1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
16 * Paul Moore <paul.moore@hp.com>
17 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
18 * Yuichi Nakamura <ynakam@hitachisoft.jp>
19 *
20 * This program is free software; you can redistribute it and/or modify
21 * it under the terms of the GNU General Public License version 2,
22 * as published by the Free Software Foundation.
23 */
24
25 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/ptrace.h>
28 #include <linux/errno.h>
29 #include <linux/sched.h>
30 #include <linux/security.h>
31 #include <linux/xattr.h>
32 #include <linux/capability.h>
33 #include <linux/unistd.h>
34 #include <linux/mm.h>
35 #include <linux/mman.h>
36 #include <linux/slab.h>
37 #include <linux/pagemap.h>
38 #include <linux/swap.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <asm/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78
79 #include "avc.h"
80 #include "objsec.h"
81 #include "netif.h"
82 #include "netnode.h"
83 #include "xfrm.h"
84 #include "netlabel.h"
85
86 #define XATTR_SELINUX_SUFFIX "selinux"
87 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
88
89 #define NUM_SEL_MNT_OPTS 4
90
91 extern unsigned int policydb_loaded_version;
92 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
93 extern int selinux_compat_net;
94 extern struct security_operations *security_ops;
95
96 /* SECMARK reference count */
97 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
98
99 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
100 int selinux_enforcing = 0;
101
102 static int __init enforcing_setup(char *str)
103 {
104 selinux_enforcing = simple_strtol(str,NULL,0);
105 return 1;
106 }
107 __setup("enforcing=", enforcing_setup);
108 #endif
109
110 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
111 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
112
113 static int __init selinux_enabled_setup(char *str)
114 {
115 selinux_enabled = simple_strtol(str, NULL, 0);
116 return 1;
117 }
118 __setup("selinux=", selinux_enabled_setup);
119 #else
120 int selinux_enabled = 1;
121 #endif
122
123 /* Original (dummy) security module. */
124 static struct security_operations *original_ops = NULL;
125
126 /* Minimal support for a secondary security module,
127 just to allow the use of the dummy or capability modules.
128 The owlsm module can alternatively be used as a secondary
129 module as long as CONFIG_OWLSM_FD is not enabled. */
130 static struct security_operations *secondary_ops = NULL;
131
132 /* Lists of inode and superblock security structures initialized
133 before the policy was loaded. */
134 static LIST_HEAD(superblock_security_head);
135 static DEFINE_SPINLOCK(sb_security_lock);
136
137 static struct kmem_cache *sel_inode_cache;
138
139 /**
140 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
141 *
142 * Description:
143 * This function checks the SECMARK reference counter to see if any SECMARK
144 * targets are currently configured, if the reference counter is greater than
145 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
146 * enabled, false (0) if SECMARK is disabled.
147 *
148 */
149 static int selinux_secmark_enabled(void)
150 {
151 return (atomic_read(&selinux_secmark_refcount) > 0);
152 }
153
154 /* Allocate and free functions for each kind of security blob. */
155
156 static int task_alloc_security(struct task_struct *task)
157 {
158 struct task_security_struct *tsec;
159
160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
161 if (!tsec)
162 return -ENOMEM;
163
164 tsec->task = task;
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
167
168 return 0;
169 }
170
171 static void task_free_security(struct task_struct *task)
172 {
173 struct task_security_struct *tsec = task->security;
174 task->security = NULL;
175 kfree(tsec);
176 }
177
178 static int inode_alloc_security(struct inode *inode)
179 {
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
182
183 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
184 if (!isec)
185 return -ENOMEM;
186
187 mutex_init(&isec->lock);
188 INIT_LIST_HEAD(&isec->list);
189 isec->inode = inode;
190 isec->sid = SECINITSID_UNLABELED;
191 isec->sclass = SECCLASS_FILE;
192 isec->task_sid = tsec->sid;
193 inode->i_security = isec;
194
195 return 0;
196 }
197
198 static void inode_free_security(struct inode *inode)
199 {
200 struct inode_security_struct *isec = inode->i_security;
201 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
202
203 spin_lock(&sbsec->isec_lock);
204 if (!list_empty(&isec->list))
205 list_del_init(&isec->list);
206 spin_unlock(&sbsec->isec_lock);
207
208 inode->i_security = NULL;
209 kmem_cache_free(sel_inode_cache, isec);
210 }
211
212 static int file_alloc_security(struct file *file)
213 {
214 struct task_security_struct *tsec = current->security;
215 struct file_security_struct *fsec;
216
217 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
218 if (!fsec)
219 return -ENOMEM;
220
221 fsec->file = file;
222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
224 file->f_security = fsec;
225
226 return 0;
227 }
228
229 static void file_free_security(struct file *file)
230 {
231 struct file_security_struct *fsec = file->f_security;
232 file->f_security = NULL;
233 kfree(fsec);
234 }
235
236 static int superblock_alloc_security(struct super_block *sb)
237 {
238 struct superblock_security_struct *sbsec;
239
240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
241 if (!sbsec)
242 return -ENOMEM;
243
244 mutex_init(&sbsec->lock);
245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
252 sb->s_security = sbsec;
253
254 return 0;
255 }
256
257 static void superblock_free_security(struct super_block *sb)
258 {
259 struct superblock_security_struct *sbsec = sb->s_security;
260
261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268 }
269
270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
271 {
272 struct sk_security_struct *ssec;
273
274 ssec = kzalloc(sizeof(*ssec), priority);
275 if (!ssec)
276 return -ENOMEM;
277
278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 ssec->sid = SECINITSID_UNLABELED;
281 sk->sk_security = ssec;
282
283 selinux_netlbl_sk_security_init(ssec, family);
284
285 return 0;
286 }
287
288 static void sk_free_security(struct sock *sk)
289 {
290 struct sk_security_struct *ssec = sk->sk_security;
291
292 sk->sk_security = NULL;
293 kfree(ssec);
294 }
295
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
299
300 /* The file system's label must be initialized prior to use. */
301
302 static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309 };
310
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313 static inline int inode_doinit(struct inode *inode)
314 {
315 return inode_doinit_with_dentry(inode, NULL);
316 }
317
318 enum {
319 Opt_error = -1,
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 3,
323 Opt_rootcontext = 4,
324 };
325
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
331 {Opt_error, NULL},
332 };
333
334 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
335
336 static int may_context_mount_sb_relabel(u32 sid,
337 struct superblock_security_struct *sbsec,
338 struct task_security_struct *tsec)
339 {
340 int rc;
341
342 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
343 FILESYSTEM__RELABELFROM, NULL);
344 if (rc)
345 return rc;
346
347 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELTO, NULL);
349 return rc;
350 }
351
352 static int may_context_mount_inode_relabel(u32 sid,
353 struct superblock_security_struct *sbsec,
354 struct task_security_struct *tsec)
355 {
356 int rc;
357 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
358 FILESYSTEM__RELABELFROM, NULL);
359 if (rc)
360 return rc;
361
362 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
363 FILESYSTEM__ASSOCIATE, NULL);
364 return rc;
365 }
366
367 static int sb_finish_set_opts(struct super_block *sb)
368 {
369 struct superblock_security_struct *sbsec = sb->s_security;
370 struct dentry *root = sb->s_root;
371 struct inode *root_inode = root->d_inode;
372 int rc = 0;
373
374 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
375 /* Make sure that the xattr handler exists and that no
376 error other than -ENODATA is returned by getxattr on
377 the root directory. -ENODATA is ok, as this may be
378 the first boot of the SELinux kernel before we have
379 assigned xattr values to the filesystem. */
380 if (!root_inode->i_op->getxattr) {
381 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
382 "xattr support\n", sb->s_id, sb->s_type->name);
383 rc = -EOPNOTSUPP;
384 goto out;
385 }
386 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
387 if (rc < 0 && rc != -ENODATA) {
388 if (rc == -EOPNOTSUPP)
389 printk(KERN_WARNING "SELinux: (dev %s, type "
390 "%s) has no security xattr handler\n",
391 sb->s_id, sb->s_type->name);
392 else
393 printk(KERN_WARNING "SELinux: (dev %s, type "
394 "%s) getxattr errno %d\n", sb->s_id,
395 sb->s_type->name, -rc);
396 goto out;
397 }
398 }
399
400 sbsec->initialized = 1;
401
402 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
403 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
404 sb->s_id, sb->s_type->name);
405 else
406 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
407 sb->s_id, sb->s_type->name,
408 labeling_behaviors[sbsec->behavior-1]);
409
410 /* Initialize the root inode. */
411 rc = inode_doinit_with_dentry(root_inode, root);
412
413 /* Initialize any other inodes associated with the superblock, e.g.
414 inodes created prior to initial policy load or inodes created
415 during get_sb by a pseudo filesystem that directly
416 populates itself. */
417 spin_lock(&sbsec->isec_lock);
418 next_inode:
419 if (!list_empty(&sbsec->isec_head)) {
420 struct inode_security_struct *isec =
421 list_entry(sbsec->isec_head.next,
422 struct inode_security_struct, list);
423 struct inode *inode = isec->inode;
424 spin_unlock(&sbsec->isec_lock);
425 inode = igrab(inode);
426 if (inode) {
427 if (!IS_PRIVATE(inode))
428 inode_doinit(inode);
429 iput(inode);
430 }
431 spin_lock(&sbsec->isec_lock);
432 list_del_init(&isec->list);
433 goto next_inode;
434 }
435 spin_unlock(&sbsec->isec_lock);
436 out:
437 return rc;
438 }
439
440 /*
441 * This function should allow an FS to ask what it's mount security
442 * options were so it can use those later for submounts, displaying
443 * mount options, or whatever.
444 */
445 static int selinux_get_mnt_opts(const struct super_block *sb,
446 struct security_mnt_opts *opts)
447 {
448 int rc = 0, i;
449 struct superblock_security_struct *sbsec = sb->s_security;
450 char *context = NULL;
451 u32 len;
452 char tmp;
453
454 security_init_mnt_opts(opts);
455
456 if (!sbsec->initialized)
457 return -EINVAL;
458
459 if (!ss_initialized)
460 return -EINVAL;
461
462 /*
463 * if we ever use sbsec flags for anything other than tracking mount
464 * settings this is going to need a mask
465 */
466 tmp = sbsec->flags;
467 /* count the number of mount options for this sb */
468 for (i = 0; i < 8; i++) {
469 if (tmp & 0x01)
470 opts->num_mnt_opts++;
471 tmp >>= 1;
472 }
473
474 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
475 if (!opts->mnt_opts) {
476 rc = -ENOMEM;
477 goto out_free;
478 }
479
480 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
481 if (!opts->mnt_opts_flags) {
482 rc = -ENOMEM;
483 goto out_free;
484 }
485
486 i = 0;
487 if (sbsec->flags & FSCONTEXT_MNT) {
488 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 if (rc)
490 goto out_free;
491 opts->mnt_opts[i] = context;
492 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
493 }
494 if (sbsec->flags & CONTEXT_MNT) {
495 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 if (rc)
497 goto out_free;
498 opts->mnt_opts[i] = context;
499 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
500 }
501 if (sbsec->flags & DEFCONTEXT_MNT) {
502 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 if (rc)
504 goto out_free;
505 opts->mnt_opts[i] = context;
506 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
507 }
508 if (sbsec->flags & ROOTCONTEXT_MNT) {
509 struct inode *root = sbsec->sb->s_root->d_inode;
510 struct inode_security_struct *isec = root->i_security;
511
512 rc = security_sid_to_context(isec->sid, &context, &len);
513 if (rc)
514 goto out_free;
515 opts->mnt_opts[i] = context;
516 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
517 }
518
519 BUG_ON(i != opts->num_mnt_opts);
520
521 return 0;
522
523 out_free:
524 security_free_mnt_opts(opts);
525 return rc;
526 }
527
528 static int bad_option(struct superblock_security_struct *sbsec, char flag,
529 u32 old_sid, u32 new_sid)
530 {
531 /* check if the old mount command had the same options */
532 if (sbsec->initialized)
533 if (!(sbsec->flags & flag) ||
534 (old_sid != new_sid))
535 return 1;
536
537 /* check if we were passed the same options twice,
538 * aka someone passed context=a,context=b
539 */
540 if (!sbsec->initialized)
541 if (sbsec->flags & flag)
542 return 1;
543 return 0;
544 }
545
546 /*
547 * Allow filesystems with binary mount data to explicitly set mount point
548 * labeling information.
549 */
550 static int selinux_set_mnt_opts(struct super_block *sb,
551 struct security_mnt_opts *opts)
552 {
553 int rc = 0, i;
554 struct task_security_struct *tsec = current->security;
555 struct superblock_security_struct *sbsec = sb->s_security;
556 const char *name = sb->s_type->name;
557 struct inode *inode = sbsec->sb->s_root->d_inode;
558 struct inode_security_struct *root_isec = inode->i_security;
559 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
560 u32 defcontext_sid = 0;
561 char **mount_options = opts->mnt_opts;
562 int *flags = opts->mnt_opts_flags;
563 int num_opts = opts->num_mnt_opts;
564
565 mutex_lock(&sbsec->lock);
566
567 if (!ss_initialized) {
568 if (!num_opts) {
569 /* Defer initialization until selinux_complete_init,
570 after the initial policy is loaded and the security
571 server is ready to handle calls. */
572 spin_lock(&sb_security_lock);
573 if (list_empty(&sbsec->list))
574 list_add(&sbsec->list, &superblock_security_head);
575 spin_unlock(&sb_security_lock);
576 goto out;
577 }
578 rc = -EINVAL;
579 printk(KERN_WARNING "Unable to set superblock options before "
580 "the security server is initialized\n");
581 goto out;
582 }
583
584 /*
585 * Binary mount data FS will come through this function twice. Once
586 * from an explicit call and once from the generic calls from the vfs.
587 * Since the generic VFS calls will not contain any security mount data
588 * we need to skip the double mount verification.
589 *
590 * This does open a hole in which we will not notice if the first
591 * mount using this sb set explict options and a second mount using
592 * this sb does not set any security options. (The first options
593 * will be used for both mounts)
594 */
595 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
596 && (num_opts == 0))
597 goto out;
598
599 /*
600 * parse the mount options, check if they are valid sids.
601 * also check if someone is trying to mount the same sb more
602 * than once with different security options.
603 */
604 for (i = 0; i < num_opts; i++) {
605 u32 sid;
606 rc = security_context_to_sid(mount_options[i],
607 strlen(mount_options[i]), &sid);
608 if (rc) {
609 printk(KERN_WARNING "SELinux: security_context_to_sid"
610 "(%s) failed for (dev %s, type %s) errno=%d\n",
611 mount_options[i], sb->s_id, name, rc);
612 goto out;
613 }
614 switch (flags[i]) {
615 case FSCONTEXT_MNT:
616 fscontext_sid = sid;
617
618 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
619 fscontext_sid))
620 goto out_double_mount;
621
622 sbsec->flags |= FSCONTEXT_MNT;
623 break;
624 case CONTEXT_MNT:
625 context_sid = sid;
626
627 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
628 context_sid))
629 goto out_double_mount;
630
631 sbsec->flags |= CONTEXT_MNT;
632 break;
633 case ROOTCONTEXT_MNT:
634 rootcontext_sid = sid;
635
636 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
637 rootcontext_sid))
638 goto out_double_mount;
639
640 sbsec->flags |= ROOTCONTEXT_MNT;
641
642 break;
643 case DEFCONTEXT_MNT:
644 defcontext_sid = sid;
645
646 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
647 defcontext_sid))
648 goto out_double_mount;
649
650 sbsec->flags |= DEFCONTEXT_MNT;
651
652 break;
653 default:
654 rc = -EINVAL;
655 goto out;
656 }
657 }
658
659 if (sbsec->initialized) {
660 /* previously mounted with options, but not on this attempt? */
661 if (sbsec->flags && !num_opts)
662 goto out_double_mount;
663 rc = 0;
664 goto out;
665 }
666
667 if (strcmp(sb->s_type->name, "proc") == 0)
668 sbsec->proc = 1;
669
670 /* Determine the labeling behavior to use for this filesystem type. */
671 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
672 if (rc) {
673 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
674 __FUNCTION__, sb->s_type->name, rc);
675 goto out;
676 }
677
678 /* sets the context of the superblock for the fs being mounted. */
679 if (fscontext_sid) {
680
681 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
682 if (rc)
683 goto out;
684
685 sbsec->sid = fscontext_sid;
686 }
687
688 /*
689 * Switch to using mount point labeling behavior.
690 * sets the label used on all file below the mountpoint, and will set
691 * the superblock context if not already set.
692 */
693 if (context_sid) {
694 if (!fscontext_sid) {
695 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
696 if (rc)
697 goto out;
698 sbsec->sid = context_sid;
699 } else {
700 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
701 if (rc)
702 goto out;
703 }
704 if (!rootcontext_sid)
705 rootcontext_sid = context_sid;
706
707 sbsec->mntpoint_sid = context_sid;
708 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
709 }
710
711 if (rootcontext_sid) {
712 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
713 if (rc)
714 goto out;
715
716 root_isec->sid = rootcontext_sid;
717 root_isec->initialized = 1;
718 }
719
720 if (defcontext_sid) {
721 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
722 rc = -EINVAL;
723 printk(KERN_WARNING "SELinux: defcontext option is "
724 "invalid for this filesystem type\n");
725 goto out;
726 }
727
728 if (defcontext_sid != sbsec->def_sid) {
729 rc = may_context_mount_inode_relabel(defcontext_sid,
730 sbsec, tsec);
731 if (rc)
732 goto out;
733 }
734
735 sbsec->def_sid = defcontext_sid;
736 }
737
738 rc = sb_finish_set_opts(sb);
739 out:
740 mutex_unlock(&sbsec->lock);
741 return rc;
742 out_double_mount:
743 rc = -EINVAL;
744 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
745 "security settings for (dev %s, type %s)\n", sb->s_id, name);
746 goto out;
747 }
748
749 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
750 struct super_block *newsb)
751 {
752 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
753 struct superblock_security_struct *newsbsec = newsb->s_security;
754
755 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
756 int set_context = (oldsbsec->flags & CONTEXT_MNT);
757 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
758
759 /*
760 * if the parent was able to be mounted it clearly had no special lsm
761 * mount options. thus we can safely put this sb on the list and deal
762 * with it later
763 */
764 if (!ss_initialized) {
765 spin_lock(&sb_security_lock);
766 if (list_empty(&newsbsec->list))
767 list_add(&newsbsec->list, &superblock_security_head);
768 spin_unlock(&sb_security_lock);
769 return;
770 }
771
772 /* how can we clone if the old one wasn't set up?? */
773 BUG_ON(!oldsbsec->initialized);
774
775 /* if fs is reusing a sb, just let its options stand... */
776 if (newsbsec->initialized)
777 return;
778
779 mutex_lock(&newsbsec->lock);
780
781 newsbsec->flags = oldsbsec->flags;
782
783 newsbsec->sid = oldsbsec->sid;
784 newsbsec->def_sid = oldsbsec->def_sid;
785 newsbsec->behavior = oldsbsec->behavior;
786
787 if (set_context) {
788 u32 sid = oldsbsec->mntpoint_sid;
789
790 if (!set_fscontext)
791 newsbsec->sid = sid;
792 if (!set_rootcontext) {
793 struct inode *newinode = newsb->s_root->d_inode;
794 struct inode_security_struct *newisec = newinode->i_security;
795 newisec->sid = sid;
796 }
797 newsbsec->mntpoint_sid = sid;
798 }
799 if (set_rootcontext) {
800 const struct inode *oldinode = oldsb->s_root->d_inode;
801 const struct inode_security_struct *oldisec = oldinode->i_security;
802 struct inode *newinode = newsb->s_root->d_inode;
803 struct inode_security_struct *newisec = newinode->i_security;
804
805 newisec->sid = oldisec->sid;
806 }
807
808 sb_finish_set_opts(newsb);
809 mutex_unlock(&newsbsec->lock);
810 }
811
812 static int selinux_parse_opts_str(char *options,
813 struct security_mnt_opts *opts)
814 {
815 char *p;
816 char *context = NULL, *defcontext = NULL;
817 char *fscontext = NULL, *rootcontext = NULL;
818 int rc, num_mnt_opts = 0;
819
820 opts->num_mnt_opts = 0;
821
822 /* Standard string-based options. */
823 while ((p = strsep(&options, "|")) != NULL) {
824 int token;
825 substring_t args[MAX_OPT_ARGS];
826
827 if (!*p)
828 continue;
829
830 token = match_token(p, tokens, args);
831
832 switch (token) {
833 case Opt_context:
834 if (context || defcontext) {
835 rc = -EINVAL;
836 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
837 goto out_err;
838 }
839 context = match_strdup(&args[0]);
840 if (!context) {
841 rc = -ENOMEM;
842 goto out_err;
843 }
844 break;
845
846 case Opt_fscontext:
847 if (fscontext) {
848 rc = -EINVAL;
849 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
850 goto out_err;
851 }
852 fscontext = match_strdup(&args[0]);
853 if (!fscontext) {
854 rc = -ENOMEM;
855 goto out_err;
856 }
857 break;
858
859 case Opt_rootcontext:
860 if (rootcontext) {
861 rc = -EINVAL;
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
863 goto out_err;
864 }
865 rootcontext = match_strdup(&args[0]);
866 if (!rootcontext) {
867 rc = -ENOMEM;
868 goto out_err;
869 }
870 break;
871
872 case Opt_defcontext:
873 if (context || defcontext) {
874 rc = -EINVAL;
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
876 goto out_err;
877 }
878 defcontext = match_strdup(&args[0]);
879 if (!defcontext) {
880 rc = -ENOMEM;
881 goto out_err;
882 }
883 break;
884
885 default:
886 rc = -EINVAL;
887 printk(KERN_WARNING "SELinux: unknown mount option\n");
888 goto out_err;
889
890 }
891 }
892
893 rc = -ENOMEM;
894 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
895 if (!opts->mnt_opts)
896 goto out_err;
897
898 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
899 if (!opts->mnt_opts_flags) {
900 kfree(opts->mnt_opts);
901 goto out_err;
902 }
903
904 if (fscontext) {
905 opts->mnt_opts[num_mnt_opts] = fscontext;
906 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
907 }
908 if (context) {
909 opts->mnt_opts[num_mnt_opts] = context;
910 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
911 }
912 if (rootcontext) {
913 opts->mnt_opts[num_mnt_opts] = rootcontext;
914 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
915 }
916 if (defcontext) {
917 opts->mnt_opts[num_mnt_opts] = defcontext;
918 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
919 }
920
921 opts->num_mnt_opts = num_mnt_opts;
922 return 0;
923
924 out_err:
925 kfree(context);
926 kfree(defcontext);
927 kfree(fscontext);
928 kfree(rootcontext);
929 return rc;
930 }
931 /*
932 * string mount options parsing and call set the sbsec
933 */
934 static int superblock_doinit(struct super_block *sb, void *data)
935 {
936 int rc = 0;
937 char *options = data;
938 struct security_mnt_opts opts;
939
940 security_init_mnt_opts(&opts);
941
942 if (!data)
943 goto out;
944
945 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
946
947 rc = selinux_parse_opts_str(options, &opts);
948 if (rc)
949 goto out_err;
950
951 out:
952 rc = selinux_set_mnt_opts(sb, &opts);
953
954 out_err:
955 security_free_mnt_opts(&opts);
956 return rc;
957 }
958
959 static inline u16 inode_mode_to_security_class(umode_t mode)
960 {
961 switch (mode & S_IFMT) {
962 case S_IFSOCK:
963 return SECCLASS_SOCK_FILE;
964 case S_IFLNK:
965 return SECCLASS_LNK_FILE;
966 case S_IFREG:
967 return SECCLASS_FILE;
968 case S_IFBLK:
969 return SECCLASS_BLK_FILE;
970 case S_IFDIR:
971 return SECCLASS_DIR;
972 case S_IFCHR:
973 return SECCLASS_CHR_FILE;
974 case S_IFIFO:
975 return SECCLASS_FIFO_FILE;
976
977 }
978
979 return SECCLASS_FILE;
980 }
981
982 static inline int default_protocol_stream(int protocol)
983 {
984 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
985 }
986
987 static inline int default_protocol_dgram(int protocol)
988 {
989 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
990 }
991
992 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
993 {
994 switch (family) {
995 case PF_UNIX:
996 switch (type) {
997 case SOCK_STREAM:
998 case SOCK_SEQPACKET:
999 return SECCLASS_UNIX_STREAM_SOCKET;
1000 case SOCK_DGRAM:
1001 return SECCLASS_UNIX_DGRAM_SOCKET;
1002 }
1003 break;
1004 case PF_INET:
1005 case PF_INET6:
1006 switch (type) {
1007 case SOCK_STREAM:
1008 if (default_protocol_stream(protocol))
1009 return SECCLASS_TCP_SOCKET;
1010 else
1011 return SECCLASS_RAWIP_SOCKET;
1012 case SOCK_DGRAM:
1013 if (default_protocol_dgram(protocol))
1014 return SECCLASS_UDP_SOCKET;
1015 else
1016 return SECCLASS_RAWIP_SOCKET;
1017 case SOCK_DCCP:
1018 return SECCLASS_DCCP_SOCKET;
1019 default:
1020 return SECCLASS_RAWIP_SOCKET;
1021 }
1022 break;
1023 case PF_NETLINK:
1024 switch (protocol) {
1025 case NETLINK_ROUTE:
1026 return SECCLASS_NETLINK_ROUTE_SOCKET;
1027 case NETLINK_FIREWALL:
1028 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1029 case NETLINK_INET_DIAG:
1030 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1031 case NETLINK_NFLOG:
1032 return SECCLASS_NETLINK_NFLOG_SOCKET;
1033 case NETLINK_XFRM:
1034 return SECCLASS_NETLINK_XFRM_SOCKET;
1035 case NETLINK_SELINUX:
1036 return SECCLASS_NETLINK_SELINUX_SOCKET;
1037 case NETLINK_AUDIT:
1038 return SECCLASS_NETLINK_AUDIT_SOCKET;
1039 case NETLINK_IP6_FW:
1040 return SECCLASS_NETLINK_IP6FW_SOCKET;
1041 case NETLINK_DNRTMSG:
1042 return SECCLASS_NETLINK_DNRT_SOCKET;
1043 case NETLINK_KOBJECT_UEVENT:
1044 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1045 default:
1046 return SECCLASS_NETLINK_SOCKET;
1047 }
1048 case PF_PACKET:
1049 return SECCLASS_PACKET_SOCKET;
1050 case PF_KEY:
1051 return SECCLASS_KEY_SOCKET;
1052 case PF_APPLETALK:
1053 return SECCLASS_APPLETALK_SOCKET;
1054 }
1055
1056 return SECCLASS_SOCKET;
1057 }
1058
1059 #ifdef CONFIG_PROC_FS
1060 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1061 u16 tclass,
1062 u32 *sid)
1063 {
1064 int buflen, rc;
1065 char *buffer, *path, *end;
1066
1067 buffer = (char*)__get_free_page(GFP_KERNEL);
1068 if (!buffer)
1069 return -ENOMEM;
1070
1071 buflen = PAGE_SIZE;
1072 end = buffer+buflen;
1073 *--end = '\0';
1074 buflen--;
1075 path = end-1;
1076 *path = '/';
1077 while (de && de != de->parent) {
1078 buflen -= de->namelen + 1;
1079 if (buflen < 0)
1080 break;
1081 end -= de->namelen;
1082 memcpy(end, de->name, de->namelen);
1083 *--end = '/';
1084 path = end;
1085 de = de->parent;
1086 }
1087 rc = security_genfs_sid("proc", path, tclass, sid);
1088 free_page((unsigned long)buffer);
1089 return rc;
1090 }
1091 #else
1092 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1093 u16 tclass,
1094 u32 *sid)
1095 {
1096 return -EINVAL;
1097 }
1098 #endif
1099
1100 /* The inode's security attributes must be initialized before first use. */
1101 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1102 {
1103 struct superblock_security_struct *sbsec = NULL;
1104 struct inode_security_struct *isec = inode->i_security;
1105 u32 sid;
1106 struct dentry *dentry;
1107 #define INITCONTEXTLEN 255
1108 char *context = NULL;
1109 unsigned len = 0;
1110 int rc = 0;
1111
1112 if (isec->initialized)
1113 goto out;
1114
1115 mutex_lock(&isec->lock);
1116 if (isec->initialized)
1117 goto out_unlock;
1118
1119 sbsec = inode->i_sb->s_security;
1120 if (!sbsec->initialized) {
1121 /* Defer initialization until selinux_complete_init,
1122 after the initial policy is loaded and the security
1123 server is ready to handle calls. */
1124 spin_lock(&sbsec->isec_lock);
1125 if (list_empty(&isec->list))
1126 list_add(&isec->list, &sbsec->isec_head);
1127 spin_unlock(&sbsec->isec_lock);
1128 goto out_unlock;
1129 }
1130
1131 switch (sbsec->behavior) {
1132 case SECURITY_FS_USE_XATTR:
1133 if (!inode->i_op->getxattr) {
1134 isec->sid = sbsec->def_sid;
1135 break;
1136 }
1137
1138 /* Need a dentry, since the xattr API requires one.
1139 Life would be simpler if we could just pass the inode. */
1140 if (opt_dentry) {
1141 /* Called from d_instantiate or d_splice_alias. */
1142 dentry = dget(opt_dentry);
1143 } else {
1144 /* Called from selinux_complete_init, try to find a dentry. */
1145 dentry = d_find_alias(inode);
1146 }
1147 if (!dentry) {
1148 printk(KERN_WARNING "%s: no dentry for dev=%s "
1149 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
1150 inode->i_ino);
1151 goto out_unlock;
1152 }
1153
1154 len = INITCONTEXTLEN;
1155 context = kmalloc(len, GFP_NOFS);
1156 if (!context) {
1157 rc = -ENOMEM;
1158 dput(dentry);
1159 goto out_unlock;
1160 }
1161 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1162 context, len);
1163 if (rc == -ERANGE) {
1164 /* Need a larger buffer. Query for the right size. */
1165 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1166 NULL, 0);
1167 if (rc < 0) {
1168 dput(dentry);
1169 goto out_unlock;
1170 }
1171 kfree(context);
1172 len = rc;
1173 context = kmalloc(len, GFP_NOFS);
1174 if (!context) {
1175 rc = -ENOMEM;
1176 dput(dentry);
1177 goto out_unlock;
1178 }
1179 rc = inode->i_op->getxattr(dentry,
1180 XATTR_NAME_SELINUX,
1181 context, len);
1182 }
1183 dput(dentry);
1184 if (rc < 0) {
1185 if (rc != -ENODATA) {
1186 printk(KERN_WARNING "%s: getxattr returned "
1187 "%d for dev=%s ino=%ld\n", __FUNCTION__,
1188 -rc, inode->i_sb->s_id, inode->i_ino);
1189 kfree(context);
1190 goto out_unlock;
1191 }
1192 /* Map ENODATA to the default file SID */
1193 sid = sbsec->def_sid;
1194 rc = 0;
1195 } else {
1196 rc = security_context_to_sid_default(context, rc, &sid,
1197 sbsec->def_sid,
1198 GFP_NOFS);
1199 if (rc) {
1200 printk(KERN_WARNING "%s: context_to_sid(%s) "
1201 "returned %d for dev=%s ino=%ld\n",
1202 __FUNCTION__, context, -rc,
1203 inode->i_sb->s_id, inode->i_ino);
1204 kfree(context);
1205 /* Leave with the unlabeled SID */
1206 rc = 0;
1207 break;
1208 }
1209 }
1210 kfree(context);
1211 isec->sid = sid;
1212 break;
1213 case SECURITY_FS_USE_TASK:
1214 isec->sid = isec->task_sid;
1215 break;
1216 case SECURITY_FS_USE_TRANS:
1217 /* Default to the fs SID. */
1218 isec->sid = sbsec->sid;
1219
1220 /* Try to obtain a transition SID. */
1221 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1222 rc = security_transition_sid(isec->task_sid,
1223 sbsec->sid,
1224 isec->sclass,
1225 &sid);
1226 if (rc)
1227 goto out_unlock;
1228 isec->sid = sid;
1229 break;
1230 case SECURITY_FS_USE_MNTPOINT:
1231 isec->sid = sbsec->mntpoint_sid;
1232 break;
1233 default:
1234 /* Default to the fs superblock SID. */
1235 isec->sid = sbsec->sid;
1236
1237 if (sbsec->proc) {
1238 struct proc_inode *proci = PROC_I(inode);
1239 if (proci->pde) {
1240 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1241 rc = selinux_proc_get_sid(proci->pde,
1242 isec->sclass,
1243 &sid);
1244 if (rc)
1245 goto out_unlock;
1246 isec->sid = sid;
1247 }
1248 }
1249 break;
1250 }
1251
1252 isec->initialized = 1;
1253
1254 out_unlock:
1255 mutex_unlock(&isec->lock);
1256 out:
1257 if (isec->sclass == SECCLASS_FILE)
1258 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1259 return rc;
1260 }
1261
1262 /* Convert a Linux signal to an access vector. */
1263 static inline u32 signal_to_av(int sig)
1264 {
1265 u32 perm = 0;
1266
1267 switch (sig) {
1268 case SIGCHLD:
1269 /* Commonly granted from child to parent. */
1270 perm = PROCESS__SIGCHLD;
1271 break;
1272 case SIGKILL:
1273 /* Cannot be caught or ignored */
1274 perm = PROCESS__SIGKILL;
1275 break;
1276 case SIGSTOP:
1277 /* Cannot be caught or ignored */
1278 perm = PROCESS__SIGSTOP;
1279 break;
1280 default:
1281 /* All other signals. */
1282 perm = PROCESS__SIGNAL;
1283 break;
1284 }
1285
1286 return perm;
1287 }
1288
1289 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1290 fork check, ptrace check, etc. */
1291 static int task_has_perm(struct task_struct *tsk1,
1292 struct task_struct *tsk2,
1293 u32 perms)
1294 {
1295 struct task_security_struct *tsec1, *tsec2;
1296
1297 tsec1 = tsk1->security;
1298 tsec2 = tsk2->security;
1299 return avc_has_perm(tsec1->sid, tsec2->sid,
1300 SECCLASS_PROCESS, perms, NULL);
1301 }
1302
1303 #if CAP_LAST_CAP > 63
1304 #error Fix SELinux to handle capabilities > 63.
1305 #endif
1306
1307 /* Check whether a task is allowed to use a capability. */
1308 static int task_has_capability(struct task_struct *tsk,
1309 int cap)
1310 {
1311 struct task_security_struct *tsec;
1312 struct avc_audit_data ad;
1313 u16 sclass;
1314 u32 av = CAP_TO_MASK(cap);
1315
1316 tsec = tsk->security;
1317
1318 AVC_AUDIT_DATA_INIT(&ad,CAP);
1319 ad.tsk = tsk;
1320 ad.u.cap = cap;
1321
1322 switch (CAP_TO_INDEX(cap)) {
1323 case 0:
1324 sclass = SECCLASS_CAPABILITY;
1325 break;
1326 case 1:
1327 sclass = SECCLASS_CAPABILITY2;
1328 break;
1329 default:
1330 printk(KERN_ERR
1331 "SELinux: out of range capability %d\n", cap);
1332 BUG();
1333 }
1334 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1335 }
1336
1337 /* Check whether a task is allowed to use a system operation. */
1338 static int task_has_system(struct task_struct *tsk,
1339 u32 perms)
1340 {
1341 struct task_security_struct *tsec;
1342
1343 tsec = tsk->security;
1344
1345 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1346 SECCLASS_SYSTEM, perms, NULL);
1347 }
1348
1349 /* Check whether a task has a particular permission to an inode.
1350 The 'adp' parameter is optional and allows other audit
1351 data to be passed (e.g. the dentry). */
1352 static int inode_has_perm(struct task_struct *tsk,
1353 struct inode *inode,
1354 u32 perms,
1355 struct avc_audit_data *adp)
1356 {
1357 struct task_security_struct *tsec;
1358 struct inode_security_struct *isec;
1359 struct avc_audit_data ad;
1360
1361 if (unlikely (IS_PRIVATE (inode)))
1362 return 0;
1363
1364 tsec = tsk->security;
1365 isec = inode->i_security;
1366
1367 if (!adp) {
1368 adp = &ad;
1369 AVC_AUDIT_DATA_INIT(&ad, FS);
1370 ad.u.fs.inode = inode;
1371 }
1372
1373 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1374 }
1375
1376 /* Same as inode_has_perm, but pass explicit audit data containing
1377 the dentry to help the auditing code to more easily generate the
1378 pathname if needed. */
1379 static inline int dentry_has_perm(struct task_struct *tsk,
1380 struct vfsmount *mnt,
1381 struct dentry *dentry,
1382 u32 av)
1383 {
1384 struct inode *inode = dentry->d_inode;
1385 struct avc_audit_data ad;
1386 AVC_AUDIT_DATA_INIT(&ad,FS);
1387 ad.u.fs.path.mnt = mnt;
1388 ad.u.fs.path.dentry = dentry;
1389 return inode_has_perm(tsk, inode, av, &ad);
1390 }
1391
1392 /* Check whether a task can use an open file descriptor to
1393 access an inode in a given way. Check access to the
1394 descriptor itself, and then use dentry_has_perm to
1395 check a particular permission to the file.
1396 Access to the descriptor is implicitly granted if it
1397 has the same SID as the process. If av is zero, then
1398 access to the file is not checked, e.g. for cases
1399 where only the descriptor is affected like seek. */
1400 static int file_has_perm(struct task_struct *tsk,
1401 struct file *file,
1402 u32 av)
1403 {
1404 struct task_security_struct *tsec = tsk->security;
1405 struct file_security_struct *fsec = file->f_security;
1406 struct inode *inode = file->f_path.dentry->d_inode;
1407 struct avc_audit_data ad;
1408 int rc;
1409
1410 AVC_AUDIT_DATA_INIT(&ad, FS);
1411 ad.u.fs.path = file->f_path;
1412
1413 if (tsec->sid != fsec->sid) {
1414 rc = avc_has_perm(tsec->sid, fsec->sid,
1415 SECCLASS_FD,
1416 FD__USE,
1417 &ad);
1418 if (rc)
1419 return rc;
1420 }
1421
1422 /* av is zero if only checking access to the descriptor. */
1423 if (av)
1424 return inode_has_perm(tsk, inode, av, &ad);
1425
1426 return 0;
1427 }
1428
1429 /* Check whether a task can create a file. */
1430 static int may_create(struct inode *dir,
1431 struct dentry *dentry,
1432 u16 tclass)
1433 {
1434 struct task_security_struct *tsec;
1435 struct inode_security_struct *dsec;
1436 struct superblock_security_struct *sbsec;
1437 u32 newsid;
1438 struct avc_audit_data ad;
1439 int rc;
1440
1441 tsec = current->security;
1442 dsec = dir->i_security;
1443 sbsec = dir->i_sb->s_security;
1444
1445 AVC_AUDIT_DATA_INIT(&ad, FS);
1446 ad.u.fs.path.dentry = dentry;
1447
1448 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1449 DIR__ADD_NAME | DIR__SEARCH,
1450 &ad);
1451 if (rc)
1452 return rc;
1453
1454 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1455 newsid = tsec->create_sid;
1456 } else {
1457 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1458 &newsid);
1459 if (rc)
1460 return rc;
1461 }
1462
1463 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1464 if (rc)
1465 return rc;
1466
1467 return avc_has_perm(newsid, sbsec->sid,
1468 SECCLASS_FILESYSTEM,
1469 FILESYSTEM__ASSOCIATE, &ad);
1470 }
1471
1472 /* Check whether a task can create a key. */
1473 static int may_create_key(u32 ksid,
1474 struct task_struct *ctx)
1475 {
1476 struct task_security_struct *tsec;
1477
1478 tsec = ctx->security;
1479
1480 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1481 }
1482
1483 #define MAY_LINK 0
1484 #define MAY_UNLINK 1
1485 #define MAY_RMDIR 2
1486
1487 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1488 static int may_link(struct inode *dir,
1489 struct dentry *dentry,
1490 int kind)
1491
1492 {
1493 struct task_security_struct *tsec;
1494 struct inode_security_struct *dsec, *isec;
1495 struct avc_audit_data ad;
1496 u32 av;
1497 int rc;
1498
1499 tsec = current->security;
1500 dsec = dir->i_security;
1501 isec = dentry->d_inode->i_security;
1502
1503 AVC_AUDIT_DATA_INIT(&ad, FS);
1504 ad.u.fs.path.dentry = dentry;
1505
1506 av = DIR__SEARCH;
1507 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1508 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1509 if (rc)
1510 return rc;
1511
1512 switch (kind) {
1513 case MAY_LINK:
1514 av = FILE__LINK;
1515 break;
1516 case MAY_UNLINK:
1517 av = FILE__UNLINK;
1518 break;
1519 case MAY_RMDIR:
1520 av = DIR__RMDIR;
1521 break;
1522 default:
1523 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1524 return 0;
1525 }
1526
1527 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1528 return rc;
1529 }
1530
1531 static inline int may_rename(struct inode *old_dir,
1532 struct dentry *old_dentry,
1533 struct inode *new_dir,
1534 struct dentry *new_dentry)
1535 {
1536 struct task_security_struct *tsec;
1537 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1538 struct avc_audit_data ad;
1539 u32 av;
1540 int old_is_dir, new_is_dir;
1541 int rc;
1542
1543 tsec = current->security;
1544 old_dsec = old_dir->i_security;
1545 old_isec = old_dentry->d_inode->i_security;
1546 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1547 new_dsec = new_dir->i_security;
1548
1549 AVC_AUDIT_DATA_INIT(&ad, FS);
1550
1551 ad.u.fs.path.dentry = old_dentry;
1552 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1553 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1554 if (rc)
1555 return rc;
1556 rc = avc_has_perm(tsec->sid, old_isec->sid,
1557 old_isec->sclass, FILE__RENAME, &ad);
1558 if (rc)
1559 return rc;
1560 if (old_is_dir && new_dir != old_dir) {
1561 rc = avc_has_perm(tsec->sid, old_isec->sid,
1562 old_isec->sclass, DIR__REPARENT, &ad);
1563 if (rc)
1564 return rc;
1565 }
1566
1567 ad.u.fs.path.dentry = new_dentry;
1568 av = DIR__ADD_NAME | DIR__SEARCH;
1569 if (new_dentry->d_inode)
1570 av |= DIR__REMOVE_NAME;
1571 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1572 if (rc)
1573 return rc;
1574 if (new_dentry->d_inode) {
1575 new_isec = new_dentry->d_inode->i_security;
1576 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1577 rc = avc_has_perm(tsec->sid, new_isec->sid,
1578 new_isec->sclass,
1579 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1580 if (rc)
1581 return rc;
1582 }
1583
1584 return 0;
1585 }
1586
1587 /* Check whether a task can perform a filesystem operation. */
1588 static int superblock_has_perm(struct task_struct *tsk,
1589 struct super_block *sb,
1590 u32 perms,
1591 struct avc_audit_data *ad)
1592 {
1593 struct task_security_struct *tsec;
1594 struct superblock_security_struct *sbsec;
1595
1596 tsec = tsk->security;
1597 sbsec = sb->s_security;
1598 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1599 perms, ad);
1600 }
1601
1602 /* Convert a Linux mode and permission mask to an access vector. */
1603 static inline u32 file_mask_to_av(int mode, int mask)
1604 {
1605 u32 av = 0;
1606
1607 if ((mode & S_IFMT) != S_IFDIR) {
1608 if (mask & MAY_EXEC)
1609 av |= FILE__EXECUTE;
1610 if (mask & MAY_READ)
1611 av |= FILE__READ;
1612
1613 if (mask & MAY_APPEND)
1614 av |= FILE__APPEND;
1615 else if (mask & MAY_WRITE)
1616 av |= FILE__WRITE;
1617
1618 } else {
1619 if (mask & MAY_EXEC)
1620 av |= DIR__SEARCH;
1621 if (mask & MAY_WRITE)
1622 av |= DIR__WRITE;
1623 if (mask & MAY_READ)
1624 av |= DIR__READ;
1625 }
1626
1627 return av;
1628 }
1629
1630 /* Convert a Linux file to an access vector. */
1631 static inline u32 file_to_av(struct file *file)
1632 {
1633 u32 av = 0;
1634
1635 if (file->f_mode & FMODE_READ)
1636 av |= FILE__READ;
1637 if (file->f_mode & FMODE_WRITE) {
1638 if (file->f_flags & O_APPEND)
1639 av |= FILE__APPEND;
1640 else
1641 av |= FILE__WRITE;
1642 }
1643 if (!av) {
1644 /*
1645 * Special file opened with flags 3 for ioctl-only use.
1646 */
1647 av = FILE__IOCTL;
1648 }
1649
1650 return av;
1651 }
1652
1653 /* Hook functions begin here. */
1654
1655 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1656 {
1657 struct task_security_struct *psec = parent->security;
1658 struct task_security_struct *csec = child->security;
1659 int rc;
1660
1661 rc = secondary_ops->ptrace(parent,child);
1662 if (rc)
1663 return rc;
1664
1665 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1666 /* Save the SID of the tracing process for later use in apply_creds. */
1667 if (!(child->ptrace & PT_PTRACED) && !rc)
1668 csec->ptrace_sid = psec->sid;
1669 return rc;
1670 }
1671
1672 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1673 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1674 {
1675 int error;
1676
1677 error = task_has_perm(current, target, PROCESS__GETCAP);
1678 if (error)
1679 return error;
1680
1681 return secondary_ops->capget(target, effective, inheritable, permitted);
1682 }
1683
1684 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1685 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1686 {
1687 int error;
1688
1689 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1690 if (error)
1691 return error;
1692
1693 return task_has_perm(current, target, PROCESS__SETCAP);
1694 }
1695
1696 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1697 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1698 {
1699 secondary_ops->capset_set(target, effective, inheritable, permitted);
1700 }
1701
1702 static int selinux_capable(struct task_struct *tsk, int cap)
1703 {
1704 int rc;
1705
1706 rc = secondary_ops->capable(tsk, cap);
1707 if (rc)
1708 return rc;
1709
1710 return task_has_capability(tsk,cap);
1711 }
1712
1713 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1714 {
1715 int buflen, rc;
1716 char *buffer, *path, *end;
1717
1718 rc = -ENOMEM;
1719 buffer = (char*)__get_free_page(GFP_KERNEL);
1720 if (!buffer)
1721 goto out;
1722
1723 buflen = PAGE_SIZE;
1724 end = buffer+buflen;
1725 *--end = '\0';
1726 buflen--;
1727 path = end-1;
1728 *path = '/';
1729 while (table) {
1730 const char *name = table->procname;
1731 size_t namelen = strlen(name);
1732 buflen -= namelen + 1;
1733 if (buflen < 0)
1734 goto out_free;
1735 end -= namelen;
1736 memcpy(end, name, namelen);
1737 *--end = '/';
1738 path = end;
1739 table = table->parent;
1740 }
1741 buflen -= 4;
1742 if (buflen < 0)
1743 goto out_free;
1744 end -= 4;
1745 memcpy(end, "/sys", 4);
1746 path = end;
1747 rc = security_genfs_sid("proc", path, tclass, sid);
1748 out_free:
1749 free_page((unsigned long)buffer);
1750 out:
1751 return rc;
1752 }
1753
1754 static int selinux_sysctl(ctl_table *table, int op)
1755 {
1756 int error = 0;
1757 u32 av;
1758 struct task_security_struct *tsec;
1759 u32 tsid;
1760 int rc;
1761
1762 rc = secondary_ops->sysctl(table, op);
1763 if (rc)
1764 return rc;
1765
1766 tsec = current->security;
1767
1768 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1769 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1770 if (rc) {
1771 /* Default to the well-defined sysctl SID. */
1772 tsid = SECINITSID_SYSCTL;
1773 }
1774
1775 /* The op values are "defined" in sysctl.c, thereby creating
1776 * a bad coupling between this module and sysctl.c */
1777 if(op == 001) {
1778 error = avc_has_perm(tsec->sid, tsid,
1779 SECCLASS_DIR, DIR__SEARCH, NULL);
1780 } else {
1781 av = 0;
1782 if (op & 004)
1783 av |= FILE__READ;
1784 if (op & 002)
1785 av |= FILE__WRITE;
1786 if (av)
1787 error = avc_has_perm(tsec->sid, tsid,
1788 SECCLASS_FILE, av, NULL);
1789 }
1790
1791 return error;
1792 }
1793
1794 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1795 {
1796 int rc = 0;
1797
1798 if (!sb)
1799 return 0;
1800
1801 switch (cmds) {
1802 case Q_SYNC:
1803 case Q_QUOTAON:
1804 case Q_QUOTAOFF:
1805 case Q_SETINFO:
1806 case Q_SETQUOTA:
1807 rc = superblock_has_perm(current,
1808 sb,
1809 FILESYSTEM__QUOTAMOD, NULL);
1810 break;
1811 case Q_GETFMT:
1812 case Q_GETINFO:
1813 case Q_GETQUOTA:
1814 rc = superblock_has_perm(current,
1815 sb,
1816 FILESYSTEM__QUOTAGET, NULL);
1817 break;
1818 default:
1819 rc = 0; /* let the kernel handle invalid cmds */
1820 break;
1821 }
1822 return rc;
1823 }
1824
1825 static int selinux_quota_on(struct dentry *dentry)
1826 {
1827 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1828 }
1829
1830 static int selinux_syslog(int type)
1831 {
1832 int rc;
1833
1834 rc = secondary_ops->syslog(type);
1835 if (rc)
1836 return rc;
1837
1838 switch (type) {
1839 case 3: /* Read last kernel messages */
1840 case 10: /* Return size of the log buffer */
1841 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1842 break;
1843 case 6: /* Disable logging to console */
1844 case 7: /* Enable logging to console */
1845 case 8: /* Set level of messages printed to console */
1846 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1847 break;
1848 case 0: /* Close log */
1849 case 1: /* Open log */
1850 case 2: /* Read from log */
1851 case 4: /* Read/clear last kernel messages */
1852 case 5: /* Clear ring buffer */
1853 default:
1854 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1855 break;
1856 }
1857 return rc;
1858 }
1859
1860 /*
1861 * Check that a process has enough memory to allocate a new virtual
1862 * mapping. 0 means there is enough memory for the allocation to
1863 * succeed and -ENOMEM implies there is not.
1864 *
1865 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1866 * if the capability is granted, but __vm_enough_memory requires 1 if
1867 * the capability is granted.
1868 *
1869 * Do not audit the selinux permission check, as this is applied to all
1870 * processes that allocate mappings.
1871 */
1872 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1873 {
1874 int rc, cap_sys_admin = 0;
1875 struct task_security_struct *tsec = current->security;
1876
1877 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1878 if (rc == 0)
1879 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1880 SECCLASS_CAPABILITY,
1881 CAP_TO_MASK(CAP_SYS_ADMIN),
1882 0,
1883 NULL);
1884
1885 if (rc == 0)
1886 cap_sys_admin = 1;
1887
1888 return __vm_enough_memory(mm, pages, cap_sys_admin);
1889 }
1890
1891 /* binprm security operations */
1892
1893 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1894 {
1895 struct bprm_security_struct *bsec;
1896
1897 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1898 if (!bsec)
1899 return -ENOMEM;
1900
1901 bsec->bprm = bprm;
1902 bsec->sid = SECINITSID_UNLABELED;
1903 bsec->set = 0;
1904
1905 bprm->security = bsec;
1906 return 0;
1907 }
1908
1909 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1910 {
1911 struct task_security_struct *tsec;
1912 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1913 struct inode_security_struct *isec;
1914 struct bprm_security_struct *bsec;
1915 u32 newsid;
1916 struct avc_audit_data ad;
1917 int rc;
1918
1919 rc = secondary_ops->bprm_set_security(bprm);
1920 if (rc)
1921 return rc;
1922
1923 bsec = bprm->security;
1924
1925 if (bsec->set)
1926 return 0;
1927
1928 tsec = current->security;
1929 isec = inode->i_security;
1930
1931 /* Default to the current task SID. */
1932 bsec->sid = tsec->sid;
1933
1934 /* Reset fs, key, and sock SIDs on execve. */
1935 tsec->create_sid = 0;
1936 tsec->keycreate_sid = 0;
1937 tsec->sockcreate_sid = 0;
1938
1939 if (tsec->exec_sid) {
1940 newsid = tsec->exec_sid;
1941 /* Reset exec SID on execve. */
1942 tsec->exec_sid = 0;
1943 } else {
1944 /* Check for a default transition on this program. */
1945 rc = security_transition_sid(tsec->sid, isec->sid,
1946 SECCLASS_PROCESS, &newsid);
1947 if (rc)
1948 return rc;
1949 }
1950
1951 AVC_AUDIT_DATA_INIT(&ad, FS);
1952 ad.u.fs.path = bprm->file->f_path;
1953
1954 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1955 newsid = tsec->sid;
1956
1957 if (tsec->sid == newsid) {
1958 rc = avc_has_perm(tsec->sid, isec->sid,
1959 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1960 if (rc)
1961 return rc;
1962 } else {
1963 /* Check permissions for the transition. */
1964 rc = avc_has_perm(tsec->sid, newsid,
1965 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1966 if (rc)
1967 return rc;
1968
1969 rc = avc_has_perm(newsid, isec->sid,
1970 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1971 if (rc)
1972 return rc;
1973
1974 /* Clear any possibly unsafe personality bits on exec: */
1975 current->personality &= ~PER_CLEAR_ON_SETID;
1976
1977 /* Set the security field to the new SID. */
1978 bsec->sid = newsid;
1979 }
1980
1981 bsec->set = 1;
1982 return 0;
1983 }
1984
1985 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1986 {
1987 return secondary_ops->bprm_check_security(bprm);
1988 }
1989
1990
1991 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1992 {
1993 struct task_security_struct *tsec = current->security;
1994 int atsecure = 0;
1995
1996 if (tsec->osid != tsec->sid) {
1997 /* Enable secure mode for SIDs transitions unless
1998 the noatsecure permission is granted between
1999 the two SIDs, i.e. ahp returns 0. */
2000 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2001 SECCLASS_PROCESS,
2002 PROCESS__NOATSECURE, NULL);
2003 }
2004
2005 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2006 }
2007
2008 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2009 {
2010 kfree(bprm->security);
2011 bprm->security = NULL;
2012 }
2013
2014 extern struct vfsmount *selinuxfs_mount;
2015 extern struct dentry *selinux_null;
2016
2017 /* Derived from fs/exec.c:flush_old_files. */
2018 static inline void flush_unauthorized_files(struct files_struct * files)
2019 {
2020 struct avc_audit_data ad;
2021 struct file *file, *devnull = NULL;
2022 struct tty_struct *tty;
2023 struct fdtable *fdt;
2024 long j = -1;
2025 int drop_tty = 0;
2026
2027 mutex_lock(&tty_mutex);
2028 tty = get_current_tty();
2029 if (tty) {
2030 lock_list_for_each_entry(file,
2031 percpu_list_head(&tty->tty_files),
2032 f_u.fu_llist)
2033 break;
2034
2035 if (file) {
2036 /* Revalidate access to controlling tty.
2037 Use inode_has_perm on the tty inode directly rather
2038 than using file_has_perm, as this particular open
2039 file may belong to another process and we are only
2040 interested in the inode-based check here. */
2041 struct inode *inode = file->f_path.dentry->d_inode;
2042 if (inode_has_perm(current, inode,
2043 FILE__READ | FILE__WRITE, NULL)) {
2044 drop_tty = 1;
2045 }
2046 lock_list_for_each_entry_stop(file, f_u.fu_llist);
2047 }
2048 }
2049 mutex_unlock(&tty_mutex);
2050 /* Reset controlling tty. */
2051 if (drop_tty)
2052 no_tty();
2053
2054 /* Revalidate access to inherited open files. */
2055
2056 AVC_AUDIT_DATA_INIT(&ad,FS);
2057
2058 spin_lock(&files->file_lock);
2059 for (;;) {
2060 unsigned long set, i;
2061 int fd;
2062
2063 j++;
2064 i = j * __NFDBITS;
2065 fdt = files_fdtable(files);
2066 if (i >= fdt->max_fds)
2067 break;
2068 set = fdt->open_fds->fds_bits[j];
2069 if (!set)
2070 continue;
2071 spin_unlock(&files->file_lock);
2072 for ( ; set ; i++,set >>= 1) {
2073 if (set & 1) {
2074 file = fget(i);
2075 if (!file)
2076 continue;
2077 if (file_has_perm(current,
2078 file,
2079 file_to_av(file))) {
2080 sys_close(i);
2081 fd = get_unused_fd();
2082 if (fd != i) {
2083 if (fd >= 0)
2084 put_unused_fd(fd);
2085 fput(file);
2086 continue;
2087 }
2088 if (devnull) {
2089 get_file(devnull);
2090 } else {
2091 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2092 if (IS_ERR(devnull)) {
2093 devnull = NULL;
2094 put_unused_fd(fd);
2095 fput(file);
2096 continue;
2097 }
2098 }
2099 fd_install(fd, devnull);
2100 }
2101 fput(file);
2102 }
2103 }
2104 spin_lock(&files->file_lock);
2105
2106 }
2107 spin_unlock(&files->file_lock);
2108 }
2109
2110 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2111 {
2112 struct task_security_struct *tsec;
2113 struct bprm_security_struct *bsec;
2114 u32 sid;
2115 int rc;
2116
2117 secondary_ops->bprm_apply_creds(bprm, unsafe);
2118
2119 tsec = current->security;
2120
2121 bsec = bprm->security;
2122 sid = bsec->sid;
2123
2124 tsec->osid = tsec->sid;
2125 bsec->unsafe = 0;
2126 if (tsec->sid != sid) {
2127 /* Check for shared state. If not ok, leave SID
2128 unchanged and kill. */
2129 if (unsafe & LSM_UNSAFE_SHARE) {
2130 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2131 PROCESS__SHARE, NULL);
2132 if (rc) {
2133 bsec->unsafe = 1;
2134 return;
2135 }
2136 }
2137
2138 /* Check for ptracing, and update the task SID if ok.
2139 Otherwise, leave SID unchanged and kill. */
2140 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2141 rc = avc_has_perm(tsec->ptrace_sid, sid,
2142 SECCLASS_PROCESS, PROCESS__PTRACE,
2143 NULL);
2144 if (rc) {
2145 bsec->unsafe = 1;
2146 return;
2147 }
2148 }
2149 tsec->sid = sid;
2150 }
2151 }
2152
2153 /*
2154 * called after apply_creds without the task lock held
2155 */
2156 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2157 {
2158 struct task_security_struct *tsec;
2159 struct rlimit *rlim, *initrlim;
2160 struct itimerval itimer;
2161 struct bprm_security_struct *bsec;
2162 int rc, i;
2163
2164 tsec = current->security;
2165 bsec = bprm->security;
2166
2167 if (bsec->unsafe) {
2168 force_sig_specific(SIGKILL, current);
2169 return;
2170 }
2171 if (tsec->osid == tsec->sid)
2172 return;
2173
2174 /* Close files for which the new task SID is not authorized. */
2175 flush_unauthorized_files(current->files);
2176
2177 /* Check whether the new SID can inherit signal state
2178 from the old SID. If not, clear itimers to avoid
2179 subsequent signal generation and flush and unblock
2180 signals. This must occur _after_ the task SID has
2181 been updated so that any kill done after the flush
2182 will be checked against the new SID. */
2183 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2184 PROCESS__SIGINH, NULL);
2185 if (rc) {
2186 memset(&itimer, 0, sizeof itimer);
2187 for (i = 0; i < 3; i++)
2188 do_setitimer(i, &itimer, NULL);
2189 flush_signals(current);
2190 spin_lock_irq(¤t->sighand->siglock);
2191 flush_signal_handlers(current, 1);
2192 sigemptyset(¤t->blocked);
2193 recalc_sigpending();
2194 spin_unlock_irq(¤t->sighand->siglock);
2195 }
2196
2197 /* Always clear parent death signal on SID transitions. */
2198 current->pdeath_signal = 0;
2199
2200 /* Check whether the new SID can inherit resource limits
2201 from the old SID. If not, reset all soft limits to
2202 the lower of the current task's hard limit and the init
2203 task's soft limit. Note that the setting of hard limits
2204 (even to lower them) can be controlled by the setrlimit
2205 check. The inclusion of the init task's soft limit into
2206 the computation is to avoid resetting soft limits higher
2207 than the default soft limit for cases where the default
2208 is lower than the hard limit, e.g. RLIMIT_CORE or
2209 RLIMIT_STACK.*/
2210 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2211 PROCESS__RLIMITINH, NULL);
2212 if (rc) {
2213 for (i = 0; i < RLIM_NLIMITS; i++) {
2214 rlim = current->signal->rlim + i;
2215 initrlim = init_task.signal->rlim+i;
2216 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2217 }
2218 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2219 /*
2220 * This will cause RLIMIT_CPU calculations
2221 * to be refigured.
2222 */
2223 current->it_prof_expires = jiffies_to_cputime(1);
2224 }
2225 }
2226
2227 /* Wake up the parent if it is waiting so that it can
2228 recheck wait permission to the new task SID. */
2229 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
2230 }
2231
2232 /* superblock security operations */
2233
2234 static int selinux_sb_alloc_security(struct super_block *sb)
2235 {
2236 return superblock_alloc_security(sb);
2237 }
2238
2239 static void selinux_sb_free_security(struct super_block *sb)
2240 {
2241 superblock_free_security(sb);
2242 }
2243
2244 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2245 {
2246 if (plen > olen)
2247 return 0;
2248
2249 return !memcmp(prefix, option, plen);
2250 }
2251
2252 static inline int selinux_option(char *option, int len)
2253 {
2254 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
2255 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
2256 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
2257 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
2258 }
2259
2260 static inline void take_option(char **to, char *from, int *first, int len)
2261 {
2262 if (!*first) {
2263 **to = ',';
2264 *to += 1;
2265 } else
2266 *first = 0;
2267 memcpy(*to, from, len);
2268 *to += len;
2269 }
2270
2271 static inline void take_selinux_option(char **to, char *from, int *first,
2272 int len)
2273 {
2274 int current_size = 0;
2275
2276 if (!*first) {
2277 **to = '|';
2278 *to += 1;
2279 }
2280 else
2281 *first = 0;
2282
2283 while (current_size < len) {
2284 if (*from != '"') {
2285 **to = *from;
2286 *to += 1;
2287 }
2288 from += 1;
2289 current_size += 1;
2290 }
2291 }
2292
2293 static int selinux_sb_copy_data(char *orig, char *copy)
2294 {
2295 int fnosec, fsec, rc = 0;
2296 char *in_save, *in_curr, *in_end;
2297 char *sec_curr, *nosec_save, *nosec;
2298 int open_quote = 0;
2299
2300 in_curr = orig;
2301 sec_curr = copy;
2302
2303 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2304 if (!nosec) {
2305 rc = -ENOMEM;
2306 goto out;
2307 }
2308
2309 nosec_save = nosec;
2310 fnosec = fsec = 1;
2311 in_save = in_end = orig;
2312
2313 do {
2314 if (*in_end == '"')
2315 open_quote = !open_quote;
2316 if ((*in_end == ',' && open_quote == 0) ||
2317 *in_end == '\0') {
2318 int len = in_end - in_curr;
2319
2320 if (selinux_option(in_curr, len))
2321 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2322 else
2323 take_option(&nosec, in_curr, &fnosec, len);
2324
2325 in_curr = in_end + 1;
2326 }
2327 } while (*in_end++);
2328
2329 strcpy(in_save, nosec_save);
2330 free_page((unsigned long)nosec_save);
2331 out:
2332 return rc;
2333 }
2334
2335 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2336 {
2337 struct avc_audit_data ad;
2338 int rc;
2339
2340 rc = superblock_doinit(sb, data);
2341 if (rc)
2342 return rc;
2343
2344 AVC_AUDIT_DATA_INIT(&ad,FS);
2345 ad.u.fs.path.dentry = sb->s_root;
2346 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2347 }
2348
2349 static int selinux_sb_statfs(struct dentry *dentry)
2350 {
2351 struct avc_audit_data ad;
2352
2353 AVC_AUDIT_DATA_INIT(&ad,FS);
2354 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2355 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2356 }
2357
2358 static int selinux_mount(char * dev_name,
2359 struct nameidata *nd,
2360 char * type,
2361 unsigned long flags,
2362 void * data)
2363 {
2364 int rc;
2365
2366 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2367 if (rc)
2368 return rc;
2369
2370 if (flags & MS_REMOUNT)
2371 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2372 FILESYSTEM__REMOUNT, NULL);
2373 else
2374 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2375 FILE__MOUNTON);
2376 }
2377
2378 static int selinux_umount(struct vfsmount *mnt, int flags)
2379 {
2380 int rc;
2381
2382 rc = secondary_ops->sb_umount(mnt, flags);
2383 if (rc)
2384 return rc;
2385
2386 return superblock_has_perm(current,mnt->mnt_sb,
2387 FILESYSTEM__UNMOUNT,NULL);
2388 }
2389
2390 /* inode security operations */
2391
2392 static int selinux_inode_alloc_security(struct inode *inode)
2393 {
2394 return inode_alloc_security(inode);
2395 }
2396
2397 static void selinux_inode_free_security(struct inode *inode)
2398 {
2399 inode_free_security(inode);
2400 }
2401
2402 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2403 char **name, void **value,
2404 size_t *len)
2405 {
2406 struct task_security_struct *tsec;
2407 struct inode_security_struct *dsec;
2408 struct superblock_security_struct *sbsec;
2409 u32 newsid, clen;
2410 int rc;
2411 char *namep = NULL, *context;
2412
2413 tsec = current->security;
2414 dsec = dir->i_security;
2415 sbsec = dir->i_sb->s_security;
2416
2417 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2418 newsid = tsec->create_sid;
2419 } else {
2420 rc = security_transition_sid(tsec->sid, dsec->sid,
2421 inode_mode_to_security_class(inode->i_mode),
2422 &newsid);
2423 if (rc) {
2424 printk(KERN_WARNING "%s: "
2425 "security_transition_sid failed, rc=%d (dev=%s "
2426 "ino=%ld)\n",
2427 __FUNCTION__,
2428 -rc, inode->i_sb->s_id, inode->i_ino);
2429 return rc;
2430 }
2431 }
2432
2433 /* Possibly defer initialization to selinux_complete_init. */
2434 if (sbsec->initialized) {
2435 struct inode_security_struct *isec = inode->i_security;
2436 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2437 isec->sid = newsid;
2438 isec->initialized = 1;
2439 }
2440
2441 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2442 return -EOPNOTSUPP;
2443
2444 if (name) {
2445 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2446 if (!namep)
2447 return -ENOMEM;
2448 *name = namep;
2449 }
2450
2451 if (value && len) {
2452 rc = security_sid_to_context(newsid, &context, &clen);
2453 if (rc) {
2454 kfree(namep);
2455 return rc;
2456 }
2457 *value = context;
2458 *len = clen;
2459 }
2460
2461 return 0;
2462 }
2463
2464 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2465 {
2466 return may_create(dir, dentry, SECCLASS_FILE);
2467 }
2468
2469 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2470 {
2471 int rc;
2472
2473 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2474 if (rc)
2475 return rc;
2476 return may_link(dir, old_dentry, MAY_LINK);
2477 }
2478
2479 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2480 {
2481 int rc;
2482
2483 rc = secondary_ops->inode_unlink(dir, dentry);
2484 if (rc)
2485 return rc;
2486 return may_link(dir, dentry, MAY_UNLINK);
2487 }
2488
2489 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2490 {
2491 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2492 }
2493
2494 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2495 {
2496 return may_create(dir, dentry, SECCLASS_DIR);
2497 }
2498
2499 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2500 {
2501 return may_link(dir, dentry, MAY_RMDIR);
2502 }
2503
2504 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2505 {
2506 int rc;
2507
2508 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2509 if (rc)
2510 return rc;
2511
2512 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2513 }
2514
2515 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2516 struct inode *new_inode, struct dentry *new_dentry)
2517 {
2518 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2519 }
2520
2521 static int selinux_inode_readlink(struct dentry *dentry)
2522 {
2523 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2524 }
2525
2526 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2527 {
2528 int rc;
2529
2530 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2531 if (rc)
2532 return rc;
2533 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2534 }
2535
2536 static int selinux_inode_permission(struct inode *inode, int mask,
2537 struct nameidata *nd)
2538 {
2539 int rc;
2540
2541 rc = secondary_ops->inode_permission(inode, mask, nd);
2542 if (rc)
2543 return rc;
2544
2545 if (!mask) {
2546 /* No permission to check. Existence test. */
2547 return 0;
2548 }
2549
2550 return inode_has_perm(current, inode,
2551 file_mask_to_av(inode->i_mode, mask), NULL);
2552 }
2553
2554 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2555 {
2556 int rc;
2557
2558 rc = secondary_ops->inode_setattr(dentry, iattr);
2559 if (rc)
2560 return rc;
2561
2562 if (iattr->ia_valid & ATTR_FORCE)
2563 return 0;
2564
2565 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2566 ATTR_ATIME_SET | ATTR_MTIME_SET))
2567 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2568
2569 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2570 }
2571
2572 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2573 {
2574 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2575 }
2576
2577 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2578 {
2579 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2580 sizeof XATTR_SECURITY_PREFIX - 1)) {
2581 if (!strcmp(name, XATTR_NAME_CAPS)) {
2582 if (!capable(CAP_SETFCAP))
2583 return -EPERM;
2584 } else if (!capable(CAP_SYS_ADMIN)) {
2585 /* A different attribute in the security namespace.
2586 Restrict to administrator. */
2587 return -EPERM;
2588 }
2589 }
2590
2591 /* Not an attribute we recognize, so just check the
2592 ordinary setattr permission. */
2593 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2594 }
2595
2596 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2597 {
2598 struct task_security_struct *tsec = current->security;
2599 struct inode *inode = dentry->d_inode;
2600 struct inode_security_struct *isec = inode->i_security;
2601 struct superblock_security_struct *sbsec;
2602 struct avc_audit_data ad;
2603 u32 newsid;
2604 int rc = 0;
2605
2606 if (strcmp(name, XATTR_NAME_SELINUX))
2607 return selinux_inode_setotherxattr(dentry, name);
2608
2609 sbsec = inode->i_sb->s_security;
2610 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2611 return -EOPNOTSUPP;
2612
2613 if (!is_owner_or_cap(inode))
2614 return -EPERM;
2615
2616 AVC_AUDIT_DATA_INIT(&ad,FS);
2617 ad.u.fs.path.dentry = dentry;
2618
2619 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2620 FILE__RELABELFROM, &ad);
2621 if (rc)
2622 return rc;
2623
2624 rc = security_context_to_sid(value, size, &newsid);
2625 if (rc)
2626 return rc;
2627
2628 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2629 FILE__RELABELTO, &ad);
2630 if (rc)
2631 return rc;
2632
2633 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2634 isec->sclass);
2635 if (rc)
2636 return rc;
2637
2638 return avc_has_perm(newsid,
2639 sbsec->sid,
2640 SECCLASS_FILESYSTEM,
2641 FILESYSTEM__ASSOCIATE,
2642 &ad);
2643 }
2644
2645 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2646 void *value, size_t size, int flags)
2647 {
2648 struct inode *inode = dentry->d_inode;
2649 struct inode_security_struct *isec = inode->i_security;
2650 u32 newsid;
2651 int rc;
2652
2653 if (strcmp(name, XATTR_NAME_SELINUX)) {
2654 /* Not an attribute we recognize, so nothing to do. */
2655 return;
2656 }
2657
2658 rc = security_context_to_sid(value, size, &newsid);
2659 if (rc) {
2660 printk(KERN_WARNING "%s: unable to obtain SID for context "
2661 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2662 return;
2663 }
2664
2665 isec->sid = newsid;
2666 return;
2667 }
2668
2669 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2670 {
2671 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2672 }
2673
2674 static int selinux_inode_listxattr (struct dentry *dentry)
2675 {
2676 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2677 }
2678
2679 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2680 {
2681 if (strcmp(name, XATTR_NAME_SELINUX))
2682 return selinux_inode_setotherxattr(dentry, name);
2683
2684 /* No one is allowed to remove a SELinux security label.
2685 You can change the label, but all data must be labeled. */
2686 return -EACCES;
2687 }
2688
2689 /*
2690 * Copy the in-core inode security context value to the user. If the
2691 * getxattr() prior to this succeeded, check to see if we need to
2692 * canonicalize the value to be finally returned to the user.
2693 *
2694 * Permission check is handled by selinux_inode_getxattr hook.
2695 */
2696 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2697 {
2698 u32 size;
2699 int error;
2700 char *context = NULL;
2701 struct inode_security_struct *isec = inode->i_security;
2702
2703 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2704 return -EOPNOTSUPP;
2705
2706 error = security_sid_to_context(isec->sid, &context, &size);
2707 if (error)
2708 return error;
2709 error = size;
2710 if (alloc) {
2711 *buffer = context;
2712 goto out_nofree;
2713 }
2714 kfree(context);
2715 out_nofree:
2716 return error;
2717 }
2718
2719 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2720 const void *value, size_t size, int flags)
2721 {
2722 struct inode_security_struct *isec = inode->i_security;
2723 u32 newsid;
2724 int rc;
2725
2726 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2727 return -EOPNOTSUPP;
2728
2729 if (!value || !size)
2730 return -EACCES;
2731
2732 rc = security_context_to_sid((void*)value, size, &newsid);
2733 if (rc)
2734 return rc;
2735
2736 isec->sid = newsid;
2737 return 0;
2738 }
2739
2740 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2741 {
2742 const int len = sizeof(XATTR_NAME_SELINUX);
2743 if (buffer && len <= buffer_size)
2744 memcpy(buffer, XATTR_NAME_SELINUX, len);
2745 return len;
2746 }
2747
2748 static int selinux_inode_need_killpriv(struct dentry *dentry)
2749 {
2750 return secondary_ops->inode_need_killpriv(dentry);
2751 }
2752
2753 static int selinux_inode_killpriv(struct dentry *dentry)
2754 {
2755 return secondary_ops->inode_killpriv(dentry);
2756 }
2757
2758 /* file security operations */
2759
2760 static int selinux_revalidate_file_permission(struct file *file, int mask)
2761 {
2762 int rc;
2763 struct inode *inode = file->f_path.dentry->d_inode;
2764
2765 if (!mask) {
2766 /* No permission to check. Existence test. */
2767 return 0;
2768 }
2769
2770 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2771 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2772 mask |= MAY_APPEND;
2773
2774 rc = file_has_perm(current, file,
2775 file_mask_to_av(inode->i_mode, mask));
2776 if (rc)
2777 return rc;
2778
2779 return selinux_netlbl_inode_permission(inode, mask);
2780 }
2781
2782 static int selinux_file_permission(struct file *file, int mask)
2783 {
2784 struct inode *inode = file->f_path.dentry->d_inode;
2785 struct task_security_struct *tsec = current->security;
2786 struct file_security_struct *fsec = file->f_security;
2787 struct inode_security_struct *isec = inode->i_security;
2788
2789 if (!mask) {
2790 /* No permission to check. Existence test. */
2791 return 0;
2792 }
2793
2794 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2795 && fsec->pseqno == avc_policy_seqno())
2796 return selinux_netlbl_inode_permission(inode, mask);
2797
2798 return selinux_revalidate_file_permission(file, mask);
2799 }
2800
2801 static int selinux_file_alloc_security(struct file *file)
2802 {
2803 return file_alloc_security(file);
2804 }
2805
2806 static void selinux_file_free_security(struct file *file)
2807 {
2808 file_free_security(file);
2809 }
2810
2811 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2812 unsigned long arg)
2813 {
2814 int error = 0;
2815
2816 switch (cmd) {
2817 case FIONREAD:
2818 /* fall through */
2819 case FIBMAP:
2820 /* fall through */
2821 case FIGETBSZ:
2822 /* fall through */
2823 case EXT2_IOC_GETFLAGS:
2824 /* fall through */
2825 case EXT2_IOC_GETVERSION:
2826 error = file_has_perm(current, file, FILE__GETATTR);
2827 break;
2828
2829 case EXT2_IOC_SETFLAGS:
2830 /* fall through */
2831 case EXT2_IOC_SETVERSION:
2832 error = file_has_perm(current, file, FILE__SETATTR);
2833 break;
2834
2835 /* sys_ioctl() checks */
2836 case FIONBIO:
2837 /* fall through */
2838 case FIOASYNC:
2839 error = file_has_perm(current, file, 0);
2840 break;
2841
2842 case KDSKBENT:
2843 case KDSKBSENT:
2844 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2845 break;
2846
2847 /* default case assumes that the command will go
2848 * to the file's ioctl() function.
2849 */
2850 default:
2851 error = file_has_perm(current, file, FILE__IOCTL);
2852
2853 }
2854 return error;
2855 }
2856
2857 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2858 {
2859 #ifndef CONFIG_PPC32
2860 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2861 /*
2862 * We are making executable an anonymous mapping or a
2863 * private file mapping that will also be writable.
2864 * This has an additional check.
2865 */
2866 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2867 if (rc)
2868 return rc;
2869 }
2870 #endif
2871
2872 if (file) {
2873 /* read access is always possible with a mapping */
2874 u32 av = FILE__READ;
2875
2876 /* write access only matters if the mapping is shared */
2877 if (shared && (prot & PROT_WRITE))
2878 av |= FILE__WRITE;
2879
2880 if (prot & PROT_EXEC)
2881 av |= FILE__EXECUTE;
2882
2883 return file_has_perm(current, file, av);
2884 }
2885 return 0;
2886 }
2887
2888 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2889 unsigned long prot, unsigned long flags,
2890 unsigned long addr, unsigned long addr_only)
2891 {
2892 int rc = 0;
2893 u32 sid = ((struct task_security_struct*)(current->security))->sid;
2894
2895 if (addr < mmap_min_addr)
2896 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2897 MEMPROTECT__MMAP_ZERO, NULL);
2898 if (rc || addr_only)
2899 return rc;
2900
2901 if (selinux_checkreqprot)
2902 prot = reqprot;
2903
2904 return file_map_prot_check(file, prot,
2905 (flags & MAP_TYPE) == MAP_SHARED);
2906 }
2907
2908 static int selinux_file_mprotect(struct vm_area_struct *vma,
2909 unsigned long reqprot,
2910 unsigned long prot)
2911 {
2912 int rc;
2913
2914 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2915 if (rc)
2916 return rc;
2917
2918 if (selinux_checkreqprot)
2919 prot = reqprot;
2920
2921 #ifndef CONFIG_PPC32
2922 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2923 rc = 0;
2924 if (vma->vm_start >= vma->vm_mm->start_brk &&
2925 vma->vm_end <= vma->vm_mm->brk) {
2926 rc = task_has_perm(current, current,
2927 PROCESS__EXECHEAP);
2928 } else if (!vma->vm_file &&
2929 vma->vm_start <= vma->vm_mm->start_stack &&
2930 vma->vm_end >= vma->vm_mm->start_stack) {
2931 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2932 } else if (vma->vm_file && vma->anon_vma) {
2933 /*
2934 * We are making executable a file mapping that has
2935 * had some COW done. Since pages might have been
2936 * written, check ability to execute the possibly
2937 * modified content. This typically should only
2938 * occur for text relocations.
2939 */
2940 rc = file_has_perm(current, vma->vm_file,
2941 FILE__EXECMOD);
2942 }
2943 if (rc)
2944 return rc;
2945 }
2946 #endif
2947
2948 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2949 }
2950
2951 static int selinux_file_lock(struct file *file, unsigned int cmd)
2952 {
2953 return file_has_perm(current, file, FILE__LOCK);
2954 }
2955
2956 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2957 unsigned long arg)
2958 {
2959 int err = 0;
2960
2961 switch (cmd) {
2962 case F_SETFL:
2963 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2964 err = -EINVAL;
2965 break;
2966 }
2967
2968 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2969 err = file_has_perm(current, file,FILE__WRITE);
2970 break;
2971 }
2972 /* fall through */
2973 case F_SETOWN:
2974 case F_SETSIG:
2975 case F_GETFL:
2976 case F_GETOWN:
2977 case F_GETSIG:
2978 /* Just check FD__USE permission */
2979 err = file_has_perm(current, file, 0);
2980 break;
2981 case F_GETLK:
2982 case F_SETLK:
2983 case F_SETLKW:
2984 #if BITS_PER_LONG == 32
2985 case F_GETLK64:
2986 case F_SETLK64:
2987 case F_SETLKW64:
2988 #endif
2989 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2990 err = -EINVAL;
2991 break;
2992 }
2993 err = file_has_perm(current, file, FILE__LOCK);
2994 break;
2995 }
2996
2997 return err;
2998 }
2999
3000 static int selinux_file_set_fowner(struct file *file)
3001 {
3002 struct task_security_struct *tsec;
3003 struct file_security_struct *fsec;
3004
3005 tsec = current->security;
3006 fsec = file->f_security;
3007 fsec->fown_sid = tsec->sid;
3008
3009 return 0;
3010 }
3011
3012 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3013 struct fown_struct *fown, int signum)
3014 {
3015 struct file *file;
3016 u32 perm;
3017 struct task_security_struct *tsec;
3018 struct file_security_struct *fsec;
3019
3020 /* struct fown_struct is never outside the context of a struct file */
3021 file = container_of(fown, struct file, f_owner);
3022
3023 tsec = tsk->security;
3024 fsec = file->f_security;
3025
3026 if (!signum)
3027 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3028 else
3029 perm = signal_to_av(signum);
3030
3031 return avc_has_perm(fsec->fown_sid, tsec->sid,
3032 SECCLASS_PROCESS, perm, NULL);
3033 }
3034
3035 static int selinux_file_receive(struct file *file)
3036 {
3037 return file_has_perm(current, file, file_to_av(file));
3038 }
3039
3040 static int selinux_dentry_open(struct file *file)
3041 {
3042 struct file_security_struct *fsec;
3043 struct inode *inode;
3044 struct inode_security_struct *isec;
3045 inode = file->f_path.dentry->d_inode;
3046 fsec = file->f_security;
3047 isec = inode->i_security;
3048 /*
3049 * Save inode label and policy sequence number
3050 * at open-time so that selinux_file_permission
3051 * can determine whether revalidation is necessary.
3052 * Task label is already saved in the file security
3053 * struct as its SID.
3054 */
3055 fsec->isid = isec->sid;
3056 fsec->pseqno = avc_policy_seqno();
3057 /*
3058 * Since the inode label or policy seqno may have changed
3059 * between the selinux_inode_permission check and the saving
3060 * of state above, recheck that access is still permitted.
3061 * Otherwise, access might never be revalidated against the
3062 * new inode label or new policy.
3063 * This check is not redundant - do not remove.
3064 */
3065 return inode_has_perm(current, inode, file_to_av(file), NULL);
3066 }
3067
3068 /* task security operations */
3069
3070 static int selinux_task_create(unsigned long clone_flags)
3071 {
3072 int rc;
3073
3074 rc = secondary_ops->task_create(clone_flags);
3075 if (rc)
3076 return rc;
3077
3078 return task_has_perm(current, current, PROCESS__FORK);
3079 }
3080
3081 static int selinux_task_alloc_security(struct task_struct *tsk)
3082 {
3083 struct task_security_struct *tsec1, *tsec2;
3084 int rc;
3085
3086 tsec1 = current->security;
3087
3088 rc = task_alloc_security(tsk);
3089 if (rc)
3090 return rc;
3091 tsec2 = tsk->security;
3092
3093 tsec2->osid = tsec1->osid;
3094 tsec2->sid = tsec1->sid;
3095
3096 /* Retain the exec, fs, key, and sock SIDs across fork */
3097 tsec2->exec_sid = tsec1->exec_sid;
3098 tsec2->create_sid = tsec1->create_sid;
3099 tsec2->keycreate_sid = tsec1->keycreate_sid;
3100 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3101
3102 /* Retain ptracer SID across fork, if any.
3103 This will be reset by the ptrace hook upon any
3104 subsequent ptrace_attach operations. */
3105 tsec2->ptrace_sid = tsec1->ptrace_sid;
3106
3107 return 0;
3108 }
3109
3110 static void selinux_task_free_security(struct task_struct *tsk)
3111 {
3112 task_free_security(tsk);
3113 }
3114
3115 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3116 {
3117 /* Since setuid only affects the current process, and
3118 since the SELinux controls are not based on the Linux
3119 identity attributes, SELinux does not need to control
3120 this operation. However, SELinux does control the use
3121 of the CAP_SETUID and CAP_SETGID capabilities using the
3122 capable hook. */
3123 return 0;
3124 }
3125
3126 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3127 {
3128 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3129 }
3130
3131 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3132 {
3133 /* See the comment for setuid above. */
3134 return 0;
3135 }
3136
3137 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3138 {
3139 return task_has_perm(current, p, PROCESS__SETPGID);
3140 }
3141
3142 static int selinux_task_getpgid(struct task_struct *p)
3143 {
3144 return task_has_perm(current, p, PROCESS__GETPGID);
3145 }
3146
3147 static int selinux_task_getsid(struct task_struct *p)
3148 {
3149 return task_has_perm(current, p, PROCESS__GETSESSION);
3150 }
3151
3152 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3153 {
3154 selinux_get_task_sid(p, secid);
3155 }
3156
3157 static int selinux_task_setgroups(struct group_info *group_info)
3158 {
3159 /* See the comment for setuid above. */
3160 return 0;
3161 }
3162
3163 static int selinux_task_setnice(struct task_struct *p, int nice)
3164 {
3165 int rc;
3166
3167 rc = secondary_ops->task_setnice(p, nice);
3168 if (rc)
3169 return rc;
3170
3171 return task_has_perm(current,p, PROCESS__SETSCHED);
3172 }
3173
3174 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3175 {
3176 int rc;
3177
3178 rc = secondary_ops->task_setioprio(p, ioprio);
3179 if (rc)
3180 return rc;
3181
3182 return task_has_perm(current, p, PROCESS__SETSCHED);
3183 }
3184
3185 static int selinux_task_getioprio(struct task_struct *p)
3186 {
3187 return task_has_perm(current, p, PROCESS__GETSCHED);
3188 }
3189
3190 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3191 {
3192 struct rlimit *old_rlim = current->signal->rlim + resource;
3193 int rc;
3194
3195 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3196 if (rc)
3197 return rc;
3198
3199 /* Control the ability to change the hard limit (whether
3200 lowering or raising it), so that the hard limit can
3201 later be used as a safe reset point for the soft limit
3202 upon context transitions. See selinux_bprm_apply_creds. */
3203 if (old_rlim->rlim_max != new_rlim->rlim_max)
3204 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3205
3206 return 0;
3207 }
3208
3209 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3210 {
3211 int rc;
3212
3213 rc = secondary_ops->task_setscheduler(p, policy, lp);
3214 if (rc)
3215 return rc;
3216
3217 return task_has_perm(current, p, PROCESS__SETSCHED);
3218 }
3219
3220 static int selinux_task_getscheduler(struct task_struct *p)
3221 {
3222 return task_has_perm(current, p, PROCESS__GETSCHED);
3223 }
3224
3225 static int selinux_task_movememory(struct task_struct *p)
3226 {
3227 return task_has_perm(current, p, PROCESS__SETSCHED);
3228 }
3229
3230 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3231 int sig, u32 secid)
3232 {
3233 u32 perm;
3234 int rc;
3235 struct task_security_struct *tsec;
3236
3237 rc = secondary_ops->task_kill(p, info, sig, secid);
3238 if (rc)
3239 return rc;
3240
3241 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3242 return 0;
3243
3244 if (!sig)
3245 perm = PROCESS__SIGNULL; /* null signal; existence test */
3246 else
3247 perm = signal_to_av(sig);
3248 tsec = p->security;
3249 if (secid)
3250 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3251 else
3252 rc = task_has_perm(current, p, perm);
3253 return rc;
3254 }
3255
3256 static int selinux_task_prctl(int option,
3257 unsigned long arg2,
3258 unsigned long arg3,
3259 unsigned long arg4,
3260 unsigned long arg5)
3261 {
3262 /* The current prctl operations do not appear to require
3263 any SELinux controls since they merely observe or modify
3264 the state of the current process. */
3265 return 0;
3266 }
3267
3268 static int selinux_task_wait(struct task_struct *p)
3269 {
3270 return task_has_perm(p, current, PROCESS__SIGCHLD);
3271 }
3272
3273 static void selinux_task_reparent_to_init(struct task_struct *p)
3274 {
3275 struct task_security_struct *tsec;
3276
3277 secondary_ops->task_reparent_to_init(p);
3278
3279 tsec = p->security;
3280 tsec->osid = tsec->sid;
3281 tsec->sid = SECINITSID_KERNEL;
3282 return;
3283 }
3284
3285 static void selinux_task_to_inode(struct task_struct *p,
3286 struct inode *inode)
3287 {
3288 struct task_security_struct *tsec = p->security;
3289 struct inode_security_struct *isec = inode->i_security;
3290
3291 isec->sid = tsec->sid;
3292 isec->initialized = 1;
3293 return;
3294 }
3295
3296 /* Returns error only if unable to parse addresses */
3297 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3298 struct avc_audit_data *ad, u8 *proto)
3299 {
3300 int offset, ihlen, ret = -EINVAL;
3301 struct iphdr _iph, *ih;
3302
3303 offset = skb_network_offset(skb);
3304 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3305 if (ih == NULL)
3306 goto out;
3307
3308 ihlen = ih->ihl * 4;
3309 if (ihlen < sizeof(_iph))
3310 goto out;
3311
3312 ad->u.net.v4info.saddr = ih->saddr;
3313 ad->u.net.v4info.daddr = ih->daddr;
3314 ret = 0;
3315
3316 if (proto)
3317 *proto = ih->protocol;
3318
3319 switch (ih->protocol) {
3320 case IPPROTO_TCP: {
3321 struct tcphdr _tcph, *th;
3322
3323 if (ntohs(ih->frag_off) & IP_OFFSET)
3324 break;
3325
3326 offset += ihlen;
3327 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3328 if (th == NULL)
3329 break;
3330
3331 ad->u.net.sport = th->source;
3332 ad->u.net.dport = th->dest;
3333 break;
3334 }
3335
3336 case IPPROTO_UDP: {
3337 struct udphdr _udph, *uh;
3338
3339 if (ntohs(ih->frag_off) & IP_OFFSET)
3340 break;
3341
3342 offset += ihlen;
3343 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3344 if (uh == NULL)
3345 break;
3346
3347 ad->u.net.sport = uh->source;
3348 ad->u.net.dport = uh->dest;
3349 break;
3350 }
3351
3352 case IPPROTO_DCCP: {
3353 struct dccp_hdr _dccph, *dh;
3354
3355 if (ntohs(ih->frag_off) & IP_OFFSET)
3356 break;
3357
3358 offset += ihlen;
3359 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3360 if (dh == NULL)
3361 break;
3362
3363 ad->u.net.sport = dh->dccph_sport;
3364 ad->u.net.dport = dh->dccph_dport;
3365 break;
3366 }
3367
3368 default:
3369 break;
3370 }
3371 out:
3372 return ret;
3373 }
3374
3375 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3376
3377 /* Returns error only if unable to parse addresses */
3378 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3379 struct avc_audit_data *ad, u8 *proto)
3380 {
3381 u8 nexthdr;
3382 int ret = -EINVAL, offset;
3383 struct ipv6hdr _ipv6h, *ip6;
3384
3385 offset = skb_network_offset(skb);
3386 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3387 if (ip6 == NULL)
3388 goto out;
3389
3390 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3391 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3392 ret = 0;
3393
3394 nexthdr = ip6->nexthdr;
3395 offset += sizeof(_ipv6h);
3396 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3397 if (offset < 0)
3398 goto out;
3399
3400 if (proto)
3401 *proto = nexthdr;
3402
3403 switch (nexthdr) {
3404 case IPPROTO_TCP: {
3405 struct tcphdr _tcph, *th;
3406
3407 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3408 if (th == NULL)
3409 break;
3410
3411 ad->u.net.sport = th->source;
3412 ad->u.net.dport = th->dest;
3413 break;
3414 }
3415
3416 case IPPROTO_UDP: {
3417 struct udphdr _udph, *uh;
3418
3419 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3420 if (uh == NULL)
3421 break;
3422
3423 ad->u.net.sport = uh->source;
3424 ad->u.net.dport = uh->dest;
3425 break;
3426 }
3427
3428 case IPPROTO_DCCP: {
3429 struct dccp_hdr _dccph, *dh;
3430
3431 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3432 if (dh == NULL)
3433 break;
3434
3435 ad->u.net.sport = dh->dccph_sport;
3436 ad->u.net.dport = dh->dccph_dport;
3437 break;
3438 }
3439
3440 /* includes fragments */
3441 default:
3442 break;
3443 }
3444 out:
3445 return ret;
3446 }
3447
3448 #endif /* IPV6 */
3449
3450 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3451 char **addrp, int src, u8 *proto)
3452 {
3453 int ret = 0;
3454
3455 switch (ad->u.net.family) {
3456 case PF_INET:
3457 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3458 if (ret || !addrp)
3459 break;
3460 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3461 &ad->u.net.v4info.daddr);
3462 break;
3463
3464 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3465 case PF_INET6:
3466 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3467 if (ret || !addrp)
3468 break;
3469 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3470 &ad->u.net.v6info.daddr);
3471 break;
3472 #endif /* IPV6 */
3473 default:
3474 break;
3475 }
3476
3477 if (unlikely(ret))
3478 printk(KERN_WARNING
3479 "SELinux: failure in selinux_parse_skb(),"
3480 " unable to parse packet\n");
3481
3482 return ret;
3483 }
3484
3485 /**
3486 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3487 * @skb: the packet
3488 * @family: protocol family
3489 * @sid: the packet's peer label SID
3490 *
3491 * Description:
3492 * Check the various different forms of network peer labeling and determine
3493 * the peer label/SID for the packet; most of the magic actually occurs in
3494 * the security server function security_net_peersid_cmp(). The function
3495 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3496 * or -EACCES if @sid is invalid due to inconsistencies with the different
3497 * peer labels.
3498 *
3499 */
3500 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3501 {
3502 int err;
3503 u32 xfrm_sid;
3504 u32 nlbl_sid;
3505 u32 nlbl_type;
3506
3507 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3508 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3509
3510 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3511 if (unlikely(err)) {
3512 printk(KERN_WARNING
3513 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3514 " unable to determine packet's peer label\n");
3515 return -EACCES;
3516 }
3517
3518 return 0;
3519 }
3520
3521 /* socket security operations */
3522 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3523 u32 perms)
3524 {
3525 struct inode_security_struct *isec;
3526 struct task_security_struct *tsec;
3527 struct avc_audit_data ad;
3528 int err = 0;
3529
3530 tsec = task->security;
3531 isec = SOCK_INODE(sock)->i_security;
3532
3533 if (isec->sid == SECINITSID_KERNEL)
3534 goto out;
3535
3536 AVC_AUDIT_DATA_INIT(&ad,NET);
3537 ad.u.net.sk = sock->sk;
3538 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3539
3540 out:
3541 return err;
3542 }
3543
3544 static int selinux_socket_create(int family, int type,
3545 int protocol, int kern)
3546 {
3547 int err = 0;
3548 struct task_security_struct *tsec;
3549 u32 newsid;
3550
3551 if (kern)
3552 goto out;
3553
3554 tsec = current->security;
3555 newsid = tsec->sockcreate_sid ? : tsec->sid;
3556 err = avc_has_perm(tsec->sid, newsid,
3557 socket_type_to_security_class(family, type,
3558 protocol), SOCKET__CREATE, NULL);
3559
3560 out:
3561 return err;
3562 }
3563
3564 static int selinux_socket_post_create(struct socket *sock, int family,
3565 int type, int protocol, int kern)
3566 {
3567 int err = 0;
3568 struct inode_security_struct *isec;
3569 struct task_security_struct *tsec;
3570 struct sk_security_struct *sksec;
3571 u32 newsid;
3572
3573 isec = SOCK_INODE(sock)->i_security;
3574
3575 tsec = current->security;
3576 newsid = tsec->sockcreate_sid ? : tsec->sid;
3577 isec->sclass = socket_type_to_security_class(family, type, protocol);
3578 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3579 isec->initialized = 1;
3580
3581 if (sock->sk) {
3582 sksec = sock->sk->sk_security;
3583 sksec->sid = isec->sid;
3584 sksec->sclass = isec->sclass;
3585 err = selinux_netlbl_socket_post_create(sock);
3586 }
3587
3588 return err;
3589 }
3590
3591 /* Range of port numbers used to automatically bind.
3592 Need to determine whether we should perform a name_bind
3593 permission check between the socket and the port number. */
3594
3595 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3596 {
3597 u16 family;
3598 int err;
3599
3600 err = socket_has_perm(current, sock, SOCKET__BIND);
3601 if (err)
3602 goto out;
3603
3604 /*
3605 * If PF_INET or PF_INET6, check name_bind permission for the port.
3606 * Multiple address binding for SCTP is not supported yet: we just
3607 * check the first address now.
3608 */
3609 family = sock->sk->sk_family;
3610 if (family == PF_INET || family == PF_INET6) {
3611 char *addrp;
3612 struct inode_security_struct *isec;
3613 struct task_security_struct *tsec;
3614 struct avc_audit_data ad;
3615 struct sockaddr_in *addr4 = NULL;
3616 struct sockaddr_in6 *addr6 = NULL;
3617 unsigned short snum;
3618 struct sock *sk = sock->sk;
3619 u32 sid, node_perm, addrlen;
3620
3621 tsec = current->security;
3622 isec = SOCK_INODE(sock)->i_security;
3623
3624 if (family == PF_INET) {
3625 addr4 = (struct sockaddr_in *)address;
3626 snum = ntohs(addr4->sin_port);
3627 addrlen = sizeof(addr4->sin_addr.s_addr);
3628 addrp = (char *)&addr4->sin_addr.s_addr;
3629 } else {
3630 addr6 = (struct sockaddr_in6 *)address;
3631 snum = ntohs(addr6->sin6_port);
3632 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3633 addrp = (char *)&addr6->sin6_addr.s6_addr;
3634 }
3635
3636 if (snum) {
3637 int low, high;
3638
3639 inet_get_local_port_range(&low, &high);
3640
3641 if (snum < max(PROT_SOCK, low) || snum > high) {
3642 err = security_port_sid(sk->sk_family,
3643 sk->sk_type,
3644 sk->sk_protocol, snum,
3645 &sid);
3646 if (err)
3647 goto out;
3648 AVC_AUDIT_DATA_INIT(&ad,NET);
3649 ad.u.net.sport = htons(snum);
3650 ad.u.net.family = family;
3651 err = avc_has_perm(isec->sid, sid,
3652 isec->sclass,
3653 SOCKET__NAME_BIND, &ad);
3654 if (err)
3655 goto out;
3656 }
3657 }
3658
3659 switch(isec->sclass) {
3660 case SECCLASS_TCP_SOCKET:
3661 node_perm = TCP_SOCKET__NODE_BIND;
3662 break;
3663
3664 case SECCLASS_UDP_SOCKET:
3665 node_perm = UDP_SOCKET__NODE_BIND;
3666 break;
3667
3668 case SECCLASS_DCCP_SOCKET:
3669 node_perm = DCCP_SOCKET__NODE_BIND;
3670 break;
3671
3672 default:
3673 node_perm = RAWIP_SOCKET__NODE_BIND;
3674 break;
3675 }
3676
3677 err = sel_netnode_sid(addrp, family, &sid);
3678 if (err)
3679 goto out;
3680
3681 AVC_AUDIT_DATA_INIT(&ad,NET);
3682 ad.u.net.sport = htons(snum);
3683 ad.u.net.family = family;
3684
3685 if (family == PF_INET)
3686 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3687 else
3688 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3689
3690 err = avc_has_perm(isec->sid, sid,
3691 isec->sclass, node_perm, &ad);
3692 if (err)
3693 goto out;
3694 }
3695 out:
3696 return err;
3697 }
3698
3699 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3700 {
3701 struct inode_security_struct *isec;
3702 int err;
3703
3704 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3705 if (err)
3706 return err;
3707
3708 /*
3709 * If a TCP or DCCP socket, check name_connect permission for the port.
3710 */
3711 isec = SOCK_INODE(sock)->i_security;
3712 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3713 isec->sclass == SECCLASS_DCCP_SOCKET) {
3714 struct sock *sk = sock->sk;
3715 struct avc_audit_data ad;
3716 struct sockaddr_in *addr4 = NULL;
3717 struct sockaddr_in6 *addr6 = NULL;
3718 unsigned short snum;
3719 u32 sid, perm;
3720
3721 if (sk->sk_family == PF_INET) {
3722 addr4 = (struct sockaddr_in *)address;
3723 if (addrlen < sizeof(struct sockaddr_in))
3724 return -EINVAL;
3725 snum = ntohs(addr4->sin_port);
3726 } else {
3727 addr6 = (struct sockaddr_in6 *)address;
3728 if (addrlen < SIN6_LEN_RFC2133)
3729 return -EINVAL;
3730 snum = ntohs(addr6->sin6_port);
3731 }
3732
3733 err = security_port_sid(sk->sk_family, sk->sk_type,
3734 sk->sk_protocol, snum, &sid);
3735 if (err)
3736 goto out;
3737
3738 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3739 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3740
3741 AVC_AUDIT_DATA_INIT(&ad,NET);
3742 ad.u.net.dport = htons(snum);
3743 ad.u.net.family = sk->sk_family;
3744 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3745 if (err)
3746 goto out;
3747 }
3748
3749 out:
3750 return err;
3751 }
3752
3753 static int selinux_socket_listen(struct socket *sock, int backlog)
3754 {
3755 return socket_has_perm(current, sock, SOCKET__LISTEN);
3756 }
3757
3758 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3759 {
3760 int err;
3761 struct inode_security_struct *isec;
3762 struct inode_security_struct *newisec;
3763
3764 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3765 if (err)
3766 return err;
3767
3768 newisec = SOCK_INODE(newsock)->i_security;
3769
3770 isec = SOCK_INODE(sock)->i_security;
3771 newisec->sclass = isec->sclass;
3772 newisec->sid = isec->sid;
3773 newisec->initialized = 1;
3774
3775 return 0;
3776 }
3777
3778 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3779 int size)
3780 {
3781 int rc;
3782
3783 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3784 if (rc)
3785 return rc;
3786
3787 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3788 }
3789
3790 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3791 int size, int flags)
3792 {
3793 return socket_has_perm(current, sock, SOCKET__READ);
3794 }
3795
3796 static int selinux_socket_getsockname(struct socket *sock)
3797 {
3798 return socket_has_perm(current, sock, SOCKET__GETATTR);
3799 }
3800
3801 static int selinux_socket_getpeername(struct socket *sock)
3802 {
3803 return socket_has_perm(current, sock, SOCKET__GETATTR);
3804 }
3805
3806 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3807 {
3808 int err;
3809
3810 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3811 if (err)
3812 return err;
3813
3814 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3815 }
3816
3817 static int selinux_socket_getsockopt(struct socket *sock, int level,
3818 int optname)
3819 {
3820 return socket_has_perm(current, sock, SOCKET__GETOPT);
3821 }
3822
3823 static int selinux_socket_shutdown(struct socket *sock, int how)
3824 {
3825 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3826 }
3827
3828 static int selinux_socket_unix_stream_connect(struct socket *sock,
3829 struct socket *other,
3830 struct sock *newsk)
3831 {
3832 struct sk_security_struct *ssec;
3833 struct inode_security_struct *isec;
3834 struct inode_security_struct *other_isec;
3835 struct avc_audit_data ad;
3836 int err;
3837
3838 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3839 if (err)
3840 return err;
3841
3842 isec = SOCK_INODE(sock)->i_security;
3843 other_isec = SOCK_INODE(other)->i_security;
3844
3845 AVC_AUDIT_DATA_INIT(&ad,NET);
3846 ad.u.net.sk = other->sk;
3847
3848 err = avc_has_perm(isec->sid, other_isec->sid,
3849 isec->sclass,
3850 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3851 if (err)
3852 return err;
3853
3854 /* connecting socket */
3855 ssec = sock->sk->sk_security;
3856 ssec->peer_sid = other_isec->sid;
3857
3858 /* server child socket */
3859 ssec = newsk->sk_security;
3860 ssec->peer_sid = isec->sid;
3861 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3862
3863 return err;
3864 }
3865
3866 static int selinux_socket_unix_may_send(struct socket *sock,
3867 struct socket *other)
3868 {
3869 struct inode_security_struct *isec;
3870 struct inode_security_struct *other_isec;
3871 struct avc_audit_data ad;
3872 int err;
3873
3874 isec = SOCK_INODE(sock)->i_security;
3875 other_isec = SOCK_INODE(other)->i_security;
3876
3877 AVC_AUDIT_DATA_INIT(&ad,NET);
3878 ad.u.net.sk = other->sk;
3879
3880 err = avc_has_perm(isec->sid, other_isec->sid,
3881 isec->sclass, SOCKET__SENDTO, &ad);
3882 if (err)
3883 return err;
3884
3885 return 0;
3886 }
3887
3888 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3889 u32 peer_sid,
3890 struct avc_audit_data *ad)
3891 {
3892 int err;
3893 u32 if_sid;
3894 u32 node_sid;
3895
3896 err = sel_netif_sid(ifindex, &if_sid);
3897 if (err)
3898 return err;
3899 err = avc_has_perm(peer_sid, if_sid,
3900 SECCLASS_NETIF, NETIF__INGRESS, ad);
3901 if (err)
3902 return err;
3903
3904 err = sel_netnode_sid(addrp, family, &node_sid);
3905 if (err)
3906 return err;
3907 return avc_has_perm(peer_sid, node_sid,
3908 SECCLASS_NODE, NODE__RECVFROM, ad);
3909 }
3910
3911 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3912 struct sk_buff *skb,
3913 struct avc_audit_data *ad,
3914 u16 family,
3915 char *addrp)
3916 {
3917 int err;
3918 struct sk_security_struct *sksec = sk->sk_security;
3919 u16 sk_class;
3920 u32 netif_perm, node_perm, recv_perm;
3921 u32 port_sid, node_sid, if_sid, sk_sid;
3922
3923 sk_sid = sksec->sid;
3924 sk_class = sksec->sclass;
3925
3926 switch (sk_class) {
3927 case SECCLASS_UDP_SOCKET:
3928 netif_perm = NETIF__UDP_RECV;
3929 node_perm = NODE__UDP_RECV;
3930 recv_perm = UDP_SOCKET__RECV_MSG;
3931 break;
3932 case SECCLASS_TCP_SOCKET:
3933 netif_perm = NETIF__TCP_RECV;
3934 node_perm = NODE__TCP_RECV;
3935 recv_perm = TCP_SOCKET__RECV_MSG;
3936 break;
3937 case SECCLASS_DCCP_SOCKET:
3938 netif_perm = NETIF__DCCP_RECV;
3939 node_perm = NODE__DCCP_RECV;
3940 recv_perm = DCCP_SOCKET__RECV_MSG;
3941 break;
3942 default:
3943 netif_perm = NETIF__RAWIP_RECV;
3944 node_perm = NODE__RAWIP_RECV;
3945 recv_perm = 0;
3946 break;
3947 }
3948
3949 err = sel_netif_sid(skb->iif, &if_sid);
3950 if (err)
3951 return err;
3952 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3953 if (err)
3954 return err;
3955
3956 err = sel_netnode_sid(addrp, family, &node_sid);
3957 if (err)
3958 return err;
3959 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3960 if (err)
3961 return err;
3962
3963 if (!recv_perm)
3964 return 0;
3965 err = security_port_sid(sk->sk_family, sk->sk_type,
3966 sk->sk_protocol, ntohs(ad->u.net.sport),
3967 &port_sid);
3968 if (unlikely(err)) {
3969 printk(KERN_WARNING
3970 "SELinux: failure in"
3971 " selinux_sock_rcv_skb_iptables_compat(),"
3972 " network port label not found\n");
3973 return err;
3974 }
3975 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
3976 }
3977
3978 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3979 struct avc_audit_data *ad,
3980 u16 family, char *addrp)
3981 {
3982 int err;
3983 struct sk_security_struct *sksec = sk->sk_security;
3984 u32 peer_sid;
3985 u32 sk_sid = sksec->sid;
3986
3987 if (selinux_compat_net)
3988 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
3989 family, addrp);
3990 else
3991 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
3992 PACKET__RECV, ad);
3993 if (err)
3994 return err;
3995
3996 if (selinux_policycap_netpeer) {
3997 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
3998 if (err)
3999 return err;
4000 err = avc_has_perm(sk_sid, peer_sid,
4001 SECCLASS_PEER, PEER__RECV, ad);
4002 } else {
4003 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4004 if (err)
4005 return err;
4006 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4007 }
4008
4009 return err;
4010 }
4011
4012 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4013 {
4014 int err;
4015 struct sk_security_struct *sksec = sk->sk_security;
4016 u16 family = sk->sk_family;
4017 u32 sk_sid = sksec->sid;
4018 struct avc_audit_data ad;
4019 char *addrp;
4020
4021 if (family != PF_INET && family != PF_INET6)
4022 return 0;
4023
4024 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4025 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4026 family = PF_INET;
4027
4028 AVC_AUDIT_DATA_INIT(&ad, NET);
4029 ad.u.net.netif = skb->iif;
4030 ad.u.net.family = family;
4031 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4032 if (err)
4033 return err;
4034
4035 /* If any sort of compatibility mode is enabled then handoff processing
4036 * to the selinux_sock_rcv_skb_compat() function to deal with the
4037 * special handling. We do this in an attempt to keep this function
4038 * as fast and as clean as possible. */
4039 if (selinux_compat_net || !selinux_policycap_netpeer)
4040 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4041 family, addrp);
4042
4043 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4044 u32 peer_sid;
4045
4046 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4047 if (err)
4048 return err;
4049 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4050 peer_sid, &ad);
4051 if (err)
4052 return err;
4053 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4054 PEER__RECV, &ad);
4055 }
4056
4057 if (selinux_secmark_enabled()) {
4058 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4059 PACKET__RECV, &ad);
4060 if (err)
4061 return err;
4062 }
4063
4064 return err;
4065 }
4066
4067 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4068 int __user *optlen, unsigned len)
4069 {
4070 int err = 0;
4071 char *scontext;
4072 u32 scontext_len;
4073 struct sk_security_struct *ssec;
4074 struct inode_security_struct *isec;
4075 u32 peer_sid = SECSID_NULL;
4076
4077 isec = SOCK_INODE(sock)->i_security;
4078
4079 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4080 isec->sclass == SECCLASS_TCP_SOCKET) {
4081 ssec = sock->sk->sk_security;
4082 peer_sid = ssec->peer_sid;
4083 }
4084 if (peer_sid == SECSID_NULL) {
4085 err = -ENOPROTOOPT;
4086 goto out;
4087 }
4088
4089 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4090
4091 if (err)
4092 goto out;
4093
4094 if (scontext_len > len) {
4095 err = -ERANGE;
4096 goto out_len;
4097 }
4098
4099 if (copy_to_user(optval, scontext, scontext_len))
4100 err = -EFAULT;
4101
4102 out_len:
4103 if (put_user(scontext_len, optlen))
4104 err = -EFAULT;
4105
4106 kfree(scontext);
4107 out:
4108 return err;
4109 }
4110
4111 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4112 {
4113 u32 peer_secid = SECSID_NULL;
4114 u16 family;
4115
4116 if (sock)
4117 family = sock->sk->sk_family;
4118 else if (skb && skb->sk)
4119 family = skb->sk->sk_family;
4120 else
4121 goto out;
4122
4123 if (sock && family == PF_UNIX)
4124 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
4125 else if (skb)
4126 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4127
4128 out:
4129 *secid = peer_secid;
4130 if (peer_secid == SECSID_NULL)
4131 return -EINVAL;
4132 return 0;
4133 }
4134
4135 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4136 {
4137 return sk_alloc_security(sk, family, priority);
4138 }
4139
4140 static void selinux_sk_free_security(struct sock *sk)
4141 {
4142 sk_free_security(sk);
4143 }
4144
4145 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4146 {
4147 struct sk_security_struct *ssec = sk->sk_security;
4148 struct sk_security_struct *newssec = newsk->sk_security;
4149
4150 newssec->sid = ssec->sid;
4151 newssec->peer_sid = ssec->peer_sid;
4152 newssec->sclass = ssec->sclass;
4153
4154 selinux_netlbl_sk_security_clone(ssec, newssec);
4155 }
4156
4157 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4158 {
4159 if (!sk)
4160 *secid = SECINITSID_ANY_SOCKET;
4161 else {
4162 struct sk_security_struct *sksec = sk->sk_security;
4163
4164 *secid = sksec->sid;
4165 }
4166 }
4167
4168 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4169 {
4170 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4171 struct sk_security_struct *sksec = sk->sk_security;
4172
4173 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4174 sk->sk_family == PF_UNIX)
4175 isec->sid = sksec->sid;
4176 sksec->sclass = isec->sclass;
4177
4178 selinux_netlbl_sock_graft(sk, parent);
4179 }
4180
4181 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4182 struct request_sock *req)
4183 {
4184 struct sk_security_struct *sksec = sk->sk_security;
4185 int err;
4186 u32 newsid;
4187 u32 peersid;
4188
4189 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4190 if (err)
4191 return err;
4192 if (peersid == SECSID_NULL) {
4193 req->secid = sksec->sid;
4194 req->peer_secid = SECSID_NULL;
4195 return 0;
4196 }
4197
4198 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4199 if (err)
4200 return err;
4201
4202 req->secid = newsid;
4203 req->peer_secid = peersid;
4204 return 0;
4205 }
4206
4207 static void selinux_inet_csk_clone(struct sock *newsk,
4208 const struct request_sock *req)
4209 {
4210 struct sk_security_struct *newsksec = newsk->sk_security;
4211
4212 newsksec->sid = req->secid;
4213 newsksec->peer_sid = req->peer_secid;
4214 /* NOTE: Ideally, we should also get the isec->sid for the
4215 new socket in sync, but we don't have the isec available yet.
4216 So we will wait until sock_graft to do it, by which
4217 time it will have been created and available. */
4218
4219 /* We don't need to take any sort of lock here as we are the only
4220 * thread with access to newsksec */
4221 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4222 }
4223
4224 static void selinux_inet_conn_established(struct sock *sk,
4225 struct sk_buff *skb)
4226 {
4227 struct sk_security_struct *sksec = sk->sk_security;
4228
4229 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4230 }
4231
4232 static void selinux_req_classify_flow(const struct request_sock *req,
4233 struct flowi *fl)
4234 {
4235 fl->secid = req->secid;
4236 }
4237
4238 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4239 {
4240 int err = 0;
4241 u32 perm;
4242 struct nlmsghdr *nlh;
4243 struct socket *sock = sk->sk_socket;
4244 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4245
4246 if (skb->len < NLMSG_SPACE(0)) {
4247 err = -EINVAL;
4248 goto out;
4249 }
4250 nlh = nlmsg_hdr(skb);
4251
4252 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4253 if (err) {
4254 if (err == -EINVAL) {
4255 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4256 "SELinux: unrecognized netlink message"
4257 " type=%hu for sclass=%hu\n",
4258 nlh->nlmsg_type, isec->sclass);
4259 if (!selinux_enforcing)
4260 err = 0;
4261 }
4262
4263 /* Ignore */
4264 if (err == -ENOENT)
4265 err = 0;
4266 goto out;
4267 }
4268
4269 err = socket_has_perm(current, sock, perm);
4270 out:
4271 return err;
4272 }
4273
4274 #ifdef CONFIG_NETFILTER
4275
4276 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4277 u16 family)
4278 {
4279 char *addrp;
4280 u32 peer_sid;
4281 struct avc_audit_data ad;
4282 u8 secmark_active;
4283 u8 peerlbl_active;
4284
4285 if (!selinux_policycap_netpeer)
4286 return NF_ACCEPT;
4287
4288 secmark_active = selinux_secmark_enabled();
4289 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4290 if (!secmark_active && !peerlbl_active)
4291 return NF_ACCEPT;
4292
4293 AVC_AUDIT_DATA_INIT(&ad, NET);
4294 ad.u.net.netif = ifindex;
4295 ad.u.net.family = family;
4296 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4297 return NF_DROP;
4298
4299 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4300 return NF_DROP;
4301
4302 if (peerlbl_active)
4303 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4304 peer_sid, &ad) != 0)
4305 return NF_DROP;
4306
4307 if (secmark_active)
4308 if (avc_has_perm(peer_sid, skb->secmark,
4309 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4310 return NF_DROP;
4311
4312 return NF_ACCEPT;
4313 }
4314
4315 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4316 struct sk_buff *skb,
4317 const struct net_device *in,
4318 const struct net_device *out,
4319 int (*okfn)(struct sk_buff *))
4320 {
4321 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4322 }
4323
4324 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4325 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4326 struct sk_buff *skb,
4327 const struct net_device *in,
4328 const struct net_device *out,
4329 int (*okfn)(struct sk_buff *))
4330 {
4331 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4332 }
4333 #endif /* IPV6 */
4334
4335 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4336 int ifindex,
4337 struct avc_audit_data *ad,
4338 u16 family, char *addrp)
4339 {
4340 int err;
4341 struct sk_security_struct *sksec = sk->sk_security;
4342 u16 sk_class;
4343 u32 netif_perm, node_perm, send_perm;
4344 u32 port_sid, node_sid, if_sid, sk_sid;
4345
4346 sk_sid = sksec->sid;
4347 sk_class = sksec->sclass;
4348
4349 switch (sk_class) {
4350 case SECCLASS_UDP_SOCKET:
4351 netif_perm = NETIF__UDP_SEND;
4352 node_perm = NODE__UDP_SEND;
4353 send_perm = UDP_SOCKET__SEND_MSG;
4354 break;
4355 case SECCLASS_TCP_SOCKET:
4356 netif_perm = NETIF__TCP_SEND;
4357 node_perm = NODE__TCP_SEND;
4358 send_perm = TCP_SOCKET__SEND_MSG;
4359 break;
4360 case SECCLASS_DCCP_SOCKET:
4361 netif_perm = NETIF__DCCP_SEND;
4362 node_perm = NODE__DCCP_SEND;
4363 send_perm = DCCP_SOCKET__SEND_MSG;
4364 break;
4365 default:
4366 netif_perm = NETIF__RAWIP_SEND;
4367 node_perm = NODE__RAWIP_SEND;
4368 send_perm = 0;
4369 break;
4370 }
4371
4372 err = sel_netif_sid(ifindex, &if_sid);
4373 if (err)
4374 return err;
4375 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4376 return err;
4377
4378 err = sel_netnode_sid(addrp, family, &node_sid);
4379 if (err)
4380 return err;
4381 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4382 if (err)
4383 return err;
4384
4385 if (send_perm != 0)
4386 return 0;
4387
4388 err = security_port_sid(sk->sk_family, sk->sk_type,
4389 sk->sk_protocol, ntohs(ad->u.net.dport),
4390 &port_sid);
4391 if (unlikely(err)) {
4392 printk(KERN_WARNING
4393 "SELinux: failure in"
4394 " selinux_ip_postroute_iptables_compat(),"
4395 " network port label not found\n");
4396 return err;
4397 }
4398 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4399 }
4400
4401 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4402 int ifindex,
4403 struct avc_audit_data *ad,
4404 u16 family,
4405 char *addrp,
4406 u8 proto)
4407 {
4408 struct sock *sk = skb->sk;
4409 struct sk_security_struct *sksec;
4410
4411 if (sk == NULL)
4412 return NF_ACCEPT;
4413 sksec = sk->sk_security;
4414
4415 if (selinux_compat_net) {
4416 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4417 ad, family, addrp))
4418 return NF_DROP;
4419 } else {
4420 if (avc_has_perm(sksec->sid, skb->secmark,
4421 SECCLASS_PACKET, PACKET__SEND, ad))
4422 return NF_DROP;
4423 }
4424
4425 if (selinux_policycap_netpeer)
4426 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4427 return NF_DROP;
4428
4429 return NF_ACCEPT;
4430 }
4431
4432 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4433 u16 family)
4434 {
4435 u32 secmark_perm;
4436 u32 peer_sid;
4437 struct sock *sk;
4438 struct avc_audit_data ad;
4439 char *addrp;
4440 u8 proto;
4441 u8 secmark_active;
4442 u8 peerlbl_active;
4443
4444 AVC_AUDIT_DATA_INIT(&ad, NET);
4445 ad.u.net.netif = ifindex;
4446 ad.u.net.family = family;
4447 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4448 return NF_DROP;
4449
4450 /* If any sort of compatibility mode is enabled then handoff processing
4451 * to the selinux_ip_postroute_compat() function to deal with the
4452 * special handling. We do this in an attempt to keep this function
4453 * as fast and as clean as possible. */
4454 if (selinux_compat_net || !selinux_policycap_netpeer)
4455 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4456 family, addrp, proto);
4457
4458 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4459 * packet transformation so allow the packet to pass without any checks
4460 * since we'll have another chance to perform access control checks
4461 * when the packet is on it's final way out.
4462 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4463 * is NULL, in this case go ahead and apply access control. */
4464 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4465 return NF_ACCEPT;
4466
4467 secmark_active = selinux_secmark_enabled();
4468 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4469 if (!secmark_active && !peerlbl_active)
4470 return NF_ACCEPT;
4471
4472 /* if the packet is locally generated (skb->sk != NULL) then use the
4473 * socket's label as the peer label, otherwise the packet is being
4474 * forwarded through this system and we need to fetch the peer label
4475 * directly from the packet */
4476 sk = skb->sk;
4477 if (sk) {
4478 struct sk_security_struct *sksec = sk->sk_security;
4479 peer_sid = sksec->sid;
4480 secmark_perm = PACKET__SEND;
4481 } else {
4482 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4483 return NF_DROP;
4484 secmark_perm = PACKET__FORWARD_OUT;
4485 }
4486
4487 if (secmark_active)
4488 if (avc_has_perm(peer_sid, skb->secmark,
4489 SECCLASS_PACKET, secmark_perm, &ad))
4490 return NF_DROP;
4491
4492 if (peerlbl_active) {
4493 u32 if_sid;
4494 u32 node_sid;
4495
4496 if (sel_netif_sid(ifindex, &if_sid))
4497 return NF_DROP;
4498 if (avc_has_perm(peer_sid, if_sid,
4499 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4500 return NF_DROP;
4501
4502 if (sel_netnode_sid(addrp, family, &node_sid))
4503 return NF_DROP;
4504 if (avc_has_perm(peer_sid, node_sid,
4505 SECCLASS_NODE, NODE__SENDTO, &ad))
4506 return NF_DROP;
4507 }
4508
4509 return NF_ACCEPT;
4510 }
4511
4512 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4513 struct sk_buff *skb,
4514 const struct net_device *in,
4515 const struct net_device *out,
4516 int (*okfn)(struct sk_buff *))
4517 {
4518 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4519 }
4520
4521 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4522 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4523 struct sk_buff *skb,
4524 const struct net_device *in,
4525 const struct net_device *out,
4526 int (*okfn)(struct sk_buff *))
4527 {
4528 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4529 }
4530 #endif /* IPV6 */
4531
4532 #endif /* CONFIG_NETFILTER */
4533
4534 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4535 {
4536 int err;
4537
4538 err = secondary_ops->netlink_send(sk, skb);
4539 if (err)
4540 return err;
4541
4542 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4543 err = selinux_nlmsg_perm(sk, skb);
4544
4545 return err;
4546 }
4547
4548 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4549 {
4550 int err;
4551 struct avc_audit_data ad;
4552
4553 err = secondary_ops->netlink_recv(skb, capability);
4554 if (err)
4555 return err;
4556
4557 AVC_AUDIT_DATA_INIT(&ad, CAP);
4558 ad.u.cap = capability;
4559
4560 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4561 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4562 }
4563
4564 static int ipc_alloc_security(struct task_struct *task,
4565 struct kern_ipc_perm *perm,
4566 u16 sclass)
4567 {
4568 struct task_security_struct *tsec = task->security;
4569 struct ipc_security_struct *isec;
4570
4571 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4572 if (!isec)
4573 return -ENOMEM;
4574
4575 isec->sclass = sclass;
4576 isec->ipc_perm = perm;
4577 isec->sid = tsec->sid;
4578 perm->security = isec;
4579
4580 return 0;
4581 }
4582
4583 static void ipc_free_security(struct kern_ipc_perm *perm)
4584 {
4585 struct ipc_security_struct *isec = perm->security;
4586 perm->security = NULL;
4587 kfree(isec);
4588 }
4589
4590 static int msg_msg_alloc_security(struct msg_msg *msg)
4591 {
4592 struct msg_security_struct *msec;
4593
4594 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4595 if (!msec)
4596 return -ENOMEM;
4597
4598 msec->msg = msg;
4599 msec->sid = SECINITSID_UNLABELED;
4600 msg->security = msec;
4601
4602 return 0;
4603 }
4604
4605 static void msg_msg_free_security(struct msg_msg *msg)
4606 {
4607 struct msg_security_struct *msec = msg->security;
4608
4609 msg->security = NULL;
4610 kfree(msec);
4611 }
4612
4613 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4614 u32 perms)
4615 {
4616 struct task_security_struct *tsec;
4617 struct ipc_security_struct *isec;
4618 struct avc_audit_data ad;
4619
4620 tsec = current->security;
4621 isec = ipc_perms->security;
4622
4623 AVC_AUDIT_DATA_INIT(&ad, IPC);
4624 ad.u.ipc_id = ipc_perms->key;
4625
4626 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4627 }
4628
4629 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4630 {
4631 return msg_msg_alloc_security(msg);
4632 }
4633
4634 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4635 {
4636 msg_msg_free_security(msg);
4637 }
4638
4639 /* message queue security operations */
4640 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4641 {
4642 struct task_security_struct *tsec;
4643 struct ipc_security_struct *isec;
4644 struct avc_audit_data ad;
4645 int rc;
4646
4647 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4648 if (rc)
4649 return rc;
4650
4651 tsec = current->security;
4652 isec = msq->q_perm.security;
4653
4654 AVC_AUDIT_DATA_INIT(&ad, IPC);
4655 ad.u.ipc_id = msq->q_perm.key;
4656
4657 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4658 MSGQ__CREATE, &ad);
4659 if (rc) {
4660 ipc_free_security(&msq->q_perm);
4661 return rc;
4662 }
4663 return 0;
4664 }
4665
4666 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4667 {
4668 ipc_free_security(&msq->q_perm);
4669 }
4670
4671 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4672 {
4673 struct task_security_struct *tsec;
4674 struct ipc_security_struct *isec;
4675 struct avc_audit_data ad;
4676
4677 tsec = current->security;
4678 isec = msq->q_perm.security;
4679
4680 AVC_AUDIT_DATA_INIT(&ad, IPC);
4681 ad.u.ipc_id = msq->q_perm.key;
4682
4683 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4684 MSGQ__ASSOCIATE, &ad);
4685 }
4686
4687 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4688 {
4689 int err;
4690 int perms;
4691
4692 switch(cmd) {
4693 case IPC_INFO:
4694 case MSG_INFO:
4695 /* No specific object, just general system-wide information. */
4696 return task_has_system(current, SYSTEM__IPC_INFO);
4697 case IPC_STAT:
4698 case MSG_STAT:
4699 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4700 break;
4701 case IPC_SET:
4702 perms = MSGQ__SETATTR;
4703 break;
4704 case IPC_RMID:
4705 perms = MSGQ__DESTROY;
4706 break;
4707 default:
4708 return 0;
4709 }
4710
4711 err = ipc_has_perm(&msq->q_perm, perms);
4712 return err;
4713 }
4714
4715 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4716 {
4717 struct task_security_struct *tsec;
4718 struct ipc_security_struct *isec;
4719 struct msg_security_struct *msec;
4720 struct avc_audit_data ad;
4721 int rc;
4722
4723 tsec = current->security;
4724 isec = msq->q_perm.security;
4725 msec = msg->security;
4726
4727 /*
4728 * First time through, need to assign label to the message
4729 */
4730 if (msec->sid == SECINITSID_UNLABELED) {
4731 /*
4732 * Compute new sid based on current process and
4733 * message queue this message will be stored in
4734 */
4735 rc = security_transition_sid(tsec->sid,
4736 isec->sid,
4737 SECCLASS_MSG,
4738 &msec->sid);
4739 if (rc)
4740 return rc;
4741 }
4742
4743 AVC_AUDIT_DATA_INIT(&ad, IPC);
4744 ad.u.ipc_id = msq->q_perm.key;
4745
4746 /* Can this process write to the queue? */
4747 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4748 MSGQ__WRITE, &ad);
4749 if (!rc)
4750 /* Can this process send the message */
4751 rc = avc_has_perm(tsec->sid, msec->sid,
4752 SECCLASS_MSG, MSG__SEND, &ad);
4753 if (!rc)
4754 /* Can the message be put in the queue? */
4755 rc = avc_has_perm(msec->sid, isec->sid,
4756 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4757
4758 return rc;
4759 }
4760
4761 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4762 struct task_struct *target,
4763 long type, int mode)
4764 {
4765 struct task_security_struct *tsec;
4766 struct ipc_security_struct *isec;
4767 struct msg_security_struct *msec;
4768 struct avc_audit_data ad;
4769 int rc;
4770
4771 tsec = target->security;
4772 isec = msq->q_perm.security;
4773 msec = msg->security;
4774
4775 AVC_AUDIT_DATA_INIT(&ad, IPC);
4776 ad.u.ipc_id = msq->q_perm.key;
4777
4778 rc = avc_has_perm(tsec->sid, isec->sid,
4779 SECCLASS_MSGQ, MSGQ__READ, &ad);
4780 if (!rc)
4781 rc = avc_has_perm(tsec->sid, msec->sid,
4782 SECCLASS_MSG, MSG__RECEIVE, &ad);
4783 return rc;
4784 }
4785
4786 /* Shared Memory security operations */
4787 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4788 {
4789 struct task_security_struct *tsec;
4790 struct ipc_security_struct *isec;
4791 struct avc_audit_data ad;
4792 int rc;
4793
4794 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4795 if (rc)
4796 return rc;
4797
4798 tsec = current->security;
4799 isec = shp->shm_perm.security;
4800
4801 AVC_AUDIT_DATA_INIT(&ad, IPC);
4802 ad.u.ipc_id = shp->shm_perm.key;
4803
4804 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4805 SHM__CREATE, &ad);
4806 if (rc) {
4807 ipc_free_security(&shp->shm_perm);
4808 return rc;
4809 }
4810 return 0;
4811 }
4812
4813 static void selinux_shm_free_security(struct shmid_kernel *shp)
4814 {
4815 ipc_free_security(&shp->shm_perm);
4816 }
4817
4818 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4819 {
4820 struct task_security_struct *tsec;
4821 struct ipc_security_struct *isec;
4822 struct avc_audit_data ad;
4823
4824 tsec = current->security;
4825 isec = shp->shm_perm.security;
4826
4827 AVC_AUDIT_DATA_INIT(&ad, IPC);
4828 ad.u.ipc_id = shp->shm_perm.key;
4829
4830 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4831 SHM__ASSOCIATE, &ad);
4832 }
4833
4834 /* Note, at this point, shp is locked down */
4835 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4836 {
4837 int perms;
4838 int err;
4839
4840 switch(cmd) {
4841 case IPC_INFO:
4842 case SHM_INFO:
4843 /* No specific object, just general system-wide information. */
4844 return task_has_system(current, SYSTEM__IPC_INFO);
4845 case IPC_STAT:
4846 case SHM_STAT:
4847 perms = SHM__GETATTR | SHM__ASSOCIATE;
4848 break;
4849 case IPC_SET:
4850 perms = SHM__SETATTR;
4851 break;
4852 case SHM_LOCK:
4853 case SHM_UNLOCK:
4854 perms = SHM__LOCK;
4855 break;
4856 case IPC_RMID:
4857 perms = SHM__DESTROY;
4858 break;
4859 default:
4860 return 0;
4861 }
4862
4863 err = ipc_has_perm(&shp->shm_perm, perms);
4864 return err;
4865 }
4866
4867 static int selinux_shm_shmat(struct shmid_kernel *shp,
4868 char __user *shmaddr, int shmflg)
4869 {
4870 u32 perms;
4871 int rc;
4872
4873 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4874 if (rc)
4875 return rc;
4876
4877 if (shmflg & SHM_RDONLY)
4878 perms = SHM__READ;
4879 else
4880 perms = SHM__READ | SHM__WRITE;
4881
4882 return ipc_has_perm(&shp->shm_perm, perms);
4883 }
4884
4885 /* Semaphore security operations */
4886 static int selinux_sem_alloc_security(struct sem_array *sma)
4887 {
4888 struct task_security_struct *tsec;
4889 struct ipc_security_struct *isec;
4890 struct avc_audit_data ad;
4891 int rc;
4892
4893 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4894 if (rc)
4895 return rc;
4896
4897 tsec = current->security;
4898 isec = sma->sem_perm.security;
4899
4900 AVC_AUDIT_DATA_INIT(&ad, IPC);
4901 ad.u.ipc_id = sma->sem_perm.key;
4902
4903 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4904 SEM__CREATE, &ad);
4905 if (rc) {
4906 ipc_free_security(&sma->sem_perm);
4907 return rc;
4908 }
4909 return 0;
4910 }
4911
4912 static void selinux_sem_free_security(struct sem_array *sma)
4913 {
4914 ipc_free_security(&sma->sem_perm);
4915 }
4916
4917 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4918 {
4919 struct task_security_struct *tsec;
4920 struct ipc_security_struct *isec;
4921 struct avc_audit_data ad;
4922
4923 tsec = current->security;
4924 isec = sma->sem_perm.security;
4925
4926 AVC_AUDIT_DATA_INIT(&ad, IPC);
4927 ad.u.ipc_id = sma->sem_perm.key;
4928
4929 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4930 SEM__ASSOCIATE, &ad);
4931 }
4932
4933 /* Note, at this point, sma is locked down */
4934 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4935 {
4936 int err;
4937 u32 perms;
4938
4939 switch(cmd) {
4940 case IPC_INFO:
4941 case SEM_INFO:
4942 /* No specific object, just general system-wide information. */
4943 return task_has_system(current, SYSTEM__IPC_INFO);
4944 case GETPID:
4945 case GETNCNT:
4946 case GETZCNT:
4947 perms = SEM__GETATTR;
4948 break;
4949 case GETVAL:
4950 case GETALL:
4951 perms = SEM__READ;
4952 break;
4953 case SETVAL:
4954 case SETALL:
4955 perms = SEM__WRITE;
4956 break;
4957 case IPC_RMID:
4958 perms = SEM__DESTROY;
4959 break;
4960 case IPC_SET:
4961 perms = SEM__SETATTR;
4962 break;
4963 case IPC_STAT:
4964 case SEM_STAT:
4965 perms = SEM__GETATTR | SEM__ASSOCIATE;
4966 break;
4967 default:
4968 return 0;
4969 }
4970
4971 err = ipc_has_perm(&sma->sem_perm, perms);
4972 return err;
4973 }
4974
4975 static int selinux_sem_semop(struct sem_array *sma,
4976 struct sembuf *sops, unsigned nsops, int alter)
4977 {
4978 u32 perms;
4979
4980 if (alter)
4981 perms = SEM__READ | SEM__WRITE;
4982 else
4983 perms = SEM__READ;
4984
4985 return ipc_has_perm(&sma->sem_perm, perms);
4986 }
4987
4988 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4989 {
4990 u32 av = 0;
4991
4992 av = 0;
4993 if (flag & S_IRUGO)
4994 av |= IPC__UNIX_READ;
4995 if (flag & S_IWUGO)
4996 av |= IPC__UNIX_WRITE;
4997
4998 if (av == 0)
4999 return 0;
5000
5001 return ipc_has_perm(ipcp, av);
5002 }
5003
5004 /* module stacking operations */
5005 static int selinux_register_security (const char *name, struct security_operations *ops)
5006 {
5007 if (secondary_ops != original_ops) {
5008 printk(KERN_ERR "%s: There is already a secondary security "
5009 "module registered.\n", __FUNCTION__);
5010 return -EINVAL;
5011 }
5012
5013 secondary_ops = ops;
5014
5015 printk(KERN_INFO "%s: Registering secondary module %s\n",
5016 __FUNCTION__,
5017 name);
5018
5019 return 0;
5020 }
5021
5022 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5023 {
5024 if (inode)
5025 inode_doinit_with_dentry(inode, dentry);
5026 }
5027
5028 static int selinux_getprocattr(struct task_struct *p,
5029 char *name, char **value)
5030 {
5031 struct task_security_struct *tsec;
5032 u32 sid;
5033 int error;
5034 unsigned len;
5035
5036 if (current != p) {
5037 error = task_has_perm(current, p, PROCESS__GETATTR);
5038 if (error)
5039 return error;
5040 }
5041
5042 tsec = p->security;
5043
5044 if (!strcmp(name, "current"))
5045 sid = tsec->sid;
5046 else if (!strcmp(name, "prev"))
5047 sid = tsec->osid;
5048 else if (!strcmp(name, "exec"))
5049 sid = tsec->exec_sid;
5050 else if (!strcmp(name, "fscreate"))
5051 sid = tsec->create_sid;
5052 else if (!strcmp(name, "keycreate"))
5053 sid = tsec->keycreate_sid;
5054 else if (!strcmp(name, "sockcreate"))
5055 sid = tsec->sockcreate_sid;
5056 else
5057 return -EINVAL;
5058
5059 if (!sid)
5060 return 0;
5061
5062 error = security_sid_to_context(sid, value, &len);
5063 if (error)
5064 return error;
5065 return len;
5066 }
5067
5068 static int selinux_setprocattr(struct task_struct *p,
5069 char *name, void *value, size_t size)
5070 {
5071 struct task_security_struct *tsec;
5072 u32 sid = 0;
5073 int error;
5074 char *str = value;
5075
5076 if (current != p) {
5077 /* SELinux only allows a process to change its own
5078 security attributes. */
5079 return -EACCES;
5080 }
5081
5082 /*
5083 * Basic control over ability to set these attributes at all.
5084 * current == p, but we'll pass them separately in case the
5085 * above restriction is ever removed.
5086 */
5087 if (!strcmp(name, "exec"))
5088 error = task_has_perm(current, p, PROCESS__SETEXEC);
5089 else if (!strcmp(name, "fscreate"))
5090 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5091 else if (!strcmp(name, "keycreate"))
5092 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5093 else if (!strcmp(name, "sockcreate"))
5094 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5095 else if (!strcmp(name, "current"))
5096 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5097 else
5098 error = -EINVAL;
5099 if (error)
5100 return error;
5101
5102 /* Obtain a SID for the context, if one was specified. */
5103 if (size && str[1] && str[1] != '\n') {
5104 if (str[size-1] == '\n') {
5105 str[size-1] = 0;
5106 size--;
5107 }
5108 error = security_context_to_sid(value, size, &sid);
5109 if (error)
5110 return error;
5111 }
5112
5113 /* Permission checking based on the specified context is
5114 performed during the actual operation (execve,
5115 open/mkdir/...), when we know the full context of the
5116 operation. See selinux_bprm_set_security for the execve
5117 checks and may_create for the file creation checks. The
5118 operation will then fail if the context is not permitted. */
5119 tsec = p->security;
5120 if (!strcmp(name, "exec"))
5121 tsec->exec_sid = sid;
5122 else if (!strcmp(name, "fscreate"))
5123 tsec->create_sid = sid;
5124 else if (!strcmp(name, "keycreate")) {
5125 error = may_create_key(sid, p);
5126 if (error)
5127 return error;
5128 tsec->keycreate_sid = sid;
5129 } else if (!strcmp(name, "sockcreate"))
5130 tsec->sockcreate_sid = sid;
5131 else if (!strcmp(name, "current")) {
5132 struct av_decision avd;
5133
5134 if (sid == 0)
5135 return -EINVAL;
5136
5137 /* Only allow single threaded processes to change context */
5138 if (atomic_read(&p->mm->mm_users) != 1) {
5139 struct task_struct *g, *t;
5140 struct mm_struct *mm = p->mm;
5141 read_lock(&tasklist_lock);
5142 do_each_thread(g, t)
5143 if (t->mm == mm && t != p) {
5144 read_unlock(&tasklist_lock);
5145 return -EPERM;
5146 }
5147 while_each_thread(g, t);
5148 read_unlock(&tasklist_lock);
5149 }
5150
5151 /* Check permissions for the transition. */
5152 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5153 PROCESS__DYNTRANSITION, NULL);
5154 if (error)
5155 return error;
5156
5157 /* Check for ptracing, and update the task SID if ok.
5158 Otherwise, leave SID unchanged and fail. */
5159 task_lock(p);
5160 if (p->ptrace & PT_PTRACED) {
5161 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
5162 SECCLASS_PROCESS,
5163 PROCESS__PTRACE, 0, &avd);
5164 if (!error)
5165 tsec->sid = sid;
5166 task_unlock(p);
5167 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
5168 PROCESS__PTRACE, &avd, error, NULL);
5169 if (error)
5170 return error;
5171 } else {
5172 tsec->sid = sid;
5173 task_unlock(p);
5174 }
5175 }
5176 else
5177 return -EINVAL;
5178
5179 return size;
5180 }
5181
5182 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5183 {
5184 return security_sid_to_context(secid, secdata, seclen);
5185 }
5186
5187 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5188 {
5189 return security_context_to_sid(secdata, seclen, secid);
5190 }
5191
5192 static void selinux_release_secctx(char *secdata, u32 seclen)
5193 {
5194 kfree(secdata);
5195 }
5196
5197 #ifdef CONFIG_KEYS
5198
5199 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5200 unsigned long flags)
5201 {
5202 struct task_security_struct *tsec = tsk->security;
5203 struct key_security_struct *ksec;
5204
5205 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5206 if (!ksec)
5207 return -ENOMEM;
5208
5209 ksec->obj = k;
5210 if (tsec->keycreate_sid)
5211 ksec->sid = tsec->keycreate_sid;
5212 else
5213 ksec->sid = tsec->sid;
5214 k->security = ksec;
5215
5216 return 0;
5217 }
5218
5219 static void selinux_key_free(struct key *k)
5220 {
5221 struct key_security_struct *ksec = k->security;
5222
5223 k->security = NULL;
5224 kfree(ksec);
5225 }
5226
5227 static int selinux_key_permission(key_ref_t key_ref,
5228 struct task_struct *ctx,
5229 key_perm_t perm)
5230 {
5231 struct key *key;
5232 struct task_security_struct *tsec;
5233 struct key_security_struct *ksec;
5234
5235 key = key_ref_to_ptr(key_ref);
5236
5237 tsec = ctx->security;
5238 ksec = key->security;
5239
5240 /* if no specific permissions are requested, we skip the
5241 permission check. No serious, additional covert channels
5242 appear to be created. */
5243 if (perm == 0)
5244 return 0;
5245
5246 return avc_has_perm(tsec->sid, ksec->sid,
5247 SECCLASS_KEY, perm, NULL);
5248 }
5249
5250 #endif
5251
5252 static struct security_operations selinux_ops = {
5253 .ptrace = selinux_ptrace,
5254 .capget = selinux_capget,
5255 .capset_check = selinux_capset_check,
5256 .capset_set = selinux_capset_set,
5257 .sysctl = selinux_sysctl,
5258 .capable = selinux_capable,
5259 .quotactl = selinux_quotactl,
5260 .quota_on = selinux_quota_on,
5261 .syslog = selinux_syslog,
5262 .vm_enough_memory = selinux_vm_enough_memory,
5263
5264 .netlink_send = selinux_netlink_send,
5265 .netlink_recv = selinux_netlink_recv,
5266
5267 .bprm_alloc_security = selinux_bprm_alloc_security,
5268 .bprm_free_security = selinux_bprm_free_security,
5269 .bprm_apply_creds = selinux_bprm_apply_creds,
5270 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5271 .bprm_set_security = selinux_bprm_set_security,
5272 .bprm_check_security = selinux_bprm_check_security,
5273 .bprm_secureexec = selinux_bprm_secureexec,
5274
5275 .sb_alloc_security = selinux_sb_alloc_security,
5276 .sb_free_security = selinux_sb_free_security,
5277 .sb_copy_data = selinux_sb_copy_data,
5278 .sb_kern_mount = selinux_sb_kern_mount,
5279 .sb_statfs = selinux_sb_statfs,
5280 .sb_mount = selinux_mount,
5281 .sb_umount = selinux_umount,
5282 .sb_get_mnt_opts = selinux_get_mnt_opts,
5283 .sb_set_mnt_opts = selinux_set_mnt_opts,
5284 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5285 .sb_parse_opts_str = selinux_parse_opts_str,
5286
5287
5288 .inode_alloc_security = selinux_inode_alloc_security,
5289 .inode_free_security = selinux_inode_free_security,
5290 .inode_init_security = selinux_inode_init_security,
5291 .inode_create = selinux_inode_create,
5292 .inode_link = selinux_inode_link,
5293 .inode_unlink = selinux_inode_unlink,
5294 .inode_symlink = selinux_inode_symlink,
5295 .inode_mkdir = selinux_inode_mkdir,
5296 .inode_rmdir = selinux_inode_rmdir,
5297 .inode_mknod = selinux_inode_mknod,
5298 .inode_rename = selinux_inode_rename,
5299 .inode_readlink = selinux_inode_readlink,
5300 .inode_follow_link = selinux_inode_follow_link,
5301 .inode_permission = selinux_inode_permission,
5302 .inode_setattr = selinux_inode_setattr,
5303 .inode_getattr = selinux_inode_getattr,
5304 .inode_setxattr = selinux_inode_setxattr,
5305 .inode_post_setxattr = selinux_inode_post_setxattr,
5306 .inode_getxattr = selinux_inode_getxattr,
5307 .inode_listxattr = selinux_inode_listxattr,
5308 .inode_removexattr = selinux_inode_removexattr,
5309 .inode_getsecurity = selinux_inode_getsecurity,
5310 .inode_setsecurity = selinux_inode_setsecurity,
5311 .inode_listsecurity = selinux_inode_listsecurity,
5312 .inode_need_killpriv = selinux_inode_need_killpriv,
5313 .inode_killpriv = selinux_inode_killpriv,
5314
5315 .file_permission = selinux_file_permission,
5316 .file_alloc_security = selinux_file_alloc_security,
5317 .file_free_security = selinux_file_free_security,
5318 .file_ioctl = selinux_file_ioctl,
5319 .file_mmap = selinux_file_mmap,
5320 .file_mprotect = selinux_file_mprotect,
5321 .file_lock = selinux_file_lock,
5322 .file_fcntl = selinux_file_fcntl,
5323 .file_set_fowner = selinux_file_set_fowner,
5324 .file_send_sigiotask = selinux_file_send_sigiotask,
5325 .file_receive = selinux_file_receive,
5326
5327 .dentry_open = selinux_dentry_open,
5328
5329 .task_create = selinux_task_create,
5330 .task_alloc_security = selinux_task_alloc_security,
5331 .task_free_security = selinux_task_free_security,
5332 .task_setuid = selinux_task_setuid,
5333 .task_post_setuid = selinux_task_post_setuid,
5334 .task_setgid = selinux_task_setgid,
5335 .task_setpgid = selinux_task_setpgid,
5336 .task_getpgid = selinux_task_getpgid,
5337 .task_getsid = selinux_task_getsid,
5338 .task_getsecid = selinux_task_getsecid,
5339 .task_setgroups = selinux_task_setgroups,
5340 .task_setnice = selinux_task_setnice,
5341 .task_setioprio = selinux_task_setioprio,
5342 .task_getioprio = selinux_task_getioprio,
5343 .task_setrlimit = selinux_task_setrlimit,
5344 .task_setscheduler = selinux_task_setscheduler,
5345 .task_getscheduler = selinux_task_getscheduler,
5346 .task_movememory = selinux_task_movememory,
5347 .task_kill = selinux_task_kill,
5348 .task_wait = selinux_task_wait,
5349 .task_prctl = selinux_task_prctl,
5350 .task_reparent_to_init = selinux_task_reparent_to_init,
5351 .task_to_inode = selinux_task_to_inode,
5352
5353 .ipc_permission = selinux_ipc_permission,
5354
5355 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5356 .msg_msg_free_security = selinux_msg_msg_free_security,
5357
5358 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5359 .msg_queue_free_security = selinux_msg_queue_free_security,
5360 .msg_queue_associate = selinux_msg_queue_associate,
5361 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5362 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5363 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5364
5365 .shm_alloc_security = selinux_shm_alloc_security,
5366 .shm_free_security = selinux_shm_free_security,
5367 .shm_associate = selinux_shm_associate,
5368 .shm_shmctl = selinux_shm_shmctl,
5369 .shm_shmat = selinux_shm_shmat,
5370
5371 .sem_alloc_security = selinux_sem_alloc_security,
5372 .sem_free_security = selinux_sem_free_security,
5373 .sem_associate = selinux_sem_associate,
5374 .sem_semctl = selinux_sem_semctl,
5375 .sem_semop = selinux_sem_semop,
5376
5377 .register_security = selinux_register_security,
5378
5379 .d_instantiate = selinux_d_instantiate,
5380
5381 .getprocattr = selinux_getprocattr,
5382 .setprocattr = selinux_setprocattr,
5383
5384 .secid_to_secctx = selinux_secid_to_secctx,
5385 .secctx_to_secid = selinux_secctx_to_secid,
5386 .release_secctx = selinux_release_secctx,
5387
5388 .unix_stream_connect = selinux_socket_unix_stream_connect,
5389 .unix_may_send = selinux_socket_unix_may_send,
5390
5391 .socket_create = selinux_socket_create,
5392 .socket_post_create = selinux_socket_post_create,
5393 .socket_bind = selinux_socket_bind,
5394 .socket_connect = selinux_socket_connect,
5395 .socket_listen = selinux_socket_listen,
5396 .socket_accept = selinux_socket_accept,
5397 .socket_sendmsg = selinux_socket_sendmsg,
5398 .socket_recvmsg = selinux_socket_recvmsg,
5399 .socket_getsockname = selinux_socket_getsockname,
5400 .socket_getpeername = selinux_socket_getpeername,
5401 .socket_getsockopt = selinux_socket_getsockopt,
5402 .socket_setsockopt = selinux_socket_setsockopt,
5403 .socket_shutdown = selinux_socket_shutdown,
5404 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5405 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5406 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5407 .sk_alloc_security = selinux_sk_alloc_security,
5408 .sk_free_security = selinux_sk_free_security,
5409 .sk_clone_security = selinux_sk_clone_security,
5410 .sk_getsecid = selinux_sk_getsecid,
5411 .sock_graft = selinux_sock_graft,
5412 .inet_conn_request = selinux_inet_conn_request,
5413 .inet_csk_clone = selinux_inet_csk_clone,
5414 .inet_conn_established = selinux_inet_conn_established,
5415 .req_classify_flow = selinux_req_classify_flow,
5416
5417 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5418 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5419 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5420 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5421 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5422 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5423 .xfrm_state_free_security = selinux_xfrm_state_free,
5424 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5425 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5426 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5427 .xfrm_decode_session = selinux_xfrm_decode_session,
5428 #endif
5429
5430 #ifdef CONFIG_KEYS
5431 .key_alloc = selinux_key_alloc,
5432 .key_free = selinux_key_free,
5433 .key_permission = selinux_key_permission,
5434 #endif
5435 };
5436
5437 static __init int selinux_init(void)
5438 {
5439 struct task_security_struct *tsec;
5440
5441 if (!selinux_enabled) {
5442 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5443 return 0;
5444 }
5445
5446 printk(KERN_INFO "SELinux: Initializing.\n");
5447
5448 /* Set the security state for the initial task. */
5449 if (task_alloc_security(current))
5450 panic("SELinux: Failed to initialize initial task.\n");
5451 tsec = current->security;
5452 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5453
5454 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5455 sizeof(struct inode_security_struct),
5456 0, SLAB_PANIC, NULL);
5457 avc_init();
5458
5459 original_ops = secondary_ops = security_ops;
5460 if (!secondary_ops)
5461 panic ("SELinux: No initial security operations\n");
5462 if (register_security (&selinux_ops))
5463 panic("SELinux: Unable to register with kernel.\n");
5464
5465 if (selinux_enforcing) {
5466 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5467 } else {
5468 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5469 }
5470
5471 #ifdef CONFIG_KEYS
5472 /* Add security information to initial keyrings */
5473 selinux_key_alloc(&root_user_keyring, current,
5474 KEY_ALLOC_NOT_IN_QUOTA);
5475 selinux_key_alloc(&root_session_keyring, current,
5476 KEY_ALLOC_NOT_IN_QUOTA);
5477 #endif
5478
5479 return 0;
5480 }
5481
5482 void selinux_complete_init(void)
5483 {
5484 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5485
5486 /* Set up any superblocks initialized prior to the policy load. */
5487 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5488 spin_lock(&sb_lock);
5489 spin_lock(&sb_security_lock);
5490 next_sb:
5491 if (!list_empty(&superblock_security_head)) {
5492 struct superblock_security_struct *sbsec =
5493 list_entry(superblock_security_head.next,
5494 struct superblock_security_struct,
5495 list);
5496 struct super_block *sb = sbsec->sb;
5497 sb->s_count++;
5498 spin_unlock(&sb_security_lock);
5499 spin_unlock(&sb_lock);
5500 down_read(&sb->s_umount);
5501 if (sb->s_root)
5502 superblock_doinit(sb, NULL);
5503 drop_super(sb);
5504 spin_lock(&sb_lock);
5505 spin_lock(&sb_security_lock);
5506 list_del_init(&sbsec->list);
5507 goto next_sb;
5508 }
5509 spin_unlock(&sb_security_lock);
5510 spin_unlock(&sb_lock);
5511 }
5512
5513 /* SELinux requires early initialization in order to label
5514 all processes and objects when they are created. */
5515 security_initcall(selinux_init);
5516
5517 #if defined(CONFIG_NETFILTER)
5518
5519 static struct nf_hook_ops selinux_ipv4_ops[] = {
5520 {
5521 .hook = selinux_ipv4_postroute,
5522 .owner = THIS_MODULE,
5523 .pf = PF_INET,
5524 .hooknum = NF_INET_POST_ROUTING,
5525 .priority = NF_IP_PRI_SELINUX_LAST,
5526 },
5527 {
5528 .hook = selinux_ipv4_forward,
5529 .owner = THIS_MODULE,
5530 .pf = PF_INET,
5531 .hooknum = NF_INET_FORWARD,
5532 .priority = NF_IP_PRI_SELINUX_FIRST,
5533 }
5534 };
5535
5536 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5537
5538 static struct nf_hook_ops selinux_ipv6_ops[] = {
5539 {
5540 .hook = selinux_ipv6_postroute,
5541 .owner = THIS_MODULE,
5542 .pf = PF_INET6,
5543 .hooknum = NF_INET_POST_ROUTING,
5544 .priority = NF_IP6_PRI_SELINUX_LAST,
5545 },
5546 {
5547 .hook = selinux_ipv6_forward,
5548 .owner = THIS_MODULE,
5549 .pf = PF_INET6,
5550 .hooknum = NF_INET_FORWARD,
5551 .priority = NF_IP6_PRI_SELINUX_FIRST,
5552 }
5553 };
5554
5555 #endif /* IPV6 */
5556
5557 static int __init selinux_nf_ip_init(void)
5558 {
5559 int err = 0;
5560 u32 iter;
5561
5562 if (!selinux_enabled)
5563 goto out;
5564
5565 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5566
5567 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5568 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5569 if (err)
5570 panic("SELinux: nf_register_hook for IPv4: error %d\n",
5571 err);
5572 }
5573
5574 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5575 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5576 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5577 if (err)
5578 panic("SELinux: nf_register_hook for IPv6: error %d\n",
5579 err);
5580 }
5581 #endif /* IPV6 */
5582
5583 out:
5584 return err;
5585 }
5586
5587 __initcall(selinux_nf_ip_init);
5588
5589 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5590 static void selinux_nf_ip_exit(void)
5591 {
5592 u32 iter;
5593
5594 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5595
5596 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5597 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5598 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5599 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5600 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5601 #endif /* IPV6 */
5602 }
5603 #endif
5604
5605 #else /* CONFIG_NETFILTER */
5606
5607 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5608 #define selinux_nf_ip_exit()
5609 #endif
5610
5611 #endif /* CONFIG_NETFILTER */
5612
5613 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5614 int selinux_disable(void)
5615 {
5616 extern void exit_sel_fs(void);
5617 static int selinux_disabled = 0;
5618
5619 if (ss_initialized) {
5620 /* Not permitted after initial policy load. */
5621 return -EINVAL;
5622 }
5623
5624 if (selinux_disabled) {
5625 /* Only do this once. */
5626 return -EINVAL;
5627 }
5628
5629 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5630
5631 selinux_disabled = 1;
5632 selinux_enabled = 0;
5633
5634 /* Reset security_ops to the secondary module, dummy or capability. */
5635 security_ops = secondary_ops;
5636
5637 /* Unregister netfilter hooks. */
5638 selinux_nf_ip_exit();
5639
5640 /* Unregister selinuxfs. */
5641 exit_sel_fs();
5642
5643 return 0;
5644 }
5645 #endif
5646
5647
5648
|
This page was automatically generated by the
LXR engine.
|