1 /* 2 * NSA Security-Enhanced Linux (SELinux) security module 3 * 4 * This file contains the SELinux hook function implementations. 5 * 6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil> 7 * Chris Vance, <cvance@nai.com> 8 * Wayne Salamon, <wsalamon@nai.com> 9 * James Morris <jmorris@redhat.com> 10 * 11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com> 13 * Eric Paris <eparis@redhat.com> 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc. 15 * <dgoeddel@trustedcs.com> 16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P. 17 * Paul Moore <paul@paul-moore.com> 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd. 19 * Yuichi Nakamura <ynakam@hitachisoft.jp> 20 * 21 * This program is free software; you can redistribute it and/or modify 22 * it under the terms of the GNU General Public License version 2, 23 * as published by the Free Software Foundation. 24 */ 25 26 #include <linux/init.h> 27 #include <linux/kd.h> 28 #include <linux/kernel.h> 29 #include <linux/tracehook.h> 30 #include <linux/errno.h> 31 #include <linux/sched/signal.h> 32 #include <linux/sched/task.h> 33 #include <linux/lsm_hooks.h> 34 #include <linux/xattr.h> 35 #include <linux/capability.h> 36 #include <linux/unistd.h> 37 #include <linux/mm.h> 38 #include <linux/mman.h> 39 #include <linux/slab.h> 40 #include <linux/pagemap.h> 41 #include <linux/proc_fs.h> 42 #include <linux/swap.h> 43 #include <linux/spinlock.h> 44 #include <linux/syscalls.h> 45 #include <linux/dcache.h> 46 #include <linux/file.h> 47 #include <linux/fdtable.h> 48 #include <linux/namei.h> 49 #include <linux/mount.h> 50 #include <linux/netfilter_ipv4.h> 51 #include <linux/netfilter_ipv6.h> 52 #include <linux/tty.h> 53 #include <net/icmp.h> 54 #include <net/ip.h> /* for local_port_range[] */ 55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */ 56 #include <net/inet_connection_sock.h> 57 #include <net/net_namespace.h> 58 #include <net/netlabel.h> 59 #include <linux/uaccess.h> 60 #include <asm/ioctls.h> 61 #include <linux/atomic.h> 62 #include <linux/bitops.h> 63 #include <linux/interrupt.h> 64 #include <linux/netdevice.h> /* for network interface checks */ 65 #include <net/netlink.h> 66 #include <linux/tcp.h> 67 #include <linux/udp.h> 68 #include <linux/dccp.h> 69 #include <linux/quota.h> 70 #include <linux/un.h> /* for Unix socket types */ 71 #include <net/af_unix.h> /* for Unix socket types */ 72 #include <linux/parser.h> 73 #include <linux/nfs_mount.h> 74 #include <net/ipv6.h> 75 #include <linux/hugetlb.h> 76 #include <linux/personality.h> 77 #include <linux/audit.h> 78 #include <linux/string.h> 79 #include <linux/selinux.h> 80 #include <linux/mutex.h> 81 #include <linux/posix-timers.h> 82 #include <linux/syslog.h> 83 #include <linux/user_namespace.h> 84 #include <linux/export.h> 85 #include <linux/msg.h> 86 #include <linux/shm.h> 87 88 #include "avc.h" 89 #include "objsec.h" 90 #include "netif.h" 91 #include "netnode.h" 92 #include "netport.h" 93 #include "xfrm.h" 94 #include "netlabel.h" 95 #include "audit.h" 96 #include "avc_ss.h" 97 98 /* SECMARK reference count */ 99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0); 100 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP 102 int selinux_enforcing; 103 104 static int __init enforcing_setup(char *str) 105 { 106 unsigned long enforcing; 107 if (!kstrtoul(str, 0, &enforcing)) 108 selinux_enforcing = enforcing ? 1 : 0; 109 return 1; 110 } 111 __setup("enforcing=", enforcing_setup); 112 #endif 113 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE; 116 117 static int __init selinux_enabled_setup(char *str) 118 { 119 unsigned long enabled; 120 if (!kstrtoul(str, 0, &enabled)) 121 selinux_enabled = enabled ? 1 : 0; 122 return 1; 123 } 124 __setup("selinux=", selinux_enabled_setup); 125 #else 126 int selinux_enabled = 1; 127 #endif 128 129 static struct kmem_cache *sel_inode_cache; 130 static struct kmem_cache *file_security_cache; 131 132 /** 133 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled 134 * 135 * Description: 136 * This function checks the SECMARK reference counter to see if any SECMARK 137 * targets are currently configured, if the reference counter is greater than 138 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is 139 * enabled, false (0) if SECMARK is disabled. If the always_check_network 140 * policy capability is enabled, SECMARK is always considered enabled. 141 * 142 */ 143 static int selinux_secmark_enabled(void) 144 { 145 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount)); 146 } 147 148 /** 149 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled 150 * 151 * Description: 152 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true 153 * (1) if any are enabled or false (0) if neither are enabled. If the 154 * always_check_network policy capability is enabled, peer labeling 155 * is always considered enabled. 156 * 157 */ 158 static int selinux_peerlbl_enabled(void) 159 { 160 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled()); 161 } 162 163 static int selinux_netcache_avc_callback(u32 event) 164 { 165 if (event == AVC_CALLBACK_RESET) { 166 sel_netif_flush(); 167 sel_netnode_flush(); 168 sel_netport_flush(); 169 synchronize_net(); 170 } 171 return 0; 172 } 173 174 /* 175 * initialise the security for the init task 176 */ 177 static void cred_init_security(void) 178 { 179 struct cred *cred = (struct cred *) current->real_cred; 180 struct task_security_struct *tsec; 181 182 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL); 183 if (!tsec) 184 panic("SELinux: Failed to initialize initial task.\n"); 185 186 tsec->osid = tsec->sid = SECINITSID_KERNEL; 187 cred->security = tsec; 188 } 189 190 /* 191 * get the security ID of a set of credentials 192 */ 193 static inline u32 cred_sid(const struct cred *cred) 194 { 195 const struct task_security_struct *tsec; 196 197 tsec = cred->security; 198 return tsec->sid; 199 } 200 201 /* 202 * get the objective security ID of a task 203 */ 204 static inline u32 task_sid(const struct task_struct *task) 205 { 206 u32 sid; 207 208 rcu_read_lock(); 209 sid = cred_sid(__task_cred(task)); 210 rcu_read_unlock(); 211 return sid; 212 } 213 214 /* Allocate and free functions for each kind of security blob. */ 215 216 static int inode_alloc_security(struct inode *inode) 217 { 218 struct inode_security_struct *isec; 219 u32 sid = current_sid(); 220 221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS); 222 if (!isec) 223 return -ENOMEM; 224 225 spin_lock_init(&isec->lock); 226 INIT_LIST_HEAD(&isec->list); 227 isec->inode = inode; 228 isec->sid = SECINITSID_UNLABELED; 229 isec->sclass = SECCLASS_FILE; 230 isec->task_sid = sid; 231 isec->initialized = LABEL_INVALID; 232 inode->i_security = isec; 233 234 return 0; 235 } 236 237 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry); 238 239 /* 240 * Try reloading inode security labels that have been marked as invalid. The 241 * @may_sleep parameter indicates when sleeping and thus reloading labels is 242 * allowed; when set to false, returns -ECHILD when the label is 243 * invalid. The @opt_dentry parameter should be set to a dentry of the inode; 244 * when no dentry is available, set it to NULL instead. 245 */ 246 static int __inode_security_revalidate(struct inode *inode, 247 struct dentry *opt_dentry, 248 bool may_sleep) 249 { 250 struct inode_security_struct *isec = inode->i_security; 251 252 might_sleep_if(may_sleep); 253 254 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) { 255 if (!may_sleep) 256 return -ECHILD; 257 258 /* 259 * Try reloading the inode security label. This will fail if 260 * @opt_dentry is NULL and no dentry for this inode can be 261 * found; in that case, continue using the old label. 262 */ 263 inode_doinit_with_dentry(inode, opt_dentry); 264 } 265 return 0; 266 } 267 268 static struct inode_security_struct *inode_security_novalidate(struct inode *inode) 269 { 270 return inode->i_security; 271 } 272 273 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu) 274 { 275 int error; 276 277 error = __inode_security_revalidate(inode, NULL, !rcu); 278 if (error) 279 return ERR_PTR(error); 280 return inode->i_security; 281 } 282 283 /* 284 * Get the security label of an inode. 285 */ 286 static struct inode_security_struct *inode_security(struct inode *inode) 287 { 288 __inode_security_revalidate(inode, NULL, true); 289 return inode->i_security; 290 } 291 292 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry) 293 { 294 struct inode *inode = d_backing_inode(dentry); 295 296 return inode->i_security; 297 } 298 299 /* 300 * Get the security label of a dentry's backing inode. 301 */ 302 static struct inode_security_struct *backing_inode_security(struct dentry *dentry) 303 { 304 struct inode *inode = d_backing_inode(dentry); 305 306 __inode_security_revalidate(inode, dentry, true); 307 return inode->i_security; 308 } 309 310 static void inode_free_rcu(struct rcu_head *head) 311 { 312 struct inode_security_struct *isec; 313 314 isec = container_of(head, struct inode_security_struct, rcu); 315 kmem_cache_free(sel_inode_cache, isec); 316 } 317 318 static void inode_free_security(struct inode *inode) 319 { 320 struct inode_security_struct *isec = inode->i_security; 321 struct superblock_security_struct *sbsec = inode->i_sb->s_security; 322 323 /* 324 * As not all inode security structures are in a list, we check for 325 * empty list outside of the lock to make sure that we won't waste 326 * time taking a lock doing nothing. 327 * 328 * The list_del_init() function can be safely called more than once. 329 * It should not be possible for this function to be called with 330 * concurrent list_add(), but for better safety against future changes 331 * in the code, we use list_empty_careful() here. 332 */ 333 if (!list_empty_careful(&isec->list)) { 334 spin_lock(&sbsec->isec_lock); 335 list_del_init(&isec->list); 336 spin_unlock(&sbsec->isec_lock); 337 } 338 339 /* 340 * The inode may still be referenced in a path walk and 341 * a call to selinux_inode_permission() can be made 342 * after inode_free_security() is called. Ideally, the VFS 343 * wouldn't do this, but fixing that is a much harder 344 * job. For now, simply free the i_security via RCU, and 345 * leave the current inode->i_security pointer intact. 346 * The inode will be freed after the RCU grace period too. 347 */ 348 call_rcu(&isec->rcu, inode_free_rcu); 349 } 350 351 static int file_alloc_security(struct file *file) 352 { 353 struct file_security_struct *fsec; 354 u32 sid = current_sid(); 355 356 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL); 357 if (!fsec) 358 return -ENOMEM; 359 360 fsec->sid = sid; 361 fsec->fown_sid = sid; 362 file->f_security = fsec; 363 364 return 0; 365 } 366 367 static void file_free_security(struct file *file) 368 { 369 struct file_security_struct *fsec = file->f_security; 370 file->f_security = NULL; 371 kmem_cache_free(file_security_cache, fsec); 372 } 373 374 static int superblock_alloc_security(struct super_block *sb) 375 { 376 struct superblock_security_struct *sbsec; 377 378 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL); 379 if (!sbsec) 380 return -ENOMEM; 381 382 mutex_init(&sbsec->lock); 383 INIT_LIST_HEAD(&sbsec->isec_head); 384 spin_lock_init(&sbsec->isec_lock); 385 sbsec->sb = sb; 386 sbsec->sid = SECINITSID_UNLABELED; 387 sbsec->def_sid = SECINITSID_FILE; 388 sbsec->mntpoint_sid = SECINITSID_UNLABELED; 389 sb->s_security = sbsec; 390 391 return 0; 392 } 393 394 static void superblock_free_security(struct super_block *sb) 395 { 396 struct superblock_security_struct *sbsec = sb->s_security; 397 sb->s_security = NULL; 398 kfree(sbsec); 399 } 400 401 /* The file system's label must be initialized prior to use. */ 402 403 static const char *labeling_behaviors[7] = { 404 "uses xattr", 405 "uses transition SIDs", 406 "uses task SIDs", 407 "uses genfs_contexts", 408 "not configured for labeling", 409 "uses mountpoint labeling", 410 "uses native labeling", 411 }; 412 413 static inline int inode_doinit(struct inode *inode) 414 { 415 return inode_doinit_with_dentry(inode, NULL); 416 } 417 418 enum { 419 Opt_error = -1, 420 Opt_context = 1, 421 Opt_fscontext = 2, 422 Opt_defcontext = 3, 423 Opt_rootcontext = 4, 424 Opt_labelsupport = 5, 425 Opt_nextmntopt = 6, 426 }; 427 428 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1) 429 430 static const match_table_t tokens = { 431 {Opt_context, CONTEXT_STR "%s"}, 432 {Opt_fscontext, FSCONTEXT_STR "%s"}, 433 {Opt_defcontext, DEFCONTEXT_STR "%s"}, 434 {Opt_rootcontext, ROOTCONTEXT_STR "%s"}, 435 {Opt_labelsupport, LABELSUPP_STR}, 436 {Opt_error, NULL}, 437 }; 438 439 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n" 440 441 static int may_context_mount_sb_relabel(u32 sid, 442 struct superblock_security_struct *sbsec, 443 const struct cred *cred) 444 { 445 const struct task_security_struct *tsec = cred->security; 446 int rc; 447 448 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, 449 FILESYSTEM__RELABELFROM, NULL); 450 if (rc) 451 return rc; 452 453 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM, 454 FILESYSTEM__RELABELTO, NULL); 455 return rc; 456 } 457 458 static int may_context_mount_inode_relabel(u32 sid, 459 struct superblock_security_struct *sbsec, 460 const struct cred *cred) 461 { 462 const struct task_security_struct *tsec = cred->security; 463 int rc; 464 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, 465 FILESYSTEM__RELABELFROM, NULL); 466 if (rc) 467 return rc; 468 469 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, 470 FILESYSTEM__ASSOCIATE, NULL); 471 return rc; 472 } 473 474 static int selinux_is_sblabel_mnt(struct super_block *sb) 475 { 476 struct superblock_security_struct *sbsec = sb->s_security; 477 478 return sbsec->behavior == SECURITY_FS_USE_XATTR || 479 sbsec->behavior == SECURITY_FS_USE_TRANS || 480 sbsec->behavior == SECURITY_FS_USE_TASK || 481 sbsec->behavior == SECURITY_FS_USE_NATIVE || 482 /* Special handling. Genfs but also in-core setxattr handler */ 483 !strcmp(sb->s_type->name, "sysfs") || 484 !strcmp(sb->s_type->name, "pstore") || 485 !strcmp(sb->s_type->name, "debugfs") || 486 !strcmp(sb->s_type->name, "tracefs") || 487 !strcmp(sb->s_type->name, "rootfs") || 488 (selinux_policycap_cgroupseclabel && 489 (!strcmp(sb->s_type->name, "cgroup") || 490 !strcmp(sb->s_type->name, "cgroup2"))); 491 } 492 493 static int sb_finish_set_opts(struct super_block *sb) 494 { 495 struct superblock_security_struct *sbsec = sb->s_security; 496 struct dentry *root = sb->s_root; 497 struct inode *root_inode = d_backing_inode(root); 498 int rc = 0; 499 500 if (sbsec->behavior == SECURITY_FS_USE_XATTR) { 501 /* Make sure that the xattr handler exists and that no 502 error other than -ENODATA is returned by getxattr on 503 the root directory. -ENODATA is ok, as this may be 504 the first boot of the SELinux kernel before we have 505 assigned xattr values to the filesystem. */ 506 if (!(root_inode->i_opflags & IOP_XATTR)) { 507 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no " 508 "xattr support\n", sb->s_id, sb->s_type->name); 509 rc = -EOPNOTSUPP; 510 goto out; 511 } 512 513 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0); 514 if (rc < 0 && rc != -ENODATA) { 515 if (rc == -EOPNOTSUPP) 516 printk(KERN_WARNING "SELinux: (dev %s, type " 517 "%s) has no security xattr handler\n", 518 sb->s_id, sb->s_type->name); 519 else 520 printk(KERN_WARNING "SELinux: (dev %s, type " 521 "%s) getxattr errno %d\n", sb->s_id, 522 sb->s_type->name, -rc); 523 goto out; 524 } 525 } 526 527 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) 528 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n", 529 sb->s_id, sb->s_type->name); 530 531 sbsec->flags |= SE_SBINITIALIZED; 532 if (selinux_is_sblabel_mnt(sb)) 533 sbsec->flags |= SBLABEL_MNT; 534 535 /* Initialize the root inode. */ 536 rc = inode_doinit_with_dentry(root_inode, root); 537 538 /* Initialize any other inodes associated with the superblock, e.g. 539 inodes created prior to initial policy load or inodes created 540 during get_sb by a pseudo filesystem that directly 541 populates itself. */ 542 spin_lock(&sbsec->isec_lock); 543 next_inode: 544 if (!list_empty(&sbsec->isec_head)) { 545 struct inode_security_struct *isec = 546 list_entry(sbsec->isec_head.next, 547 struct inode_security_struct, list); 548 struct inode *inode = isec->inode; 549 list_del_init(&isec->list); 550 spin_unlock(&sbsec->isec_lock); 551 inode = igrab(inode); 552 if (inode) { 553 if (!IS_PRIVATE(inode)) 554 inode_doinit(inode); 555 iput(inode); 556 } 557 spin_lock(&sbsec->isec_lock); 558 goto next_inode; 559 } 560 spin_unlock(&sbsec->isec_lock); 561 out: 562 return rc; 563 } 564 565 /* 566 * This function should allow an FS to ask what it's mount security 567 * options were so it can use those later for submounts, displaying 568 * mount options, or whatever. 569 */ 570 static int selinux_get_mnt_opts(const struct super_block *sb, 571 struct security_mnt_opts *opts) 572 { 573 int rc = 0, i; 574 struct superblock_security_struct *sbsec = sb->s_security; 575 char *context = NULL; 576 u32 len; 577 char tmp; 578 579 security_init_mnt_opts(opts); 580 581 if (!(sbsec->flags & SE_SBINITIALIZED)) 582 return -EINVAL; 583 584 if (!ss_initialized) 585 return -EINVAL; 586 587 /* make sure we always check enough bits to cover the mask */ 588 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS)); 589 590 tmp = sbsec->flags & SE_MNTMASK; 591 /* count the number of mount options for this sb */ 592 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) { 593 if (tmp & 0x01) 594 opts->num_mnt_opts++; 595 tmp >>= 1; 596 } 597 /* Check if the Label support flag is set */ 598 if (sbsec->flags & SBLABEL_MNT) 599 opts->num_mnt_opts++; 600 601 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC); 602 if (!opts->mnt_opts) { 603 rc = -ENOMEM; 604 goto out_free; 605 } 606 607 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC); 608 if (!opts->mnt_opts_flags) { 609 rc = -ENOMEM; 610 goto out_free; 611 } 612 613 i = 0; 614 if (sbsec->flags & FSCONTEXT_MNT) { 615 rc = security_sid_to_context(sbsec->sid, &context, &len); 616 if (rc) 617 goto out_free; 618 opts->mnt_opts[i] = context; 619 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT; 620 } 621 if (sbsec->flags & CONTEXT_MNT) { 622 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len); 623 if (rc) 624 goto out_free; 625 opts->mnt_opts[i] = context; 626 opts->mnt_opts_flags[i++] = CONTEXT_MNT; 627 } 628 if (sbsec->flags & DEFCONTEXT_MNT) { 629 rc = security_sid_to_context(sbsec->def_sid, &context, &len); 630 if (rc) 631 goto out_free; 632 opts->mnt_opts[i] = context; 633 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT; 634 } 635 if (sbsec->flags & ROOTCONTEXT_MNT) { 636 struct dentry *root = sbsec->sb->s_root; 637 struct inode_security_struct *isec = backing_inode_security(root); 638 639 rc = security_sid_to_context(isec->sid, &context, &len); 640 if (rc) 641 goto out_free; 642 opts->mnt_opts[i] = context; 643 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT; 644 } 645 if (sbsec->flags & SBLABEL_MNT) { 646 opts->mnt_opts[i] = NULL; 647 opts->mnt_opts_flags[i++] = SBLABEL_MNT; 648 } 649 650 BUG_ON(i != opts->num_mnt_opts); 651 652 return 0; 653 654 out_free: 655 security_free_mnt_opts(opts); 656 return rc; 657 } 658 659 static int bad_option(struct superblock_security_struct *sbsec, char flag, 660 u32 old_sid, u32 new_sid) 661 { 662 char mnt_flags = sbsec->flags & SE_MNTMASK; 663 664 /* check if the old mount command had the same options */ 665 if (sbsec->flags & SE_SBINITIALIZED) 666 if (!(sbsec->flags & flag) || 667 (old_sid != new_sid)) 668 return 1; 669 670 /* check if we were passed the same options twice, 671 * aka someone passed context=a,context=b 672 */ 673 if (!(sbsec->flags & SE_SBINITIALIZED)) 674 if (mnt_flags & flag) 675 return 1; 676 return 0; 677 } 678 679 /* 680 * Allow filesystems with binary mount data to explicitly set mount point 681 * labeling information. 682 */ 683 static int selinux_set_mnt_opts(struct super_block *sb, 684 struct security_mnt_opts *opts, 685 unsigned long kern_flags, 686 unsigned long *set_kern_flags) 687 { 688 const struct cred *cred = current_cred(); 689 int rc = 0, i; 690 struct superblock_security_struct *sbsec = sb->s_security; 691 const char *name = sb->s_type->name; 692 struct dentry *root = sbsec->sb->s_root; 693 struct inode_security_struct *root_isec; 694 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0; 695 u32 defcontext_sid = 0; 696 char **mount_options = opts->mnt_opts; 697 int *flags = opts->mnt_opts_flags; 698 int num_opts = opts->num_mnt_opts; 699 700 mutex_lock(&sbsec->lock); 701 702 if (!ss_initialized) { 703 if (!num_opts) { 704 /* Defer initialization until selinux_complete_init, 705 after the initial policy is loaded and the security 706 server is ready to handle calls. */ 707 goto out; 708 } 709 rc = -EINVAL; 710 printk(KERN_WARNING "SELinux: Unable to set superblock options " 711 "before the security server is initialized\n"); 712 goto out; 713 } 714 if (kern_flags && !set_kern_flags) { 715 /* Specifying internal flags without providing a place to 716 * place the results is not allowed */ 717 rc = -EINVAL; 718 goto out; 719 } 720 721 /* 722 * Binary mount data FS will come through this function twice. Once 723 * from an explicit call and once from the generic calls from the vfs. 724 * Since the generic VFS calls will not contain any security mount data 725 * we need to skip the double mount verification. 726 * 727 * This does open a hole in which we will not notice if the first 728 * mount using this sb set explict options and a second mount using 729 * this sb does not set any security options. (The first options 730 * will be used for both mounts) 731 */ 732 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) 733 && (num_opts == 0)) 734 goto out; 735 736 root_isec = backing_inode_security_novalidate(root); 737 738 /* 739 * parse the mount options, check if they are valid sids. 740 * also check if someone is trying to mount the same sb more 741 * than once with different security options. 742 */ 743 for (i = 0; i < num_opts; i++) { 744 u32 sid; 745 746 if (flags[i] == SBLABEL_MNT) 747 continue; 748 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL); 749 if (rc) { 750 printk(KERN_WARNING "SELinux: security_context_str_to_sid" 751 "(%s) failed for (dev %s, type %s) errno=%d\n", 752 mount_options[i], sb->s_id, name, rc); 753 goto out; 754 } 755 switch (flags[i]) { 756 case FSCONTEXT_MNT: 757 fscontext_sid = sid; 758 759 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, 760 fscontext_sid)) 761 goto out_double_mount; 762 763 sbsec->flags |= FSCONTEXT_MNT; 764 break; 765 case CONTEXT_MNT: 766 context_sid = sid; 767 768 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, 769 context_sid)) 770 goto out_double_mount; 771 772 sbsec->flags |= CONTEXT_MNT; 773 break; 774 case ROOTCONTEXT_MNT: 775 rootcontext_sid = sid; 776 777 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, 778 rootcontext_sid)) 779 goto out_double_mount; 780 781 sbsec->flags |= ROOTCONTEXT_MNT; 782 783 break; 784 case DEFCONTEXT_MNT: 785 defcontext_sid = sid; 786 787 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, 788 defcontext_sid)) 789 goto out_double_mount; 790 791 sbsec->flags |= DEFCONTEXT_MNT; 792 793 break; 794 default: 795 rc = -EINVAL; 796 goto out; 797 } 798 } 799 800 if (sbsec->flags & SE_SBINITIALIZED) { 801 /* previously mounted with options, but not on this attempt? */ 802 if ((sbsec->flags & SE_MNTMASK) && !num_opts) 803 goto out_double_mount; 804 rc = 0; 805 goto out; 806 } 807 808 if (strcmp(sb->s_type->name, "proc") == 0) 809 sbsec->flags |= SE_SBPROC | SE_SBGENFS; 810 811 if (!strcmp(sb->s_type->name, "debugfs") || 812 !strcmp(sb->s_type->name, "sysfs") || 813 !strcmp(sb->s_type->name, "pstore")) 814 sbsec->flags |= SE_SBGENFS; 815 816 if (!sbsec->behavior) { 817 /* 818 * Determine the labeling behavior to use for this 819 * filesystem type. 820 */ 821 rc = security_fs_use(sb); 822 if (rc) { 823 printk(KERN_WARNING 824 "%s: security_fs_use(%s) returned %d\n", 825 __func__, sb->s_type->name, rc); 826 goto out; 827 } 828 } 829 830 /* 831 * If this is a user namespace mount and the filesystem type is not 832 * explicitly whitelisted, then no contexts are allowed on the command 833 * line and security labels must be ignored. 834 */ 835 if (sb->s_user_ns != &init_user_ns && 836 strcmp(sb->s_type->name, "tmpfs") && 837 strcmp(sb->s_type->name, "ramfs") && 838 strcmp(sb->s_type->name, "devpts")) { 839 if (context_sid || fscontext_sid || rootcontext_sid || 840 defcontext_sid) { 841 rc = -EACCES; 842 goto out; 843 } 844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) { 845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT; 846 rc = security_transition_sid(current_sid(), current_sid(), 847 SECCLASS_FILE, NULL, 848 &sbsec->mntpoint_sid); 849 if (rc) 850 goto out; 851 } 852 goto out_set_opts; 853 } 854 855 /* sets the context of the superblock for the fs being mounted. */ 856 if (fscontext_sid) { 857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred); 858 if (rc) 859 goto out; 860 861 sbsec->sid = fscontext_sid; 862 } 863 864 /* 865 * Switch to using mount point labeling behavior. 866 * sets the label used on all file below the mountpoint, and will set 867 * the superblock context if not already set. 868 */ 869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) { 870 sbsec->behavior = SECURITY_FS_USE_NATIVE; 871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS; 872 } 873 874 if (context_sid) { 875 if (!fscontext_sid) { 876 rc = may_context_mount_sb_relabel(context_sid, sbsec, 877 cred); 878 if (rc) 879 goto out; 880 sbsec->sid = context_sid; 881 } else { 882 rc = may_context_mount_inode_relabel(context_sid, sbsec, 883 cred); 884 if (rc) 885 goto out; 886 } 887 if (!rootcontext_sid) 888 rootcontext_sid = context_sid; 889 890 sbsec->mntpoint_sid = context_sid; 891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT; 892 } 893 894 if (rootcontext_sid) { 895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, 896 cred); 897 if (rc) 898 goto out; 899 900 root_isec->sid = rootcontext_sid; 901 root_isec->initialized = LABEL_INITIALIZED; 902 } 903 904 if (defcontext_sid) { 905 if (sbsec->behavior != SECURITY_FS_USE_XATTR && 906 sbsec->behavior != SECURITY_FS_USE_NATIVE) { 907 rc = -EINVAL; 908 printk(KERN_WARNING "SELinux: defcontext option is " 909 "invalid for this filesystem type\n"); 910 goto out; 911 } 912 913 if (defcontext_sid != sbsec->def_sid) { 914 rc = may_context_mount_inode_relabel(defcontext_sid, 915 sbsec, cred); 916 if (rc) 917 goto out; 918 } 919 920 sbsec->def_sid = defcontext_sid; 921 } 922 923 out_set_opts: 924 rc = sb_finish_set_opts(sb); 925 out: 926 mutex_unlock(&sbsec->lock); 927 return rc; 928 out_double_mount: 929 rc = -EINVAL; 930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different " 931 "security settings for (dev %s, type %s)\n", sb->s_id, name); 932 goto out; 933 } 934 935 static int selinux_cmp_sb_context(const struct super_block *oldsb, 936 const struct super_block *newsb) 937 { 938 struct superblock_security_struct *old = oldsb->s_security; 939 struct superblock_security_struct *new = newsb->s_security; 940 char oldflags = old->flags & SE_MNTMASK; 941 char newflags = new->flags & SE_MNTMASK; 942 943 if (oldflags != newflags) 944 goto mismatch; 945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid) 946 goto mismatch; 947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid) 948 goto mismatch; 949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid) 950 goto mismatch; 951 if (oldflags & ROOTCONTEXT_MNT) { 952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root); 953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root); 954 if (oldroot->sid != newroot->sid) 955 goto mismatch; 956 } 957 return 0; 958 mismatch: 959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, " 960 "different security settings for (dev %s, " 961 "type %s)\n", newsb->s_id, newsb->s_type->name); 962 return -EBUSY; 963 } 964 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, 966 struct super_block *newsb) 967 { 968 const struct superblock_security_struct *oldsbsec = oldsb->s_security; 969 struct superblock_security_struct *newsbsec = newsb->s_security; 970 971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT); 972 int set_context = (oldsbsec->flags & CONTEXT_MNT); 973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT); 974 975 /* 976 * if the parent was able to be mounted it clearly had no special lsm 977 * mount options. thus we can safely deal with this superblock later 978 */ 979 if (!ss_initialized) 980 return 0; 981 982 /* how can we clone if the old one wasn't set up?? */ 983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED)); 984 985 /* if fs is reusing a sb, make sure that the contexts match */ 986 if (newsbsec->flags & SE_SBINITIALIZED) 987 return selinux_cmp_sb_context(oldsb, newsb); 988 989 mutex_lock(&newsbsec->lock); 990 991 newsbsec->flags = oldsbsec->flags; 992 993 newsbsec->sid = oldsbsec->sid; 994 newsbsec->def_sid = oldsbsec->def_sid; 995 newsbsec->behavior = oldsbsec->behavior; 996 997 if (set_context) { 998 u32 sid = oldsbsec->mntpoint_sid; 999 1000 if (!set_fscontext) 1001 newsbsec->sid = sid; 1002 if (!set_rootcontext) { 1003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root); 1004 newisec->sid = sid; 1005 } 1006 newsbsec->mntpoint_sid = sid; 1007 } 1008 if (set_rootcontext) { 1009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root); 1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root); 1011 1012 newisec->sid = oldisec->sid; 1013 } 1014 1015 sb_finish_set_opts(newsb); 1016 mutex_unlock(&newsbsec->lock); 1017 return 0; 1018 } 1019 1020 static int selinux_parse_opts_str(char *options, 1021 struct security_mnt_opts *opts) 1022 { 1023 char *p; 1024 char *context = NULL, *defcontext = NULL; 1025 char *fscontext = NULL, *rootcontext = NULL; 1026 int rc, num_mnt_opts = 0; 1027 1028 opts->num_mnt_opts = 0; 1029 1030 /* Standard string-based options. */ 1031 while ((p = strsep(&options, "|")) != NULL) { 1032 int token; 1033 substring_t args[MAX_OPT_ARGS]; 1034 1035 if (!*p) 1036 continue; 1037 1038 token = match_token(p, tokens, args); 1039 1040 switch (token) { 1041 case Opt_context: 1042 if (context || defcontext) { 1043 rc = -EINVAL; 1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1045 goto out_err; 1046 } 1047 context = match_strdup(&args[0]); 1048 if (!context) { 1049 rc = -ENOMEM; 1050 goto out_err; 1051 } 1052 break; 1053 1054 case Opt_fscontext: 1055 if (fscontext) { 1056 rc = -EINVAL; 1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1058 goto out_err; 1059 } 1060 fscontext = match_strdup(&args[0]); 1061 if (!fscontext) { 1062 rc = -ENOMEM; 1063 goto out_err; 1064 } 1065 break; 1066 1067 case Opt_rootcontext: 1068 if (rootcontext) { 1069 rc = -EINVAL; 1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1071 goto out_err; 1072 } 1073 rootcontext = match_strdup(&args[0]); 1074 if (!rootcontext) { 1075 rc = -ENOMEM; 1076 goto out_err; 1077 } 1078 break; 1079 1080 case Opt_defcontext: 1081 if (context || defcontext) { 1082 rc = -EINVAL; 1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); 1084 goto out_err; 1085 } 1086 defcontext = match_strdup(&args[0]); 1087 if (!defcontext) { 1088 rc = -ENOMEM; 1089 goto out_err; 1090 } 1091 break; 1092 case Opt_labelsupport: 1093 break; 1094 default: 1095 rc = -EINVAL; 1096 printk(KERN_WARNING "SELinux: unknown mount option\n"); 1097 goto out_err; 1098 1099 } 1100 } 1101 1102 rc = -ENOMEM; 1103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL); 1104 if (!opts->mnt_opts) 1105 goto out_err; 1106 1107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), 1108 GFP_KERNEL); 1109 if (!opts->mnt_opts_flags) { 1110 kfree(opts->mnt_opts); 1111 goto out_err; 1112 } 1113 1114 if (fscontext) { 1115 opts->mnt_opts[num_mnt_opts] = fscontext; 1116 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT; 1117 } 1118 if (context) { 1119 opts->mnt_opts[num_mnt_opts] = context; 1120 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT; 1121 } 1122 if (rootcontext) { 1123 opts->mnt_opts[num_mnt_opts] = rootcontext; 1124 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT; 1125 } 1126 if (defcontext) { 1127 opts->mnt_opts[num_mnt_opts] = defcontext; 1128 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT; 1129 } 1130 1131 opts->num_mnt_opts = num_mnt_opts; 1132 return 0; 1133 1134 out_err: 1135 kfree(context); 1136 kfree(defcontext); 1137 kfree(fscontext); 1138 kfree(rootcontext); 1139 return rc; 1140 } 1141 /* 1142 * string mount options parsing and call set the sbsec 1143 */ 1144 static int superblock_doinit(struct super_block *sb, void *data) 1145 { 1146 int rc = 0; 1147 char *options = data; 1148 struct security_mnt_opts opts; 1149 1150 security_init_mnt_opts(&opts); 1151 1152 if (!data) 1153 goto out; 1154 1155 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA); 1156 1157 rc = selinux_parse_opts_str(options, &opts); 1158 if (rc) 1159 goto out_err; 1160 1161 out: 1162 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL); 1163 1164 out_err: 1165 security_free_mnt_opts(&opts); 1166 return rc; 1167 } 1168 1169 static void selinux_write_opts(struct seq_file *m, 1170 struct security_mnt_opts *opts) 1171 { 1172 int i; 1173 char *prefix; 1174 1175 for (i = 0; i < opts->num_mnt_opts; i++) { 1176 char *has_comma; 1177 1178 if (opts->mnt_opts[i]) 1179 has_comma = strchr(opts->mnt_opts[i], ','); 1180 else 1181 has_comma = NULL; 1182 1183 switch (opts->mnt_opts_flags[i]) { 1184 case CONTEXT_MNT: 1185 prefix = CONTEXT_STR; 1186 break; 1187 case FSCONTEXT_MNT: 1188 prefix = FSCONTEXT_STR; 1189 break; 1190 case ROOTCONTEXT_MNT: 1191 prefix = ROOTCONTEXT_STR; 1192 break; 1193 case DEFCONTEXT_MNT: 1194 prefix = DEFCONTEXT_STR; 1195 break; 1196 case SBLABEL_MNT: 1197 seq_putc(m, ','); 1198 seq_puts(m, LABELSUPP_STR); 1199 continue; 1200 default: 1201 BUG(); 1202 return; 1203 }; 1204 /* we need a comma before each option */ 1205 seq_putc(m, ','); 1206 seq_puts(m, prefix); 1207 if (has_comma) 1208 seq_putc(m, '\"'); 1209 seq_escape(m, opts->mnt_opts[i], "\"\n\\"); 1210 if (has_comma) 1211 seq_putc(m, '\"'); 1212 } 1213 } 1214 1215 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb) 1216 { 1217 struct security_mnt_opts opts; 1218 int rc; 1219 1220 rc = selinux_get_mnt_opts(sb, &opts); 1221 if (rc) { 1222 /* before policy load we may get EINVAL, don't show anything */ 1223 if (rc == -EINVAL) 1224 rc = 0; 1225 return rc; 1226 } 1227 1228 selinux_write_opts(m, &opts); 1229 1230 security_free_mnt_opts(&opts); 1231 1232 return rc; 1233 } 1234 1235 static inline u16 inode_mode_to_security_class(umode_t mode) 1236 { 1237 switch (mode & S_IFMT) { 1238 case S_IFSOCK: 1239 return SECCLASS_SOCK_FILE; 1240 case S_IFLNK: 1241 return SECCLASS_LNK_FILE; 1242 case S_IFREG: 1243 return SECCLASS_FILE; 1244 case S_IFBLK: 1245 return SECCLASS_BLK_FILE; 1246 case S_IFDIR: 1247 return SECCLASS_DIR; 1248 case S_IFCHR: 1249 return SECCLASS_CHR_FILE; 1250 case S_IFIFO: 1251 return SECCLASS_FIFO_FILE; 1252 1253 } 1254 1255 return SECCLASS_FILE; 1256 } 1257 1258 static inline int default_protocol_stream(int protocol) 1259 { 1260 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP); 1261 } 1262 1263 static inline int default_protocol_dgram(int protocol) 1264 { 1265 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP); 1266 } 1267 1268 static inline u16 socket_type_to_security_class(int family, int type, int protocol) 1269 { 1270 int extsockclass = selinux_policycap_extsockclass; 1271 1272 switch (family) { 1273 case PF_UNIX: 1274 switch (type) { 1275 case SOCK_STREAM: 1276 case SOCK_SEQPACKET: 1277 return SECCLASS_UNIX_STREAM_SOCKET; 1278 case SOCK_DGRAM: 1279 return SECCLASS_UNIX_DGRAM_SOCKET; 1280 } 1281 break; 1282 case PF_INET: 1283 case PF_INET6: 1284 switch (type) { 1285 case SOCK_STREAM: 1286 case SOCK_SEQPACKET: 1287 if (default_protocol_stream(protocol)) 1288 return SECCLASS_TCP_SOCKET; 1289 else if (extsockclass && protocol == IPPROTO_SCTP) 1290 return SECCLASS_SCTP_SOCKET; 1291 else 1292 return SECCLASS_RAWIP_SOCKET; 1293 case SOCK_DGRAM: 1294 if (default_protocol_dgram(protocol)) 1295 return SECCLASS_UDP_SOCKET; 1296 else if (extsockclass && (protocol == IPPROTO_ICMP || 1297 protocol == IPPROTO_ICMPV6)) 1298 return SECCLASS_ICMP_SOCKET; 1299 else 1300 return SECCLASS_RAWIP_SOCKET; 1301 case SOCK_DCCP: 1302 return SECCLASS_DCCP_SOCKET; 1303 default: 1304 return SECCLASS_RAWIP_SOCKET; 1305 } 1306 break; 1307 case PF_NETLINK: 1308 switch (protocol) { 1309 case NETLINK_ROUTE: 1310 return SECCLASS_NETLINK_ROUTE_SOCKET; 1311 case NETLINK_SOCK_DIAG: 1312 return SECCLASS_NETLINK_TCPDIAG_SOCKET; 1313 case NETLINK_NFLOG: 1314 return SECCLASS_NETLINK_NFLOG_SOCKET; 1315 case NETLINK_XFRM: 1316 return SECCLASS_NETLINK_XFRM_SOCKET; 1317 case NETLINK_SELINUX: 1318 return SECCLASS_NETLINK_SELINUX_SOCKET; 1319 case NETLINK_ISCSI: 1320 return SECCLASS_NETLINK_ISCSI_SOCKET; 1321 case NETLINK_AUDIT: 1322 return SECCLASS_NETLINK_AUDIT_SOCKET; 1323 case NETLINK_FIB_LOOKUP: 1324 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET; 1325 case NETLINK_CONNECTOR: 1326 return SECCLASS_NETLINK_CONNECTOR_SOCKET; 1327 case NETLINK_NETFILTER: 1328 return SECCLASS_NETLINK_NETFILTER_SOCKET; 1329 case NETLINK_DNRTMSG: 1330 return SECCLASS_NETLINK_DNRT_SOCKET; 1331 case NETLINK_KOBJECT_UEVENT: 1332 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET; 1333 case NETLINK_GENERIC: 1334 return SECCLASS_NETLINK_GENERIC_SOCKET; 1335 case NETLINK_SCSITRANSPORT: 1336 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET; 1337 case NETLINK_RDMA: 1338 return SECCLASS_NETLINK_RDMA_SOCKET; 1339 case NETLINK_CRYPTO: 1340 return SECCLASS_NETLINK_CRYPTO_SOCKET; 1341 default: 1342 return SECCLASS_NETLINK_SOCKET; 1343 } 1344 case PF_PACKET: 1345 return SECCLASS_PACKET_SOCKET; 1346 case PF_KEY: 1347 return SECCLASS_KEY_SOCKET; 1348 case PF_APPLETALK: 1349 return SECCLASS_APPLETALK_SOCKET; 1350 } 1351 1352 if (extsockclass) { 1353 switch (family) { 1354 case PF_AX25: 1355 return SECCLASS_AX25_SOCKET; 1356 case PF_IPX: 1357 return SECCLASS_IPX_SOCKET; 1358 case PF_NETROM: 1359 return SECCLASS_NETROM_SOCKET; 1360 case PF_ATMPVC: 1361 return SECCLASS_ATMPVC_SOCKET; 1362 case PF_X25: 1363 return SECCLASS_X25_SOCKET; 1364 case PF_ROSE: 1365 return SECCLASS_ROSE_SOCKET; 1366 case PF_DECnet: 1367 return SECCLASS_DECNET_SOCKET; 1368 case PF_ATMSVC: 1369 return SECCLASS_ATMSVC_SOCKET; 1370 case PF_RDS: 1371 return SECCLASS_RDS_SOCKET; 1372 case PF_IRDA: 1373 return SECCLASS_IRDA_SOCKET; 1374 case PF_PPPOX: 1375 return SECCLASS_PPPOX_SOCKET; 1376 case PF_LLC: 1377 return SECCLASS_LLC_SOCKET; 1378 case PF_CAN: 1379 return SECCLASS_CAN_SOCKET; 1380 case PF_TIPC: 1381 return SECCLASS_TIPC_SOCKET; 1382 case PF_BLUETOOTH: 1383 return SECCLASS_BLUETOOTH_SOCKET; 1384 case PF_IUCV: 1385 return SECCLASS_IUCV_SOCKET; 1386 case PF_RXRPC: 1387 return SECCLASS_RXRPC_SOCKET; 1388 case PF_ISDN: 1389 return SECCLASS_ISDN_SOCKET; 1390 case PF_PHONET: 1391 return SECCLASS_PHONET_SOCKET; 1392 case PF_IEEE802154: 1393 return SECCLASS_IEEE802154_SOCKET; 1394 case PF_CAIF: 1395 return SECCLASS_CAIF_SOCKET; 1396 case PF_ALG: 1397 return SECCLASS_ALG_SOCKET; 1398 case PF_NFC: 1399 return SECCLASS_NFC_SOCKET; 1400 case PF_VSOCK: 1401 return SECCLASS_VSOCK_SOCKET; 1402 case PF_KCM: 1403 return SECCLASS_KCM_SOCKET; 1404 case PF_QIPCRTR: 1405 return SECCLASS_QIPCRTR_SOCKET; 1406 case PF_SMC: 1407 return SECCLASS_SMC_SOCKET; 1408 #if PF_MAX > 44 1409 #error New address family defined, please update this function. 1410 #endif 1411 } 1412 } 1413 1414 return SECCLASS_SOCKET; 1415 } 1416 1417 static int selinux_genfs_get_sid(struct dentry *dentry, 1418 u16 tclass, 1419 u16 flags, 1420 u32 *sid) 1421 { 1422 int rc; 1423 struct super_block *sb = dentry->d_sb; 1424 char *buffer, *path; 1425 1426 buffer = (char *)__get_free_page(GFP_KERNEL); 1427 if (!buffer) 1428 return -ENOMEM; 1429 1430 path = dentry_path_raw(dentry, buffer, PAGE_SIZE); 1431 if (IS_ERR(path)) 1432 rc = PTR_ERR(path); 1433 else { 1434 if (flags & SE_SBPROC) { 1435 /* each process gets a /proc/PID/ entry. Strip off the 1436 * PID part to get a valid selinux labeling. 1437 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */ 1438 while (path[1] >= '0' && path[1] <= '9') { 1439 path[1] = '/'; 1440 path++; 1441 } 1442 } 1443 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid); 1444 } 1445 free_page((unsigned long)buffer); 1446 return rc; 1447 } 1448 1449 /* The inode's security attributes must be initialized before first use. */ 1450 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry) 1451 { 1452 struct superblock_security_struct *sbsec = NULL; 1453 struct inode_security_struct *isec = inode->i_security; 1454 u32 task_sid, sid = 0; 1455 u16 sclass; 1456 struct dentry *dentry; 1457 #define INITCONTEXTLEN 255 1458 char *context = NULL; 1459 unsigned len = 0; 1460 int rc = 0; 1461 1462 if (isec->initialized == LABEL_INITIALIZED) 1463 return 0; 1464 1465 spin_lock(&isec->lock); 1466 if (isec->initialized == LABEL_INITIALIZED) 1467 goto out_unlock; 1468 1469 if (isec->sclass == SECCLASS_FILE) 1470 isec->sclass = inode_mode_to_security_class(inode->i_mode); 1471 1472 sbsec = inode->i_sb->s_security; 1473 if (!(sbsec->flags & SE_SBINITIALIZED)) { 1474 /* Defer initialization until selinux_complete_init, 1475 after the initial policy is loaded and the security 1476 server is ready to handle calls. */ 1477 spin_lock(&sbsec->isec_lock); 1478 if (list_empty(&isec->list)) 1479 list_add(&isec->list, &sbsec->isec_head); 1480 spin_unlock(&sbsec->isec_lock); 1481 goto out_unlock; 1482 } 1483 1484 sclass = isec->sclass; 1485 task_sid = isec->task_sid; 1486 sid = isec->sid; 1487 isec->initialized = LABEL_PENDING; 1488 spin_unlock(&isec->lock); 1489 1490 switch (sbsec->behavior) { 1491 case SECURITY_FS_USE_NATIVE: 1492 break; 1493 case SECURITY_FS_USE_XATTR: 1494 if (!(inode->i_opflags & IOP_XATTR)) { 1495 sid = sbsec->def_sid; 1496 break; 1497 } 1498 /* Need a dentry, since the xattr API requires one. 1499 Life would be simpler if we could just pass the inode. */ 1500 if (opt_dentry) { 1501 /* Called from d_instantiate or d_splice_alias. */ 1502 dentry = dget(opt_dentry); 1503 } else { 1504 /* Called from selinux_complete_init, try to find a dentry. */ 1505 dentry = d_find_alias(inode); 1506 } 1507 if (!dentry) { 1508 /* 1509 * this is can be hit on boot when a file is accessed 1510 * before the policy is loaded. When we load policy we 1511 * may find inodes that have no dentry on the 1512 * sbsec->isec_head list. No reason to complain as these 1513 * will get fixed up the next time we go through 1514 * inode_doinit with a dentry, before these inodes could 1515 * be used again by userspace. 1516 */ 1517 goto out; 1518 } 1519 1520 len = INITCONTEXTLEN; 1521 context = kmalloc(len+1, GFP_NOFS); 1522 if (!context) { 1523 rc = -ENOMEM; 1524 dput(dentry); 1525 goto out; 1526 } 1527 context[len] = '\0'; 1528 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len); 1529 if (rc == -ERANGE) { 1530 kfree(context); 1531 1532 /* Need a larger buffer. Query for the right size. */ 1533 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0); 1534 if (rc < 0) { 1535 dput(dentry); 1536 goto out; 1537 } 1538 len = rc; 1539 context = kmalloc(len+1, GFP_NOFS); 1540 if (!context) { 1541 rc = -ENOMEM; 1542 dput(dentry); 1543 goto out; 1544 } 1545 context[len] = '\0'; 1546 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len); 1547 } 1548 dput(dentry); 1549 if (rc < 0) { 1550 if (rc != -ENODATA) { 1551 printk(KERN_WARNING "SELinux: %s: getxattr returned " 1552 "%d for dev=%s ino=%ld\n", __func__, 1553 -rc, inode->i_sb->s_id, inode->i_ino); 1554 kfree(context); 1555 goto out; 1556 } 1557 /* Map ENODATA to the default file SID */ 1558 sid = sbsec->def_sid; 1559 rc = 0; 1560 } else { 1561 rc = security_context_to_sid_default(context, rc, &sid, 1562 sbsec->def_sid, 1563 GFP_NOFS); 1564 if (rc) { 1565 char *dev = inode->i_sb->s_id; 1566 unsigned long ino = inode->i_ino; 1567 1568 if (rc == -EINVAL) { 1569 if (printk_ratelimit()) 1570 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid " 1571 "context=%s. This indicates you may need to relabel the inode or the " 1572 "filesystem in question.\n", ino, dev, context); 1573 } else { 1574 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) " 1575 "returned %d for dev=%s ino=%ld\n", 1576 __func__, context, -rc, dev, ino); 1577 } 1578 kfree(context); 1579 /* Leave with the unlabeled SID */ 1580 rc = 0; 1581 break; 1582 } 1583 } 1584 kfree(context); 1585 break; 1586 case SECURITY_FS_USE_TASK: 1587 sid = task_sid; 1588 break; 1589 case SECURITY_FS_USE_TRANS: 1590 /* Default to the fs SID. */ 1591 sid = sbsec->sid; 1592 1593 /* Try to obtain a transition SID. */ 1594 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid); 1595 if (rc) 1596 goto out; 1597 break; 1598 case SECURITY_FS_USE_MNTPOINT: 1599 sid = sbsec->mntpoint_sid; 1600 break; 1601 default: 1602 /* Default to the fs superblock SID. */ 1603 sid = sbsec->sid; 1604 1605 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) { 1606 /* We must have a dentry to determine the label on 1607 * procfs inodes */ 1608 if (opt_dentry) 1609 /* Called from d_instantiate or 1610 * d_splice_alias. */ 1611 dentry = dget(opt_dentry); 1612 else 1613 /* Called from selinux_complete_init, try to 1614 * find a dentry. */ 1615 dentry = d_find_alias(inode); 1616 /* 1617 * This can be hit on boot when a file is accessed 1618 * before the policy is loaded. When we load policy we 1619 * may find inodes that have no dentry on the 1620 * sbsec->isec_head list. No reason to complain as 1621 * these will get fixed up the next time we go through 1622 * inode_doinit() with a dentry, before these inodes 1623 * could be used again by userspace. 1624 */ 1625 if (!dentry) 1626 goto out; 1627 rc = selinux_genfs_get_sid(dentry, sclass, 1628 sbsec->flags, &sid); 1629 dput(dentry); 1630 if (rc) 1631 goto out; 1632 } 1633 break; 1634 } 1635 1636 out: 1637 spin_lock(&isec->lock); 1638 if (isec->initialized == LABEL_PENDING) { 1639 if (!sid || rc) { 1640 isec->initialized = LABEL_INVALID; 1641 goto out_unlock; 1642 } 1643 1644 isec->initialized = LABEL_INITIALIZED; 1645 isec->sid = sid; 1646 } 1647 1648 out_unlock: 1649 spin_unlock(&isec->lock); 1650 return rc; 1651 } 1652 1653 /* Convert a Linux signal to an access vector. */ 1654 static inline u32 signal_to_av(int sig) 1655 { 1656 u32 perm = 0; 1657 1658 switch (sig) { 1659 case SIGCHLD: 1660 /* Commonly granted from child to parent. */ 1661 perm = PROCESS__SIGCHLD; 1662 break; 1663 case SIGKILL: 1664 /* Cannot be caught or ignored */ 1665 perm = PROCESS__SIGKILL; 1666 break; 1667 case SIGSTOP: 1668 /* Cannot be caught or ignored */ 1669 perm = PROCESS__SIGSTOP; 1670 break; 1671 default: 1672 /* All other signals. */ 1673 perm = PROCESS__SIGNAL; 1674 break; 1675 } 1676 1677 return perm; 1678 } 1679 1680 #if CAP_LAST_CAP > 63 1681 #error Fix SELinux to handle capabilities > 63. 1682 #endif 1683 1684 /* Check whether a task is allowed to use a capability. */ 1685 static int cred_has_capability(const struct cred *cred, 1686 int cap, int audit, bool initns) 1687 { 1688 struct common_audit_data ad; 1689 struct av_decision avd; 1690 u16 sclass; 1691 u32 sid = cred_sid(cred); 1692 u32 av = CAP_TO_MASK(cap); 1693 int rc; 1694 1695 ad.type = LSM_AUDIT_DATA_CAP; 1696 ad.u.cap = cap; 1697 1698 switch (CAP_TO_INDEX(cap)) { 1699 case 0: 1700 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS; 1701 break; 1702 case 1: 1703 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS; 1704 break; 1705 default: 1706 printk(KERN_ERR 1707 "SELinux: out of range capability %d\n", cap); 1708 BUG(); 1709 return -EINVAL; 1710 } 1711 1712 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd); 1713 if (audit == SECURITY_CAP_AUDIT) { 1714 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0); 1715 if (rc2) 1716 return rc2; 1717 } 1718 return rc; 1719 } 1720 1721 /* Check whether a task has a particular permission to an inode. 1722 The 'adp' parameter is optional and allows other audit 1723 data to be passed (e.g. the dentry). */ 1724 static int inode_has_perm(const struct cred *cred, 1725 struct inode *inode, 1726 u32 perms, 1727 struct common_audit_data *adp) 1728 { 1729 struct inode_security_struct *isec; 1730 u32 sid; 1731 1732 validate_creds(cred); 1733 1734 if (unlikely(IS_PRIVATE(inode))) 1735 return 0; 1736 1737 sid = cred_sid(cred); 1738 isec = inode->i_security; 1739 1740 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp); 1741 } 1742 1743 /* Same as inode_has_perm, but pass explicit audit data containing 1744 the dentry to help the auditing code to more easily generate the 1745 pathname if needed. */ 1746 static inline int dentry_has_perm(const struct cred *cred, 1747 struct dentry *dentry, 1748 u32 av) 1749 { 1750 struct inode *inode = d_backing_inode(dentry); 1751 struct common_audit_data ad; 1752 1753 ad.type = LSM_AUDIT_DATA_DENTRY; 1754 ad.u.dentry = dentry; 1755 __inode_security_revalidate(inode, dentry, true); 1756 return inode_has_perm(cred, inode, av, &ad); 1757 } 1758 1759 /* Same as inode_has_perm, but pass explicit audit data containing 1760 the path to help the auditing code to more easily generate the 1761 pathname if needed. */ 1762 static inline int path_has_perm(const struct cred *cred, 1763 const struct path *path, 1764 u32 av) 1765 { 1766 struct inode *inode = d_backing_inode(path->dentry); 1767 struct common_audit_data ad; 1768 1769 ad.type = LSM_AUDIT_DATA_PATH; 1770 ad.u.path = *path; 1771 __inode_security_revalidate(inode, path->dentry, true); 1772 return inode_has_perm(cred, inode, av, &ad); 1773 } 1774 1775 /* Same as path_has_perm, but uses the inode from the file struct. */ 1776 static inline int file_path_has_perm(const struct cred *cred, 1777 struct file *file, 1778 u32 av) 1779 { 1780 struct common_audit_data ad; 1781 1782 ad.type = LSM_AUDIT_DATA_FILE; 1783 ad.u.file = file; 1784 return inode_has_perm(cred, file_inode(file), av, &ad); 1785 } 1786 1787 /* Check whether a task can use an open file descriptor to 1788 access an inode in a given way. Check access to the 1789 descriptor itself, and then use dentry_has_perm to 1790 check a particular permission to the file. 1791 Access to the descriptor is implicitly granted if it 1792 has the same SID as the process. If av is zero, then 1793 access to the file is not checked, e.g. for cases 1794 where only the descriptor is affected like seek. */ 1795 static int file_has_perm(const struct cred *cred, 1796 struct file *file, 1797 u32 av) 1798 { 1799 struct file_security_struct *fsec = file->f_security; 1800 struct inode *inode = file_inode(file); 1801 struct common_audit_data ad; 1802 u32 sid = cred_sid(cred); 1803 int rc; 1804 1805 ad.type = LSM_AUDIT_DATA_FILE; 1806 ad.u.file = file; 1807 1808 if (sid != fsec->sid) { 1809 rc = avc_has_perm(sid, fsec->sid, 1810 SECCLASS_FD, 1811 FD__USE, 1812 &ad); 1813 if (rc) 1814 goto out; 1815 } 1816 1817 /* av is zero if only checking access to the descriptor. */ 1818 rc = 0; 1819 if (av) 1820 rc = inode_has_perm(cred, inode, av, &ad); 1821 1822 out: 1823 return rc; 1824 } 1825 1826 /* 1827 * Determine the label for an inode that might be unioned. 1828 */ 1829 static int 1830 selinux_determine_inode_label(const struct task_security_struct *tsec, 1831 struct inode *dir, 1832 const struct qstr *name, u16 tclass, 1833 u32 *_new_isid) 1834 { 1835 const struct superblock_security_struct *sbsec = dir->i_sb->s_security; 1836 1837 if ((sbsec->flags & SE_SBINITIALIZED) && 1838 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) { 1839 *_new_isid = sbsec->mntpoint_sid; 1840 } else if ((sbsec->flags & SBLABEL_MNT) && 1841 tsec->create_sid) { 1842 *_new_isid = tsec->create_sid; 1843 } else { 1844 const struct inode_security_struct *dsec = inode_security(dir); 1845 return security_transition_sid(tsec->sid, dsec->sid, tclass, 1846 name, _new_isid); 1847 } 1848 1849 return 0; 1850 } 1851 1852 /* Check whether a task can create a file. */ 1853 static int may_create(struct inode *dir, 1854 struct dentry *dentry, 1855 u16 tclass) 1856 { 1857 const struct task_security_struct *tsec = current_security(); 1858 struct inode_security_struct *dsec; 1859 struct superblock_security_struct *sbsec; 1860 u32 sid, newsid; 1861 struct common_audit_data ad; 1862 int rc; 1863 1864 dsec = inode_security(dir); 1865 sbsec = dir->i_sb->s_security; 1866 1867 sid = tsec->sid; 1868 1869 ad.type = LSM_AUDIT_DATA_DENTRY; 1870 ad.u.dentry = dentry; 1871 1872 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, 1873 DIR__ADD_NAME | DIR__SEARCH, 1874 &ad); 1875 if (rc) 1876 return rc; 1877 1878 rc = selinux_determine_inode_label(current_security(), dir, 1879 &dentry->d_name, tclass, &newsid); 1880 if (rc) 1881 return rc; 1882 1883 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad); 1884 if (rc) 1885 return rc; 1886 1887 return avc_has_perm(newsid, sbsec->sid, 1888 SECCLASS_FILESYSTEM, 1889 FILESYSTEM__ASSOCIATE, &ad); 1890 } 1891 1892 #define MAY_LINK 0 1893 #define MAY_UNLINK 1 1894 #define MAY_RMDIR 2 1895 1896 /* Check whether a task can link, unlink, or rmdir a file/directory. */ 1897 static int may_link(struct inode *dir, 1898 struct dentry *dentry, 1899 int kind) 1900 1901 { 1902 struct inode_security_struct *dsec, *isec; 1903 struct common_audit_data ad; 1904 u32 sid = current_sid(); 1905 u32 av; 1906 int rc; 1907 1908 dsec = inode_security(dir); 1909 isec = backing_inode_security(dentry); 1910 1911 ad.type = LSM_AUDIT_DATA_DENTRY; 1912 ad.u.dentry = dentry; 1913 1914 av = DIR__SEARCH; 1915 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME); 1916 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad); 1917 if (rc) 1918 return rc; 1919 1920 switch (kind) { 1921 case MAY_LINK: 1922 av = FILE__LINK; 1923 break; 1924 case MAY_UNLINK: 1925 av = FILE__UNLINK; 1926 break; 1927 case MAY_RMDIR: 1928 av = DIR__RMDIR; 1929 break; 1930 default: 1931 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n", 1932 __func__, kind); 1933 return 0; 1934 } 1935 1936 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad); 1937 return rc; 1938 } 1939 1940 static inline int may_rename(struct inode *old_dir, 1941 struct dentry *old_dentry, 1942 struct inode *new_dir, 1943 struct dentry *new_dentry) 1944 { 1945 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec; 1946 struct common_audit_data ad; 1947 u32 sid = current_sid(); 1948 u32 av; 1949 int old_is_dir, new_is_dir; 1950 int rc; 1951 1952 old_dsec = inode_security(old_dir); 1953 old_isec = backing_inode_security(old_dentry); 1954 old_is_dir = d_is_dir(old_dentry); 1955 new_dsec = inode_security(new_dir); 1956 1957 ad.type = LSM_AUDIT_DATA_DENTRY; 1958 1959 ad.u.dentry = old_dentry; 1960 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR, 1961 DIR__REMOVE_NAME | DIR__SEARCH, &ad); 1962 if (rc) 1963 return rc; 1964 rc = avc_has_perm(sid, old_isec->sid, 1965 old_isec->sclass, FILE__RENAME, &ad); 1966 if (rc) 1967 return rc; 1968 if (old_is_dir && new_dir != old_dir) { 1969 rc = avc_has_perm(sid, old_isec->sid, 1970 old_isec->sclass, DIR__REPARENT, &ad); 1971 if (rc) 1972 return rc; 1973 } 1974 1975 ad.u.dentry = new_dentry; 1976 av = DIR__ADD_NAME | DIR__SEARCH; 1977 if (d_is_positive(new_dentry)) 1978 av |= DIR__REMOVE_NAME; 1979 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad); 1980 if (rc) 1981 return rc; 1982 if (d_is_positive(new_dentry)) { 1983 new_isec = backing_inode_security(new_dentry); 1984 new_is_dir = d_is_dir(new_dentry); 1985 rc = avc_has_perm(sid, new_isec->sid, 1986 new_isec->sclass, 1987 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad); 1988 if (rc) 1989 return rc; 1990 } 1991 1992 return 0; 1993 } 1994 1995 /* Check whether a task can perform a filesystem operation. */ 1996 static int superblock_has_perm(const struct cred *cred, 1997 struct super_block *sb, 1998 u32 perms, 1999 struct common_audit_data *ad) 2000 { 2001 struct superblock_security_struct *sbsec; 2002 u32 sid = cred_sid(cred); 2003 2004 sbsec = sb->s_security; 2005 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad); 2006 } 2007 2008 /* Convert a Linux mode and permission mask to an access vector. */ 2009 static inline u32 file_mask_to_av(int mode, int mask) 2010 { 2011 u32 av = 0; 2012 2013 if (!S_ISDIR(mode)) { 2014 if (mask & MAY_EXEC) 2015 av |= FILE__EXECUTE; 2016 if (mask & MAY_READ) 2017 av |= FILE__READ; 2018 2019 if (mask & MAY_APPEND) 2020 av |= FILE__APPEND; 2021 else if (mask & MAY_WRITE) 2022 av |= FILE__WRITE; 2023 2024 } else { 2025 if (mask & MAY_EXEC) 2026 av |= DIR__SEARCH; 2027 if (mask & MAY_WRITE) 2028 av |= DIR__WRITE; 2029 if (mask & MAY_READ) 2030 av |= DIR__READ; 2031 } 2032 2033 return av; 2034 } 2035 2036 /* Convert a Linux file to an access vector. */ 2037 static inline u32 file_to_av(struct file *file) 2038 { 2039 u32 av = 0; 2040 2041 if (file->f_mode & FMODE_READ) 2042 av |= FILE__READ; 2043 if (file->f_mode & FMODE_WRITE) { 2044 if (file->f_flags & O_APPEND) 2045 av |= FILE__APPEND; 2046 else 2047 av |= FILE__WRITE; 2048 } 2049 if (!av) { 2050 /* 2051 * Special file opened with flags 3 for ioctl-only use. 2052 */ 2053 av = FILE__IOCTL; 2054 } 2055 2056 return av; 2057 } 2058 2059 /* 2060 * Convert a file to an access vector and include the correct open 2061 * open permission. 2062 */ 2063 static inline u32 open_file_to_av(struct file *file) 2064 { 2065 u32 av = file_to_av(file); 2066 2067 if (selinux_policycap_openperm) 2068 av |= FILE__OPEN; 2069 2070 return av; 2071 } 2072 2073 /* Hook functions begin here. */ 2074 2075 static int selinux_binder_set_context_mgr(struct task_struct *mgr) 2076 { 2077 u32 mysid = current_sid(); 2078 u32 mgrsid = task_sid(mgr); 2079 2080 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, 2081 BINDER__SET_CONTEXT_MGR, NULL); 2082 } 2083 2084 static int selinux_binder_transaction(struct task_struct *from, 2085 struct task_struct *to) 2086 { 2087 u32 mysid = current_sid(); 2088 u32 fromsid = task_sid(from); 2089 u32 tosid = task_sid(to); 2090 int rc; 2091 2092 if (mysid != fromsid) { 2093 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, 2094 BINDER__IMPERSONATE, NULL); 2095 if (rc) 2096 return rc; 2097 } 2098 2099 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, 2100 NULL); 2101 } 2102 2103 static int selinux_binder_transfer_binder(struct task_struct *from, 2104 struct task_struct *to) 2105 { 2106 u32 fromsid = task_sid(from); 2107 u32 tosid = task_sid(to); 2108 2109 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, 2110 NULL); 2111 } 2112 2113 static int selinux_binder_transfer_file(struct task_struct *from, 2114 struct task_struct *to, 2115 struct file *file) 2116 { 2117 u32 sid = task_sid(to); 2118 struct file_security_struct *fsec = file->f_security; 2119 struct dentry *dentry = file->f_path.dentry; 2120 struct inode_security_struct *isec; 2121 struct common_audit_data ad; 2122 int rc; 2123 2124 ad.type = LSM_AUDIT_DATA_PATH; 2125 ad.u.path = file->f_path; 2126 2127 if (sid != fsec->sid) { 2128 rc = avc_has_perm(sid, fsec->sid, 2129 SECCLASS_FD, 2130 FD__USE, 2131 &ad); 2132 if (rc) 2133 return rc; 2134 } 2135 2136 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 2137 return 0; 2138 2139 isec = backing_inode_security(dentry); 2140 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file), 2141 &ad); 2142 } 2143 2144 static int selinux_ptrace_access_check(struct task_struct *child, 2145 unsigned int mode) 2146 { 2147 u32 sid = current_sid(); 2148 u32 csid = task_sid(child); 2149 2150 if (mode & PTRACE_MODE_READ) 2151 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL); 2152 2153 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL); 2154 } 2155 2156 static int selinux_ptrace_traceme(struct task_struct *parent) 2157 { 2158 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS, 2159 PROCESS__PTRACE, NULL); 2160 } 2161 2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective, 2163 kernel_cap_t *inheritable, kernel_cap_t *permitted) 2164 { 2165 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS, 2166 PROCESS__GETCAP, NULL); 2167 } 2168 2169 static int selinux_capset(struct cred *new, const struct cred *old, 2170 const kernel_cap_t *effective, 2171 const kernel_cap_t *inheritable, 2172 const kernel_cap_t *permitted) 2173 { 2174 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS, 2175 PROCESS__SETCAP, NULL); 2176 } 2177 2178 /* 2179 * (This comment used to live with the selinux_task_setuid hook, 2180 * which was removed). 2181 * 2182 * Since setuid only affects the current process, and since the SELinux 2183 * controls are not based on the Linux identity attributes, SELinux does not 2184 * need to control this operation. However, SELinux does control the use of 2185 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook. 2186 */ 2187 2188 static int selinux_capable(const struct cred *cred, struct user_namespace *ns, 2189 int cap, int audit) 2190 { 2191 return cred_has_capability(cred, cap, audit, ns == &init_user_ns); 2192 } 2193 2194 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb) 2195 { 2196 const struct cred *cred = current_cred(); 2197 int rc = 0; 2198 2199 if (!sb) 2200 return 0; 2201 2202 switch (cmds) { 2203 case Q_SYNC: 2204 case Q_QUOTAON: 2205 case Q_QUOTAOFF: 2206 case Q_SETINFO: 2207 case Q_SETQUOTA: 2208 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL); 2209 break; 2210 case Q_GETFMT: 2211 case Q_GETINFO: 2212 case Q_GETQUOTA: 2213 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL); 2214 break; 2215 default: 2216 rc = 0; /* let the kernel handle invalid cmds */ 2217 break; 2218 } 2219 return rc; 2220 } 2221 2222 static int selinux_quota_on(struct dentry *dentry) 2223 { 2224 const struct cred *cred = current_cred(); 2225 2226 return dentry_has_perm(cred, dentry, FILE__QUOTAON); 2227 } 2228 2229 static int selinux_syslog(int type) 2230 { 2231 switch (type) { 2232 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */ 2233 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */ 2234 return avc_has_perm(current_sid(), SECINITSID_KERNEL, 2235 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL); 2236 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */ 2237 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */ 2238 /* Set level of messages printed to console */ 2239 case SYSLOG_ACTION_CONSOLE_LEVEL: 2240 return avc_has_perm(current_sid(), SECINITSID_KERNEL, 2241 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE, 2242 NULL); 2243 } 2244 /* All other syslog types */ 2245 return avc_has_perm(current_sid(), SECINITSID_KERNEL, 2246 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL); 2247 } 2248 2249 /* 2250 * Check that a process has enough memory to allocate a new virtual 2251 * mapping. 0 means there is enough memory for the allocation to 2252 * succeed and -ENOMEM implies there is not. 2253 * 2254 * Do not audit the selinux permission check, as this is applied to all 2255 * processes that allocate mappings. 2256 */ 2257 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages) 2258 { 2259 int rc, cap_sys_admin = 0; 2260 2261 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN, 2262 SECURITY_CAP_NOAUDIT, true); 2263 if (rc == 0) 2264 cap_sys_admin = 1; 2265 2266 return cap_sys_admin; 2267 } 2268 2269 /* binprm security operations */ 2270 2271 static u32 ptrace_parent_sid(void) 2272 { 2273 u32 sid = 0; 2274 struct task_struct *tracer; 2275 2276 rcu_read_lock(); 2277 tracer = ptrace_parent(current); 2278 if (tracer) 2279 sid = task_sid(tracer); 2280 rcu_read_unlock(); 2281 2282 return sid; 2283 } 2284 2285 static int check_nnp_nosuid(const struct linux_binprm *bprm, 2286 const struct task_security_struct *old_tsec, 2287 const struct task_security_struct *new_tsec) 2288 { 2289 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS); 2290 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt); 2291 int rc; 2292 2293 if (!nnp && !nosuid) 2294 return 0; /* neither NNP nor nosuid */ 2295 2296 if (new_tsec->sid == old_tsec->sid) 2297 return 0; /* No change in credentials */ 2298 2299 /* 2300 * The only transitions we permit under NNP or nosuid 2301 * are transitions to bounded SIDs, i.e. SIDs that are 2302 * guaranteed to only be allowed a subset of the permissions 2303 * of the current SID. 2304 */ 2305 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid); 2306 if (rc) { 2307 /* 2308 * On failure, preserve the errno values for NNP vs nosuid. 2309 * NNP: Operation not permitted for caller. 2310 * nosuid: Permission denied to file. 2311 */ 2312 if (nnp) 2313 return -EPERM; 2314 else 2315 return -EACCES; 2316 } 2317 return 0; 2318 } 2319 2320 static int selinux_bprm_set_creds(struct linux_binprm *bprm) 2321 { 2322 const struct task_security_struct *old_tsec; 2323 struct task_security_struct *new_tsec; 2324 struct inode_security_struct *isec; 2325 struct common_audit_data ad; 2326 struct inode *inode = file_inode(bprm->file); 2327 int rc; 2328 2329 /* SELinux context only depends on initial program or script and not 2330 * the script interpreter */ 2331 if (bprm->cred_prepared) 2332 return 0; 2333 2334 old_tsec = current_security(); 2335 new_tsec = bprm->cred->security; 2336 isec = inode_security(inode); 2337 2338 /* Default to the current task SID. */ 2339 new_tsec->sid = old_tsec->sid; 2340 new_tsec->osid = old_tsec->sid; 2341 2342 /* Reset fs, key, and sock SIDs on execve. */ 2343 new_tsec->create_sid = 0; 2344 new_tsec->keycreate_sid = 0; 2345 new_tsec->sockcreate_sid = 0; 2346 2347 if (old_tsec->exec_sid) { 2348 new_tsec->sid = old_tsec->exec_sid; 2349 /* Reset exec SID on execve. */ 2350 new_tsec->exec_sid = 0; 2351 2352 /* Fail on NNP or nosuid if not an allowed transition. */ 2353 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec); 2354 if (rc) 2355 return rc; 2356 } else { 2357 /* Check for a default transition on this program. */ 2358 rc = security_transition_sid(old_tsec->sid, isec->sid, 2359 SECCLASS_PROCESS, NULL, 2360 &new_tsec->sid); 2361 if (rc) 2362 return rc; 2363 2364 /* 2365 * Fallback to old SID on NNP or nosuid if not an allowed 2366 * transition. 2367 */ 2368 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec); 2369 if (rc) 2370 new_tsec->sid = old_tsec->sid; 2371 } 2372 2373 ad.type = LSM_AUDIT_DATA_FILE; 2374 ad.u.file = bprm->file; 2375 2376 if (new_tsec->sid == old_tsec->sid) { 2377 rc = avc_has_perm(old_tsec->sid, isec->sid, 2378 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad); 2379 if (rc) 2380 return rc; 2381 } else { 2382 /* Check permissions for the transition. */ 2383 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, 2384 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad); 2385 if (rc) 2386 return rc; 2387 2388 rc = avc_has_perm(new_tsec->sid, isec->sid, 2389 SECCLASS_FILE, FILE__ENTRYPOINT, &ad); 2390 if (rc) 2391 return rc; 2392 2393 /* Check for shared state */ 2394 if (bprm->unsafe & LSM_UNSAFE_SHARE) { 2395 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, 2396 SECCLASS_PROCESS, PROCESS__SHARE, 2397 NULL); 2398 if (rc) 2399 return -EPERM; 2400 } 2401 2402 /* Make sure that anyone attempting to ptrace over a task that 2403 * changes its SID has the appropriate permit */ 2404 if (bprm->unsafe & LSM_UNSAFE_PTRACE) { 2405 u32 ptsid = ptrace_parent_sid(); 2406 if (ptsid != 0) { 2407 rc = avc_has_perm(ptsid, new_tsec->sid, 2408 SECCLASS_PROCESS, 2409 PROCESS__PTRACE, NULL); 2410 if (rc) 2411 return -EPERM; 2412 } 2413 } 2414 2415 /* Clear any possibly unsafe personality bits on exec: */ 2416 bprm->per_clear |= PER_CLEAR_ON_SETID; 2417 } 2418 2419 return 0; 2420 } 2421 2422 static int selinux_bprm_secureexec(struct linux_binprm *bprm) 2423 { 2424 const struct task_security_struct *tsec = current_security(); 2425 u32 sid, osid; 2426 int atsecure = 0; 2427 2428 sid = tsec->sid; 2429 osid = tsec->osid; 2430 2431 if (osid != sid) { 2432 /* Enable secure mode for SIDs transitions unless 2433 the noatsecure permission is granted between 2434 the two SIDs, i.e. ahp returns 0. */ 2435 atsecure = avc_has_perm(osid, sid, 2436 SECCLASS_PROCESS, 2437 PROCESS__NOATSECURE, NULL); 2438 } 2439 2440 return !!atsecure; 2441 } 2442 2443 static int match_file(const void *p, struct file *file, unsigned fd) 2444 { 2445 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0; 2446 } 2447 2448 /* Derived from fs/exec.c:flush_old_files. */ 2449 static inline void flush_unauthorized_files(const struct cred *cred, 2450 struct files_struct *files) 2451 { 2452 struct file *file, *devnull = NULL; 2453 struct tty_struct *tty; 2454 int drop_tty = 0; 2455 unsigned n; 2456 2457 tty = get_current_tty(); 2458 if (tty) { 2459 spin_lock(&tty->files_lock); 2460 if (!list_empty(&tty->tty_files)) { 2461 struct tty_file_private *file_priv; 2462 2463 /* Revalidate access to controlling tty. 2464 Use file_path_has_perm on the tty path directly 2465 rather than using file_has_perm, as this particular 2466 open file may belong to another process and we are 2467 only interested in the inode-based check here. */ 2468 file_priv = list_first_entry(&tty->tty_files, 2469 struct tty_file_private, list); 2470 file = file_priv->file; 2471 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE)) 2472 drop_tty = 1; 2473 } 2474 spin_unlock(&tty->files_lock); 2475 tty_kref_put(tty); 2476 } 2477 /* Reset controlling tty. */ 2478 if (drop_tty) 2479 no_tty(); 2480 2481 /* Revalidate access to inherited open files. */ 2482 n = iterate_fd(files, 0, match_file, cred); 2483 if (!n) /* none found? */ 2484 return; 2485 2486 devnull = dentry_open(&selinux_null, O_RDWR, cred); 2487 if (IS_ERR(devnull)) 2488 devnull = NULL; 2489 /* replace all the matching ones with this */ 2490 do { 2491 replace_fd(n - 1, devnull, 0); 2492 } while ((n = iterate_fd(files, n, match_file, cred)) != 0); 2493 if (devnull) 2494 fput(devnull); 2495 } 2496 2497 /* 2498 * Prepare a process for imminent new credential changes due to exec 2499 */ 2500 static void selinux_bprm_committing_creds(struct linux_binprm *bprm) 2501 { 2502 struct task_security_struct *new_tsec; 2503 struct rlimit *rlim, *initrlim; 2504 int rc, i; 2505 2506 new_tsec = bprm->cred->security; 2507 if (new_tsec->sid == new_tsec->osid) 2508 return; 2509 2510 /* Close files for which the new task SID is not authorized. */ 2511 flush_unauthorized_files(bprm->cred, current->files); 2512 2513 /* Always clear parent death signal on SID transitions. */ 2514 current->pdeath_signal = 0; 2515 2516 /* Check whether the new SID can inherit resource limits from the old 2517 * SID. If not, reset all soft limits to the lower of the current 2518 * task's hard limit and the init task's soft limit. 2519 * 2520 * Note that the setting of hard limits (even to lower them) can be 2521 * controlled by the setrlimit check. The inclusion of the init task's 2522 * soft limit into the computation is to avoid resetting soft limits 2523 * higher than the default soft limit for cases where the default is 2524 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK. 2525 */ 2526 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS, 2527 PROCESS__RLIMITINH, NULL); 2528 if (rc) { 2529 /* protect against do_prlimit() */ 2530 task_lock(current); 2531 for (i = 0; i < RLIM_NLIMITS; i++) { 2532 rlim = current->signal->rlim + i; 2533 initrlim = init_task.signal->rlim + i; 2534 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur); 2535 } 2536 task_unlock(current); 2537 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) 2538 update_rlimit_cpu(current, rlimit(RLIMIT_CPU)); 2539 } 2540 } 2541 2542 /* 2543 * Clean up the process immediately after the installation of new credentials 2544 * due to exec 2545 */ 2546 static void selinux_bprm_committed_creds(struct linux_binprm *bprm) 2547 { 2548 const struct task_security_struct *tsec = current_security(); 2549 struct itimerval itimer; 2550 u32 osid, sid; 2551 int rc, i; 2552 2553 osid = tsec->osid; 2554 sid = tsec->sid; 2555 2556 if (sid == osid) 2557 return; 2558 2559 /* Check whether the new SID can inherit signal state from the old SID. 2560 * If not, clear itimers to avoid subsequent signal generation and 2561 * flush and unblock signals. 2562 * 2563 * This must occur _after_ the task SID has been updated so that any 2564 * kill done after the flush will be checked against the new SID. 2565 */ 2566 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL); 2567 if (rc) { 2568 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) { 2569 memset(&itimer, 0, sizeof itimer); 2570 for (i = 0; i < 3; i++) 2571 do_setitimer(i, &itimer, NULL); 2572 } 2573 spin_lock_irq(¤t->sighand->siglock); 2574 if (!fatal_signal_pending(current)) { 2575 flush_sigqueue(¤t->pending); 2576 flush_sigqueue(¤t->signal->shared_pending); 2577 flush_signal_handlers(current, 1); 2578 sigemptyset(¤t->blocked); 2579 recalc_sigpending(); 2580 } 2581 spin_unlock_irq(¤t->sighand->siglock); 2582 } 2583 2584 /* Wake up the parent if it is waiting so that it can recheck 2585 * wait permission to the new task SID. */ 2586 read_lock(&tasklist_lock); 2587 __wake_up_parent(current, current->real_parent); 2588 read_unlock(&tasklist_lock); 2589 } 2590 2591 /* superblock security operations */ 2592 2593 static int selinux_sb_alloc_security(struct super_block *sb) 2594 { 2595 return superblock_alloc_security(sb); 2596 } 2597 2598 static void selinux_sb_free_security(struct super_block *sb) 2599 { 2600 superblock_free_security(sb); 2601 } 2602 2603 static inline int match_prefix(char *prefix, int plen, char *option, int olen) 2604 { 2605 if (plen > olen) 2606 return 0; 2607 2608 return !memcmp(prefix, option, plen); 2609 } 2610 2611 static inline int selinux_option(char *option, int len) 2612 { 2613 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) || 2614 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) || 2615 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) || 2616 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) || 2617 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len)); 2618 } 2619 2620 static inline void take_option(char **to, char *from, int *first, int len) 2621 { 2622 if (!*first) { 2623 **to = ','; 2624 *to += 1; 2625 } else 2626 *first = 0; 2627 memcpy(*to, from, len); 2628 *to += len; 2629 } 2630 2631 static inline void take_selinux_option(char **to, char *from, int *first, 2632 int len) 2633 { 2634 int current_size = 0; 2635 2636 if (!*first) { 2637 **to = '|'; 2638 *to += 1; 2639 } else 2640 *first = 0; 2641 2642 while (current_size < len) { 2643 if (*from != '"') { 2644 **to = *from; 2645 *to += 1; 2646 } 2647 from += 1; 2648 current_size += 1; 2649 } 2650 } 2651 2652 static int selinux_sb_copy_data(char *orig, char *copy) 2653 { 2654 int fnosec, fsec, rc = 0; 2655 char *in_save, *in_curr, *in_end; 2656 char *sec_curr, *nosec_save, *nosec; 2657 int open_quote = 0; 2658 2659 in_curr = orig; 2660 sec_curr = copy; 2661 2662 nosec = (char *)get_zeroed_page(GFP_KERNEL); 2663 if (!nosec) { 2664 rc = -ENOMEM; 2665 goto out; 2666 } 2667 2668 nosec_save = nosec; 2669 fnosec = fsec = 1; 2670 in_save = in_end = orig; 2671 2672 do { 2673 if (*in_end == '"') 2674 open_quote = !open_quote; 2675 if ((*in_end == ',' && open_quote == 0) || 2676 *in_end == '\0') { 2677 int len = in_end - in_curr; 2678 2679 if (selinux_option(in_curr, len)) 2680 take_selinux_option(&sec_curr, in_curr, &fsec, len); 2681 else 2682 take_option(&nosec, in_curr, &fnosec, len); 2683 2684 in_curr = in_end + 1; 2685 } 2686 } while (*in_end++); 2687 2688 strcpy(in_save, nosec_save); 2689 free_page((unsigned long)nosec_save); 2690 out: 2691 return rc; 2692 } 2693 2694 static int selinux_sb_remount(struct super_block *sb, void *data) 2695 { 2696 int rc, i, *flags; 2697 struct security_mnt_opts opts; 2698 char *secdata, **mount_options; 2699 struct superblock_security_struct *sbsec = sb->s_security; 2700 2701 if (!(sbsec->flags & SE_SBINITIALIZED)) 2702 return 0; 2703 2704 if (!data) 2705 return 0; 2706 2707 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) 2708 return 0; 2709 2710 security_init_mnt_opts(&opts); 2711 secdata = alloc_secdata(); 2712 if (!secdata) 2713 return -ENOMEM; 2714 rc = selinux_sb_copy_data(data, secdata); 2715 if (rc) 2716 goto out_free_secdata; 2717 2718 rc = selinux_parse_opts_str(secdata, &opts); 2719 if (rc) 2720 goto out_free_secdata; 2721 2722 mount_options = opts.mnt_opts; 2723 flags = opts.mnt_opts_flags; 2724 2725 for (i = 0; i < opts.num_mnt_opts; i++) { 2726 u32 sid; 2727 2728 if (flags[i] == SBLABEL_MNT) 2729 continue; 2730 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL); 2731 if (rc) { 2732 printk(KERN_WARNING "SELinux: security_context_str_to_sid" 2733 "(%s) failed for (dev %s, type %s) errno=%d\n", 2734 mount_options[i], sb->s_id, sb->s_type->name, rc); 2735 goto out_free_opts; 2736 } 2737 rc = -EINVAL; 2738 switch (flags[i]) { 2739 case FSCONTEXT_MNT: 2740 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid)) 2741 goto out_bad_option; 2742 break; 2743 case CONTEXT_MNT: 2744 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid)) 2745 goto out_bad_option; 2746 break; 2747 case ROOTCONTEXT_MNT: { 2748 struct inode_security_struct *root_isec; 2749 root_isec = backing_inode_security(sb->s_root); 2750 2751 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid)) 2752 goto out_bad_option; 2753 break; 2754 } 2755 case DEFCONTEXT_MNT: 2756 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid)) 2757 goto out_bad_option; 2758 break; 2759 default: 2760 goto out_free_opts; 2761 } 2762 } 2763 2764 rc = 0; 2765 out_free_opts: 2766 security_free_mnt_opts(&opts); 2767 out_free_secdata: 2768 free_secdata(secdata); 2769 return rc; 2770 out_bad_option: 2771 printk(KERN_WARNING "SELinux: unable to change security options " 2772 "during remount (dev %s, type=%s)\n", sb->s_id, 2773 sb->s_type->name); 2774 goto out_free_opts; 2775 } 2776 2777 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data) 2778 { 2779 const struct cred *cred = current_cred(); 2780 struct common_audit_data ad; 2781 int rc; 2782 2783 rc = superblock_doinit(sb, data); 2784 if (rc) 2785 return rc; 2786 2787 /* Allow all mounts performed by the kernel */ 2788 if (flags & MS_KERNMOUNT) 2789 return 0; 2790 2791 ad.type = LSM_AUDIT_DATA_DENTRY; 2792 ad.u.dentry = sb->s_root; 2793 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad); 2794 } 2795 2796 static int selinux_sb_statfs(struct dentry *dentry) 2797 { 2798 const struct cred *cred = current_cred(); 2799 struct common_audit_data ad; 2800 2801 ad.type = LSM_AUDIT_DATA_DENTRY; 2802 ad.u.dentry = dentry->d_sb->s_root; 2803 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad); 2804 } 2805 2806 static int selinux_mount(const char *dev_name, 2807 const struct path *path, 2808 const char *type, 2809 unsigned long flags, 2810 void *data) 2811 { 2812 const struct cred *cred = current_cred(); 2813 2814 if (flags & MS_REMOUNT) 2815 return superblock_has_perm(cred, path->dentry->d_sb, 2816 FILESYSTEM__REMOUNT, NULL); 2817 else 2818 return path_has_perm(cred, path, FILE__MOUNTON); 2819 } 2820 2821 static int selinux_umount(struct vfsmount *mnt, int flags) 2822 { 2823 const struct cred *cred = current_cred(); 2824 2825 return superblock_has_perm(cred, mnt->mnt_sb, 2826 FILESYSTEM__UNMOUNT, NULL); 2827 } 2828 2829 /* inode security operations */ 2830 2831 static int selinux_inode_alloc_security(struct inode *inode) 2832 { 2833 return inode_alloc_security(inode); 2834 } 2835 2836 static void selinux_inode_free_security(struct inode *inode) 2837 { 2838 inode_free_security(inode); 2839 } 2840 2841 static int selinux_dentry_init_security(struct dentry *dentry, int mode, 2842 const struct qstr *name, void **ctx, 2843 u32 *ctxlen) 2844 { 2845 u32 newsid; 2846 int rc; 2847 2848 rc = selinux_determine_inode_label(current_security(), 2849 d_inode(dentry->d_parent), name, 2850 inode_mode_to_security_class(mode), 2851 &newsid); 2852 if (rc) 2853 return rc; 2854 2855 return security_sid_to_context(newsid, (char **)ctx, ctxlen); 2856 } 2857 2858 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode, 2859 struct qstr *name, 2860 const struct cred *old, 2861 struct cred *new) 2862 { 2863 u32 newsid; 2864 int rc; 2865 struct task_security_struct *tsec; 2866 2867 rc = selinux_determine_inode_label(old->security, 2868 d_inode(dentry->d_parent), name, 2869 inode_mode_to_security_class(mode), 2870 &newsid); 2871 if (rc) 2872 return rc; 2873 2874 tsec = new->security; 2875 tsec->create_sid = newsid; 2876 return 0; 2877 } 2878 2879 static int selinux_inode_init_security(struct inode *inode, struct inode *dir, 2880 const struct qstr *qstr, 2881 const char **name, 2882 void **value, size_t *len) 2883 { 2884 const struct task_security_struct *tsec = current_security(); 2885 struct superblock_security_struct *sbsec; 2886 u32 sid, newsid, clen; 2887 int rc; 2888 char *context; 2889 2890 sbsec = dir->i_sb->s_security; 2891 2892 sid = tsec->sid; 2893 newsid = tsec->create_sid; 2894 2895 rc = selinux_determine_inode_label(current_security(), 2896 dir, qstr, 2897 inode_mode_to_security_class(inode->i_mode), 2898 &newsid); 2899 if (rc) 2900 return rc; 2901 2902 /* Possibly defer initialization to selinux_complete_init. */ 2903 if (sbsec->flags & SE_SBINITIALIZED) { 2904 struct inode_security_struct *isec = inode->i_security; 2905 isec->sclass = inode_mode_to_security_class(inode->i_mode); 2906 isec->sid = newsid; 2907 isec->initialized = LABEL_INITIALIZED; 2908 } 2909 2910 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT)) 2911 return -EOPNOTSUPP; 2912 2913 if (name) 2914 *name = XATTR_SELINUX_SUFFIX; 2915 2916 if (value && len) { 2917 rc = security_sid_to_context_force(newsid, &context, &clen); 2918 if (rc) 2919 return rc; 2920 *value = context; 2921 *len = clen; 2922 } 2923 2924 return 0; 2925 } 2926 2927 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode) 2928 { 2929 return may_create(dir, dentry, SECCLASS_FILE); 2930 } 2931 2932 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) 2933 { 2934 return may_link(dir, old_dentry, MAY_LINK); 2935 } 2936 2937 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry) 2938 { 2939 return may_link(dir, dentry, MAY_UNLINK); 2940 } 2941 2942 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name) 2943 { 2944 return may_create(dir, dentry, SECCLASS_LNK_FILE); 2945 } 2946 2947 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask) 2948 { 2949 return may_create(dir, dentry, SECCLASS_DIR); 2950 } 2951 2952 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry) 2953 { 2954 return may_link(dir, dentry, MAY_RMDIR); 2955 } 2956 2957 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 2958 { 2959 return may_create(dir, dentry, inode_mode_to_security_class(mode)); 2960 } 2961 2962 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry, 2963 struct inode *new_inode, struct dentry *new_dentry) 2964 { 2965 return may_rename(old_inode, old_dentry, new_inode, new_dentry); 2966 } 2967 2968 static int selinux_inode_readlink(struct dentry *dentry) 2969 { 2970 const struct cred *cred = current_cred(); 2971 2972 return dentry_has_perm(cred, dentry, FILE__READ); 2973 } 2974 2975 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode, 2976 bool rcu) 2977 { 2978 const struct cred *cred = current_cred(); 2979 struct common_audit_data ad; 2980 struct inode_security_struct *isec; 2981 u32 sid; 2982 2983 validate_creds(cred); 2984 2985 ad.type = LSM_AUDIT_DATA_DENTRY; 2986 ad.u.dentry = dentry; 2987 sid = cred_sid(cred); 2988 isec = inode_security_rcu(inode, rcu); 2989 if (IS_ERR(isec)) 2990 return PTR_ERR(isec); 2991 2992 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad, 2993 rcu ? MAY_NOT_BLOCK : 0); 2994 } 2995 2996 static noinline int audit_inode_permission(struct inode *inode, 2997 u32 perms, u32 audited, u32 denied, 2998 int result, 2999 unsigned flags) 3000 { 3001 struct common_audit_data ad; 3002 struct inode_security_struct *isec = inode->i_security; 3003 int rc; 3004 3005 ad.type = LSM_AUDIT_DATA_INODE; 3006 ad.u.inode = inode; 3007 3008 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms, 3009 audited, denied, result, &ad, flags); 3010 if (rc) 3011 return rc; 3012 return 0; 3013 } 3014 3015 static int selinux_inode_permission(struct inode *inode, int mask) 3016 { 3017 const struct cred *cred = current_cred(); 3018 u32 perms; 3019 bool from_access; 3020 unsigned flags = mask & MAY_NOT_BLOCK; 3021 struct inode_security_struct *isec; 3022 u32 sid; 3023 struct av_decision avd; 3024 int rc, rc2; 3025 u32 audited, denied; 3026 3027 from_access = mask & MAY_ACCESS; 3028 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 3029 3030 /* No permission to check. Existence test. */ 3031 if (!mask) 3032 return 0; 3033 3034 validate_creds(cred); 3035 3036 if (unlikely(IS_PRIVATE(inode))) 3037 return 0; 3038 3039 perms = file_mask_to_av(inode->i_mode, mask); 3040 3041 sid = cred_sid(cred); 3042 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK); 3043 if (IS_ERR(isec)) 3044 return PTR_ERR(isec); 3045 3046 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd); 3047 audited = avc_audit_required(perms, &avd, rc, 3048 from_access ? FILE__AUDIT_ACCESS : 0, 3049 &denied); 3050 if (likely(!audited)) 3051 return rc; 3052 3053 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags); 3054 if (rc2) 3055 return rc2; 3056 return rc; 3057 } 3058 3059 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) 3060 { 3061 const struct cred *cred = current_cred(); 3062 unsigned int ia_valid = iattr->ia_valid; 3063 __u32 av = FILE__WRITE; 3064 3065 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */ 3066 if (ia_valid & ATTR_FORCE) { 3067 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE | 3068 ATTR_FORCE); 3069 if (!ia_valid) 3070 return 0; 3071 } 3072 3073 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | 3074 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) 3075 return dentry_has_perm(cred, dentry, FILE__SETATTR); 3076 3077 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE) 3078 && !(ia_valid & ATTR_FILE)) 3079 av |= FILE__OPEN; 3080 3081 return dentry_has_perm(cred, dentry, av); 3082 } 3083 3084 static int selinux_inode_getattr(const struct path *path) 3085 { 3086 return path_has_perm(current_cred(), path, FILE__GETATTR); 3087 } 3088 3089 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name) 3090 { 3091 const struct cred *cred = current_cred(); 3092 3093 if (!strncmp(name, XATTR_SECURITY_PREFIX, 3094 sizeof XATTR_SECURITY_PREFIX - 1)) { 3095 if (!strcmp(name, XATTR_NAME_CAPS)) { 3096 if (!capable(CAP_SETFCAP)) 3097 return -EPERM; 3098 } else if (!capable(CAP_SYS_ADMIN)) { 3099 /* A different attribute in the security namespace. 3100 Restrict to administrator. */ 3101 return -EPERM; 3102 } 3103 } 3104 3105 /* Not an attribute we recognize, so just check the 3106 ordinary setattr permission. */ 3107 return dentry_has_perm(cred, dentry, FILE__SETATTR); 3108 } 3109 3110 static int selinux_inode_setxattr(struct dentry *dentry, const char *name, 3111 const void *value, size_t size, int flags) 3112 { 3113 struct inode *inode = d_backing_inode(dentry); 3114 struct inode_security_struct *isec; 3115 struct superblock_security_struct *sbsec; 3116 struct common_audit_data ad; 3117 u32 newsid, sid = current_sid(); 3118 int rc = 0; 3119 3120 if (strcmp(name, XATTR_NAME_SELINUX)) 3121 return selinux_inode_setotherxattr(dentry, name); 3122 3123 sbsec = inode->i_sb->s_security; 3124 if (!(sbsec->flags & SBLABEL_MNT)) 3125 return -EOPNOTSUPP; 3126 3127 if (!inode_owner_or_capable(inode)) 3128 return -EPERM; 3129 3130 ad.type = LSM_AUDIT_DATA_DENTRY; 3131 ad.u.dentry = dentry; 3132 3133 isec = backing_inode_security(dentry); 3134 rc = avc_has_perm(sid, isec->sid, isec->sclass, 3135 FILE__RELABELFROM, &ad); 3136 if (rc) 3137 return rc; 3138 3139 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL); 3140 if (rc == -EINVAL) { 3141 if (!capable(CAP_MAC_ADMIN)) { 3142 struct audit_buffer *ab; 3143 size_t audit_size; 3144 const char *str; 3145 3146 /* We strip a nul only if it is at the end, otherwise the 3147 * context contains a nul and we should audit that */ 3148 if (value) { 3149 str = value; 3150 if (str[size - 1] == '\0') 3151 audit_size = size - 1; 3152 else 3153 audit_size = size; 3154 } else { 3155 str = ""; 3156 audit_size = 0; 3157 } 3158 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR); 3159 audit_log_format(ab, "op=setxattr invalid_context="); 3160 audit_log_n_untrustedstring(ab, value, audit_size); 3161 audit_log_end(ab); 3162 3163 return rc; 3164 } 3165 rc = security_context_to_sid_force(value, size, &newsid); 3166 } 3167 if (rc) 3168 return rc; 3169 3170 rc = avc_has_perm(sid, newsid, isec->sclass, 3171 FILE__RELABELTO, &ad); 3172 if (rc) 3173 return rc; 3174 3175 rc = security_validate_transition(isec->sid, newsid, sid, 3176 isec->sclass); 3177 if (rc) 3178 return rc; 3179 3180 return avc_has_perm(newsid, 3181 sbsec->sid, 3182 SECCLASS_FILESYSTEM, 3183 FILESYSTEM__ASSOCIATE, 3184 &ad); 3185 } 3186 3187 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, 3188 const void *value, size_t size, 3189 int flags) 3190 { 3191 struct inode *inode = d_backing_inode(dentry); 3192 struct inode_security_struct *isec; 3193 u32 newsid; 3194 int rc; 3195 3196 if (strcmp(name, XATTR_NAME_SELINUX)) { 3197 /* Not an attribute we recognize, so nothing to do. */ 3198 return; 3199 } 3200 3201 rc = security_context_to_sid_force(value, size, &newsid); 3202 if (rc) { 3203 printk(KERN_ERR "SELinux: unable to map context to SID" 3204 "for (%s, %lu), rc=%d\n", 3205 inode->i_sb->s_id, inode->i_ino, -rc); 3206 return; 3207 } 3208 3209 isec = backing_inode_security(dentry); 3210 spin_lock(&isec->lock); 3211 isec->sclass = inode_mode_to_security_class(inode->i_mode); 3212 isec->sid = newsid; 3213 isec->initialized = LABEL_INITIALIZED; 3214 spin_unlock(&isec->lock); 3215 3216 return; 3217 } 3218 3219 static int selinux_inode_getxattr(struct dentry *dentry, const char *name) 3220 { 3221 const struct cred *cred = current_cred(); 3222 3223 return dentry_has_perm(cred, dentry, FILE__GETATTR); 3224 } 3225 3226 static int selinux_inode_listxattr(struct dentry *dentry) 3227 { 3228 const struct cred *cred = current_cred(); 3229 3230 return dentry_has_perm(cred, dentry, FILE__GETATTR); 3231 } 3232 3233 static int selinux_inode_removexattr(struct dentry *dentry, const char *name) 3234 { 3235 if (strcmp(name, XATTR_NAME_SELINUX)) 3236 return selinux_inode_setotherxattr(dentry, name); 3237 3238 /* No one is allowed to remove a SELinux security label. 3239 You can change the label, but all data must be labeled. */ 3240 return -EACCES; 3241 } 3242 3243 /* 3244 * Copy the inode security context value to the user. 3245 * 3246 * Permission check is handled by selinux_inode_getxattr hook. 3247 */ 3248 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc) 3249 { 3250 u32 size; 3251 int error; 3252 char *context = NULL; 3253 struct inode_security_struct *isec; 3254 3255 if (strcmp(name, XATTR_SELINUX_SUFFIX)) 3256 return -EOPNOTSUPP; 3257 3258 /* 3259 * If the caller has CAP_MAC_ADMIN, then get the raw context 3260 * value even if it is not defined by current policy; otherwise, 3261 * use the in-core value under current policy. 3262 * Use the non-auditing forms of the permission checks since 3263 * getxattr may be called by unprivileged processes commonly 3264 * and lack of permission just means that we fall back to the 3265 * in-core context value, not a denial. 3266 */ 3267 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN, 3268 SECURITY_CAP_NOAUDIT); 3269 if (!error) 3270 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN, 3271 SECURITY_CAP_NOAUDIT, true); 3272 isec = inode_security(inode); 3273 if (!error) 3274 error = security_sid_to_context_force(isec->sid, &context, 3275 &size); 3276 else 3277 error = security_sid_to_context(isec->sid, &context, &size); 3278 if (error) 3279 return error; 3280 error = size; 3281 if (alloc) { 3282 *buffer = context; 3283 goto out_nofree; 3284 } 3285 kfree(context); 3286 out_nofree: 3287 return error; 3288 } 3289 3290 static int selinux_inode_setsecurity(struct inode *inode, const char *name, 3291 const void *value, size_t size, int flags) 3292 { 3293 struct inode_security_struct *isec = inode_security_novalidate(inode); 3294 u32 newsid; 3295 int rc; 3296 3297 if (strcmp(name, XATTR_SELINUX_SUFFIX)) 3298 return -EOPNOTSUPP; 3299 3300 if (!value || !size) 3301 return -EACCES; 3302 3303 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL); 3304 if (rc) 3305 return rc; 3306 3307 spin_lock(&isec->lock); 3308 isec->sclass = inode_mode_to_security_class(inode->i_mode); 3309 isec->sid = newsid; 3310 isec->initialized = LABEL_INITIALIZED; 3311 spin_unlock(&isec->lock); 3312 return 0; 3313 } 3314 3315 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) 3316 { 3317 const int len = sizeof(XATTR_NAME_SELINUX); 3318 if (buffer && len <= buffer_size) 3319 memcpy(buffer, XATTR_NAME_SELINUX, len); 3320 return len; 3321 } 3322 3323 static void selinux_inode_getsecid(struct inode *inode, u32 *secid) 3324 { 3325 struct inode_security_struct *isec = inode_security_novalidate(inode); 3326 *secid = isec->sid; 3327 } 3328 3329 static int selinux_inode_copy_up(struct dentry *src, struct cred **new) 3330 { 3331 u32 sid; 3332 struct task_security_struct *tsec; 3333 struct cred *new_creds = *new; 3334 3335 if (new_creds == NULL) { 3336 new_creds = prepare_creds(); 3337 if (!new_creds) 3338 return -ENOMEM; 3339 } 3340 3341 tsec = new_creds->security; 3342 /* Get label from overlay inode and set it in create_sid */ 3343 selinux_inode_getsecid(d_inode(src), &sid); 3344 tsec->create_sid = sid; 3345 *new = new_creds; 3346 return 0; 3347 } 3348 3349 static int selinux_inode_copy_up_xattr(const char *name) 3350 { 3351 /* The copy_up hook above sets the initial context on an inode, but we 3352 * don't then want to overwrite it by blindly copying all the lower 3353 * xattrs up. Instead, we have to filter out SELinux-related xattrs. 3354 */ 3355 if (strcmp(name, XATTR_NAME_SELINUX) == 0) 3356 return 1; /* Discard */ 3357 /* 3358 * Any other attribute apart from SELINUX is not claimed, supported 3359 * by selinux. 3360 */ 3361 return -EOPNOTSUPP; 3362 } 3363 3364 /* file security operations */ 3365 3366 static int selinux_revalidate_file_permission(struct file *file, int mask) 3367 { 3368 const struct cred *cred = current_cred(); 3369 struct inode *inode = file_inode(file); 3370 3371 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */ 3372 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE)) 3373 mask |= MAY_APPEND; 3374 3375 return file_has_perm(cred, file, 3376 file_mask_to_av(inode->i_mode, mask)); 3377 } 3378 3379 static int selinux_file_permission(struct file *file, int mask) 3380 { 3381 struct inode *inode = file_inode(file); 3382 struct file_security_struct *fsec = file->f_security; 3383 struct inode_security_struct *isec; 3384 u32 sid = current_sid(); 3385 3386 if (!mask) 3387 /* No permission to check. Existence test. */ 3388 return 0; 3389 3390 isec = inode_security(inode); 3391 if (sid == fsec->sid && fsec->isid == isec->sid && 3392 fsec->pseqno == avc_policy_seqno()) 3393 /* No change since file_open check. */ 3394 return 0; 3395 3396 return selinux_revalidate_file_permission(file, mask); 3397 } 3398 3399 static int selinux_file_alloc_security(struct file *file) 3400 { 3401 return file_alloc_security(file); 3402 } 3403 3404 static void selinux_file_free_security(struct file *file) 3405 { 3406 file_free_security(file); 3407 } 3408 3409 /* 3410 * Check whether a task has the ioctl permission and cmd 3411 * operation to an inode. 3412 */ 3413 static int ioctl_has_perm(const struct cred *cred, struct file *file, 3414 u32 requested, u16 cmd) 3415 { 3416 struct common_audit_data ad; 3417 struct file_security_struct *fsec = file->f_security; 3418 struct inode *inode = file_inode(file); 3419 struct inode_security_struct *isec; 3420 struct lsm_ioctlop_audit ioctl; 3421 u32 ssid = cred_sid(cred); 3422 int rc; 3423 u8 driver = cmd >> 8; 3424 u8 xperm = cmd & 0xff; 3425 3426 ad.type = LSM_AUDIT_DATA_IOCTL_OP; 3427 ad.u.op = &ioctl; 3428 ad.u.op->cmd = cmd; 3429 ad.u.op->path = file->f_path; 3430 3431 if (ssid != fsec->sid) { 3432 rc = avc_has_perm(ssid, fsec->sid, 3433 SECCLASS_FD, 3434 FD__USE, 3435 &ad); 3436 if (rc) 3437 goto out; 3438 } 3439 3440 if (unlikely(IS_PRIVATE(inode))) 3441 return 0; 3442 3443 isec = inode_security(inode); 3444 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass, 3445 requested, driver, xperm, &ad); 3446 out: 3447 return rc; 3448 } 3449 3450 static int selinux_file_ioctl(struct file *file, unsigned int cmd, 3451 unsigned long arg) 3452 { 3453 const struct cred *cred = current_cred(); 3454 int error = 0; 3455 3456 switch (cmd) { 3457 case FIONREAD: 3458 /* fall through */ 3459 case FIBMAP: 3460 /* fall through */ 3461 case FIGETBSZ: 3462 /* fall through */ 3463 case FS_IOC_GETFLAGS: 3464 /* fall through */ 3465 case FS_IOC_GETVERSION: 3466 error = file_has_perm(cred, file, FILE__GETATTR); 3467 break; 3468 3469 case FS_IOC_SETFLAGS: 3470 /* fall through */ 3471 case FS_IOC_SETVERSION: 3472 error = file_has_perm(cred, file, FILE__SETATTR); 3473 break; 3474 3475 /* sys_ioctl() checks */ 3476 case FIONBIO: 3477 /* fall through */ 3478 case FIOASYNC: 3479 error = file_has_perm(cred, file, 0); 3480 break; 3481 3482 case KDSKBENT: 3483 case KDSKBSENT: 3484 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG, 3485 SECURITY_CAP_AUDIT, true); 3486 break; 3487 3488 /* default case assumes that the command will go 3489 * to the file's ioctl() function. 3490 */ 3491 default: 3492 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd); 3493 } 3494 return error; 3495 } 3496 3497 static int default_noexec; 3498 3499 static int file_map_prot_check(struct file *file, unsigned long prot, int shared) 3500 { 3501 const struct cred *cred = current_cred(); 3502 u32 sid = cred_sid(cred); 3503 int rc = 0; 3504 3505 if (default_noexec && 3506 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || 3507 (!shared && (prot & PROT_WRITE)))) { 3508 /* 3509 * We are making executable an anonymous mapping or a 3510 * private file mapping that will also be writable. 3511 * This has an additional check. 3512 */ 3513 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, 3514 PROCESS__EXECMEM, NULL); 3515 if (rc) 3516 goto error; 3517 } 3518 3519 if (file) { 3520 /* read access is always possible with a mapping */ 3521 u32 av = FILE__READ; 3522 3523 /* write access only matters if the mapping is shared */ 3524 if (shared && (prot & PROT_WRITE)) 3525 av |= FILE__WRITE; 3526 3527 if (prot & PROT_EXEC) 3528 av |= FILE__EXECUTE; 3529 3530 return file_has_perm(cred, file, av); 3531 } 3532 3533 error: 3534 return rc; 3535 } 3536 3537 static int selinux_mmap_addr(unsigned long addr) 3538 { 3539 int rc = 0; 3540 3541 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) { 3542 u32 sid = current_sid(); 3543 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT, 3544 MEMPROTECT__MMAP_ZERO, NULL); 3545 } 3546 3547 return rc; 3548 } 3549 3550 static int selinux_mmap_file(struct file *file, unsigned long reqprot, 3551 unsigned long prot, unsigned long flags) 3552 { 3553 if (selinux_checkreqprot) 3554 prot = reqprot; 3555 3556 return file_map_prot_check(file, prot, 3557 (flags & MAP_TYPE) == MAP_SHARED); 3558 } 3559 3560 static int selinux_file_mprotect(struct vm_area_struct *vma, 3561 unsigned long reqprot, 3562 unsigned long prot) 3563 { 3564 const struct cred *cred = current_cred(); 3565 u32 sid = cred_sid(cred); 3566 3567 if (selinux_checkreqprot) 3568 prot = reqprot; 3569 3570 if (default_noexec && 3571 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) { 3572 int rc = 0; 3573 if (vma->vm_start >= vma->vm_mm->start_brk && 3574 vma->vm_end <= vma->vm_mm->brk) { 3575 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, 3576 PROCESS__EXECHEAP, NULL); 3577 } else if (!vma->vm_file && 3578 ((vma->vm_start <= vma->vm_mm->start_stack && 3579 vma->vm_end >= vma->vm_mm->start_stack) || 3580 vma_is_stack_for_current(vma))) { 3581 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, 3582 PROCESS__EXECSTACK, NULL); 3583 } else if (vma->vm_file && vma->anon_vma) { 3584 /* 3585 * We are making executable a file mapping that has 3586 * had some COW done. Since pages might have been 3587 * written, check ability to execute the possibly 3588 * modified content. This typically should only 3589 * occur for text relocations. 3590 */ 3591 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD); 3592 } 3593 if (rc) 3594 return rc; 3595 } 3596 3597 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED); 3598 } 3599 3600 static int selinux_file_lock(struct file *file, unsigned int cmd) 3601 { 3602 const struct cred *cred = current_cred(); 3603 3604 return file_has_perm(cred, file, FILE__LOCK); 3605 } 3606 3607 static int selinux_file_fcntl(struct file *file, unsigned int cmd, 3608 unsigned long arg) 3609 { 3610 const struct cred *cred = current_cred(); 3611 int err = 0; 3612 3613 switch (cmd) { 3614 case F_SETFL: 3615 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) { 3616 err = file_has_perm(cred, file, FILE__WRITE); 3617 break; 3618 } 3619 /* fall through */ 3620 case F_SETOWN: 3621 case F_SETSIG: 3622 case F_GETFL: 3623 case F_GETOWN: 3624 case F_GETSIG: 3625 case F_GETOWNER_UIDS: 3626 /* Just check FD__USE permission */ 3627 err = file_has_perm(cred, file, 0); 3628 break; 3629 case F_GETLK: 3630 case F_SETLK: 3631 case F_SETLKW: 3632 case F_OFD_GETLK: 3633 case F_OFD_SETLK: 3634 case F_OFD_SETLKW: 3635 #if BITS_PER_LONG == 32 3636 case F_GETLK64: 3637 case F_SETLK64: 3638 case F_SETLKW64: 3639 #endif 3640 err = file_has_perm(cred, file, FILE__LOCK); 3641 break; 3642 } 3643 3644 return err; 3645 } 3646 3647 static void selinux_file_set_fowner(struct file *file) 3648 { 3649 struct file_security_struct *fsec; 3650 3651 fsec = file->f_security; 3652 fsec->fown_sid = current_sid(); 3653 } 3654 3655 static int selinux_file_send_sigiotask(struct task_struct *tsk, 3656 struct fown_struct *fown, int signum) 3657 { 3658 struct file *file; 3659 u32 sid = task_sid(tsk); 3660 u32 perm; 3661 struct file_security_struct *fsec; 3662 3663 /* struct fown_struct is never outside the context of a struct file */ 3664 file = container_of(fown, struct file, f_owner); 3665 3666 fsec = file->f_security; 3667 3668 if (!signum) 3669 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */ 3670 else 3671 perm = signal_to_av(signum); 3672 3673 return avc_has_perm(fsec->fown_sid, sid, 3674 SECCLASS_PROCESS, perm, NULL); 3675 } 3676 3677 static int selinux_file_receive(struct file *file) 3678 { 3679 const struct cred *cred = current_cred(); 3680 3681 return file_has_perm(cred, file, file_to_av(file)); 3682 } 3683 3684 static int selinux_file_open(struct file *file, const struct cred *cred) 3685 { 3686 struct file_security_struct *fsec; 3687 struct inode_security_struct *isec; 3688 3689 fsec = file->f_security; 3690 isec = inode_security(file_inode(file)); 3691 /* 3692 * Save inode label and policy sequence number 3693 * at open-time so that selinux_file_permission 3694 * can determine whether revalidation is necessary. 3695 * Task label is already saved in the file security 3696 * struct as its SID. 3697 */ 3698 fsec->isid = isec->sid; 3699 fsec->pseqno = avc_policy_seqno(); 3700 /* 3701 * Since the inode label or policy seqno may have changed 3702 * between the selinux_inode_permission check and the saving 3703 * of state above, recheck that access is still permitted. 3704 * Otherwise, access might never be revalidated against the 3705 * new inode label or new policy. 3706 * This check is not redundant - do not remove. 3707 */ 3708 return file_path_has_perm(cred, file, open_file_to_av(file)); 3709 } 3710 3711 /* task security operations */ 3712 3713 static int selinux_task_create(unsigned long clone_flags) 3714 { 3715 u32 sid = current_sid(); 3716 3717 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL); 3718 } 3719 3720 /* 3721 * allocate the SELinux part of blank credentials 3722 */ 3723 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp) 3724 { 3725 struct task_security_struct *tsec; 3726 3727 tsec = kzalloc(sizeof(struct task_security_struct), gfp); 3728 if (!tsec) 3729 return -ENOMEM; 3730 3731 cred->security = tsec; 3732 return 0; 3733 } 3734 3735 /* 3736 * detach and free the LSM part of a set of credentials 3737 */ 3738 static void selinux_cred_free(struct cred *cred) 3739 { 3740 struct task_security_struct *tsec = cred->security; 3741 3742 /* 3743 * cred->security == NULL if security_cred_alloc_blank() or 3744 * security_prepare_creds() returned an error. 3745 */ 3746 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE); 3747 cred->security = (void *) 0x7UL; 3748 kfree(tsec); 3749 } 3750 3751 /* 3752 * prepare a new set of credentials for modification 3753 */ 3754 static int selinux_cred_prepare(struct cred *new, const struct cred *old, 3755 gfp_t gfp) 3756 { 3757 const struct task_security_struct *old_tsec; 3758 struct task_security_struct *tsec; 3759 3760 old_tsec = old->security; 3761 3762 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp); 3763 if (!tsec) 3764 return -ENOMEM; 3765 3766 new->security = tsec; 3767 return 0; 3768 } 3769 3770 /* 3771 * transfer the SELinux data to a blank set of creds 3772 */ 3773 static void selinux_cred_transfer(struct cred *new, const struct cred *old) 3774 { 3775 const struct task_security_struct *old_tsec = old->security; 3776 struct task_security_struct *tsec = new->security; 3777 3778 *tsec = *old_tsec; 3779 } 3780 3781 /* 3782 * set the security data for a kernel service 3783 * - all the creation contexts are set to unlabelled 3784 */ 3785 static int selinux_kernel_act_as(struct cred *new, u32 secid) 3786 { 3787 struct task_security_struct *tsec = new->security; 3788 u32 sid = current_sid(); 3789 int ret; 3790 3791 ret = avc_has_perm(sid, secid, 3792 SECCLASS_KERNEL_SERVICE, 3793 KERNEL_SERVICE__USE_AS_OVERRIDE, 3794 NULL); 3795 if (ret == 0) { 3796 tsec->sid = secid; 3797 tsec->create_sid = 0; 3798 tsec->keycreate_sid = 0; 3799 tsec->sockcreate_sid = 0; 3800 } 3801 return ret; 3802 } 3803 3804 /* 3805 * set the file creation context in a security record to the same as the 3806 * objective context of the specified inode 3807 */ 3808 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode) 3809 { 3810 struct inode_security_struct *isec = inode_security(inode); 3811 struct task_security_struct *tsec = new->security; 3812 u32 sid = current_sid(); 3813 int ret; 3814 3815 ret = avc_has_perm(sid, isec->sid, 3816 SECCLASS_KERNEL_SERVICE, 3817 KERNEL_SERVICE__CREATE_FILES_AS, 3818 NULL); 3819 3820 if (ret == 0) 3821 tsec->create_sid = isec->sid; 3822 return ret; 3823 } 3824 3825 static int selinux_kernel_module_request(char *kmod_name) 3826 { 3827 struct common_audit_data ad; 3828 3829 ad.type = LSM_AUDIT_DATA_KMOD; 3830 ad.u.kmod_name = kmod_name; 3831 3832 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM, 3833 SYSTEM__MODULE_REQUEST, &ad); 3834 } 3835 3836 static int selinux_kernel_module_from_file(struct file *file) 3837 { 3838 struct common_audit_data ad; 3839 struct inode_security_struct *isec; 3840 struct file_security_struct *fsec; 3841 u32 sid = current_sid(); 3842 int rc; 3843 3844 /* init_module */ 3845 if (file == NULL) 3846 return avc_has_perm(sid, sid, SECCLASS_SYSTEM, 3847 SYSTEM__MODULE_LOAD, NULL); 3848 3849 /* finit_module */ 3850 3851 ad.type = LSM_AUDIT_DATA_FILE; 3852 ad.u.file = file; 3853 3854 fsec = file->f_security; 3855 if (sid != fsec->sid) { 3856 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad); 3857 if (rc) 3858 return rc; 3859 } 3860 3861 isec = inode_security(file_inode(file)); 3862 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM, 3863 SYSTEM__MODULE_LOAD, &ad); 3864 } 3865 3866 static int selinux_kernel_read_file(struct file *file, 3867 enum kernel_read_file_id id) 3868 { 3869 int rc = 0; 3870 3871 switch (id) { 3872 case READING_MODULE: 3873 rc = selinux_kernel_module_from_file(file); 3874 break; 3875 default: 3876 break; 3877 } 3878 3879 return rc; 3880 } 3881 3882 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid) 3883 { 3884 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3885 PROCESS__SETPGID, NULL); 3886 } 3887 3888 static int selinux_task_getpgid(struct task_struct *p) 3889 { 3890 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3891 PROCESS__GETPGID, NULL); 3892 } 3893 3894 static int selinux_task_getsid(struct task_struct *p) 3895 { 3896 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3897 PROCESS__GETSESSION, NULL); 3898 } 3899 3900 static void selinux_task_getsecid(struct task_struct *p, u32 *secid) 3901 { 3902 *secid = task_sid(p); 3903 } 3904 3905 static int selinux_task_setnice(struct task_struct *p, int nice) 3906 { 3907 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3908 PROCESS__SETSCHED, NULL); 3909 } 3910 3911 static int selinux_task_setioprio(struct task_struct *p, int ioprio) 3912 { 3913 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3914 PROCESS__SETSCHED, NULL); 3915 } 3916 3917 static int selinux_task_getioprio(struct task_struct *p) 3918 { 3919 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3920 PROCESS__GETSCHED, NULL); 3921 } 3922 3923 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource, 3924 struct rlimit *new_rlim) 3925 { 3926 struct rlimit *old_rlim = p->signal->rlim + resource; 3927 3928 /* Control the ability to change the hard limit (whether 3929 lowering or raising it), so that the hard limit can 3930 later be used as a safe reset point for the soft limit 3931 upon context transitions. See selinux_bprm_committing_creds. */ 3932 if (old_rlim->rlim_max != new_rlim->rlim_max) 3933 return avc_has_perm(current_sid(), task_sid(p), 3934 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL); 3935 3936 return 0; 3937 } 3938 3939 static int selinux_task_setscheduler(struct task_struct *p) 3940 { 3941 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3942 PROCESS__SETSCHED, NULL); 3943 } 3944 3945 static int selinux_task_getscheduler(struct task_struct *p) 3946 { 3947 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3948 PROCESS__GETSCHED, NULL); 3949 } 3950 3951 static int selinux_task_movememory(struct task_struct *p) 3952 { 3953 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS, 3954 PROCESS__SETSCHED, NULL); 3955 } 3956 3957 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, 3958 int sig, u32 secid) 3959 { 3960 u32 perm; 3961 3962 if (!sig) 3963 perm = PROCESS__SIGNULL; /* null signal; existence test */ 3964 else 3965 perm = signal_to_av(sig); 3966 if (!secid) 3967 secid = current_sid(); 3968 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL); 3969 } 3970 3971 static void selinux_task_to_inode(struct task_struct *p, 3972 struct inode *inode) 3973 { 3974 struct inode_security_struct *isec = inode->i_security; 3975 u32 sid = task_sid(p); 3976 3977 spin_lock(&isec->lock); 3978 isec->sclass = inode_mode_to_security_class(inode->i_mode); 3979 isec->sid = sid; 3980 isec->initialized = LABEL_INITIALIZED; 3981 spin_unlock(&isec->lock); 3982 } 3983 3984 /* Returns error only if unable to parse addresses */ 3985 static int selinux_parse_skb_ipv4(struct sk_buff *skb, 3986 struct common_audit_data *ad, u8 *proto) 3987 { 3988 int offset, ihlen, ret = -EINVAL; 3989 struct iphdr _iph, *ih; 3990 3991 offset = skb_network_offset(skb); 3992 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph); 3993 if (ih == NULL) 3994 goto out; 3995 3996 ihlen = ih->ihl * 4; 3997 if (ihlen < sizeof(_iph)) 3998 goto out; 3999 4000 ad->u.net->v4info.saddr = ih->saddr; 4001 ad->u.net->v4info.daddr = ih->daddr; 4002 ret = 0; 4003 4004 if (proto) 4005 *proto = ih->protocol; 4006 4007 switch (ih->protocol) { 4008 case IPPROTO_TCP: { 4009 struct tcphdr _tcph, *th; 4010 4011 if (ntohs(ih->frag_off) & IP_OFFSET) 4012 break; 4013 4014 offset += ihlen; 4015 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 4016 if (th == NULL) 4017 break; 4018 4019 ad->u.net->sport = th->source; 4020 ad->u.net->dport = th->dest; 4021 break; 4022 } 4023 4024 case IPPROTO_UDP: { 4025 struct udphdr _udph, *uh; 4026 4027 if (ntohs(ih->frag_off) & IP_OFFSET) 4028 break; 4029 4030 offset += ihlen; 4031 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 4032 if (uh == NULL) 4033 break; 4034 4035 ad->u.net->sport = uh->source; 4036 ad->u.net->dport = uh->dest; 4037 break; 4038 } 4039 4040 case IPPROTO_DCCP: { 4041 struct dccp_hdr _dccph, *dh; 4042 4043 if (ntohs(ih->frag_off) & IP_OFFSET) 4044 break; 4045 4046 offset += ihlen; 4047 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); 4048 if (dh == NULL) 4049 break; 4050 4051 ad->u.net->sport = dh->dccph_sport; 4052 ad->u.net->dport = dh->dccph_dport; 4053 break; 4054 } 4055 4056 default: 4057 break; 4058 } 4059 out: 4060 return ret; 4061 } 4062 4063 #if IS_ENABLED(CONFIG_IPV6) 4064 4065 /* Returns error only if unable to parse addresses */ 4066 static int selinux_parse_skb_ipv6(struct sk_buff *skb, 4067 struct common_audit_data *ad, u8 *proto) 4068 { 4069 u8 nexthdr; 4070 int ret = -EINVAL, offset; 4071 struct ipv6hdr _ipv6h, *ip6; 4072 __be16 frag_off; 4073 4074 offset = skb_network_offset(skb); 4075 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h); 4076 if (ip6 == NULL) 4077 goto out; 4078 4079 ad->u.net->v6info.saddr = ip6->saddr; 4080 ad->u.net->v6info.daddr = ip6->daddr; 4081 ret = 0; 4082 4083 nexthdr = ip6->nexthdr; 4084 offset += sizeof(_ipv6h); 4085 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 4086 if (offset < 0) 4087 goto out; 4088 4089 if (proto) 4090 *proto = nexthdr; 4091 4092 switch (nexthdr) { 4093 case IPPROTO_TCP: { 4094 struct tcphdr _tcph, *th; 4095 4096 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 4097 if (th == NULL) 4098 break; 4099 4100 ad->u.net->sport = th->source; 4101 ad->u.net->dport = th->dest; 4102 break; 4103 } 4104 4105 case IPPROTO_UDP: { 4106 struct udphdr _udph, *uh; 4107 4108 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 4109 if (uh == NULL) 4110 break; 4111 4112 ad->u.net->sport = uh->source; 4113 ad->u.net->dport = uh->dest; 4114 break; 4115 } 4116 4117 case IPPROTO_DCCP: { 4118 struct dccp_hdr _dccph, *dh; 4119 4120 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); 4121 if (dh == NULL) 4122 break; 4123 4124 ad->u.net->sport = dh->dccph_sport; 4125 ad->u.net->dport = dh->dccph_dport; 4126 break; 4127 } 4128 4129 /* includes fragments */ 4130 default: 4131 break; 4132 } 4133 out: 4134 return ret; 4135 } 4136 4137 #endif /* IPV6 */ 4138 4139 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad, 4140 char **_addrp, int src, u8 *proto) 4141 { 4142 char *addrp; 4143 int ret; 4144 4145 switch (ad->u.net->family) { 4146 case PF_INET: 4147 ret = selinux_parse_skb_ipv4(skb, ad, proto); 4148 if (ret) 4149 goto parse_error; 4150 addrp = (char *)(src ? &ad->u.net->v4info.saddr : 4151 &ad->u.net->v4info.daddr); 4152 goto okay; 4153 4154 #if IS_ENABLED(CONFIG_IPV6) 4155 case PF_INET6: 4156 ret = selinux_parse_skb_ipv6(skb, ad, proto); 4157 if (ret) 4158 goto parse_error; 4159 addrp = (char *)(src ? &ad->u.net->v6info.saddr : 4160 &ad->u.net->v6info.daddr); 4161 goto okay; 4162 #endif /* IPV6 */ 4163 default: 4164 addrp = NULL; 4165 goto okay; 4166 } 4167 4168 parse_error: 4169 printk(KERN_WARNING 4170 "SELinux: failure in selinux_parse_skb()," 4171 " unable to parse packet\n"); 4172 return ret; 4173 4174 okay: 4175 if (_addrp) 4176 *_addrp = addrp; 4177 return 0; 4178 } 4179 4180 /** 4181 * selinux_skb_peerlbl_sid - Determine the peer label of a packet 4182 * @skb: the packet 4183 * @family: protocol family 4184 * @sid: the packet's peer label SID 4185 * 4186 * Description: 4187 * Check the various different forms of network peer labeling and determine 4188 * the peer label/SID for the packet; most of the magic actually occurs in 4189 * the security server function security_net_peersid_cmp(). The function 4190 * returns zero if the value in @sid is valid (although it may be SECSID_NULL) 4191 * or -EACCES if @sid is invalid due to inconsistencies with the different 4192 * peer labels. 4193 * 4194 */ 4195 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid) 4196 { 4197 int err; 4198 u32 xfrm_sid; 4199 u32 nlbl_sid; 4200 u32 nlbl_type; 4201 4202 err = selinux_xfrm_skb_sid(skb, &xfrm_sid); 4203 if (unlikely(err)) 4204 return -EACCES; 4205 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid); 4206 if (unlikely(err)) 4207 return -EACCES; 4208 4209 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid); 4210 if (unlikely(err)) { 4211 printk(KERN_WARNING 4212 "SELinux: failure in selinux_skb_peerlbl_sid()," 4213 " unable to determine packet's peer label\n"); 4214 return -EACCES; 4215 } 4216 4217 return 0; 4218 } 4219 4220 /** 4221 * selinux_conn_sid - Determine the child socket label for a connection 4222 * @sk_sid: the parent socket's SID 4223 * @skb_sid: the packet's SID 4224 * @conn_sid: the resulting connection SID 4225 * 4226 * If @skb_sid is valid then the user:role:type information from @sk_sid is 4227 * combined with the MLS information from @skb_sid in order to create 4228 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy 4229 * of @sk_sid. Returns zero on success, negative values on failure. 4230 * 4231 */ 4232 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid) 4233 { 4234 int err = 0; 4235 4236 if (skb_sid != SECSID_NULL) 4237 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid); 4238 else 4239 *conn_sid = sk_sid; 4240 4241 return err; 4242 } 4243 4244 /* socket security operations */ 4245 4246 static int socket_sockcreate_sid(const struct task_security_struct *tsec, 4247 u16 secclass, u32 *socksid) 4248 { 4249 if (tsec->sockcreate_sid > SECSID_NULL) { 4250 *socksid = tsec->sockcreate_sid; 4251 return 0; 4252 } 4253 4254 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL, 4255 socksid); 4256 } 4257 4258 static int sock_has_perm(struct sock *sk, u32 perms) 4259 { 4260 struct sk_security_struct *sksec = sk->sk_security; 4261 struct common_audit_data ad; 4262 struct lsm_network_audit net = {0,}; 4263 4264 if (sksec->sid == SECINITSID_KERNEL) 4265 return 0; 4266 4267 ad.type = LSM_AUDIT_DATA_NET; 4268 ad.u.net = &net; 4269 ad.u.net->sk = sk; 4270 4271 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms, 4272 &ad); 4273 } 4274 4275 static int selinux_socket_create(int family, int type, 4276 int protocol, int kern) 4277 { 4278 const struct task_security_struct *tsec = current_security(); 4279 u32 newsid; 4280 u16 secclass; 4281 int rc; 4282 4283 if (kern) 4284 return 0; 4285 4286 secclass = socket_type_to_security_class(family, type, protocol); 4287 rc = socket_sockcreate_sid(tsec, secclass, &newsid); 4288 if (rc) 4289 return rc; 4290 4291 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL); 4292 } 4293 4294 static int selinux_socket_post_create(struct socket *sock, int family, 4295 int type, int protocol, int kern) 4296 { 4297 const struct task_security_struct *tsec = current_security(); 4298 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock)); 4299 struct sk_security_struct *sksec; 4300 u16 sclass = socket_type_to_security_class(family, type, protocol); 4301 u32 sid = SECINITSID_KERNEL; 4302 int err = 0; 4303 4304 if (!kern) { 4305 err = socket_sockcreate_sid(tsec, sclass, &sid); 4306 if (err) 4307 return err; 4308 } 4309 4310 isec->sclass = sclass; 4311 isec->sid = sid; 4312 isec->initialized = LABEL_INITIALIZED; 4313 4314 if (sock->sk) { 4315 sksec = sock->sk->sk_security; 4316 sksec->sclass = sclass; 4317 sksec->sid = sid; 4318 err = selinux_netlbl_socket_post_create(sock->sk, family); 4319 } 4320 4321 return err; 4322 } 4323 4324 /* Range of port numbers used to automatically bind. 4325 Need to determine whether we should perform a name_bind 4326 permission check between the socket and the port number. */ 4327 4328 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) 4329 { 4330 struct sock *sk = sock->sk; 4331 u16 family; 4332 int err; 4333 4334 err = sock_has_perm(sk, SOCKET__BIND); 4335 if (err) 4336 goto out; 4337 4338 /* 4339 * If PF_INET or PF_INET6, check name_bind permission for the port. 4340 * Multiple address binding for SCTP is not supported yet: we just 4341 * check the first address now. 4342 */ 4343 family = sk->sk_family; 4344 if (family == PF_INET || family == PF_INET6) { 4345 char *addrp; 4346 struct sk_security_struct *sksec = sk->sk_security; 4347 struct common_audit_data ad; 4348 struct lsm_network_audit net = {0,}; 4349 struct sockaddr_in *addr4 = NULL; 4350 struct sockaddr_in6 *addr6 = NULL; 4351 unsigned short snum; 4352 u32 sid, node_perm; 4353 4354 if (family == PF_INET) { 4355 addr4 = (struct sockaddr_in *)address; 4356 snum = ntohs(addr4->sin_port); 4357 addrp = (char *)&addr4->sin_addr.s_addr; 4358 } else { 4359 addr6 = (struct sockaddr_in6 *)address; 4360 snum = ntohs(addr6->sin6_port); 4361 addrp = (char *)&addr6->sin6_addr.s6_addr; 4362 } 4363 4364 if (snum) { 4365 int low, high; 4366 4367 inet_get_local_port_range(sock_net(sk), &low, &high); 4368 4369 if (snum < max(inet_prot_sock(sock_net(sk)), low) || 4370 snum > high) { 4371 err = sel_netport_sid(sk->sk_protocol, 4372 snum, &sid); 4373 if (err) 4374 goto out; 4375 ad.type = LSM_AUDIT_DATA_NET; 4376 ad.u.net = &net; 4377 ad.u.net->sport = htons(snum); 4378 ad.u.net->family = family; 4379 err = avc_has_perm(sksec->sid, sid, 4380 sksec->sclass, 4381 SOCKET__NAME_BIND, &ad); 4382 if (err) 4383 goto out; 4384 } 4385 } 4386 4387 switch (sksec->sclass) { 4388 case SECCLASS_TCP_SOCKET: 4389 node_perm = TCP_SOCKET__NODE_BIND; 4390 break; 4391 4392 case SECCLASS_UDP_SOCKET: 4393 node_perm = UDP_SOCKET__NODE_BIND; 4394 break; 4395 4396 case SECCLASS_DCCP_SOCKET: 4397 node_perm = DCCP_SOCKET__NODE_BIND; 4398 break; 4399 4400 default: 4401 node_perm = RAWIP_SOCKET__NODE_BIND; 4402 break; 4403 } 4404 4405 err = sel_netnode_sid(addrp, family, &sid); 4406 if (err) 4407 goto out; 4408 4409 ad.type = LSM_AUDIT_DATA_NET; 4410 ad.u.net = &net; 4411 ad.u.net->sport = htons(snum); 4412 ad.u.net->family = family; 4413 4414 if (family == PF_INET) 4415 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr; 4416 else 4417 ad.u.net->v6info.saddr = addr6->sin6_addr; 4418 4419 err = avc_has_perm(sksec->sid, sid, 4420 sksec->sclass, node_perm, &ad); 4421 if (err) 4422 goto out; 4423 } 4424 out: 4425 return err; 4426 } 4427 4428 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen) 4429 { 4430 struct sock *sk = sock->sk; 4431 struct sk_security_struct *sksec = sk->sk_security; 4432 int err; 4433 4434 err = sock_has_perm(sk, SOCKET__CONNECT); 4435 if (err) 4436 return err; 4437 4438 /* 4439 * If a TCP or DCCP socket, check name_connect permission for the port. 4440 */ 4441 if (sksec->sclass == SECCLASS_TCP_SOCKET || 4442 sksec->sclass == SECCLASS_DCCP_SOCKET) { 4443 struct common_audit_data ad; 4444 struct lsm_network_audit net = {0,}; 4445 struct sockaddr_in *addr4 = NULL; 4446 struct sockaddr_in6 *addr6 = NULL; 4447 unsigned short snum; 4448 u32 sid, perm; 4449 4450 if (sk->sk_family == PF_INET) { 4451 addr4 = (struct sockaddr_in *)address; 4452 if (addrlen < sizeof(struct sockaddr_in)) 4453 return -EINVAL; 4454 snum = ntohs(addr4->sin_port); 4455 } else { 4456 addr6 = (struct sockaddr_in6 *)address; 4457 if (addrlen < SIN6_LEN_RFC2133) 4458 return -EINVAL; 4459 snum = ntohs(addr6->sin6_port); 4460 } 4461 4462 err = sel_netport_sid(sk->sk_protocol, snum, &sid); 4463 if (err) 4464 goto out; 4465 4466 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ? 4467 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT; 4468 4469 ad.type = LSM_AUDIT_DATA_NET; 4470 ad.u.net = &net; 4471 ad.u.net->dport = htons(snum); 4472 ad.u.net->family = sk->sk_family; 4473 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad); 4474 if (err) 4475 goto out; 4476 } 4477 4478 err = selinux_netlbl_socket_connect(sk, address); 4479 4480 out: 4481 return err; 4482 } 4483 4484 static int selinux_socket_listen(struct socket *sock, int backlog) 4485 { 4486 return sock_has_perm(sock->sk, SOCKET__LISTEN); 4487 } 4488 4489 static int selinux_socket_accept(struct socket *sock, struct socket *newsock) 4490 { 4491 int err; 4492 struct inode_security_struct *isec; 4493 struct inode_security_struct *newisec; 4494 u16 sclass; 4495 u32 sid; 4496 4497 err = sock_has_perm(sock->sk, SOCKET__ACCEPT); 4498 if (err) 4499 return err; 4500 4501 isec = inode_security_novalidate(SOCK_INODE(sock)); 4502 spin_lock(&isec->lock); 4503 sclass = isec->sclass; 4504 sid = isec->sid; 4505 spin_unlock(&isec->lock); 4506 4507 newisec = inode_security_novalidate(SOCK_INODE(newsock)); 4508 newisec->sclass = sclass; 4509 newisec->sid = sid; 4510 newisec->initialized = LABEL_INITIALIZED; 4511 4512 return 0; 4513 } 4514 4515 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg, 4516 int size) 4517 { 4518 return sock_has_perm(sock->sk, SOCKET__WRITE); 4519 } 4520 4521 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg, 4522 int size, int flags) 4523 { 4524 return sock_has_perm(sock->sk, SOCKET__READ); 4525 } 4526 4527 static int selinux_socket_getsockname(struct socket *sock) 4528 { 4529 return sock_has_perm(sock->sk, SOCKET__GETATTR); 4530 } 4531 4532 static int selinux_socket_getpeername(struct socket *sock) 4533 { 4534 return sock_has_perm(sock->sk, SOCKET__GETATTR); 4535 } 4536 4537 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname) 4538 { 4539 int err; 4540 4541 err = sock_has_perm(sock->sk, SOCKET__SETOPT); 4542 if (err) 4543 return err; 4544 4545 return selinux_netlbl_socket_setsockopt(sock, level, optname); 4546 } 4547 4548 static int selinux_socket_getsockopt(struct socket *sock, int level, 4549 int optname) 4550 { 4551 return sock_has_perm(sock->sk, SOCKET__GETOPT); 4552 } 4553 4554 static int selinux_socket_shutdown(struct socket *sock, int how) 4555 { 4556 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN); 4557 } 4558 4559 static int selinux_socket_unix_stream_connect(struct sock *sock, 4560 struct sock *other, 4561 struct sock *newsk) 4562 { 4563 struct sk_security_struct *sksec_sock = sock->sk_security; 4564 struct sk_security_struct *sksec_other = other->sk_security; 4565 struct sk_security_struct *sksec_new = newsk->sk_security; 4566 struct common_audit_data ad; 4567 struct lsm_network_audit net = {0,}; 4568 int err; 4569 4570 ad.type = LSM_AUDIT_DATA_NET; 4571 ad.u.net = &net; 4572 ad.u.net->sk = other; 4573 4574 err = avc_has_perm(sksec_sock->sid, sksec_other->sid, 4575 sksec_other->sclass, 4576 UNIX_STREAM_SOCKET__CONNECTTO, &ad); 4577 if (err) 4578 return err; 4579 4580 /* server child socket */ 4581 sksec_new->peer_sid = sksec_sock->sid; 4582 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid, 4583 &sksec_new->sid); 4584 if (err) 4585 return err; 4586 4587 /* connecting socket */ 4588 sksec_sock->peer_sid = sksec_new->sid; 4589 4590 return 0; 4591 } 4592 4593 static int selinux_socket_unix_may_send(struct socket *sock, 4594 struct socket *other) 4595 { 4596 struct sk_security_struct *ssec = sock->sk->sk_security; 4597 struct sk_security_struct *osec = other->sk->sk_security; 4598 struct common_audit_data ad; 4599 struct lsm_network_audit net = {0,}; 4600 4601 ad.type = LSM_AUDIT_DATA_NET; 4602 ad.u.net = &net; 4603 ad.u.net->sk = other->sk; 4604 4605 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO, 4606 &ad); 4607 } 4608 4609 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex, 4610 char *addrp, u16 family, u32 peer_sid, 4611 struct common_audit_data *ad) 4612 { 4613 int err; 4614 u32 if_sid; 4615 u32 node_sid; 4616 4617 err = sel_netif_sid(ns, ifindex, &if_sid); 4618 if (err) 4619 return err; 4620 err = avc_has_perm(peer_sid, if_sid, 4621 SECCLASS_NETIF, NETIF__INGRESS, ad); 4622 if (err) 4623 return err; 4624 4625 err = sel_netnode_sid(addrp, family, &node_sid); 4626 if (err) 4627 return err; 4628 return avc_has_perm(peer_sid, node_sid, 4629 SECCLASS_NODE, NODE__RECVFROM, ad); 4630 } 4631 4632 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, 4633 u16 family) 4634 { 4635 int err = 0; 4636 struct sk_security_struct *sksec = sk->sk_security; 4637 u32 sk_sid = sksec->sid; 4638 struct common_audit_data ad; 4639 struct lsm_network_audit net = {0,}; 4640 char *addrp; 4641 4642 ad.type = LSM_AUDIT_DATA_NET; 4643 ad.u.net = &net; 4644 ad.u.net->netif = skb->skb_iif; 4645 ad.u.net->family = family; 4646 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL); 4647 if (err) 4648 return err; 4649 4650 if (selinux_secmark_enabled()) { 4651 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, 4652 PACKET__RECV, &ad); 4653 if (err) 4654 return err; 4655 } 4656 4657 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad); 4658 if (err) 4659 return err; 4660 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad); 4661 4662 return err; 4663 } 4664 4665 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 4666 { 4667 int err; 4668 struct sk_security_struct *sksec = sk->sk_security; 4669 u16 family = sk->sk_family; 4670 u32 sk_sid = sksec->sid; 4671 struct common_audit_data ad; 4672 struct lsm_network_audit net = {0,}; 4673 char *addrp; 4674 u8 secmark_active; 4675 u8 peerlbl_active; 4676 4677 if (family != PF_INET && family != PF_INET6) 4678 return 0; 4679 4680 /* Handle mapped IPv4 packets arriving via IPv6 sockets */ 4681 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 4682 family = PF_INET; 4683 4684 /* If any sort of compatibility mode is enabled then handoff processing 4685 * to the selinux_sock_rcv_skb_compat() function to deal with the 4686 * special handling. We do this in an attempt to keep this function 4687 * as fast and as clean as possible. */ 4688 if (!selinux_policycap_netpeer) 4689 return selinux_sock_rcv_skb_compat(sk, skb, family); 4690 4691 secmark_active = selinux_secmark_enabled(); 4692 peerlbl_active = selinux_peerlbl_enabled(); 4693 if (!secmark_active && !peerlbl_active) 4694 return 0; 4695 4696 ad.type = LSM_AUDIT_DATA_NET; 4697 ad.u.net = &net; 4698 ad.u.net->netif = skb->skb_iif; 4699 ad.u.net->family = family; 4700 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL); 4701 if (err) 4702 return err; 4703 4704 if (peerlbl_active) { 4705 u32 peer_sid; 4706 4707 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid); 4708 if (err) 4709 return err; 4710 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif, 4711 addrp, family, peer_sid, &ad); 4712 if (err) { 4713 selinux_netlbl_err(skb, family, err, 0); 4714 return err; 4715 } 4716 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER, 4717 PEER__RECV, &ad); 4718 if (err) { 4719 selinux_netlbl_err(skb, family, err, 0); 4720 return err; 4721 } 4722 } 4723 4724 if (secmark_active) { 4725 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, 4726 PACKET__RECV, &ad); 4727 if (err) 4728 return err; 4729 } 4730 4731 return err; 4732 } 4733 4734 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval, 4735 int __user *optlen, unsigned len) 4736 { 4737 int err = 0; 4738 char *scontext; 4739 u32 scontext_len; 4740 struct sk_security_struct *sksec = sock->sk->sk_security; 4741 u32 peer_sid = SECSID_NULL; 4742 4743 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET || 4744 sksec->sclass == SECCLASS_TCP_SOCKET) 4745 peer_sid = sksec->peer_sid; 4746 if (peer_sid == SECSID_NULL) 4747 return -ENOPROTOOPT; 4748 4749 err = security_sid_to_context(peer_sid, &scontext, &scontext_len); 4750 if (err) 4751 return err; 4752 4753 if (scontext_len > len) { 4754 err = -ERANGE; 4755 goto out_len; 4756 } 4757 4758 if (copy_to_user(optval, scontext, scontext_len)) 4759 err = -EFAULT; 4760 4761 out_len: 4762 if (put_user(scontext_len, optlen)) 4763 err = -EFAULT; 4764 kfree(scontext); 4765 return err; 4766 } 4767 4768 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) 4769 { 4770 u32 peer_secid = SECSID_NULL; 4771 u16 family; 4772 struct inode_security_struct *isec; 4773 4774 if (skb && skb->protocol == htons(ETH_P_IP)) 4775 family = PF_INET; 4776 else if (skb && skb->protocol == htons(ETH_P_IPV6)) 4777 family = PF_INET6; 4778 else if (sock) 4779 family = sock->sk->sk_family; 4780 else 4781 goto out; 4782 4783 if (sock && family == PF_UNIX) { 4784 isec = inode_security_novalidate(SOCK_INODE(sock)); 4785 peer_secid = isec->sid; 4786 } else if (skb) 4787 selinux_skb_peerlbl_sid(skb, family, &peer_secid); 4788 4789 out: 4790 *secid = peer_secid; 4791 if (peer_secid == SECSID_NULL) 4792 return -EINVAL; 4793 return 0; 4794 } 4795 4796 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority) 4797 { 4798 struct sk_security_struct *sksec; 4799 4800 sksec = kzalloc(sizeof(*sksec), priority); 4801 if (!sksec) 4802 return -ENOMEM; 4803 4804 sksec->peer_sid = SECINITSID_UNLABELED; 4805 sksec->sid = SECINITSID_UNLABELED; 4806 sksec->sclass = SECCLASS_SOCKET; 4807 selinux_netlbl_sk_security_reset(sksec); 4808 sk->sk_security = sksec; 4809 4810 return 0; 4811 } 4812 4813 static void selinux_sk_free_security(struct sock *sk) 4814 { 4815 struct sk_security_struct *sksec = sk->sk_security; 4816 4817 sk->sk_security = NULL; 4818 selinux_netlbl_sk_security_free(sksec); 4819 kfree(sksec); 4820 } 4821 4822 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk) 4823 { 4824 struct sk_security_struct *sksec = sk->sk_security; 4825 struct sk_security_struct *newsksec = newsk->sk_security; 4826 4827 newsksec->sid = sksec->sid; 4828 newsksec->peer_sid = sksec->peer_sid; 4829 newsksec->sclass = sksec->sclass; 4830 4831 selinux_netlbl_sk_security_reset(newsksec); 4832 } 4833 4834 static void selinux_sk_getsecid(struct sock *sk, u32 *secid) 4835 { 4836 if (!sk) 4837 *secid = SECINITSID_ANY_SOCKET; 4838 else { 4839 struct sk_security_struct *sksec = sk->sk_security; 4840 4841 *secid = sksec->sid; 4842 } 4843 } 4844 4845 static void selinux_sock_graft(struct sock *sk, struct socket *parent) 4846 { 4847 struct inode_security_struct *isec = 4848 inode_security_novalidate(SOCK_INODE(parent)); 4849 struct sk_security_struct *sksec = sk->sk_security; 4850 4851 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 || 4852 sk->sk_family == PF_UNIX) 4853 isec->sid = sksec->sid; 4854 sksec->sclass = isec->sclass; 4855 } 4856 4857 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb, 4858 struct request_sock *req) 4859 { 4860 struct sk_security_struct *sksec = sk->sk_security; 4861 int err; 4862 u16 family = req->rsk_ops->family; 4863 u32 connsid; 4864 u32 peersid; 4865 4866 err = selinux_skb_peerlbl_sid(skb, family, &peersid); 4867 if (err) 4868 return err; 4869 err = selinux_conn_sid(sksec->sid, peersid, &connsid); 4870 if (err) 4871 return err; 4872 req->secid = connsid; 4873 req->peer_secid = peersid; 4874 4875 return selinux_netlbl_inet_conn_request(req, family); 4876 } 4877 4878 static void selinux_inet_csk_clone(struct sock *newsk, 4879 const struct request_sock *req) 4880 { 4881 struct sk_security_struct *newsksec = newsk->sk_security; 4882 4883 newsksec->sid = req->secid; 4884 newsksec->peer_sid = req->peer_secid; 4885 /* NOTE: Ideally, we should also get the isec->sid for the 4886 new socket in sync, but we don't have the isec available yet. 4887 So we will wait until sock_graft to do it, by which 4888 time it will have been created and available. */ 4889 4890 /* We don't need to take any sort of lock here as we are the only 4891 * thread with access to newsksec */ 4892 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family); 4893 } 4894 4895 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb) 4896 { 4897 u16 family = sk->sk_family; 4898 struct sk_security_struct *sksec = sk->sk_security; 4899 4900 /* handle mapped IPv4 packets arriving via IPv6 sockets */ 4901 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 4902 family = PF_INET; 4903 4904 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid); 4905 } 4906 4907 static int selinux_secmark_relabel_packet(u32 sid) 4908 { 4909 const struct task_security_struct *__tsec; 4910 u32 tsid; 4911 4912 __tsec = current_security(); 4913 tsid = __tsec->sid; 4914 4915 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL); 4916 } 4917 4918 static void selinux_secmark_refcount_inc(void) 4919 { 4920 atomic_inc(&selinux_secmark_refcount); 4921 } 4922 4923 static void selinux_secmark_refcount_dec(void) 4924 { 4925 atomic_dec(&selinux_secmark_refcount); 4926 } 4927 4928 static void selinux_req_classify_flow(const struct request_sock *req, 4929 struct flowi *fl) 4930 { 4931 fl->flowi_secid = req->secid; 4932 } 4933 4934 static int selinux_tun_dev_alloc_security(void **security) 4935 { 4936 struct tun_security_struct *tunsec; 4937 4938 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL); 4939 if (!tunsec) 4940 return -ENOMEM; 4941 tunsec->sid = current_sid(); 4942 4943 *security = tunsec; 4944 return 0; 4945 } 4946 4947 static void selinux_tun_dev_free_security(void *security) 4948 { 4949 kfree(security); 4950 } 4951 4952 static int selinux_tun_dev_create(void) 4953 { 4954 u32 sid = current_sid(); 4955 4956 /* we aren't taking into account the "sockcreate" SID since the socket 4957 * that is being created here is not a socket in the traditional sense, 4958 * instead it is a private sock, accessible only to the kernel, and 4959 * representing a wide range of network traffic spanning multiple 4960 * connections unlike traditional sockets - check the TUN driver to 4961 * get a better understanding of why this socket is special */ 4962 4963 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE, 4964 NULL); 4965 } 4966 4967 static int selinux_tun_dev_attach_queue(void *security) 4968 { 4969 struct tun_security_struct *tunsec = security; 4970 4971 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET, 4972 TUN_SOCKET__ATTACH_QUEUE, NULL); 4973 } 4974 4975 static int selinux_tun_dev_attach(struct sock *sk, void *security) 4976 { 4977 struct tun_security_struct *tunsec = security; 4978 struct sk_security_struct *sksec = sk->sk_security; 4979 4980 /* we don't currently perform any NetLabel based labeling here and it 4981 * isn't clear that we would want to do so anyway; while we could apply 4982 * labeling without the support of the TUN user the resulting labeled 4983 * traffic from the other end of the connection would almost certainly 4984 * cause confusion to the TUN user that had no idea network labeling 4985 * protocols were being used */ 4986 4987 sksec->sid = tunsec->sid; 4988 sksec->sclass = SECCLASS_TUN_SOCKET; 4989 4990 return 0; 4991 } 4992 4993 static int selinux_tun_dev_open(void *security) 4994 { 4995 struct tun_security_struct *tunsec = security; 4996 u32 sid = current_sid(); 4997 int err; 4998 4999 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET, 5000 TUN_SOCKET__RELABELFROM, NULL); 5001 if (err) 5002 return err; 5003 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, 5004 TUN_SOCKET__RELABELTO, NULL); 5005 if (err) 5006 return err; 5007 tunsec->sid = sid; 5008 5009 return 0; 5010 } 5011 5012 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) 5013 { 5014 int err = 0; 5015 u32 perm; 5016 struct nlmsghdr *nlh; 5017 struct sk_security_struct *sksec = sk->sk_security; 5018 5019 if (skb->len < NLMSG_HDRLEN) { 5020 err = -EINVAL; 5021 goto out; 5022 } 5023 nlh = nlmsg_hdr(skb); 5024 5025 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm); 5026 if (err) { 5027 if (err == -EINVAL) { 5028 pr_warn_ratelimited("SELinux: unrecognized netlink" 5029 " message: protocol=%hu nlmsg_type=%hu sclass=%s" 5030 " pig=%d comm=%s\n", 5031 sk->sk_protocol, nlh->nlmsg_type, 5032 secclass_map[sksec->sclass - 1].name, 5033 task_pid_nr(current), current->comm); 5034 if (!selinux_enforcing || security_get_allow_unknown()) 5035 err = 0; 5036 } 5037 5038 /* Ignore */ 5039 if (err == -ENOENT) 5040 err = 0; 5041 goto out; 5042 } 5043 5044 err = sock_has_perm(sk, perm); 5045 out: 5046 return err; 5047 } 5048 5049 #ifdef CONFIG_NETFILTER 5050 5051 static unsigned int selinux_ip_forward(struct sk_buff *skb, 5052 const struct net_device *indev, 5053 u16 family) 5054 { 5055 int err; 5056 char *addrp; 5057 u32 peer_sid; 5058 struct common_audit_data ad; 5059 struct lsm_network_audit net = {0,}; 5060 u8 secmark_active; 5061 u8 netlbl_active; 5062 u8 peerlbl_active; 5063 5064 if (!selinux_policycap_netpeer) 5065 return NF_ACCEPT; 5066 5067 secmark_active = selinux_secmark_enabled(); 5068 netlbl_active = netlbl_enabled(); 5069 peerlbl_active = selinux_peerlbl_enabled(); 5070 if (!secmark_active && !peerlbl_active) 5071 return NF_ACCEPT; 5072 5073 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0) 5074 return NF_DROP; 5075 5076 ad.type = LSM_AUDIT_DATA_NET; 5077 ad.u.net = &net; 5078 ad.u.net->netif = indev->ifindex; 5079 ad.u.net->family = family; 5080 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0) 5081 return NF_DROP; 5082 5083 if (peerlbl_active) { 5084 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex, 5085 addrp, family, peer_sid, &ad); 5086 if (err) { 5087 selinux_netlbl_err(skb, family, err, 1); 5088 return NF_DROP; 5089 } 5090 } 5091 5092 if (secmark_active) 5093 if (avc_has_perm(peer_sid, skb->secmark, 5094 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) 5095 return NF_DROP; 5096 5097 if (netlbl_active) 5098 /* we do this in the FORWARD path and not the POST_ROUTING 5099 * path because we want to make sure we apply the necessary 5100 * labeling before IPsec is applied so we can leverage AH 5101 * protection */ 5102 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0) 5103 return NF_DROP; 5104 5105 return NF_ACCEPT; 5106 } 5107 5108 static unsigned int selinux_ipv4_forward(void *priv, 5109 struct sk_buff *skb, 5110 const struct nf_hook_state *state) 5111 { 5112 return selinux_ip_forward(skb, state->in, PF_INET); 5113 } 5114 5115 #if IS_ENABLED(CONFIG_IPV6) 5116 static unsigned int selinux_ipv6_forward(void *priv, 5117 struct sk_buff *skb, 5118 const struct nf_hook_state *state) 5119 { 5120 return selinux_ip_forward(skb, state->in, PF_INET6); 5121 } 5122 #endif /* IPV6 */ 5123 5124 static unsigned int selinux_ip_output(struct sk_buff *skb, 5125 u16 family) 5126 { 5127 struct sock *sk; 5128 u32 sid; 5129 5130 if (!netlbl_enabled()) 5131 return NF_ACCEPT; 5132 5133 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path 5134 * because we want to make sure we apply the necessary labeling 5135 * before IPsec is applied so we can leverage AH protection */ 5136 sk = skb->sk; 5137 if (sk) { 5138 struct sk_security_struct *sksec; 5139 5140 if (sk_listener(sk)) 5141 /* if the socket is the listening state then this 5142 * packet is a SYN-ACK packet which means it needs to 5143 * be labeled based on the connection/request_sock and 5144 * not the parent socket. unfortunately, we can't 5145 * lookup the request_sock yet as it isn't queued on 5146 * the parent socket until after the SYN-ACK is sent. 5147 * the "solution" is to simply pass the packet as-is 5148 * as any IP option based labeling should be copied 5149 * from the initial connection request (in the IP 5150 * layer). it is far from ideal, but until we get a 5151 * security label in the packet itself this is the 5152 * best we can do. */ 5153 return NF_ACCEPT; 5154 5155 /* standard practice, label using the parent socket */ 5156 sksec = sk->sk_security; 5157 sid = sksec->sid; 5158 } else 5159 sid = SECINITSID_KERNEL; 5160 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0) 5161 return NF_DROP; 5162 5163 return NF_ACCEPT; 5164 } 5165 5166 static unsigned int selinux_ipv4_output(void *priv, 5167 struct sk_buff *skb, 5168 const struct nf_hook_state *state) 5169 { 5170 return selinux_ip_output(skb, PF_INET); 5171 } 5172 5173 #if IS_ENABLED(CONFIG_IPV6) 5174 static unsigned int selinux_ipv6_output(void *priv, 5175 struct sk_buff *skb, 5176 const struct nf_hook_state *state) 5177 { 5178 return selinux_ip_output(skb, PF_INET6); 5179 } 5180 #endif /* IPV6 */ 5181 5182 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, 5183 int ifindex, 5184 u16 family) 5185 { 5186 struct sock *sk = skb_to_full_sk(skb); 5187 struct sk_security_struct *sksec; 5188 struct common_audit_data ad; 5189 struct lsm_network_audit net = {0,}; 5190 char *addrp; 5191 u8 proto; 5192 5193 if (sk == NULL) 5194 return NF_ACCEPT; 5195 sksec = sk->sk_security; 5196 5197 ad.type = LSM_AUDIT_DATA_NET; 5198 ad.u.net = &net; 5199 ad.u.net->netif = ifindex; 5200 ad.u.net->family = family; 5201 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto)) 5202 return NF_DROP; 5203 5204 if (selinux_secmark_enabled()) 5205 if (avc_has_perm(sksec->sid, skb->secmark, 5206 SECCLASS_PACKET, PACKET__SEND, &ad)) 5207 return NF_DROP_ERR(-ECONNREFUSED); 5208 5209 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) 5210 return NF_DROP_ERR(-ECONNREFUSED); 5211 5212 return NF_ACCEPT; 5213 } 5214 5215 static unsigned int selinux_ip_postroute(struct sk_buff *skb, 5216 const struct net_device *outdev, 5217 u16 family) 5218 { 5219 u32 secmark_perm; 5220 u32 peer_sid; 5221 int ifindex = outdev->ifindex; 5222 struct sock *sk; 5223 struct common_audit_data ad; 5224 struct lsm_network_audit net = {0,}; 5225 char *addrp; 5226 u8 secmark_active; 5227 u8 peerlbl_active; 5228 5229 /* If any sort of compatibility mode is enabled then handoff processing 5230 * to the selinux_ip_postroute_compat() function to deal with the 5231 * special handling. We do this in an attempt to keep this function 5232 * as fast and as clean as possible. */ 5233 if (!selinux_policycap_netpeer) 5234 return selinux_ip_postroute_compat(skb, ifindex, family); 5235 5236 secmark_active = selinux_secmark_enabled(); 5237 peerlbl_active = selinux_peerlbl_enabled(); 5238 if (!secmark_active && !peerlbl_active) 5239 return NF_ACCEPT; 5240 5241 sk = skb_to_full_sk(skb); 5242 5243 #ifdef CONFIG_XFRM 5244 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec 5245 * packet transformation so allow the packet to pass without any checks 5246 * since we'll have another chance to perform access control checks 5247 * when the packet is on it's final way out. 5248 * NOTE: there appear to be some IPv6 multicast cases where skb->dst 5249 * is NULL, in this case go ahead and apply access control. 5250 * NOTE: if this is a local socket (skb->sk != NULL) that is in the 5251 * TCP listening state we cannot wait until the XFRM processing 5252 * is done as we will miss out on the SA label if we do; 5253 * unfortunately, this means more work, but it is only once per 5254 * connection. */ 5255 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL && 5256 !(sk && sk_listener(sk))) 5257 return NF_ACCEPT; 5258 #endif 5259 5260 if (sk == NULL) { 5261 /* Without an associated socket the packet is either coming 5262 * from the kernel or it is being forwarded; check the packet 5263 * to determine which and if the packet is being forwarded 5264 * query the packet directly to determine the security label. */ 5265 if (skb->skb_iif) { 5266 secmark_perm = PACKET__FORWARD_OUT; 5267 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) 5268 return NF_DROP; 5269 } else { 5270 secmark_perm = PACKET__SEND; 5271 peer_sid = SECINITSID_KERNEL; 5272 } 5273 } else if (sk_listener(sk)) { 5274 /* Locally generated packet but the associated socket is in the 5275 * listening state which means this is a SYN-ACK packet. In 5276 * this particular case the correct security label is assigned 5277 * to the connection/request_sock but unfortunately we can't 5278 * query the request_sock as it isn't queued on the parent 5279 * socket until after the SYN-ACK packet is sent; the only 5280 * viable choice is to regenerate the label like we do in 5281 * selinux_inet_conn_request(). See also selinux_ip_output() 5282 * for similar problems. */ 5283 u32 skb_sid; 5284 struct sk_security_struct *sksec; 5285 5286 sksec = sk->sk_security; 5287 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid)) 5288 return NF_DROP; 5289 /* At this point, if the returned skb peerlbl is SECSID_NULL 5290 * and the packet has been through at least one XFRM 5291 * transformation then we must be dealing with the "final" 5292 * form of labeled IPsec packet; since we've already applied 5293 * all of our access controls on this packet we can safely 5294 * pass the packet. */ 5295 if (skb_sid == SECSID_NULL) { 5296 switch (family) { 5297 case PF_INET: 5298 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) 5299 return NF_ACCEPT; 5300 break; 5301 case PF_INET6: 5302 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) 5303 return NF_ACCEPT; 5304 break; 5305 default: 5306 return NF_DROP_ERR(-ECONNREFUSED); 5307 } 5308 } 5309 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid)) 5310 return NF_DROP; 5311 secmark_perm = PACKET__SEND; 5312 } else { 5313 /* Locally generated packet, fetch the security label from the 5314 * associated socket. */ 5315 struct sk_security_struct *sksec = sk->sk_security; 5316 peer_sid = sksec->sid; 5317 secmark_perm = PACKET__SEND; 5318 } 5319 5320 ad.type = LSM_AUDIT_DATA_NET; 5321 ad.u.net = &net; 5322 ad.u.net->netif = ifindex; 5323 ad.u.net->family = family; 5324 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) 5325 return NF_DROP; 5326 5327 if (secmark_active) 5328 if (avc_has_perm(peer_sid, skb->secmark, 5329 SECCLASS_PACKET, secmark_perm, &ad)) 5330 return NF_DROP_ERR(-ECONNREFUSED); 5331 5332 if (peerlbl_active) { 5333 u32 if_sid; 5334 u32 node_sid; 5335 5336 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid)) 5337 return NF_DROP; 5338 if (avc_has_perm(peer_sid, if_sid, 5339 SECCLASS_NETIF, NETIF__EGRESS, &ad)) 5340 return NF_DROP_ERR(-ECONNREFUSED); 5341 5342 if (sel_netnode_sid(addrp, family, &node_sid)) 5343 return NF_DROP; 5344 if (avc_has_perm(peer_sid, node_sid, 5345 SECCLASS_NODE, NODE__SENDTO, &ad)) 5346 return NF_DROP_ERR(-ECONNREFUSED); 5347 } 5348 5349 return NF_ACCEPT; 5350 } 5351 5352 static unsigned int selinux_ipv4_postroute(void *priv, 5353 struct sk_buff *skb, 5354 const struct nf_hook_state *state) 5355 { 5356 return selinux_ip_postroute(skb, state->out, PF_INET); 5357 } 5358 5359 #if IS_ENABLED(CONFIG_IPV6) 5360 static unsigned int selinux_ipv6_postroute(void *priv, 5361 struct sk_buff *skb, 5362 const struct nf_hook_state *state) 5363 { 5364 return selinux_ip_postroute(skb, state->out, PF_INET6); 5365 } 5366 #endif /* IPV6 */ 5367 5368 #endif /* CONFIG_NETFILTER */ 5369 5370 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb) 5371 { 5372 return selinux_nlmsg_perm(sk, skb); 5373 } 5374 5375 static int ipc_alloc_security(struct kern_ipc_perm *perm, 5376 u16 sclass) 5377 { 5378 struct ipc_security_struct *isec; 5379 5380 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL); 5381 if (!isec) 5382 return -ENOMEM; 5383 5384 isec->sclass = sclass; 5385 isec->sid = current_sid(); 5386 perm->security = isec; 5387 5388 return 0; 5389 } 5390 5391 static void ipc_free_security(struct kern_ipc_perm *perm) 5392 { 5393 struct ipc_security_struct *isec = perm->security; 5394 perm->security = NULL; 5395 kfree(isec); 5396 } 5397 5398 static int msg_msg_alloc_security(struct msg_msg *msg) 5399 { 5400 struct msg_security_struct *msec; 5401 5402 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL); 5403 if (!msec) 5404 return -ENOMEM; 5405 5406 msec->sid = SECINITSID_UNLABELED; 5407 msg->security = msec; 5408 5409 return 0; 5410 } 5411 5412 static void msg_msg_free_security(struct msg_msg *msg) 5413 { 5414 struct msg_security_struct *msec = msg->security; 5415 5416 msg->security = NULL; 5417 kfree(msec); 5418 } 5419 5420 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms, 5421 u32 perms) 5422 { 5423 struct ipc_security_struct *isec; 5424 struct common_audit_data ad; 5425 u32 sid = current_sid(); 5426 5427 isec = ipc_perms->security; 5428 5429 ad.type = LSM_AUDIT_DATA_IPC; 5430 ad.u.ipc_id = ipc_perms->key; 5431 5432 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad); 5433 } 5434 5435 static int selinux_msg_msg_alloc_security(struct msg_msg *msg) 5436 { 5437 return msg_msg_alloc_security(msg); 5438 } 5439 5440 static void selinux_msg_msg_free_security(struct msg_msg *msg) 5441 { 5442 msg_msg_free_security(msg); 5443 } 5444 5445 /* message queue security operations */ 5446 static int selinux_msg_queue_alloc_security(struct msg_queue *msq) 5447 { 5448 struct ipc_security_struct *isec; 5449 struct common_audit_data ad; 5450 u32 sid = current_sid(); 5451 int rc; 5452 5453 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ); 5454 if (rc) 5455 return rc; 5456 5457 isec = msq->q_perm.security; 5458 5459 ad.type = LSM_AUDIT_DATA_IPC; 5460 ad.u.ipc_id = msq->q_perm.key; 5461 5462 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, 5463 MSGQ__CREATE, &ad); 5464 if (rc) { 5465 ipc_free_security(&msq->q_perm); 5466 return rc; 5467 } 5468 return 0; 5469 } 5470 5471 static void selinux_msg_queue_free_security(struct msg_queue *msq) 5472 { 5473 ipc_free_security(&msq->q_perm); 5474 } 5475 5476 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg) 5477 { 5478 struct ipc_security_struct *isec; 5479 struct common_audit_data ad; 5480 u32 sid = current_sid(); 5481 5482 isec = msq->q_perm.security; 5483 5484 ad.type = LSM_AUDIT_DATA_IPC; 5485 ad.u.ipc_id = msq->q_perm.key; 5486 5487 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, 5488 MSGQ__ASSOCIATE, &ad); 5489 } 5490 5491 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd) 5492 { 5493 int err; 5494 int perms; 5495 5496 switch (cmd) { 5497 case IPC_INFO: 5498 case MSG_INFO: 5499 /* No specific object, just general system-wide information. */ 5500 return avc_has_perm(current_sid(), SECINITSID_KERNEL, 5501 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); 5502 case IPC_STAT: 5503 case MSG_STAT: 5504 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE; 5505 break; 5506 case IPC_SET: 5507 perms = MSGQ__SETATTR; 5508 break; 5509 case IPC_RMID: 5510 perms = MSGQ__DESTROY; 5511 break; 5512 default: 5513 return 0; 5514 } 5515 5516 err = ipc_has_perm(&msq->q_perm, perms); 5517 return err; 5518 } 5519 5520 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg) 5521 { 5522 struct ipc_security_struct *isec; 5523 struct msg_security_struct *msec; 5524 struct common_audit_data ad; 5525 u32 sid = current_sid(); 5526 int rc; 5527 5528 isec = msq->q_perm.security; 5529 msec = msg->security; 5530 5531 /* 5532 * First time through, need to assign label to the message 5533 */ 5534 if (msec->sid == SECINITSID_UNLABELED) { 5535 /* 5536 * Compute new sid based on current process and 5537 * message queue this message will be stored in 5538 */ 5539 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG, 5540 NULL, &msec->sid); 5541 if (rc) 5542 return rc; 5543 } 5544 5545 ad.type = LSM_AUDIT_DATA_IPC; 5546 ad.u.ipc_id = msq->q_perm.key; 5547 5548 /* Can this process write to the queue? */ 5549 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, 5550 MSGQ__WRITE, &ad); 5551 if (!rc) 5552 /* Can this process send the message */ 5553 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG, 5554 MSG__SEND, &ad); 5555 if (!rc) 5556 /* Can the message be put in the queue? */ 5557 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ, 5558 MSGQ__ENQUEUE, &ad); 5559 5560 return rc; 5561 } 5562 5563 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, 5564 struct task_struct *target, 5565 long type, int mode) 5566 { 5567 struct ipc_security_struct *isec; 5568 struct msg_security_struct *msec; 5569 struct common_audit_data ad; 5570 u32 sid = task_sid(target); 5571 int rc; 5572 5573 isec = msq->q_perm.security; 5574 msec = msg->security; 5575 5576 ad.type = LSM_AUDIT_DATA_IPC; 5577 ad.u.ipc_id = msq->q_perm.key; 5578 5579 rc = avc_has_perm(sid, isec->sid, 5580 SECCLASS_MSGQ, MSGQ__READ, &ad); 5581 if (!rc) 5582 rc = avc_has_perm(sid, msec->sid, 5583 SECCLASS_MSG, MSG__RECEIVE, &ad); 5584 return rc; 5585 } 5586 5587 /* Shared Memory security operations */ 5588 static int selinux_shm_alloc_security(struct shmid_kernel *shp) 5589 { 5590 struct ipc_security_struct *isec; 5591 struct common_audit_data ad; 5592 u32 sid = current_sid(); 5593 int rc; 5594 5595 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM); 5596 if (rc) 5597 return rc; 5598 5599 isec = shp->shm_perm.security; 5600 5601 ad.type = LSM_AUDIT_DATA_IPC; 5602 ad.u.ipc_id = shp->shm_perm.key; 5603 5604 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM, 5605 SHM__CREATE, &ad); 5606 if (rc) { 5607 ipc_free_security(&shp->shm_perm); 5608 return rc; 5609 } 5610 return 0; 5611 } 5612 5613 static void selinux_shm_free_security(struct shmid_kernel *shp) 5614 { 5615 ipc_free_security(&shp->shm_perm); 5616 } 5617 5618 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg) 5619 { 5620 struct ipc_security_struct *isec; 5621 struct common_audit_data ad; 5622 u32 sid = current_sid(); 5623 5624 isec = shp->shm_perm.security; 5625 5626 ad.type = LSM_AUDIT_DATA_IPC; 5627 ad.u.ipc_id = shp->shm_perm.key; 5628 5629 return avc_has_perm(sid, isec->sid, SECCLASS_SHM, 5630 SHM__ASSOCIATE, &ad); 5631 } 5632 5633 /* Note, at this point, shp is locked down */ 5634 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd) 5635 { 5636 int perms; 5637 int err; 5638 5639 switch (cmd) { 5640 case IPC_INFO: 5641 case SHM_INFO: 5642 /* No specific object, just general system-wide information. */ 5643 return avc_has_perm(current_sid(), SECINITSID_KERNEL, 5644 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); 5645 case IPC_STAT: 5646 case SHM_STAT: 5647 perms = SHM__GETATTR | SHM__ASSOCIATE; 5648 break; 5649 case IPC_SET: 5650 perms = SHM__SETATTR; 5651 break; 5652 case SHM_LOCK: 5653 case SHM_UNLOCK: 5654 perms = SHM__LOCK; 5655 break; 5656 case IPC_RMID: 5657 perms = SHM__DESTROY; 5658 break; 5659 default: 5660 return 0; 5661 } 5662 5663 err = ipc_has_perm(&shp->shm_perm, perms); 5664 return err; 5665 } 5666 5667 static int selinux_shm_shmat(struct shmid_kernel *shp, 5668 char __user *shmaddr, int shmflg) 5669 { 5670 u32 perms; 5671 5672 if (shmflg & SHM_RDONLY) 5673 perms = SHM__READ; 5674 else 5675 perms = SHM__READ | SHM__WRITE; 5676 5677 return ipc_has_perm(&shp->shm_perm, perms); 5678 } 5679 5680 /* Semaphore security operations */ 5681 static int selinux_sem_alloc_security(struct sem_array *sma) 5682 { 5683 struct ipc_security_struct *isec; 5684 struct common_audit_data ad; 5685 u32 sid = current_sid(); 5686 int rc; 5687 5688 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM); 5689 if (rc) 5690 return rc; 5691 5692 isec = sma->sem_perm.security; 5693 5694 ad.type = LSM_AUDIT_DATA_IPC; 5695 ad.u.ipc_id = sma->sem_perm.key; 5696 5697 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM, 5698 SEM__CREATE, &ad); 5699 if (rc) { 5700 ipc_free_security(&sma->sem_perm); 5701 return rc; 5702 } 5703 return 0; 5704 } 5705 5706 static void selinux_sem_free_security(struct sem_array *sma) 5707 { 5708 ipc_free_security(&sma->sem_perm); 5709 } 5710 5711 static int selinux_sem_associate(struct sem_array *sma, int semflg) 5712 { 5713 struct ipc_security_struct *isec; 5714 struct common_audit_data ad; 5715 u32 sid = current_sid(); 5716 5717 isec = sma->sem_perm.security; 5718 5719 ad.type = LSM_AUDIT_DATA_IPC; 5720 ad.u.ipc_id = sma->sem_perm.key; 5721 5722 return avc_has_perm(sid, isec->sid, SECCLASS_SEM, 5723 SEM__ASSOCIATE, &ad); 5724 } 5725 5726 /* Note, at this point, sma is locked down */ 5727 static int selinux_sem_semctl(struct sem_array *sma, int cmd) 5728 { 5729 int err; 5730 u32 perms; 5731 5732 switch (cmd) { 5733 case IPC_INFO: 5734 case SEM_INFO: 5735 /* No specific object, just general system-wide information. */ 5736 return avc_has_perm(current_sid(), SECINITSID_KERNEL, 5737 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); 5738 case GETPID: 5739 case GETNCNT: 5740 case GETZCNT: 5741 perms = SEM__GETATTR; 5742 break; 5743 case GETVAL: 5744 case GETALL: 5745 perms = SEM__READ; 5746 break; 5747 case SETVAL: 5748 case SETALL: 5749 perms = SEM__WRITE; 5750 break; 5751 case IPC_RMID: 5752 perms = SEM__DESTROY; 5753 break; 5754 case IPC_SET: 5755 perms = SEM__SETATTR; 5756 break; 5757 case IPC_STAT: 5758 case SEM_STAT: 5759 perms = SEM__GETATTR | SEM__ASSOCIATE; 5760 break; 5761 default: 5762 return 0; 5763 } 5764 5765 err = ipc_has_perm(&sma->sem_perm, perms); 5766 return err; 5767 } 5768 5769 static int selinux_sem_semop(struct sem_array *sma, 5770 struct sembuf *sops, unsigned nsops, int alter) 5771 { 5772 u32 perms; 5773 5774 if (alter) 5775 perms = SEM__READ | SEM__WRITE; 5776 else 5777 perms = SEM__READ; 5778 5779 return ipc_has_perm(&sma->sem_perm, perms); 5780 } 5781 5782 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag) 5783 { 5784 u32 av = 0; 5785 5786 av = 0; 5787 if (flag & S_IRUGO) 5788 av |= IPC__UNIX_READ; 5789 if (flag & S_IWUGO) 5790 av |= IPC__UNIX_WRITE; 5791 5792 if (av == 0) 5793 return 0; 5794 5795 return ipc_has_perm(ipcp, av); 5796 } 5797 5798 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) 5799 { 5800 struct ipc_security_struct *isec = ipcp->security; 5801 *secid = isec->sid; 5802 } 5803 5804 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode) 5805 { 5806 if (inode) 5807 inode_doinit_with_dentry(inode, dentry); 5808 } 5809 5810 static int selinux_getprocattr(struct task_struct *p, 5811 char *name, char **value) 5812 { 5813 const struct task_security_struct *__tsec; 5814 u32 sid; 5815 int error; 5816 unsigned len; 5817 5818 rcu_read_lock(); 5819 __tsec = __task_cred(p)->security; 5820 5821 if (current != p) { 5822 error = avc_has_perm(current_sid(), __tsec->sid, 5823 SECCLASS_PROCESS, PROCESS__GETATTR, NULL); 5824 if (error) 5825 goto bad; 5826 } 5827 5828 if (!strcmp(name, "current")) 5829 sid = __tsec->sid; 5830 else if (!strcmp(name, "prev")) 5831 sid = __tsec->osid; 5832 else if (!strcmp(name, "exec")) 5833 sid = __tsec->exec_sid; 5834 else if (!strcmp(name, "fscreate")) 5835 sid = __tsec->create_sid; 5836 else if (!strcmp(name, "keycreate")) 5837 sid = __tsec->keycreate_sid; 5838 else if (!strcmp(name, "sockcreate")) 5839 sid = __tsec->sockcreate_sid; 5840 else { 5841 error = -EINVAL; 5842 goto bad; 5843 } 5844 rcu_read_unlock(); 5845 5846 if (!sid) 5847 return 0; 5848 5849 error = security_sid_to_context(sid, value, &len); 5850 if (error) 5851 return error; 5852 return len; 5853 5854 bad: 5855 rcu_read_unlock(); 5856 return error; 5857 } 5858 5859 static int selinux_setprocattr(const char *name, void *value, size_t size) 5860 { 5861 struct task_security_struct *tsec; 5862 struct cred *new; 5863 u32 mysid = current_sid(), sid = 0, ptsid; 5864 int error; 5865 char *str = value; 5866 5867 /* 5868 * Basic control over ability to set these attributes at all. 5869 */ 5870 if (!strcmp(name, "exec")) 5871 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS, 5872 PROCESS__SETEXEC, NULL); 5873 else if (!strcmp(name, "fscreate")) 5874 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS, 5875 PROCESS__SETFSCREATE, NULL); 5876 else if (!strcmp(name, "keycreate")) 5877 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS, 5878 PROCESS__SETKEYCREATE, NULL); 5879 else if (!strcmp(name, "sockcreate")) 5880 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS, 5881 PROCESS__SETSOCKCREATE, NULL); 5882 else if (!strcmp(name, "current")) 5883 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS, 5884 PROCESS__SETCURRENT, NULL); 5885 else 5886 error = -EINVAL; 5887 if (error) 5888 return error; 5889 5890 /* Obtain a SID for the context, if one was specified. */ 5891 if (size && str[0] && str[0] != '\n') { 5892 if (str[size-1] == '\n') { 5893 str[size-1] = 0; 5894 size--; 5895 } 5896 error = security_context_to_sid(value, size, &sid, GFP_KERNEL); 5897 if (error == -EINVAL && !strcmp(name, "fscreate")) { 5898 if (!capable(CAP_MAC_ADMIN)) { 5899 struct audit_buffer *ab; 5900 size_t audit_size; 5901 5902 /* We strip a nul only if it is at the end, otherwise the 5903 * context contains a nul and we should audit that */ 5904 if (str[size - 1] == '\0') 5905 audit_size = size - 1; 5906 else 5907 audit_size = size; 5908 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR); 5909 audit_log_format(ab, "op=fscreate invalid_context="); 5910 audit_log_n_untrustedstring(ab, value, audit_size); 5911 audit_log_end(ab); 5912 5913 return error; 5914 } 5915 error = security_context_to_sid_force(value, size, 5916 &sid); 5917 } 5918 if (error) 5919 return error; 5920 } 5921 5922 new = prepare_creds(); 5923 if (!new) 5924 return -ENOMEM; 5925 5926 /* Permission checking based on the specified context is 5927 performed during the actual operation (execve, 5928 open/mkdir/...), when we know the full context of the 5929 operation. See selinux_bprm_set_creds for the execve 5930 checks and may_create for the file creation checks. The 5931 operation will then fail if the context is not permitted. */ 5932 tsec = new->security; 5933 if (!strcmp(name, "exec")) { 5934 tsec->exec_sid = sid; 5935 } else if (!strcmp(name, "fscreate")) { 5936 tsec->create_sid = sid; 5937 } else if (!strcmp(name, "keycreate")) { 5938 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE, 5939 NULL); 5940 if (error) 5941 goto abort_change; 5942 tsec->keycreate_sid = sid; 5943 } else if (!strcmp(name, "sockcreate")) { 5944 tsec->sockcreate_sid = sid; 5945 } else if (!strcmp(name, "current")) { 5946 error = -EINVAL; 5947 if (sid == 0) 5948 goto abort_change; 5949 5950 /* Only allow single threaded processes to change context */ 5951 error = -EPERM; 5952 if (!current_is_single_threaded()) { 5953 error = security_bounded_transition(tsec->sid, sid); 5954 if (error) 5955 goto abort_change; 5956 } 5957 5958 /* Check permissions for the transition. */ 5959 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS, 5960 PROCESS__DYNTRANSITION, NULL); 5961 if (error) 5962 goto abort_change; 5963 5964 /* Check for ptracing, and update the task SID if ok. 5965 Otherwise, leave SID unchanged and fail. */ 5966 ptsid = ptrace_parent_sid(); 5967 if (ptsid != 0) { 5968 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS, 5969 PROCESS__PTRACE, NULL); 5970 if (error) 5971 goto abort_change; 5972 } 5973 5974 tsec->sid = sid; 5975 } else { 5976 error = -EINVAL; 5977 goto abort_change; 5978 } 5979 5980 commit_creds(new); 5981 return size; 5982 5983 abort_change: 5984 abort_creds(new); 5985 return error; 5986 } 5987 5988 static int selinux_ismaclabel(const char *name) 5989 { 5990 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); 5991 } 5992 5993 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 5994 { 5995 return security_sid_to_context(secid, secdata, seclen); 5996 } 5997 5998 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 5999 { 6000 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL); 6001 } 6002 6003 static void selinux_release_secctx(char *secdata, u32 seclen) 6004 { 6005 kfree(secdata); 6006 } 6007 6008 static void selinux_inode_invalidate_secctx(struct inode *inode) 6009 { 6010 struct inode_security_struct *isec = inode->i_security; 6011 6012 spin_lock(&isec->lock); 6013 isec->initialized = LABEL_INVALID; 6014 spin_unlock(&isec->lock); 6015 } 6016 6017 /* 6018 * called with inode->i_mutex locked 6019 */ 6020 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 6021 { 6022 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0); 6023 } 6024 6025 /* 6026 * called with inode->i_mutex locked 6027 */ 6028 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 6029 { 6030 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0); 6031 } 6032 6033 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 6034 { 6035 int len = 0; 6036 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX, 6037 ctx, true); 6038 if (len < 0) 6039 return len; 6040 *ctxlen = len; 6041 return 0; 6042 } 6043 #ifdef CONFIG_KEYS 6044 6045 static int selinux_key_alloc(struct key *k, const struct cred *cred, 6046 unsigned long flags) 6047 { 6048 const struct task_security_struct *tsec; 6049 struct key_security_struct *ksec; 6050 6051 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL); 6052 if (!ksec) 6053 return -ENOMEM; 6054 6055 tsec = cred->security; 6056 if (tsec->keycreate_sid) 6057 ksec->sid = tsec->keycreate_sid; 6058 else 6059 ksec->sid = tsec->sid; 6060 6061 k->security = ksec; 6062 return 0; 6063 } 6064 6065 static void selinux_key_free(struct key *k) 6066 { 6067 struct key_security_struct *ksec = k->security; 6068 6069 k->security = NULL; 6070 kfree(ksec); 6071 } 6072 6073 static int selinux_key_permission(key_ref_t key_ref, 6074 const struct cred *cred, 6075 unsigned perm) 6076 { 6077 struct key *key; 6078 struct key_security_struct *ksec; 6079 u32 sid; 6080 6081 /* if no specific permissions are requested, we skip the 6082 permission check. No serious, additional covert channels 6083 appear to be created. */ 6084 if (perm == 0) 6085 return 0; 6086 6087 sid = cred_sid(cred); 6088 6089 key = key_ref_to_ptr(key_ref); 6090 ksec = key->security; 6091 6092 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL); 6093 } 6094 6095 static int selinux_key_getsecurity(struct key *key, char **_buffer) 6096 { 6097 struct key_security_struct *ksec = key->security; 6098 char *context = NULL; 6099 unsigned len; 6100 int rc; 6101 6102 rc = security_sid_to_context(ksec->sid, &context, &len); 6103 if (!rc) 6104 rc = len; 6105 *_buffer = context; 6106 return rc; 6107 } 6108 6109 #endif 6110 6111 static struct security_hook_list selinux_hooks[] = { 6112 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr), 6113 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction), 6114 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder), 6115 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file), 6116 6117 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check), 6118 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme), 6119 LSM_HOOK_INIT(capget, selinux_capget), 6120 LSM_HOOK_INIT(capset, selinux_capset), 6121 LSM_HOOK_INIT(capable, selinux_capable), 6122 LSM_HOOK_INIT(quotactl, selinux_quotactl), 6123 LSM_HOOK_INIT(quota_on, selinux_quota_on), 6124 LSM_HOOK_INIT(syslog, selinux_syslog), 6125 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory), 6126 6127 LSM_HOOK_INIT(netlink_send, selinux_netlink_send), 6128 6129 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds), 6130 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds), 6131 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds), 6132 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec), 6133 6134 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security), 6135 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security), 6136 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data), 6137 LSM_HOOK_INIT(sb_remount, selinux_sb_remount), 6138 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount), 6139 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options), 6140 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs), 6141 LSM_HOOK_INIT(sb_mount, selinux_mount), 6142 LSM_HOOK_INIT(sb_umount, selinux_umount), 6143 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts), 6144 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts), 6145 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str), 6146 6147 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security), 6148 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as), 6149 6150 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security), 6151 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security), 6152 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security), 6153 LSM_HOOK_INIT(inode_create, selinux_inode_create), 6154 LSM_HOOK_INIT(inode_link, selinux_inode_link), 6155 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink), 6156 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink), 6157 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir), 6158 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir), 6159 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod), 6160 LSM_HOOK_INIT(inode_rename, selinux_inode_rename), 6161 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink), 6162 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link), 6163 LSM_HOOK_INIT(inode_permission, selinux_inode_permission), 6164 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr), 6165 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr), 6166 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr), 6167 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr), 6168 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr), 6169 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr), 6170 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr), 6171 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity), 6172 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity), 6173 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity), 6174 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid), 6175 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up), 6176 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr), 6177 6178 LSM_HOOK_INIT(file_permission, selinux_file_permission), 6179 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), 6180 LSM_HOOK_INIT(file_free_security, selinux_file_free_security), 6181 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), 6182 LSM_HOOK_INIT(mmap_file, selinux_mmap_file), 6183 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr), 6184 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect), 6185 LSM_HOOK_INIT(file_lock, selinux_file_lock), 6186 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl), 6187 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner), 6188 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask), 6189 LSM_HOOK_INIT(file_receive, selinux_file_receive), 6190 6191 LSM_HOOK_INIT(file_open, selinux_file_open), 6192 6193 LSM_HOOK_INIT(task_create, selinux_task_create), 6194 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank), 6195 LSM_HOOK_INIT(cred_free, selinux_cred_free), 6196 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare), 6197 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer), 6198 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as), 6199 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as), 6200 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request), 6201 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file), 6202 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid), 6203 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid), 6204 LSM_HOOK_INIT(task_getsid, selinux_task_getsid), 6205 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid), 6206 LSM_HOOK_INIT(task_setnice, selinux_task_setnice), 6207 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio), 6208 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio), 6209 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit), 6210 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler), 6211 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler), 6212 LSM_HOOK_INIT(task_movememory, selinux_task_movememory), 6213 LSM_HOOK_INIT(task_kill, selinux_task_kill), 6214 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode), 6215 6216 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission), 6217 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid), 6218 6219 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security), 6220 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security), 6221 6222 LSM_HOOK_INIT(msg_queue_alloc_security, 6223 selinux_msg_queue_alloc_security), 6224 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security), 6225 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate), 6226 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl), 6227 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd), 6228 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv), 6229 6230 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security), 6231 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security), 6232 LSM_HOOK_INIT(shm_associate, selinux_shm_associate), 6233 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl), 6234 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat), 6235 6236 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), 6237 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security), 6238 LSM_HOOK_INIT(sem_associate, selinux_sem_associate), 6239 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl), 6240 LSM_HOOK_INIT(sem_semop, selinux_sem_semop), 6241 6242 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate), 6243 6244 LSM_HOOK_INIT(getprocattr, selinux_getprocattr), 6245 LSM_HOOK_INIT(setprocattr, selinux_setprocattr), 6246 6247 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel), 6248 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), 6249 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid), 6250 LSM_HOOK_INIT(release_secctx, selinux_release_secctx), 6251 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx), 6252 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx), 6253 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx), 6254 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx), 6255 6256 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect), 6257 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send), 6258 6259 LSM_HOOK_INIT(socket_create, selinux_socket_create), 6260 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create), 6261 LSM_HOOK_INIT(socket_bind, selinux_socket_bind), 6262 LSM_HOOK_INIT(socket_connect, selinux_socket_connect), 6263 LSM_HOOK_INIT(socket_listen, selinux_socket_listen), 6264 LSM_HOOK_INIT(socket_accept, selinux_socket_accept), 6265 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg), 6266 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg), 6267 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname), 6268 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername), 6269 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt), 6270 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt), 6271 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown), 6272 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb), 6273 LSM_HOOK_INIT(socket_getpeersec_stream, 6274 selinux_socket_getpeersec_stream), 6275 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram), 6276 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security), 6277 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security), 6278 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security), 6279 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid), 6280 LSM_HOOK_INIT(sock_graft, selinux_sock_graft), 6281 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request), 6282 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone), 6283 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established), 6284 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet), 6285 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc), 6286 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec), 6287 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow), 6288 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security), 6289 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security), 6290 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create), 6291 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue), 6292 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach), 6293 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open), 6294 6295 #ifdef CONFIG_SECURITY_NETWORK_XFRM 6296 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc), 6297 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone), 6298 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free), 6299 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete), 6300 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc), 6301 LSM_HOOK_INIT(xfrm_state_alloc_acquire, 6302 selinux_xfrm_state_alloc_acquire), 6303 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free), 6304 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete), 6305 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup), 6306 LSM_HOOK_INIT(xfrm_state_pol_flow_match, 6307 selinux_xfrm_state_pol_flow_match), 6308 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session), 6309 #endif 6310 6311 #ifdef CONFIG_KEYS 6312 LSM_HOOK_INIT(key_alloc, selinux_key_alloc), 6313 LSM_HOOK_INIT(key_free, selinux_key_free), 6314 LSM_HOOK_INIT(key_permission, selinux_key_permission), 6315 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity), 6316 #endif 6317 6318 #ifdef CONFIG_AUDIT 6319 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init), 6320 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known), 6321 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match), 6322 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free), 6323 #endif 6324 }; 6325 6326 static __init int selinux_init(void) 6327 { 6328 if (!security_module_enable("selinux")) { 6329 selinux_enabled = 0; 6330 return 0; 6331 } 6332 6333 if (!selinux_enabled) { 6334 printk(KERN_INFO "SELinux: Disabled at boot.\n"); 6335 return 0; 6336 } 6337 6338 printk(KERN_INFO "SELinux: Initializing.\n"); 6339 6340 /* Set the security state for the initial task. */ 6341 cred_init_security(); 6342 6343 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC); 6344 6345 sel_inode_cache = kmem_cache_create("selinux_inode_security", 6346 sizeof(struct inode_security_struct), 6347 0, SLAB_PANIC, NULL); 6348 file_security_cache = kmem_cache_create("selinux_file_security", 6349 sizeof(struct file_security_struct), 6350 0, SLAB_PANIC, NULL); 6351 avc_init(); 6352 6353 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux"); 6354 6355 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) 6356 panic("SELinux: Unable to register AVC netcache callback\n"); 6357 6358 if (selinux_enforcing) 6359 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n"); 6360 else 6361 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n"); 6362 6363 return 0; 6364 } 6365 6366 static void delayed_superblock_init(struct super_block *sb, void *unused) 6367 { 6368 superblock_doinit(sb, NULL); 6369 } 6370 6371 void selinux_complete_init(void) 6372 { 6373 printk(KERN_DEBUG "SELinux: Completing initialization.\n"); 6374 6375 /* Set up any superblocks initialized prior to the policy load. */ 6376 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n"); 6377 iterate_supers(delayed_superblock_init, NULL); 6378 } 6379 6380 /* SELinux requires early initialization in order to label 6381 all processes and objects when they are created. */ 6382 security_initcall(selinux_init); 6383 6384 #if defined(CONFIG_NETFILTER) 6385 6386 static struct nf_hook_ops selinux_nf_ops[] = { 6387 { 6388 .hook = selinux_ipv4_postroute, 6389 .pf = NFPROTO_IPV4, 6390 .hooknum = NF_INET_POST_ROUTING, 6391 .priority = NF_IP_PRI_SELINUX_LAST, 6392 }, 6393 { 6394 .hook = selinux_ipv4_forward, 6395 .pf = NFPROTO_IPV4, 6396 .hooknum = NF_INET_FORWARD, 6397 .priority = NF_IP_PRI_SELINUX_FIRST, 6398 }, 6399 { 6400 .hook = selinux_ipv4_output, 6401 .pf = NFPROTO_IPV4, 6402 .hooknum = NF_INET_LOCAL_OUT, 6403 .priority = NF_IP_PRI_SELINUX_FIRST, 6404 }, 6405 #if IS_ENABLED(CONFIG_IPV6) 6406 { 6407 .hook = selinux_ipv6_postroute, 6408 .pf = NFPROTO_IPV6, 6409 .hooknum = NF_INET_POST_ROUTING, 6410 .priority = NF_IP6_PRI_SELINUX_LAST, 6411 }, 6412 { 6413 .hook = selinux_ipv6_forward, 6414 .pf = NFPROTO_IPV6, 6415 .hooknum = NF_INET_FORWARD, 6416 .priority = NF_IP6_PRI_SELINUX_FIRST, 6417 }, 6418 { 6419 .hook = selinux_ipv6_output, 6420 .pf = NFPROTO_IPV6, 6421 .hooknum = NF_INET_LOCAL_OUT, 6422 .priority = NF_IP6_PRI_SELINUX_FIRST, 6423 }, 6424 #endif /* IPV6 */ 6425 }; 6426 6427 static int __init selinux_nf_ip_init(void) 6428 { 6429 int err; 6430 6431 if (!selinux_enabled) 6432 return 0; 6433 6434 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); 6435 6436 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); 6437 if (err) 6438 panic("SELinux: nf_register_hooks: error %d\n", err); 6439 6440 return 0; 6441 } 6442 6443 __initcall(selinux_nf_ip_init); 6444 6445 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 6446 static void selinux_nf_ip_exit(void) 6447 { 6448 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); 6449 6450 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); 6451 } 6452 #endif 6453 6454 #else /* CONFIG_NETFILTER */ 6455 6456 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 6457 #define selinux_nf_ip_exit() 6458 #endif 6459 6460 #endif /* CONFIG_NETFILTER */ 6461 6462 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 6463 static int selinux_disabled; 6464 6465 int selinux_disable(void) 6466 { 6467 if (ss_initialized) { 6468 /* Not permitted after initial policy load. */ 6469 return -EINVAL; 6470 } 6471 6472 if (selinux_disabled) { 6473 /* Only do this once. */ 6474 return -EINVAL; 6475 } 6476 6477 printk(KERN_INFO "SELinux: Disabled at runtime.\n"); 6478 6479 selinux_disabled = 1; 6480 selinux_enabled = 0; 6481 6482 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks)); 6483 6484 /* Try to destroy the avc node cache */ 6485 avc_disable(); 6486 6487 /* Unregister netfilter hooks. */ 6488 selinux_nf_ip_exit(); 6489 6490 /* Unregister selinuxfs. */ 6491 exit_sel_fs(); 6492 6493 return 0; 6494 } 6495 #endif 6496