const struct nf_hook_state *state) 5028 { 5029 return selinux_ip_forward(skb, state->in, PF_INET); 5030 } 5031 5032 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 5033 static unsigned int selinux_ipv6_forward(void *priv, 5034 struct sk_buff *skb, 5035 const struct nf_hook_state *state) 5036 { 5037 return selinux_ip_forward(skb, state->in, PF_INET6); 5038 } 5039 #endif /* IPV6 */ 5040 5041 static unsigned int selinux_ip_output(struct sk_buff *skb, 5042 u16 family) 5043 { 5044 struct sock *sk; 5045 u32 sid; 5046 5047 if (!netlbl_enabled()) 5048 return NF_ACCEPT; 5049 5050 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path 5051 * because we want to make sure we apply the necessary labeling 5052 * before IPsec is applied so we can leverage AH protection */ 5053 sk = skb->sk; 5054 if (sk) { 5055 struct sk_security_struct *sksec; 5056 5057 if (sk_listener(sk)) 5058 /* if the socket is the listening state then this 5059 * packet is a SYN-ACK packet which means it needs to 5060 * be labeled based on the connection/request_sock and 5061 * not the parent socket. unfortunately, we can't 5062 * lookup the request_sock yet as it isn't queued on 5063 * the parent socket until after the SYN-ACK is sent. 5064 * the "solution" is to simply pass the packet as-is 5065 * as any IP option based labeling should be copied 5066 * from the initial connection request (in the IP 5067 * layer). it is far from ideal, but until we get a 5068 * security label in the packet itself this is the 5069 * best we can do. */ 5070 return NF_ACCEPT; 5071 5072 /* standard practice, label using the parent socket */ 5073 sksec = sk->sk_security; 5074 sid = sksec->sid; 5075 } else 5076 sid = SECINITSID_KERNEL; 5077 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0) 5078 return NF_DROP; 5079 5080 return NF_ACCEPT; 5081 } 5082 5083 static unsigned int selinux_ipv4_output(void *priv, 5084 struct sk_buff *skb, 5085 const struct nf_hook_state *state) 5086 { 5087 return selinux_ip_output(skb, PF_INET); 5088 } 5089 5090 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 5091 static unsigned int selinux_ipv6_output(void *priv, 5092 struct sk_buff *skb, 5093 const struct nf_hook_state *state) 5094 { 5095 return selinux_ip_output(skb, PF_INET6); 5096 } 5097 #endif /* IPV6 */ 5098 5099 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, 5100 int ifindex, 5101 u16 family) 5102 { 5103 struct sock *sk = skb_to_full_sk(skb); 5104 struct sk_security_struct *sksec; 5105 struct common_audit_data ad; 5106 struct lsm_network_audit net = {0,}; 5107 char *addrp; 5108 u8 proto; 5109 5110 if (sk == NULL) 5111 return NF_ACCEPT; 5112 sksec = sk->sk_security; 5113 5114 ad.type = LSM_AUDIT_DATA_NET; 5115 ad.u.net = &net; 5116 ad.u.net->netif = ifindex; 5117 ad.u.net->family = family; 5118 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto)) 5119 return NF_DROP; 5120 5121 if (selinux_secmark_enabled()) 5122 if (avc_has_perm(sksec->sid, skb->secmark, 5123 SECCLASS_PACKET, PACKET__SEND, &ad)) 5124 return NF_DROP_ERR(-ECONNREFUSED); 5125 5126 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) 5127 return NF_DROP_ERR(-ECONNREFUSED); 5128 5129 return NF_ACCEPT; 5130 } 5131 5132 static unsigned int selinux_ip_postroute(struct sk_buff *skb, 5133 const struct net_device *outdev, 5134 u16 family) 5135 { 5136 u32 secmark_perm; 5137 u32 peer_sid; 5138 int ifindex = outdev->ifindex; 5139 struct sock *sk; 5140 struct common_audit_data ad; 5141 struct lsm_network_audit net = {0,}; 5142 char *addrp; 5143 u8 secmark_active; 5144 u8 peerlbl_active; 5145 5146 /* If any sort of compatibility mode is enabled then handoff processing 5147 * to the selinux_ip_postroute_compat() function to deal with the 5148 * special handling. We do this in an attempt to keep this function 5149 * as fast and as clean as possible. */ 5150 if (!selinux_policycap_netpeer) 5151 return selinux_ip_postroute_compat(skb, ifindex, family); 5152 5153 secmark_active = selinux_secmark_enabled(); 5154 peerlbl_active = selinux_peerlbl_enabled(); 5155 if (!secmark_active && !peerlbl_active) 5156 return NF_ACCEPT; 5157 5158 sk = skb_to_full_sk(skb); 5159 5160 #ifdef CONFIG_XFRM 5161 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec 5162 * packet transformation so allow the packet to pass without any checks 5163 * since we'll have another chance to perform access control checks 5164 * when the packet is on it's final way out. 5165 * NOTE: there appear to be some IPv6 multicast cases where skb->dst 5166 * is NULL, in this case go ahead and apply access control. 5167 * NOTE: if this is a local socket (skb->sk != NULL) that is in the 5168 * TCP listening state we cannot wait until the XFRM processing 5169 * is done as we will miss out on the SA label if we do; 5170 * unfortunately, this means more work, but it is only once per 5171 * connection. */ 5172 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL && 5173 !(sk && sk_listener(sk))) 5174 return NF_ACCEPT; 5175 #endif 5176 5177 if (sk == NULL) { 5178 /* Without an associated socket the packet is either coming 5179 * from the kernel or it is being forwarded; check the packet 5180 * to determine which and if the packet is being forwarded 5181 * query the packet directly to determine the security label. */ 5182 if (skb->skb_iif) { 5183 secmark_perm = PACKET__FORWARD_OUT; 5184 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) 5185 return NF_DROP; 5186 } else { 5187 secmark_perm = PACKET__SEND; 5188 peer_sid = SECINITSID_KERNEL; 5189 } 5190 } else if (sk_listener(sk)) { 5191 /* Locally generated packet but the associated socket is in the 5192 * listening state which means this is a SYN-ACK packet. In 5193 * this particular case the correct security label is assigned 5194 * to the connection/request_sock but unfortunately we can't 5195 * query the request_sock as it isn't queued on the parent 5196 * socket until after the SYN-ACK packet is sent; the only 5197 * viable choice is to regenerate the label like we do in 5198 * selinux_inet_conn_request(). See also selinux_ip_output() 5199 * for similar problems. */ 5200 u32 skb_sid; 5201 struct sk_security_struct *sksec; 5202 5203 sksec = sk->sk_security; 5204 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid)) 5205 return NF_DROP; 5206 /* At this point, if the returned skb peerlbl is SECSID_NULL 5207 * and the packet has been through at least one XFRM 5208 * transformation then we must be dealing with the "final" 5209 * form of labeled IPsec packet; since we've already applied 5210 * all of our access controls on this packet we can safely 5211 * pass the packet. */ 5212 if (skb_sid == SECSID_NULL) { 5213 switch (family) { 5214 case PF_INET: 5215 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) 5216 return NF_ACCEPT; 5217 break; 5218 case PF_INET6: 5219 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) 5220 return NF_ACCEPT; 5221 break; 5222 default: 5223 return NF_DROP_ERR(-ECONNREFUSED); 5224 } 5225 } 5226 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid)) 5227 return NF_DROP; 5228 secmark_perm = PACKET__SEND; 5229 } else { 5230 /* Locally generated packet, fetch the security label from the 5231 * associated socket. */ 5232 struct sk_security_struct *sksec = sk->sk_security; 5233 peer_sid = sksec->sid; 5234 secmark_perm = PACKET__SEND; 5235 } 5236 5237 ad.type = LSM_AUDIT_DATA_NET; 5238 ad.u.net = &net; 5239 ad.u.net->netif = ifindex; 5240 ad.u.net->family = family; 5241 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) 5242 return NF_DROP; 5243 5244 if (secmark_active) 5245 if (avc_has_perm(peer_sid, skb->secmark, 5246 SECCLASS_PACKET, secmark_perm, &ad)) 5247 return NF_DROP_ERR(-ECONNREFUSED); 5248 5249 if (peerlbl_active) { 5250 u32 if_sid; 5251 u32 node_sid; 5252 5253 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid)) 5254 return NF_DROP; 5255 if (avc_has_perm(peer_sid, if_sid, 5256 SECCLASS_NETIF, NETIF__EGRESS, &ad)) 5257 return NF_DROP_ERR(-ECONNREFUSED); 5258 5259 if (sel_netnode_sid(addrp, family, &node_sid)) 5260 return NF_DROP; 5261 if (avc_has_perm(peer_sid, node_sid, 5262 SECCLASS_NODE, NODE__SENDTO, &ad)) 5263 return NF_DROP_ERR(-ECONNREFUSED); 5264 } 5265 5266 return NF_ACCEPT; 5267 } 5268 5269 static unsigned int selinux_ipv4_postroute(void *priv, 5270 struct sk_buff *skb, 5271 const struct nf_hook_state *state) 5272 { 5273 return selinux_ip_postroute(skb, state->out, PF_INET); 5274 } 5275 5276 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 5277 static unsigned int selinux_ipv6_postroute(void *priv, 5278 struct sk_buff *skb, 5279 const struct nf_hook_state *state) 5280 { 5281 return selinux_ip_postroute(skb, state->out, PF_INET6); 5282 } 5283 #endif /* IPV6 */ 5284 5285 #endif /* CONFIG_NETFILTER */ 5286 5287 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb) 5288 { 5289 return selinux_nlmsg_perm(sk, skb); 5290 } 5291 5292 static int ipc_alloc_security(struct task_struct *task, 5293 struct kern_ipc_perm *perm, 5294 u16 sclass) 5295 { 5296 struct ipc_security_struct *isec; 5297 u32 sid; 5298 5299 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL); 5300 if (!isec) 5301 return -ENOMEM; 5302 5303 sid = task_sid(task); 5304 isec->sclass = sclass; 5305 isec->sid = sid; 5306 perm->security = isec; 5307 5308 return 0; 5309 } 5310 5311 static void ipc_free_security(struct kern_ipc_perm *perm) 5312 { 5313 struct ipc_security_struct *isec = perm->security; 5314 perm->security = NULL; 5315 kfree(isec); 5316 } 5317 5318 static int msg_msg_alloc_security(struct msg_msg *msg) 5319 { 5320 struct msg_security_struct *msec; 5321 5322 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL); 5323 if (!msec) 5324 return -ENOMEM; 5325 5326 msec->sid = SECINITSID_UNLABELED; 5327 msg->security = msec; 5328 5329 return 0; 5330 } 5331 5332 static void msg_msg_free_security(struct msg_msg *msg) 5333 { 5334 struct msg_security_struct *msec = msg->security; 5335 5336 msg->security = NULL; 5337 kfree(msec); 5338 } 5339 5340 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms, 5341 u32 perms) 5342 { 5343 struct ipc_security_struct *isec; 5344 struct common_audit_data ad; 5345 u32 sid = current_sid(); 5346 5347 isec = ipc_perms->security; 5348 5349 ad.type = LSM_AUDIT_DATA_IPC; 5350 ad.u.ipc_id = ipc_perms->key; 5351 5352 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad); 5353 } 5354 5355 static int selinux_msg_msg_alloc_security(struct msg_msg *msg) 5356 { 5357 return msg_msg_alloc_security(msg); 5358 } 5359 5360 static void selinux_msg_msg_free_security(struct msg_msg *msg) 5361 { 5362 msg_msg_free_security(msg); 5363 } 5364 5365 /* message queue security operations */ 5366 static int selinux_msg_queue_alloc_security(struct msg_queue *msq) 5367 { 5368 struct ipc_security_struct *isec; 5369 struct common_audit_data ad; 5370 u32 sid = current_sid(); 5371 int rc; 5372 5373 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ); 5374 if (rc) 5375 return rc; 5376 5377 isec = msq->q_perm.security; 5378 5379 ad.type = LSM_AUDIT_DATA_IPC; 5380 ad.u.ipc_id = msq->q_perm.key; 5381 5382 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, 5383 MSGQ__CREATE, &ad); 5384 if (rc) { 5385 ipc_free_security(&msq->q_perm); 5386 return rc; 5387 } 5388 return 0; 5389 } 5390 5391 static void selinux_msg_queue_free_security(struct msg_queue *msq) 5392 { 5393 ipc_free_security(&msq->q_perm); 5394 } 5395 5396 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg) 5397 { 5398 struct ipc_security_struct *isec; 5399 struct common_audit_data ad; 5400 u32 sid = current_sid(); 5401 5402 isec = msq->q_perm.security; 5403 5404 ad.type = LSM_AUDIT_DATA_IPC; 5405 ad.u.ipc_id = msq->q_perm.key; 5406 5407 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, 5408 MSGQ__ASSOCIATE, &ad); 5409 } 5410 5411 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd) 5412 { 5413 int err; 5414 int perms; 5415 5416 switch (cmd) { 5417 case IPC_INFO: 5418 case MSG_INFO: 5419 /* No specific object, just general system-wide information. */ 5420 return task_has_system(current, SYSTEM__IPC_INFO); 5421 case IPC_STAT: 5422 case MSG_STAT: 5423 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE; 5424 break; 5425 case IPC_SET: 5426 perms = MSGQ__SETATTR; 5427 break; 5428 case IPC_RMID: 5429 perms = MSGQ__DESTROY; 5430 break; 5431 default: 5432 return 0; 5433 } 5434 5435 err = ipc_has_perm(&msq->q_perm, perms); 5436 return err; 5437 } 5438 5439 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg) 5440 { 5441 struct ipc_security_struct *isec; 5442 struct msg_security_struct *msec; 5443 struct common_audit_data ad; 5444 u32 sid = current_sid(); 5445 int rc; 5446 5447 isec = msq->q_perm.security; 5448 msec = msg->security; 5449 5450 /* 5451 * First time through, need to assign label to the message 5452 */ 5453 if (msec->sid == SECINITSID_UNLABELED) { 5454 /* 5455 * Compute new sid based on current process and 5456 * message queue this message will be stored in 5457 */ 5458 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG, 5459 NULL, &msec->sid); 5460 if (rc) 5461 return rc; 5462 } 5463 5464 ad.type = LSM_AUDIT_DATA_IPC; 5465 ad.u.ipc_id = msq->q_perm.key; 5466 5467 /* Can this process write to the queue? */ 5468 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, 5469 MSGQ__WRITE, &ad); 5470 if (!rc) 5471 /* Can this process send the message */ 5472 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG, 5473 MSG__SEND, &ad); 5474 if (!rc) 5475 /* Can the message be put in the queue? */ 5476 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ, 5477 MSGQ__ENQUEUE, &ad); 5478 5479 return rc; 5480 } 5481 5482 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, 5483 struct task_struct *target, 5484 long type, int mode) 5485 { 5486 struct ipc_security_struct *isec; 5487 struct msg_security_struct *msec; 5488 struct common_audit_data ad; 5489 u32 sid = task_sid(target); 5490 int rc; 5491 5492 isec = msq->q_perm.security; 5493 msec = msg->security; 5494 5495 ad.type = LSM_AUDIT_DATA_IPC; 5496 ad.u.ipc_id = msq->q_perm.key; 5497 5498 rc = avc_has_perm(sid, isec->sid, 5499 SECCLASS_MSGQ, MSGQ__READ, &ad); 5500 if (!rc) 5501 rc = avc_has_perm(sid, msec->sid, 5502 SECCLASS_MSG, MSG__RECEIVE, &ad); 5503 return rc; 5504 } 5505 5506 /* Shared Memory security operations */ 5507 static int selinux_shm_alloc_security(struct shmid_kernel *shp) 5508 { 5509 struct ipc_security_struct *isec; 5510 struct common_audit_data ad; 5511 u32 sid = current_sid(); 5512 int rc; 5513 5514 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM); 5515 if (rc) 5516 return rc; 5517 5518 isec = shp->shm_perm.security; 5519 5520 ad.type = LSM_AUDIT_DATA_IPC; 5521 ad.u.ipc_id = shp->shm_perm.key; 5522 5523 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM, 5524 SHM__CREATE, &ad); 5525 if (rc) { 5526 ipc_free_security(&shp->shm_perm); 5527 return rc; 5528 } 5529 return 0; 5530 } 5531 5532 static void selinux_shm_free_security(struct shmid_kernel *shp) 5533 { 5534 ipc_free_security(&shp->shm_perm); 5535 } 5536 5537 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg) 5538 { 5539 struct ipc_security_struct *isec; 5540 struct common_audit_data ad; 5541 u32 sid = current_sid(); 5542 5543 isec = shp->shm_perm.security; 5544 5545 ad.type = LSM_AUDIT_DATA_IPC; 5546 ad.u.ipc_id = shp->shm_perm.key; 5547 5548 return avc_has_perm(sid, isec->sid, SECCLASS_SHM, 5549 SHM__ASSOCIATE, &ad); 5550 } 5551 5552 /* Note, at this point, shp is locked down */ 5553 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd) 5554 { 5555 int perms; 5556 int err; 5557 5558 switch (cmd) { 5559 case IPC_INFO: 5560 case SHM_INFO: 5561 /* No specific object, just general system-wide information. */ 5562 return task_has_system(current, SYSTEM__IPC_INFO); 5563 case IPC_STAT: 5564 case SHM_STAT: 5565 perms = SHM__GETATTR | SHM__ASSOCIATE; 5566 break; 5567 case IPC_SET: 5568 perms = SHM__SETATTR; 5569 break; 5570 case SHM_LOCK: 5571 case SHM_UNLOCK: 5572 perms = SHM__LOCK; 5573 break; 5574 case IPC_RMID: 5575 perms = SHM__DESTROY; 5576 break; 5577 default: 5578 return 0; 5579 } 5580 5581 err = ipc_has_perm(&shp->shm_perm, perms); 5582 return err; 5583 } 5584 5585 static int selinux_shm_shmat(struct shmid_kernel *shp, 5586 char __user *shmaddr, int shmflg) 5587 { 5588 u32 perms; 5589 5590 if (shmflg & SHM_RDONLY) 5591 perms = SHM__READ; 5592 else 5593 perms = SHM__READ | SHM__WRITE; 5594 5595 return ipc_has_perm(&shp->shm_perm, perms); 5596 } 5597 5598 /* Semaphore security operations */ 5599 static int selinux_sem_alloc_security(struct sem_array *sma) 5600 { 5601 struct ipc_security_struct *isec; 5602 struct common_audit_data ad; 5603 u32 sid = current_sid(); 5604 int rc; 5605 5606 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM); 5607 if (rc) 5608 return rc; 5609 5610 isec = sma->sem_perm.security; 5611 5612 ad.type = LSM_AUDIT_DATA_IPC; 5613 ad.u.ipc_id = sma->sem_perm.key; 5614 5615 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM, 5616 SEM__CREATE, &ad); 5617 if (rc) { 5618 ipc_free_security(&sma->sem_perm); 5619 return rc; 5620 } 5621 return 0; 5622 } 5623 5624 static void selinux_sem_free_security(struct sem_array *sma) 5625 { 5626 ipc_free_security(&sma->sem_perm); 5627 } 5628 5629 static int selinux_sem_associate(struct sem_array *sma, int semflg) 5630 { 5631 struct ipc_security_struct *isec; 5632 struct common_audit_data ad; 5633 u32 sid = current_sid(); 5634 5635 isec = sma->sem_perm.security; 5636 5637 ad.type = LSM_AUDIT_DATA_IPC; 5638 ad.u.ipc_id = sma->sem_perm.key; 5639 5640 return avc_has_perm(sid, isec->sid, SECCLASS_SEM, 5641 SEM__ASSOCIATE, &ad); 5642 } 5643 5644 /* Note, at this point, sma is locked down */ 5645 static int selinux_sem_semctl(struct sem_array *sma, int cmd) 5646 { 5647 int err; 5648 u32 perms; 5649 5650 switch (cmd) { 5651 case IPC_INFO: 5652 case SEM_INFO: 5653 /* No specific object, just general system-wide information. */ 5654 return task_has_system(current, SYSTEM__IPC_INFO); 5655 case GETPID: 5656 case GETNCNT: 5657 case GETZCNT: 5658 perms = SEM__GETATTR; 5659 break; 5660 case GETVAL: 5661 case GETALL: 5662 perms = SEM__READ; 5663 break; 5664 case SETVAL: 5665 case SETALL: 5666 perms = SEM__WRITE; 5667 break; 5668 case IPC_RMID: 5669 perms = SEM__DESTROY; 5670 break; 5671 case IPC_SET: 5672 perms = SEM__SETATTR; 5673 break; 5674 case IPC_STAT: 5675 case SEM_STAT: 5676 perms = SEM__GETATTR | SEM__ASSOCIATE; 5677 break; 5678 default: 5679 return 0; 5680 } 5681 5682 err = ipc_has_perm(&sma->sem_perm, perms); 5683 return err; 5684 } 5685 5686 static int selinux_sem_semop(struct sem_array *sma, 5687 struct sembuf *sops, unsigned nsops, int alter) 5688 { 5689 u32 perms; 5690 5691 if (alter) 5692 perms = SEM__READ | SEM__WRITE; 5693 else 5694 perms = SEM__READ; 5695 5696 return ipc_has_perm(&sma->sem_perm, perms); 5697 } 5698 5699 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag) 5700 { 5701 u32 av = 0; 5702 5703 av = 0; 5704 if (flag & S_IRUGO) 5705 av |= IPC__UNIX_READ; 5706 if (flag & S_IWUGO) 5707 av |= IPC__UNIX_WRITE; 5708 5709 if (av == 0) 5710 return 0; 5711 5712 return ipc_has_perm(ipcp, av); 5713 } 5714 5715 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) 5716 { 5717 struct ipc_security_struct *isec = ipcp->security; 5718 *secid = isec->sid; 5719 } 5720 5721 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode) 5722 { 5723 if (inode) 5724 inode_doinit_with_dentry(inode, dentry); 5725 } 5726 5727 static int selinux_getprocattr(struct task_struct *p, 5728 char *name, char **value) 5729 { 5730 const struct task_security_struct *__tsec; 5731 u32 sid; 5732 int error; 5733 unsigned len; 5734 5735 if (current != p) { 5736 error = current_has_perm(p, PROCESS__GETATTR); 5737 if (error) 5738 return error; 5739 } 5740 5741 rcu_read_lock(); 5742 __tsec = __task_cred(p)->security; 5743 5744 if (!strcmp(name, "current")) 5745 sid = __tsec->sid; 5746 else if (!strcmp(name, "prev")) 5747 sid = __tsec->osid; 5748 else if (!strcmp(name, "exec")) 5749 sid = __tsec->exec_sid; 5750 else if (!strcmp(name, "fscreate")) 5751 sid = __tsec->create_sid; 5752 else if (!strcmp(name, "keycreate")) 5753 sid = __tsec->keycreate_sid; 5754 else if (!strcmp(name, "sockcreate")) 5755 sid = __tsec->sockcreate_sid; 5756 else 5757 goto invalid; 5758 rcu_read_unlock(); 5759 5760 if (!sid) 5761 return 0; 5762 5763 error = security_sid_to_context(sid, value, &len); 5764 if (error) 5765 return error; 5766 return len; 5767 5768 invalid: 5769 rcu_read_unlock(); 5770 return -EINVAL; 5771 } 5772 5773 static int selinux_setprocattr(struct task_struct *p, 5774 char *name, void *value, size_t size) 5775 { 5776 struct task_security_struct *tsec; 5777 struct cred *new; 5778 u32 sid = 0, ptsid; 5779 int error; 5780 char *str = value; 5781 5782 if (current != p) { 5783 /* SELinux only allows a process to change its own 5784 security attributes. */ 5785 return -EACCES; 5786 } 5787 5788 /* 5789 * Basic control over ability to set these attributes at all. 5790 * current == p, but we'll pass them separately in case the 5791 * above restriction is ever removed. 5792 */ 5793 if (!strcmp(name, "exec")) 5794 error = current_has_perm(p, PROCESS__SETEXEC); 5795 else if (!strcmp(name, "fscreate")) 5796 error = current_has_perm(p, PROCESS__SETFSCREATE); 5797 else if (!strcmp(name, "keycreate")) 5798 error = current_has_perm(p, PROCESS__SETKEYCREATE); 5799 else if (!strcmp(name, "sockcreate")) 5800 error = current_has_perm(p, PROCESS__SETSOCKCREATE); 5801 else if (!strcmp(name, "current")) 5802 error = current_has_perm(p, PROCESS__SETCURRENT); 5803 else 5804 error = -EINVAL; 5805 if (error) 5806 return error; 5807 5808 /* Obtain a SID for the context, if one was specified. */ 5809 if (size && str[1] && str[1] != '\n') { 5810 if (str[size-1] == '\n') { 5811 str[size-1] = 0; 5812 size--; 5813 } 5814 error = security_context_to_sid(value, size, &sid, GFP_KERNEL); 5815 if (error == -EINVAL && !strcmp(name, "fscreate")) { 5816 if (!capable(CAP_MAC_ADMIN)) { 5817 struct audit_buffer *ab; 5818 size_t audit_size; 5819 5820 /* We strip a nul only if it is at the end, otherwise the 5821 * context contains a nul and we should audit that */ 5822 if (str[size - 1] == '\0') 5823 audit_size = size - 1; 5824 else 5825 audit_size = size; 5826 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR); 5827 audit_log_format(ab, "op=fscreate invalid_context="); 5828 audit_log_n_untrustedstring(ab, value, audit_size); 5829 audit_log_end(ab); 5830 5831 return error; 5832 } 5833 error = security_context_to_sid_force(value, size, 5834 &sid); 5835 } 5836 if (error) 5837 return error; 5838 } 5839 5840 new = prepare_creds(); 5841 if (!new) 5842 return -ENOMEM; 5843 5844 /* Permission checking based on the specified context is 5845 performed during the actual operation (execve, 5846 open/mkdir/...), when we know the full context of the 5847 operation. See selinux_bprm_set_creds for the execve 5848 checks and may_create for the file creation checks. The 5849 operation will then fail if the context is not permitted. */ 5850 tsec = new->security; 5851 if (!strcmp(name, "exec")) { 5852 tsec->exec_sid = sid; 5853 } else if (!strcmp(name, "fscreate")) { 5854 tsec->create_sid = sid; 5855 } else if (!strcmp(name, "keycreate")) { 5856 error = may_create_key(sid, p); 5857 if (error) 5858 goto abort_change; 5859 tsec->keycreate_sid = sid; 5860 } else if (!strcmp(name, "sockcreate")) { 5861 tsec->sockcreate_sid = sid; 5862 } else if (!strcmp(name, "current")) { 5863 error = -EINVAL; 5864 if (sid == 0) 5865 goto abort_change; 5866 5867 /* Only allow single threaded processes to change context */ 5868 error = -EPERM; 5869 if (!current_is_single_threaded()) { 5870 error = security_bounded_transition(tsec->sid, sid); 5871 if (error) 5872 goto abort_change; 5873 } 5874 5875 /* Check permissions for the transition. */ 5876 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS, 5877 PROCESS__DYNTRANSITION, NULL); 5878 if (error) 5879 goto abort_change; 5880 5881 /* Check for ptracing, and update the task SID if ok. 5882 Otherwise, leave SID unchanged and fail. */ 5883 ptsid = ptrace_parent_sid(p); 5884 if (ptsid != 0) { 5885 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS, 5886 PROCESS__PTRACE, NULL); 5887 if (error) 5888 goto abort_change; 5889 } 5890 5891 tsec->sid = sid; 5892 } else { 5893 error = -EINVAL; 5894 goto abort_change; 5895 } 5896 5897 commit_creds(new); 5898 return size; 5899 5900 abort_change: 5901 abort_creds(new); 5902 return error; 5903 } 5904 5905 static int selinux_ismaclabel(const char *name) 5906 { 5907 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); 5908 } 5909 5910 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 5911 { 5912 return security_sid_to_context(secid, secdata, seclen); 5913 } 5914 5915 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 5916 { 5917 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL); 5918 } 5919 5920 static void selinux_release_secctx(char *secdata, u32 seclen) 5921 { 5922 kfree(secdata); 5923 } 5924 5925 static void selinux_inode_invalidate_secctx(struct inode *inode) 5926 { 5927 struct inode_security_struct *isec = inode->i_security; 5928 5929 mutex_lock(&isec->lock); 5930 isec->initialized = LABEL_INVALID; 5931 mutex_unlock(&isec->lock); 5932 } 5933 5934 /* 5935 * called with inode->i_mutex locked 5936 */ 5937 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 5938 { 5939 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0); 5940 } 5941 5942 /* 5943 * called with inode->i_mutex locked 5944 */ 5945 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 5946 { 5947 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0); 5948 } 5949 5950 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 5951 { 5952 int len = 0; 5953 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX, 5954 ctx, true); 5955 if (len < 0) 5956 return len; 5957 *ctxlen = len; 5958 return 0; 5959 } 5960 #ifdef CONFIG_KEYS 5961 5962 static int selinux_key_alloc(struct key *k, const struct cred *cred, 5963 unsigned long flags) 5964 { 5965 const struct task_security_struct *tsec; 5966 struct key_security_struct *ksec; 5967 5968 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL); 5969 if (!ksec) 5970 return -ENOMEM; 5971 5972 tsec = cred->security; 5973 if (tsec->keycreate_sid) 5974 ksec->sid = tsec->keycreate_sid; 5975 else 5976 ksec->sid = tsec->sid; 5977 5978 k->security = ksec; 5979 return 0; 5980 } 5981 5982 static void selinux_key_free(struct key *k) 5983 { 5984 struct key_security_struct *ksec = k->security; 5985 5986 k->security = NULL; 5987 kfree(ksec); 5988 } 5989 5990 static int selinux_key_permission(key_ref_t key_ref, 5991 const struct cred *cred, 5992 unsigned perm) 5993 { 5994 struct key *key; 5995 struct key_security_struct *ksec; 5996 u32 sid; 5997 5998 /* if no specific permissions are requested, we skip the 5999 permission check. No serious, additional covert channels 6000 appear to be created. */ 6001 if (perm == 0) 6002 return 0; 6003 6004 sid = cred_sid(cred); 6005 6006 key = key_ref_to_ptr(key_ref); 6007 ksec = key->security; 6008 6009 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL); 6010 } 6011 6012 static int selinux_key_getsecurity(struct key *key, char **_buffer) 6013 { 6014 struct key_security_struct *ksec = key->security; 6015 char *context = NULL; 6016 unsigned len; 6017 int rc; 6018 6019 rc = security_sid_to_context(ksec->sid, &context, &len); 6020 if (!rc) 6021 rc = len; 6022 *_buffer = context; 6023 return rc; 6024 } 6025 6026 #endif 6027 6028 static struct security_hook_list selinux_hooks[] = { 6029 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr), 6030 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction), 6031 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder), 6032 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file), 6033 6034 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check), 6035 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme), 6036 LSM_HOOK_INIT(capget, selinux_capget), 6037 LSM_HOOK_INIT(capset, selinux_capset), 6038 LSM_HOOK_INIT(capable, selinux_capable), 6039 LSM_HOOK_INIT(quotactl, selinux_quotactl), 6040 LSM_HOOK_INIT(quota_on, selinux_quota_on), 6041 LSM_HOOK_INIT(syslog, selinux_syslog), 6042 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory), 6043 6044 LSM_HOOK_INIT(netlink_send, selinux_netlink_send), 6045 6046 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds), 6047 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds), 6048 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds), 6049 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec), 6050 6051 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security), 6052 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security), 6053 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data), 6054 LSM_HOOK_INIT(sb_remount, selinux_sb_remount), 6055 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount), 6056 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options), 6057 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs), 6058 LSM_HOOK_INIT(sb_mount, selinux_mount), 6059 LSM_HOOK_INIT(sb_umount, selinux_umount), 6060 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts), 6061 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts), 6062 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str), 6063 6064 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security), 6065 6066 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security), 6067 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security), 6068 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security), 6069 LSM_HOOK_INIT(inode_create, selinux_inode_create), 6070 LSM_HOOK_INIT(inode_link, selinux_inode_link), 6071 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink), 6072 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink), 6073 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir), 6074 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir), 6075 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod), 6076 LSM_HOOK_INIT(inode_rename, selinux_inode_rename), 6077 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink), 6078 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link), 6079 LSM_HOOK_INIT(inode_permission, selinux_inode_permission), 6080 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr), 6081 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr), 6082 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr), 6083 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr), 6084 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr), 6085 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr), 6086 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr), 6087 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity), 6088 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity), 6089 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity), 6090 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid), 6091 6092 LSM_HOOK_INIT(file_permission, selinux_file_permission), 6093 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), 6094 LSM_HOOK_INIT(file_free_security, selinux_file_free_security), 6095 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), 6096 LSM_HOOK_INIT(mmap_file, selinux_mmap_file), 6097 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr), 6098 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect), 6099 LSM_HOOK_INIT(file_lock, selinux_file_lock), 6100 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl), 6101 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner), 6102 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask), 6103 LSM_HOOK_INIT(file_receive, selinux_file_receive), 6104 6105 LSM_HOOK_INIT(file_open, selinux_file_open), 6106 6107 LSM_HOOK_INIT(task_create, selinux_task_create), 6108 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank), 6109 LSM_HOOK_INIT(cred_free, selinux_cred_free), 6110 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare), 6111 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer), 6112 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as), 6113 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as), 6114 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request), 6115 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file), 6116 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid), 6117 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid), 6118 LSM_HOOK_INIT(task_getsid, selinux_task_getsid), 6119 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid), 6120 LSM_HOOK_INIT(task_setnice, selinux_task_setnice), 6121 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio), 6122 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio), 6123 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit), 6124 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler), 6125 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler), 6126 LSM_HOOK_INIT(task_movememory, selinux_task_movememory), 6127 LSM_HOOK_INIT(task_kill, selinux_task_kill), 6128 LSM_HOOK_INIT(task_wait, selinux_task_wait), 6129 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode), 6130 6131 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission), 6132 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid), 6133 6134 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security), 6135 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security), 6136 6137 LSM_HOOK_INIT(msg_queue_alloc_security, 6138 selinux_msg_queue_alloc_security), 6139 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security), 6140 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate), 6141 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl), 6142 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd), 6143 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv), 6144 6145 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security), 6146 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security), 6147 LSM_HOOK_INIT(shm_associate, selinux_shm_associate), 6148 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl), 6149 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat), 6150 6151 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), 6152 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security), 6153 LSM_HOOK_INIT(sem_associate, selinux_sem_associate), 6154 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl), 6155 LSM_HOOK_INIT(sem_semop, selinux_sem_semop), 6156 6157 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate), 6158 6159 LSM_HOOK_INIT(getprocattr, selinux_getprocattr), 6160 LSM_HOOK_INIT(setprocattr, selinux_setprocattr), 6161 6162 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel), 6163 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), 6164 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid), 6165 LSM_HOOK_INIT(release_secctx, selinux_release_secctx), 6166 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx), 6167 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx), 6168 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx), 6169 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx), 6170 6171 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect), 6172 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send), 6173 6174 LSM_HOOK_INIT(socket_create, selinux_socket_create), 6175 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create), 6176 LSM_HOOK_INIT(socket_bind, selinux_socket_bind), 6177 LSM_HOOK_INIT(socket_connect, selinux_socket_connect), 6178 LSM_HOOK_INIT(socket_listen, selinux_socket_listen), 6179 LSM_HOOK_INIT(socket_accept, selinux_socket_accept), 6180 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg), 6181 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg), 6182 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname), 6183 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername), 6184 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt), 6185 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt), 6186 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown), 6187 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb), 6188 LSM_HOOK_INIT(socket_getpeersec_stream, 6189 selinux_socket_getpeersec_stream), 6190 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram), 6191 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security), 6192 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security), 6193 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security), 6194 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid), 6195 LSM_HOOK_INIT(sock_graft, selinux_sock_graft), 6196 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request), 6197 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone), 6198 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established), 6199 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet), 6200 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc), 6201 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec), 6202 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow), 6203 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security), 6204 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security), 6205 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create), 6206 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue), 6207 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach), 6208 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open), 6209 6210 #ifdef CONFIG_SECURITY_NETWORK_XFRM 6211 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc), 6212 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone), 6213 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free), 6214 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete), 6215 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc), 6216 LSM_HOOK_INIT(xfrm_state_alloc_acquire, 6217 selinux_xfrm_state_alloc_acquire), 6218 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free), 6219 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete), 6220 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup), 6221 LSM_HOOK_INIT(xfrm_state_pol_flow_match, 6222 selinux_xfrm_state_pol_flow_match), 6223 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session), 6224 #endif 6225 6226 #ifdef CONFIG_KEYS 6227 LSM_HOOK_INIT(key_alloc, selinux_key_alloc), 6228 LSM_HOOK_INIT(key_free, selinux_key_free), 6229 LSM_HOOK_INIT(key_permission, selinux_key_permission), 6230 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity), 6231 #endif 6232 6233 #ifdef CONFIG_AUDIT 6234 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init), 6235 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known), 6236 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match), 6237 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free), 6238 #endif 6239 }; 6240 6241 static __init int selinux_init(void) 6242 { 6243 if (!security_module_enable("selinux")) { 6244 selinux_enabled = 0; 6245 return 0; 6246 } 6247 6248 if (!selinux_enabled) { 6249 printk(KERN_INFO "SELinux: Disabled at boot.\n"); 6250 return 0; 6251 } 6252 6253 printk(KERN_INFO "SELinux: Initializing.\n"); 6254 6255 /* Set the security state for the initial task. */ 6256 cred_init_security(); 6257 6258 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC); 6259 6260 sel_inode_cache = kmem_cache_create("selinux_inode_security", 6261 sizeof(struct inode_security_struct), 6262 0, SLAB_PANIC, NULL); 6263 file_security_cache = kmem_cache_create("selinux_file_security", 6264 sizeof(struct file_security_struct), 6265 0, SLAB_PANIC, NULL); 6266 avc_init(); 6267 6268 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks)); 6269 6270 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) 6271 panic("SELinux: Unable to register AVC netcache callback\n"); 6272 6273 if (selinux_enforcing) 6274 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n"); 6275 else 6276 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n"); 6277 6278 return 0; 6279 } 6280 6281 static void delayed_superblock_init(struct super_block *sb, void *unused) 6282 { 6283 superblock_doinit(sb, NULL); 6284 } 6285 6286 void selinux_complete_init(void) 6287 { 6288 printk(KERN_DEBUG "SELinux: Completing initialization.\n"); 6289 6290 /* Set up any superblocks initialized prior to the policy load. */ 6291 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n"); 6292 iterate_supers(delayed_superblock_init, NULL); 6293 } 6294 6295 /* SELinux requires early initialization in order to label 6296 all processes and objects when they are created. */ 6297 security_initcall(selinux_init); 6298 6299 #if defined(CONFIG_NETFILTER) 6300 6301 static struct nf_hook_ops selinux_nf_ops[] = { 6302 { 6303 .hook = selinux_ipv4_postroute, 6304 .pf = NFPROTO_IPV4, 6305 .hooknum = NF_INET_POST_ROUTING, 6306 .priority = NF_IP_PRI_SELINUX_LAST, 6307 }, 6308 { 6309 .hook = selinux_ipv4_forward, 6310 .pf = NFPROTO_IPV4, 6311 .hooknum = NF_INET_FORWARD, 6312 .priority = NF_IP_PRI_SELINUX_FIRST, 6313 }, 6314 { 6315 .hook = selinux_ipv4_output, 6316 .pf = NFPROTO_IPV4, 6317 .hooknum = NF_INET_LOCAL_OUT, 6318 .priority = NF_IP_PRI_SELINUX_FIRST, 6319 }, 6320 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 6321 { 6322 .hook = selinux_ipv6_postroute, 6323 .pf = NFPROTO_IPV6, 6324 .hooknum = NF_INET_POST_ROUTING, 6325 .priority = NF_IP6_PRI_SELINUX_LAST, 6326 }, 6327 { 6328 .hook = selinux_ipv6_forward, 6329 .pf = NFPROTO_IPV6, 6330 .hooknum = NF_INET_FORWARD, 6331 .priority = NF_IP6_PRI_SELINUX_FIRST, 6332 }, 6333 { 6334 .hook = selinux_ipv6_output, 6335 .pf = NFPROTO_IPV6, 6336 .hooknum = NF_INET_LOCAL_OUT, 6337 .priority = NF_IP6_PRI_SELINUX_FIRST, 6338 }, 6339 #endif /* IPV6 */ 6340 }; 6341 6342 static int __init selinux_nf_ip_init(void) 6343 { 6344 int err; 6345 6346 if (!selinux_enabled) 6347 return 0; 6348 6349 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); 6350 6351 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); 6352 if (err) 6353 panic("SELinux: nf_register_hooks: error %d\n", err); 6354 6355 return 0; 6356 } 6357 6358 __initcall(selinux_nf_ip_init); 6359 6360 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 6361 static void selinux_nf_ip_exit(void) 6362 { 6363 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); 6364 6365 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); 6366 } 6367 #endif 6368 6369 #else /* CONFIG_NETFILTER */ 6370 6371 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 6372 #define selinux_nf_ip_exit() 6373 #endif 6374 6375 #endif /* CONFIG_NETFILTER */ 6376 6377 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 6378 static int selinux_disabled; 6379 6380 int selinux_disable(void) 6381 { 6382 if (ss_initialized) { 6383 /* Not permitted after initial policy load. */ 6384 return -EINVAL; 6385 } 6386 6387 if (selinux_disabled) { 6388 /* Only do this once. */ 6389 return -EINVAL; 6390 } 6391 6392 printk(KERN_INFO "SELinux: Disabled at runtime.\n"); 6393 6394 selinux_disabled = 1; 6395 selinux_enabled = 0; 6396 6397 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks)); 6398 6399 /* Try to destroy the avc node cache */ 6400 avc_disable(); 6401 6402 /* Unregister netfilter hooks. */ 6403 selinux_nf_ip_exit(); 6404 6405 /* Unregister selinuxfs. */ 6406 exit_sel_fs(); 6407 6408 return 0; 6409 } 6410 #endif 6411