2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
27 #include <linux/kernel.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched.h>
31 #include <linux/security.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/swap.h>
40 #include <linux/spinlock.h>
41 #include <linux/syscalls.h>
42 #include <linux/file.h>
43 #include <linux/fdtable.h>
44 #include <linux/namei.h>
45 #include <linux/mount.h>
46 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <linux/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78 #include <linux/posix-timers.h>
79 #include <linux/syslog.h>
90 #define XATTR_SELINUX_SUFFIX "selinux"
91 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
93 #define NUM_SEL_MNT_OPTS 5
95 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
96 extern struct security_operations *security_ops;
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
104 static int __init enforcing_setup(char *str)
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
111 __setup("enforcing=", enforcing_setup);
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117 static int __init selinux_enabled_setup(char *str)
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
124 __setup("selinux=", selinux_enabled_setup);
126 int selinux_enabled = 1;
129 static struct kmem_cache *sel_inode_cache;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
141 static int selinux_secmark_enabled(void)
143 return (atomic_read(&selinux_secmark_refcount) > 0);
147 * initialise the security for the init task
149 static void cred_init_security(void)
151 struct cred *cred = (struct cred *) current->real_cred;
152 struct task_security_struct *tsec;
154 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
156 panic("SELinux: Failed to initialize initial task.\n");
158 tsec->osid = tsec->sid = SECINITSID_KERNEL;
159 cred->security = tsec;
163 * get the security ID of a set of credentials
165 static inline u32 cred_sid(const struct cred *cred)
167 const struct task_security_struct *tsec;
169 tsec = cred->security;
174 * get the objective security ID of a task
176 static inline u32 task_sid(const struct task_struct *task)
181 sid = cred_sid(__task_cred(task));
187 * get the subjective security ID of the current task
189 static inline u32 current_sid(void)
191 const struct task_security_struct *tsec = current_cred()->security;
196 /* Allocate and free functions for each kind of security blob. */
198 static int inode_alloc_security(struct inode *inode)
200 struct inode_security_struct *isec;
201 u32 sid = current_sid();
203 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
207 mutex_init(&isec->lock);
208 INIT_LIST_HEAD(&isec->list);
210 isec->sid = SECINITSID_UNLABELED;
211 isec->sclass = SECCLASS_FILE;
212 isec->task_sid = sid;
213 inode->i_security = isec;
218 static void inode_free_security(struct inode *inode)
220 struct inode_security_struct *isec = inode->i_security;
221 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
223 spin_lock(&sbsec->isec_lock);
224 if (!list_empty(&isec->list))
225 list_del_init(&isec->list);
226 spin_unlock(&sbsec->isec_lock);
228 inode->i_security = NULL;
229 kmem_cache_free(sel_inode_cache, isec);
232 static int file_alloc_security(struct file *file)
234 struct file_security_struct *fsec;
235 u32 sid = current_sid();
237 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
242 fsec->fown_sid = sid;
243 file->f_security = fsec;
248 static void file_free_security(struct file *file)
250 struct file_security_struct *fsec = file->f_security;
251 file->f_security = NULL;
255 static int superblock_alloc_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec;
259 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
263 mutex_init(&sbsec->lock);
264 INIT_LIST_HEAD(&sbsec->isec_head);
265 spin_lock_init(&sbsec->isec_lock);
267 sbsec->sid = SECINITSID_UNLABELED;
268 sbsec->def_sid = SECINITSID_FILE;
269 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
270 sb->s_security = sbsec;
275 static void superblock_free_security(struct super_block *sb)
277 struct superblock_security_struct *sbsec = sb->s_security;
278 sb->s_security = NULL;
282 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
284 struct sk_security_struct *sksec;
286 sksec = kzalloc(sizeof(*sksec), priority);
290 sksec->peer_sid = SECINITSID_UNLABELED;
291 sksec->sid = SECINITSID_UNLABELED;
292 sk->sk_security = sksec;
294 selinux_netlbl_sk_security_reset(sksec);
299 static void sk_free_security(struct sock *sk)
301 struct sk_security_struct *sksec = sk->sk_security;
303 sk->sk_security = NULL;
304 selinux_netlbl_sk_security_free(sksec);
308 /* The security server must be initialized before
309 any labeling or access decisions can be provided. */
310 extern int ss_initialized;
312 /* The file system's label must be initialized prior to use. */
314 static const char *labeling_behaviors[6] = {
316 "uses transition SIDs",
318 "uses genfs_contexts",
319 "not configured for labeling",
320 "uses mountpoint labeling",
323 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
325 static inline int inode_doinit(struct inode *inode)
327 return inode_doinit_with_dentry(inode, NULL);
336 Opt_labelsupport = 5,
339 static const match_table_t tokens = {
340 {Opt_context, CONTEXT_STR "%s"},
341 {Opt_fscontext, FSCONTEXT_STR "%s"},
342 {Opt_defcontext, DEFCONTEXT_STR "%s"},
343 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
344 {Opt_labelsupport, LABELSUPP_STR},
348 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
350 static int may_context_mount_sb_relabel(u32 sid,
351 struct superblock_security_struct *sbsec,
352 const struct cred *cred)
354 const struct task_security_struct *tsec = cred->security;
357 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
358 FILESYSTEM__RELABELFROM, NULL);
362 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
363 FILESYSTEM__RELABELTO, NULL);
367 static int may_context_mount_inode_relabel(u32 sid,
368 struct superblock_security_struct *sbsec,
369 const struct cred *cred)
371 const struct task_security_struct *tsec = cred->security;
373 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
374 FILESYSTEM__RELABELFROM, NULL);
378 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
379 FILESYSTEM__ASSOCIATE, NULL);
383 static int sb_finish_set_opts(struct super_block *sb)
385 struct superblock_security_struct *sbsec = sb->s_security;
386 struct dentry *root = sb->s_root;
387 struct inode *root_inode = root->d_inode;
390 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
391 /* Make sure that the xattr handler exists and that no
392 error other than -ENODATA is returned by getxattr on
393 the root directory. -ENODATA is ok, as this may be
394 the first boot of the SELinux kernel before we have
395 assigned xattr values to the filesystem. */
396 if (!root_inode->i_op->getxattr) {
397 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
398 "xattr support\n", sb->s_id, sb->s_type->name);
402 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
403 if (rc < 0 && rc != -ENODATA) {
404 if (rc == -EOPNOTSUPP)
405 printk(KERN_WARNING "SELinux: (dev %s, type "
406 "%s) has no security xattr handler\n",
407 sb->s_id, sb->s_type->name);
409 printk(KERN_WARNING "SELinux: (dev %s, type "
410 "%s) getxattr errno %d\n", sb->s_id,
411 sb->s_type->name, -rc);
416 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
418 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
419 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
420 sb->s_id, sb->s_type->name);
422 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
423 sb->s_id, sb->s_type->name,
424 labeling_behaviors[sbsec->behavior-1]);
426 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
427 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
428 sbsec->behavior == SECURITY_FS_USE_NONE ||
429 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
430 sbsec->flags &= ~SE_SBLABELSUPP;
432 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
433 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
434 sbsec->flags |= SE_SBLABELSUPP;
436 /* Initialize the root inode. */
437 rc = inode_doinit_with_dentry(root_inode, root);
439 /* Initialize any other inodes associated with the superblock, e.g.
440 inodes created prior to initial policy load or inodes created
441 during get_sb by a pseudo filesystem that directly
443 spin_lock(&sbsec->isec_lock);
445 if (!list_empty(&sbsec->isec_head)) {
446 struct inode_security_struct *isec =
447 list_entry(sbsec->isec_head.next,
448 struct inode_security_struct, list);
449 struct inode *inode = isec->inode;
450 spin_unlock(&sbsec->isec_lock);
451 inode = igrab(inode);
453 if (!IS_PRIVATE(inode))
457 spin_lock(&sbsec->isec_lock);
458 list_del_init(&isec->list);
461 spin_unlock(&sbsec->isec_lock);
467 * This function should allow an FS to ask what it's mount security
468 * options were so it can use those later for submounts, displaying
469 * mount options, or whatever.
471 static int selinux_get_mnt_opts(const struct super_block *sb,
472 struct security_mnt_opts *opts)
475 struct superblock_security_struct *sbsec = sb->s_security;
476 char *context = NULL;
480 security_init_mnt_opts(opts);
482 if (!(sbsec->flags & SE_SBINITIALIZED))
488 tmp = sbsec->flags & SE_MNTMASK;
489 /* count the number of mount options for this sb */
490 for (i = 0; i < 8; i++) {
492 opts->num_mnt_opts++;
495 /* Check if the Label support flag is set */
496 if (sbsec->flags & SE_SBLABELSUPP)
497 opts->num_mnt_opts++;
499 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
500 if (!opts->mnt_opts) {
505 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
506 if (!opts->mnt_opts_flags) {
512 if (sbsec->flags & FSCONTEXT_MNT) {
513 rc = security_sid_to_context(sbsec->sid, &context, &len);
516 opts->mnt_opts[i] = context;
517 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
519 if (sbsec->flags & CONTEXT_MNT) {
520 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
523 opts->mnt_opts[i] = context;
524 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
526 if (sbsec->flags & DEFCONTEXT_MNT) {
527 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
530 opts->mnt_opts[i] = context;
531 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
533 if (sbsec->flags & ROOTCONTEXT_MNT) {
534 struct inode *root = sbsec->sb->s_root->d_inode;
535 struct inode_security_struct *isec = root->i_security;
537 rc = security_sid_to_context(isec->sid, &context, &len);
540 opts->mnt_opts[i] = context;
541 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
543 if (sbsec->flags & SE_SBLABELSUPP) {
544 opts->mnt_opts[i] = NULL;
545 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
548 BUG_ON(i != opts->num_mnt_opts);
553 security_free_mnt_opts(opts);
557 static int bad_option(struct superblock_security_struct *sbsec, char flag,
558 u32 old_sid, u32 new_sid)
560 char mnt_flags = sbsec->flags & SE_MNTMASK;
562 /* check if the old mount command had the same options */
563 if (sbsec->flags & SE_SBINITIALIZED)
564 if (!(sbsec->flags & flag) ||
565 (old_sid != new_sid))
568 /* check if we were passed the same options twice,
569 * aka someone passed context=a,context=b
571 if (!(sbsec->flags & SE_SBINITIALIZED))
572 if (mnt_flags & flag)
578 * Allow filesystems with binary mount data to explicitly set mount point
579 * labeling information.
581 static int selinux_set_mnt_opts(struct super_block *sb,
582 struct security_mnt_opts *opts)
584 const struct cred *cred = current_cred();
586 struct superblock_security_struct *sbsec = sb->s_security;
587 const char *name = sb->s_type->name;
588 struct inode *inode = sbsec->sb->s_root->d_inode;
589 struct inode_security_struct *root_isec = inode->i_security;
590 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
591 u32 defcontext_sid = 0;
592 char **mount_options = opts->mnt_opts;
593 int *flags = opts->mnt_opts_flags;
594 int num_opts = opts->num_mnt_opts;
596 mutex_lock(&sbsec->lock);
598 if (!ss_initialized) {
600 /* Defer initialization until selinux_complete_init,
601 after the initial policy is loaded and the security
602 server is ready to handle calls. */
606 printk(KERN_WARNING "SELinux: Unable to set superblock options "
607 "before the security server is initialized\n");
612 * Binary mount data FS will come through this function twice. Once
613 * from an explicit call and once from the generic calls from the vfs.
614 * Since the generic VFS calls will not contain any security mount data
615 * we need to skip the double mount verification.
617 * This does open a hole in which we will not notice if the first
618 * mount using this sb set explict options and a second mount using
619 * this sb does not set any security options. (The first options
620 * will be used for both mounts)
622 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
627 * parse the mount options, check if they are valid sids.
628 * also check if someone is trying to mount the same sb more
629 * than once with different security options.
631 for (i = 0; i < num_opts; i++) {
634 if (flags[i] == SE_SBLABELSUPP)
636 rc = security_context_to_sid(mount_options[i],
637 strlen(mount_options[i]), &sid);
639 printk(KERN_WARNING "SELinux: security_context_to_sid"
640 "(%s) failed for (dev %s, type %s) errno=%d\n",
641 mount_options[i], sb->s_id, name, rc);
648 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
650 goto out_double_mount;
652 sbsec->flags |= FSCONTEXT_MNT;
657 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
659 goto out_double_mount;
661 sbsec->flags |= CONTEXT_MNT;
663 case ROOTCONTEXT_MNT:
664 rootcontext_sid = sid;
666 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
668 goto out_double_mount;
670 sbsec->flags |= ROOTCONTEXT_MNT;
674 defcontext_sid = sid;
676 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
678 goto out_double_mount;
680 sbsec->flags |= DEFCONTEXT_MNT;
689 if (sbsec->flags & SE_SBINITIALIZED) {
690 /* previously mounted with options, but not on this attempt? */
691 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
692 goto out_double_mount;
697 if (strcmp(sb->s_type->name, "proc") == 0)
698 sbsec->flags |= SE_SBPROC;
700 /* Determine the labeling behavior to use for this filesystem type. */
701 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
703 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
704 __func__, sb->s_type->name, rc);
708 /* sets the context of the superblock for the fs being mounted. */
710 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
714 sbsec->sid = fscontext_sid;
718 * Switch to using mount point labeling behavior.
719 * sets the label used on all file below the mountpoint, and will set
720 * the superblock context if not already set.
723 if (!fscontext_sid) {
724 rc = may_context_mount_sb_relabel(context_sid, sbsec,
728 sbsec->sid = context_sid;
730 rc = may_context_mount_inode_relabel(context_sid, sbsec,
735 if (!rootcontext_sid)
736 rootcontext_sid = context_sid;
738 sbsec->mntpoint_sid = context_sid;
739 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
742 if (rootcontext_sid) {
743 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
748 root_isec->sid = rootcontext_sid;
749 root_isec->initialized = 1;
752 if (defcontext_sid) {
753 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
755 printk(KERN_WARNING "SELinux: defcontext option is "
756 "invalid for this filesystem type\n");
760 if (defcontext_sid != sbsec->def_sid) {
761 rc = may_context_mount_inode_relabel(defcontext_sid,
767 sbsec->def_sid = defcontext_sid;
770 rc = sb_finish_set_opts(sb);
772 mutex_unlock(&sbsec->lock);
776 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
777 "security settings for (dev %s, type %s)\n", sb->s_id, name);
781 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
782 struct super_block *newsb)
784 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
785 struct superblock_security_struct *newsbsec = newsb->s_security;
787 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
788 int set_context = (oldsbsec->flags & CONTEXT_MNT);
789 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
792 * if the parent was able to be mounted it clearly had no special lsm
793 * mount options. thus we can safely deal with this superblock later
798 /* how can we clone if the old one wasn't set up?? */
799 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
801 /* if fs is reusing a sb, just let its options stand... */
802 if (newsbsec->flags & SE_SBINITIALIZED)
805 mutex_lock(&newsbsec->lock);
807 newsbsec->flags = oldsbsec->flags;
809 newsbsec->sid = oldsbsec->sid;
810 newsbsec->def_sid = oldsbsec->def_sid;
811 newsbsec->behavior = oldsbsec->behavior;
814 u32 sid = oldsbsec->mntpoint_sid;
818 if (!set_rootcontext) {
819 struct inode *newinode = newsb->s_root->d_inode;
820 struct inode_security_struct *newisec = newinode->i_security;
823 newsbsec->mntpoint_sid = sid;
825 if (set_rootcontext) {
826 const struct inode *oldinode = oldsb->s_root->d_inode;
827 const struct inode_security_struct *oldisec = oldinode->i_security;
828 struct inode *newinode = newsb->s_root->d_inode;
829 struct inode_security_struct *newisec = newinode->i_security;
831 newisec->sid = oldisec->sid;
834 sb_finish_set_opts(newsb);
835 mutex_unlock(&newsbsec->lock);
838 static int selinux_parse_opts_str(char *options,
839 struct security_mnt_opts *opts)
842 char *context = NULL, *defcontext = NULL;
843 char *fscontext = NULL, *rootcontext = NULL;
844 int rc, num_mnt_opts = 0;
846 opts->num_mnt_opts = 0;
848 /* Standard string-based options. */
849 while ((p = strsep(&options, "|")) != NULL) {
851 substring_t args[MAX_OPT_ARGS];
856 token = match_token(p, tokens, args);
860 if (context || defcontext) {
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
865 context = match_strdup(&args[0]);
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
878 fscontext = match_strdup(&args[0]);
885 case Opt_rootcontext:
888 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
891 rootcontext = match_strdup(&args[0]);
899 if (context || defcontext) {
901 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
904 defcontext = match_strdup(&args[0]);
910 case Opt_labelsupport:
914 printk(KERN_WARNING "SELinux: unknown mount option\n");
921 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
925 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
926 if (!opts->mnt_opts_flags) {
927 kfree(opts->mnt_opts);
932 opts->mnt_opts[num_mnt_opts] = fscontext;
933 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
936 opts->mnt_opts[num_mnt_opts] = context;
937 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
940 opts->mnt_opts[num_mnt_opts] = rootcontext;
941 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
944 opts->mnt_opts[num_mnt_opts] = defcontext;
945 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
948 opts->num_mnt_opts = num_mnt_opts;
959 * string mount options parsing and call set the sbsec
961 static int superblock_doinit(struct super_block *sb, void *data)
964 char *options = data;
965 struct security_mnt_opts opts;
967 security_init_mnt_opts(&opts);
972 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
974 rc = selinux_parse_opts_str(options, &opts);
979 rc = selinux_set_mnt_opts(sb, &opts);
982 security_free_mnt_opts(&opts);
986 static void selinux_write_opts(struct seq_file *m,
987 struct security_mnt_opts *opts)
992 for (i = 0; i < opts->num_mnt_opts; i++) {
995 if (opts->mnt_opts[i])
996 has_comma = strchr(opts->mnt_opts[i], ',');
1000 switch (opts->mnt_opts_flags[i]) {
1002 prefix = CONTEXT_STR;
1005 prefix = FSCONTEXT_STR;
1007 case ROOTCONTEXT_MNT:
1008 prefix = ROOTCONTEXT_STR;
1010 case DEFCONTEXT_MNT:
1011 prefix = DEFCONTEXT_STR;
1013 case SE_SBLABELSUPP:
1015 seq_puts(m, LABELSUPP_STR);
1020 /* we need a comma before each option */
1022 seq_puts(m, prefix);
1025 seq_puts(m, opts->mnt_opts[i]);
1031 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1033 struct security_mnt_opts opts;
1036 rc = selinux_get_mnt_opts(sb, &opts);
1038 /* before policy load we may get EINVAL, don't show anything */
1044 selinux_write_opts(m, &opts);
1046 security_free_mnt_opts(&opts);
1051 static inline u16 inode_mode_to_security_class(umode_t mode)
1053 switch (mode & S_IFMT) {
1055 return SECCLASS_SOCK_FILE;
1057 return SECCLASS_LNK_FILE;
1059 return SECCLASS_FILE;
1061 return SECCLASS_BLK_FILE;
1063 return SECCLASS_DIR;
1065 return SECCLASS_CHR_FILE;
1067 return SECCLASS_FIFO_FILE;
1071 return SECCLASS_FILE;
1074 static inline int default_protocol_stream(int protocol)
1076 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1079 static inline int default_protocol_dgram(int protocol)
1081 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1084 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1090 case SOCK_SEQPACKET:
1091 return SECCLASS_UNIX_STREAM_SOCKET;
1093 return SECCLASS_UNIX_DGRAM_SOCKET;
1100 if (default_protocol_stream(protocol))
1101 return SECCLASS_TCP_SOCKET;
1103 return SECCLASS_RAWIP_SOCKET;
1105 if (default_protocol_dgram(protocol))
1106 return SECCLASS_UDP_SOCKET;
1108 return SECCLASS_RAWIP_SOCKET;
1110 return SECCLASS_DCCP_SOCKET;
1112 return SECCLASS_RAWIP_SOCKET;
1118 return SECCLASS_NETLINK_ROUTE_SOCKET;
1119 case NETLINK_FIREWALL:
1120 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1121 case NETLINK_INET_DIAG:
1122 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1124 return SECCLASS_NETLINK_NFLOG_SOCKET;
1126 return SECCLASS_NETLINK_XFRM_SOCKET;
1127 case NETLINK_SELINUX:
1128 return SECCLASS_NETLINK_SELINUX_SOCKET;
1130 return SECCLASS_NETLINK_AUDIT_SOCKET;
1131 case NETLINK_IP6_FW:
1132 return SECCLASS_NETLINK_IP6FW_SOCKET;
1133 case NETLINK_DNRTMSG:
1134 return SECCLASS_NETLINK_DNRT_SOCKET;
1135 case NETLINK_KOBJECT_UEVENT:
1136 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1138 return SECCLASS_NETLINK_SOCKET;
1141 return SECCLASS_PACKET_SOCKET;
1143 return SECCLASS_KEY_SOCKET;
1145 return SECCLASS_APPLETALK_SOCKET;
1148 return SECCLASS_SOCKET;
1151 #ifdef CONFIG_PROC_FS
1152 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1157 char *buffer, *path, *end;
1159 buffer = (char *)__get_free_page(GFP_KERNEL);
1164 end = buffer+buflen;
1169 while (de && de != de->parent) {
1170 buflen -= de->namelen + 1;
1174 memcpy(end, de->name, de->namelen);
1179 rc = security_genfs_sid("proc", path, tclass, sid);
1180 free_page((unsigned long)buffer);
1184 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1192 /* The inode's security attributes must be initialized before first use. */
1193 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1195 struct superblock_security_struct *sbsec = NULL;
1196 struct inode_security_struct *isec = inode->i_security;
1198 struct dentry *dentry;
1199 #define INITCONTEXTLEN 255
1200 char *context = NULL;
1204 if (isec->initialized)
1207 mutex_lock(&isec->lock);
1208 if (isec->initialized)
1211 sbsec = inode->i_sb->s_security;
1212 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1213 /* Defer initialization until selinux_complete_init,
1214 after the initial policy is loaded and the security
1215 server is ready to handle calls. */
1216 spin_lock(&sbsec->isec_lock);
1217 if (list_empty(&isec->list))
1218 list_add(&isec->list, &sbsec->isec_head);
1219 spin_unlock(&sbsec->isec_lock);
1223 switch (sbsec->behavior) {
1224 case SECURITY_FS_USE_XATTR:
1225 if (!inode->i_op->getxattr) {
1226 isec->sid = sbsec->def_sid;
1230 /* Need a dentry, since the xattr API requires one.
1231 Life would be simpler if we could just pass the inode. */
1233 /* Called from d_instantiate or d_splice_alias. */
1234 dentry = dget(opt_dentry);
1236 /* Called from selinux_complete_init, try to find a dentry. */
1237 dentry = d_find_alias(inode);
1241 * this is can be hit on boot when a file is accessed
1242 * before the policy is loaded. When we load policy we
1243 * may find inodes that have no dentry on the
1244 * sbsec->isec_head list. No reason to complain as these
1245 * will get fixed up the next time we go through
1246 * inode_doinit with a dentry, before these inodes could
1247 * be used again by userspace.
1252 len = INITCONTEXTLEN;
1253 context = kmalloc(len+1, GFP_NOFS);
1259 context[len] = '\0';
1260 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1262 if (rc == -ERANGE) {
1265 /* Need a larger buffer. Query for the right size. */
1266 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1273 context = kmalloc(len+1, GFP_NOFS);
1279 context[len] = '\0';
1280 rc = inode->i_op->getxattr(dentry,
1286 if (rc != -ENODATA) {
1287 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1288 "%d for dev=%s ino=%ld\n", __func__,
1289 -rc, inode->i_sb->s_id, inode->i_ino);
1293 /* Map ENODATA to the default file SID */
1294 sid = sbsec->def_sid;
1297 rc = security_context_to_sid_default(context, rc, &sid,
1301 char *dev = inode->i_sb->s_id;
1302 unsigned long ino = inode->i_ino;
1304 if (rc == -EINVAL) {
1305 if (printk_ratelimit())
1306 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1307 "context=%s. This indicates you may need to relabel the inode or the "
1308 "filesystem in question.\n", ino, dev, context);
1310 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1311 "returned %d for dev=%s ino=%ld\n",
1312 __func__, context, -rc, dev, ino);
1315 /* Leave with the unlabeled SID */
1323 case SECURITY_FS_USE_TASK:
1324 isec->sid = isec->task_sid;
1326 case SECURITY_FS_USE_TRANS:
1327 /* Default to the fs SID. */
1328 isec->sid = sbsec->sid;
1330 /* Try to obtain a transition SID. */
1331 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1332 rc = security_transition_sid(isec->task_sid,
1340 case SECURITY_FS_USE_MNTPOINT:
1341 isec->sid = sbsec->mntpoint_sid;
1344 /* Default to the fs superblock SID. */
1345 isec->sid = sbsec->sid;
1347 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1348 struct proc_inode *proci = PROC_I(inode);
1350 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1351 rc = selinux_proc_get_sid(proci->pde,
1362 isec->initialized = 1;
1365 mutex_unlock(&isec->lock);
1367 if (isec->sclass == SECCLASS_FILE)
1368 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1372 /* Convert a Linux signal to an access vector. */
1373 static inline u32 signal_to_av(int sig)
1379 /* Commonly granted from child to parent. */
1380 perm = PROCESS__SIGCHLD;
1383 /* Cannot be caught or ignored */
1384 perm = PROCESS__SIGKILL;
1387 /* Cannot be caught or ignored */
1388 perm = PROCESS__SIGSTOP;
1391 /* All other signals. */
1392 perm = PROCESS__SIGNAL;
1400 * Check permission between a pair of credentials
1401 * fork check, ptrace check, etc.
1403 static int cred_has_perm(const struct cred *actor,
1404 const struct cred *target,
1407 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1409 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1413 * Check permission between a pair of tasks, e.g. signal checks,
1414 * fork check, ptrace check, etc.
1415 * tsk1 is the actor and tsk2 is the target
1416 * - this uses the default subjective creds of tsk1
1418 static int task_has_perm(const struct task_struct *tsk1,
1419 const struct task_struct *tsk2,
1422 const struct task_security_struct *__tsec1, *__tsec2;
1426 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1427 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1429 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1433 * Check permission between current and another task, e.g. signal checks,
1434 * fork check, ptrace check, etc.
1435 * current is the actor and tsk2 is the target
1436 * - this uses current's subjective creds
1438 static int current_has_perm(const struct task_struct *tsk,
1443 sid = current_sid();
1444 tsid = task_sid(tsk);
1445 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1448 #if CAP_LAST_CAP > 63
1449 #error Fix SELinux to handle capabilities > 63.
1452 /* Check whether a task is allowed to use a capability. */
1453 static int task_has_capability(struct task_struct *tsk,
1454 const struct cred *cred,
1457 struct common_audit_data ad;
1458 struct av_decision avd;
1460 u32 sid = cred_sid(cred);
1461 u32 av = CAP_TO_MASK(cap);
1464 COMMON_AUDIT_DATA_INIT(&ad, CAP);
1468 switch (CAP_TO_INDEX(cap)) {
1470 sclass = SECCLASS_CAPABILITY;
1473 sclass = SECCLASS_CAPABILITY2;
1477 "SELinux: out of range capability %d\n", cap);
1481 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1482 if (audit == SECURITY_CAP_AUDIT)
1483 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1487 /* Check whether a task is allowed to use a system operation. */
1488 static int task_has_system(struct task_struct *tsk,
1491 u32 sid = task_sid(tsk);
1493 return avc_has_perm(sid, SECINITSID_KERNEL,
1494 SECCLASS_SYSTEM, perms, NULL);
1497 /* Check whether a task has a particular permission to an inode.
1498 The 'adp' parameter is optional and allows other audit
1499 data to be passed (e.g. the dentry). */
1500 static int inode_has_perm(const struct cred *cred,
1501 struct inode *inode,
1503 struct common_audit_data *adp)
1505 struct inode_security_struct *isec;
1506 struct common_audit_data ad;
1509 validate_creds(cred);
1511 if (unlikely(IS_PRIVATE(inode)))
1514 sid = cred_sid(cred);
1515 isec = inode->i_security;
1519 COMMON_AUDIT_DATA_INIT(&ad, FS);
1520 ad.u.fs.inode = inode;
1523 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1526 /* Same as inode_has_perm, but pass explicit audit data containing
1527 the dentry to help the auditing code to more easily generate the
1528 pathname if needed. */
1529 static inline int dentry_has_perm(const struct cred *cred,
1530 struct vfsmount *mnt,
1531 struct dentry *dentry,
1534 struct inode *inode = dentry->d_inode;
1535 struct common_audit_data ad;
1537 COMMON_AUDIT_DATA_INIT(&ad, FS);
1538 ad.u.fs.path.mnt = mnt;
1539 ad.u.fs.path.dentry = dentry;
1540 return inode_has_perm(cred, inode, av, &ad);
1543 /* Check whether a task can use an open file descriptor to
1544 access an inode in a given way. Check access to the
1545 descriptor itself, and then use dentry_has_perm to
1546 check a particular permission to the file.
1547 Access to the descriptor is implicitly granted if it
1548 has the same SID as the process. If av is zero, then
1549 access to the file is not checked, e.g. for cases
1550 where only the descriptor is affected like seek. */
1551 static int file_has_perm(const struct cred *cred,
1555 struct file_security_struct *fsec = file->f_security;
1556 struct inode *inode = file->f_path.dentry->d_inode;
1557 struct common_audit_data ad;
1558 u32 sid = cred_sid(cred);
1561 COMMON_AUDIT_DATA_INIT(&ad, FS);
1562 ad.u.fs.path = file->f_path;
1564 if (sid != fsec->sid) {
1565 rc = avc_has_perm(sid, fsec->sid,
1573 /* av is zero if only checking access to the descriptor. */
1576 rc = inode_has_perm(cred, inode, av, &ad);
1582 /* Check whether a task can create a file. */
1583 static int may_create(struct inode *dir,
1584 struct dentry *dentry,
1587 const struct cred *cred = current_cred();
1588 const struct task_security_struct *tsec = cred->security;
1589 struct inode_security_struct *dsec;
1590 struct superblock_security_struct *sbsec;
1592 struct common_audit_data ad;
1595 dsec = dir->i_security;
1596 sbsec = dir->i_sb->s_security;
1599 newsid = tsec->create_sid;
1601 COMMON_AUDIT_DATA_INIT(&ad, FS);
1602 ad.u.fs.path.dentry = dentry;
1604 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1605 DIR__ADD_NAME | DIR__SEARCH,
1610 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1611 rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
1616 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1620 return avc_has_perm(newsid, sbsec->sid,
1621 SECCLASS_FILESYSTEM,
1622 FILESYSTEM__ASSOCIATE, &ad);
1625 /* Check whether a task can create a key. */
1626 static int may_create_key(u32 ksid,
1627 struct task_struct *ctx)
1629 u32 sid = task_sid(ctx);
1631 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1635 #define MAY_UNLINK 1
1638 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1639 static int may_link(struct inode *dir,
1640 struct dentry *dentry,
1644 struct inode_security_struct *dsec, *isec;
1645 struct common_audit_data ad;
1646 u32 sid = current_sid();
1650 dsec = dir->i_security;
1651 isec = dentry->d_inode->i_security;
1653 COMMON_AUDIT_DATA_INIT(&ad, FS);
1654 ad.u.fs.path.dentry = dentry;
1657 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1658 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1673 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1678 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1682 static inline int may_rename(struct inode *old_dir,
1683 struct dentry *old_dentry,
1684 struct inode *new_dir,
1685 struct dentry *new_dentry)
1687 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1688 struct common_audit_data ad;
1689 u32 sid = current_sid();
1691 int old_is_dir, new_is_dir;
1694 old_dsec = old_dir->i_security;
1695 old_isec = old_dentry->d_inode->i_security;
1696 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1697 new_dsec = new_dir->i_security;
1699 COMMON_AUDIT_DATA_INIT(&ad, FS);
1701 ad.u.fs.path.dentry = old_dentry;
1702 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1703 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1706 rc = avc_has_perm(sid, old_isec->sid,
1707 old_isec->sclass, FILE__RENAME, &ad);
1710 if (old_is_dir && new_dir != old_dir) {
1711 rc = avc_has_perm(sid, old_isec->sid,
1712 old_isec->sclass, DIR__REPARENT, &ad);
1717 ad.u.fs.path.dentry = new_dentry;
1718 av = DIR__ADD_NAME | DIR__SEARCH;
1719 if (new_dentry->d_inode)
1720 av |= DIR__REMOVE_NAME;
1721 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1724 if (new_dentry->d_inode) {
1725 new_isec = new_dentry->d_inode->i_security;
1726 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1727 rc = avc_has_perm(sid, new_isec->sid,
1729 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1737 /* Check whether a task can perform a filesystem operation. */
1738 static int superblock_has_perm(const struct cred *cred,
1739 struct super_block *sb,
1741 struct common_audit_data *ad)
1743 struct superblock_security_struct *sbsec;
1744 u32 sid = cred_sid(cred);
1746 sbsec = sb->s_security;
1747 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1750 /* Convert a Linux mode and permission mask to an access vector. */
1751 static inline u32 file_mask_to_av(int mode, int mask)
1755 if ((mode & S_IFMT) != S_IFDIR) {
1756 if (mask & MAY_EXEC)
1757 av |= FILE__EXECUTE;
1758 if (mask & MAY_READ)
1761 if (mask & MAY_APPEND)
1763 else if (mask & MAY_WRITE)
1767 if (mask & MAY_EXEC)
1769 if (mask & MAY_WRITE)
1771 if (mask & MAY_READ)
1778 /* Convert a Linux file to an access vector. */
1779 static inline u32 file_to_av(struct file *file)
1783 if (file->f_mode & FMODE_READ)
1785 if (file->f_mode & FMODE_WRITE) {
1786 if (file->f_flags & O_APPEND)
1793 * Special file opened with flags 3 for ioctl-only use.
1802 * Convert a file to an access vector and include the correct open
1805 static inline u32 open_file_to_av(struct file *file)
1807 u32 av = file_to_av(file);
1809 if (selinux_policycap_openperm) {
1810 mode_t mode = file->f_path.dentry->d_inode->i_mode;
1812 * lnk files and socks do not really have an 'open'
1816 else if (S_ISCHR(mode))
1817 av |= CHR_FILE__OPEN;
1818 else if (S_ISBLK(mode))
1819 av |= BLK_FILE__OPEN;
1820 else if (S_ISFIFO(mode))
1821 av |= FIFO_FILE__OPEN;
1822 else if (S_ISDIR(mode))
1824 else if (S_ISSOCK(mode))
1825 av |= SOCK_FILE__OPEN;
1827 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1828 "unknown mode:%o\n", __func__, mode);
1833 /* Hook functions begin here. */
1835 static int selinux_ptrace_access_check(struct task_struct *child,
1840 rc = cap_ptrace_access_check(child, mode);
1844 if (mode == PTRACE_MODE_READ) {
1845 u32 sid = current_sid();
1846 u32 csid = task_sid(child);
1847 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1850 return current_has_perm(child, PROCESS__PTRACE);
1853 static int selinux_ptrace_traceme(struct task_struct *parent)
1857 rc = cap_ptrace_traceme(parent);
1861 return task_has_perm(parent, current, PROCESS__PTRACE);
1864 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1865 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1869 error = current_has_perm(target, PROCESS__GETCAP);
1873 return cap_capget(target, effective, inheritable, permitted);
1876 static int selinux_capset(struct cred *new, const struct cred *old,
1877 const kernel_cap_t *effective,
1878 const kernel_cap_t *inheritable,
1879 const kernel_cap_t *permitted)
1883 error = cap_capset(new, old,
1884 effective, inheritable, permitted);
1888 return cred_has_perm(old, new, PROCESS__SETCAP);
1892 * (This comment used to live with the selinux_task_setuid hook,
1893 * which was removed).
1895 * Since setuid only affects the current process, and since the SELinux
1896 * controls are not based on the Linux identity attributes, SELinux does not
1897 * need to control this operation. However, SELinux does control the use of
1898 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1901 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1906 rc = cap_capable(tsk, cred, cap, audit);
1910 return task_has_capability(tsk, cred, cap, audit);
1913 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1916 char *buffer, *path, *end;
1919 buffer = (char *)__get_free_page(GFP_KERNEL);
1924 end = buffer+buflen;
1930 const char *name = table->procname;
1931 size_t namelen = strlen(name);
1932 buflen -= namelen + 1;
1936 memcpy(end, name, namelen);
1939 table = table->parent;
1945 memcpy(end, "/sys", 4);
1947 rc = security_genfs_sid("proc", path, tclass, sid);
1949 free_page((unsigned long)buffer);
1954 static int selinux_sysctl(ctl_table *table, int op)
1961 sid = current_sid();
1963 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1964 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1966 /* Default to the well-defined sysctl SID. */
1967 tsid = SECINITSID_SYSCTL;
1970 /* The op values are "defined" in sysctl.c, thereby creating
1971 * a bad coupling between this module and sysctl.c */
1973 error = avc_has_perm(sid, tsid,
1974 SECCLASS_DIR, DIR__SEARCH, NULL);
1982 error = avc_has_perm(sid, tsid,
1983 SECCLASS_FILE, av, NULL);
1989 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1991 const struct cred *cred = current_cred();
2003 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2008 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2011 rc = 0; /* let the kernel handle invalid cmds */
2017 static int selinux_quota_on(struct dentry *dentry)
2019 const struct cred *cred = current_cred();
2021 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
2024 static int selinux_syslog(int type, bool from_file)
2028 rc = cap_syslog(type, from_file);
2033 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2034 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2035 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2037 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2038 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2039 /* Set level of messages printed to console */
2040 case SYSLOG_ACTION_CONSOLE_LEVEL:
2041 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2043 case SYSLOG_ACTION_CLOSE: /* Close log */
2044 case SYSLOG_ACTION_OPEN: /* Open log */
2045 case SYSLOG_ACTION_READ: /* Read from log */
2046 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2047 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2049 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2056 * Check that a process has enough memory to allocate a new virtual
2057 * mapping. 0 means there is enough memory for the allocation to
2058 * succeed and -ENOMEM implies there is not.
2060 * Do not audit the selinux permission check, as this is applied to all
2061 * processes that allocate mappings.
2063 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2065 int rc, cap_sys_admin = 0;
2067 rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
2068 SECURITY_CAP_NOAUDIT);
2072 return __vm_enough_memory(mm, pages, cap_sys_admin);
2075 /* binprm security operations */
2077 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2079 const struct task_security_struct *old_tsec;
2080 struct task_security_struct *new_tsec;
2081 struct inode_security_struct *isec;
2082 struct common_audit_data ad;
2083 struct inode *inode = bprm->file->f_path.dentry->d_inode;
2086 rc = cap_bprm_set_creds(bprm);
2090 /* SELinux context only depends on initial program or script and not
2091 * the script interpreter */
2092 if (bprm->cred_prepared)
2095 old_tsec = current_security();
2096 new_tsec = bprm->cred->security;
2097 isec = inode->i_security;
2099 /* Default to the current task SID. */
2100 new_tsec->sid = old_tsec->sid;
2101 new_tsec->osid = old_tsec->sid;
2103 /* Reset fs, key, and sock SIDs on execve. */
2104 new_tsec->create_sid = 0;
2105 new_tsec->keycreate_sid = 0;
2106 new_tsec->sockcreate_sid = 0;
2108 if (old_tsec->exec_sid) {
2109 new_tsec->sid = old_tsec->exec_sid;
2110 /* Reset exec SID on execve. */
2111 new_tsec->exec_sid = 0;
2113 /* Check for a default transition on this program. */
2114 rc = security_transition_sid(old_tsec->sid, isec->sid,
2115 SECCLASS_PROCESS, &new_tsec->sid);
2120 COMMON_AUDIT_DATA_INIT(&ad, FS);
2121 ad.u.fs.path = bprm->file->f_path;
2123 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2124 new_tsec->sid = old_tsec->sid;
2126 if (new_tsec->sid == old_tsec->sid) {
2127 rc = avc_has_perm(old_tsec->sid, isec->sid,
2128 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2132 /* Check permissions for the transition. */
2133 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2134 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2138 rc = avc_has_perm(new_tsec->sid, isec->sid,
2139 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2143 /* Check for shared state */
2144 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2145 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2146 SECCLASS_PROCESS, PROCESS__SHARE,
2152 /* Make sure that anyone attempting to ptrace over a task that
2153 * changes its SID has the appropriate permit */
2155 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2156 struct task_struct *tracer;
2157 struct task_security_struct *sec;
2161 tracer = tracehook_tracer_task(current);
2162 if (likely(tracer != NULL)) {
2163 sec = __task_cred(tracer)->security;
2169 rc = avc_has_perm(ptsid, new_tsec->sid,
2171 PROCESS__PTRACE, NULL);
2177 /* Clear any possibly unsafe personality bits on exec: */
2178 bprm->per_clear |= PER_CLEAR_ON_SETID;
2184 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2186 const struct cred *cred = current_cred();
2187 const struct task_security_struct *tsec = cred->security;
2195 /* Enable secure mode for SIDs transitions unless
2196 the noatsecure permission is granted between
2197 the two SIDs, i.e. ahp returns 0. */
2198 atsecure = avc_has_perm(osid, sid,
2200 PROCESS__NOATSECURE, NULL);
2203 return (atsecure || cap_bprm_secureexec(bprm));
2206 extern struct vfsmount *selinuxfs_mount;
2207 extern struct dentry *selinux_null;
2209 /* Derived from fs/exec.c:flush_old_files. */
2210 static inline void flush_unauthorized_files(const struct cred *cred,
2211 struct files_struct *files)
2213 struct common_audit_data ad;
2214 struct file *file, *devnull = NULL;
2215 struct tty_struct *tty;
2216 struct fdtable *fdt;
2220 tty = get_current_tty();
2223 if (!list_empty(&tty->tty_files)) {
2224 struct inode *inode;
2226 /* Revalidate access to controlling tty.
2227 Use inode_has_perm on the tty inode directly rather
2228 than using file_has_perm, as this particular open
2229 file may belong to another process and we are only
2230 interested in the inode-based check here. */
2231 file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
2232 inode = file->f_path.dentry->d_inode;
2233 if (inode_has_perm(cred, inode,
2234 FILE__READ | FILE__WRITE, NULL)) {
2241 /* Reset controlling tty. */
2245 /* Revalidate access to inherited open files. */
2247 COMMON_AUDIT_DATA_INIT(&ad, FS);
2249 spin_lock(&files->file_lock);
2251 unsigned long set, i;
2256 fdt = files_fdtable(files);
2257 if (i >= fdt->max_fds)
2259 set = fdt->open_fds->fds_bits[j];
2262 spin_unlock(&files->file_lock);
2263 for ( ; set ; i++, set >>= 1) {
2268 if (file_has_perm(cred,
2270 file_to_av(file))) {
2272 fd = get_unused_fd();
2282 devnull = dentry_open(
2284 mntget(selinuxfs_mount),
2286 if (IS_ERR(devnull)) {
2293 fd_install(fd, devnull);
2298 spin_lock(&files->file_lock);
2301 spin_unlock(&files->file_lock);
2305 * Prepare a process for imminent new credential changes due to exec
2307 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2309 struct task_security_struct *new_tsec;
2310 struct rlimit *rlim, *initrlim;
2313 new_tsec = bprm->cred->security;
2314 if (new_tsec->sid == new_tsec->osid)
2317 /* Close files for which the new task SID is not authorized. */
2318 flush_unauthorized_files(bprm->cred, current->files);
2320 /* Always clear parent death signal on SID transitions. */
2321 current->pdeath_signal = 0;
2323 /* Check whether the new SID can inherit resource limits from the old
2324 * SID. If not, reset all soft limits to the lower of the current
2325 * task's hard limit and the init task's soft limit.
2327 * Note that the setting of hard limits (even to lower them) can be
2328 * controlled by the setrlimit check. The inclusion of the init task's
2329 * soft limit into the computation is to avoid resetting soft limits
2330 * higher than the default soft limit for cases where the default is
2331 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2333 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2334 PROCESS__RLIMITINH, NULL);
2336 for (i = 0; i < RLIM_NLIMITS; i++) {
2337 rlim = current->signal->rlim + i;
2338 initrlim = init_task.signal->rlim + i;
2339 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2341 update_rlimit_cpu(current->signal->rlim[RLIMIT_CPU].rlim_cur);
2346 * Clean up the process immediately after the installation of new credentials
2349 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2351 const struct task_security_struct *tsec = current_security();
2352 struct itimerval itimer;
2362 /* Check whether the new SID can inherit signal state from the old SID.
2363 * If not, clear itimers to avoid subsequent signal generation and
2364 * flush and unblock signals.
2366 * This must occur _after_ the task SID has been updated so that any
2367 * kill done after the flush will be checked against the new SID.
2369 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2371 memset(&itimer, 0, sizeof itimer);
2372 for (i = 0; i < 3; i++)
2373 do_setitimer(i, &itimer, NULL);
2374 spin_lock_irq(¤t->sighand->siglock);
2375 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2376 __flush_signals(current);
2377 flush_signal_handlers(current, 1);
2378 sigemptyset(¤t->blocked);
2380 spin_unlock_irq(¤t->sighand->siglock);
2383 /* Wake up the parent if it is waiting so that it can recheck
2384 * wait permission to the new task SID. */
2385 read_lock(&tasklist_lock);
2386 __wake_up_parent(current, current->real_parent);
2387 read_unlock(&tasklist_lock);
2390 /* superblock security operations */
2392 static int selinux_sb_alloc_security(struct super_block *sb)
2394 return superblock_alloc_security(sb);
2397 static void selinux_sb_free_security(struct super_block *sb)
2399 superblock_free_security(sb);
2402 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2407 return !memcmp(prefix, option, plen);
2410 static inline int selinux_option(char *option, int len)
2412 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2413 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2414 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2415 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2416 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2419 static inline void take_option(char **to, char *from, int *first, int len)
2426 memcpy(*to, from, len);
2430 static inline void take_selinux_option(char **to, char *from, int *first,
2433 int current_size = 0;
2441 while (current_size < len) {
2451 static int selinux_sb_copy_data(char *orig, char *copy)
2453 int fnosec, fsec, rc = 0;
2454 char *in_save, *in_curr, *in_end;
2455 char *sec_curr, *nosec_save, *nosec;
2461 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2469 in_save = in_end = orig;
2473 open_quote = !open_quote;
2474 if ((*in_end == ',' && open_quote == 0) ||
2476 int len = in_end - in_curr;
2478 if (selinux_option(in_curr, len))
2479 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2481 take_option(&nosec, in_curr, &fnosec, len);
2483 in_curr = in_end + 1;
2485 } while (*in_end++);
2487 strcpy(in_save, nosec_save);
2488 free_page((unsigned long)nosec_save);
2493 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2495 const struct cred *cred = current_cred();
2496 struct common_audit_data ad;
2499 rc = superblock_doinit(sb, data);
2503 /* Allow all mounts performed by the kernel */
2504 if (flags & MS_KERNMOUNT)
2507 COMMON_AUDIT_DATA_INIT(&ad, FS);
2508 ad.u.fs.path.dentry = sb->s_root;
2509 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2512 static int selinux_sb_statfs(struct dentry *dentry)
2514 const struct cred *cred = current_cred();
2515 struct common_audit_data ad;
2517 COMMON_AUDIT_DATA_INIT(&ad, FS);
2518 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2519 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2522 static int selinux_mount(char *dev_name,
2525 unsigned long flags,
2528 const struct cred *cred = current_cred();
2530 if (flags & MS_REMOUNT)
2531 return superblock_has_perm(cred, path->mnt->mnt_sb,
2532 FILESYSTEM__REMOUNT, NULL);
2534 return dentry_has_perm(cred, path->mnt, path->dentry,
2538 static int selinux_umount(struct vfsmount *mnt, int flags)
2540 const struct cred *cred = current_cred();
2542 return superblock_has_perm(cred, mnt->mnt_sb,
2543 FILESYSTEM__UNMOUNT, NULL);
2546 /* inode security operations */
2548 static int selinux_inode_alloc_security(struct inode *inode)
2550 return inode_alloc_security(inode);
2553 static void selinux_inode_free_security(struct inode *inode)
2555 inode_free_security(inode);
2558 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2559 char **name, void **value,
2562 const struct cred *cred = current_cred();
2563 const struct task_security_struct *tsec = cred->security;
2564 struct inode_security_struct *dsec;
2565 struct superblock_security_struct *sbsec;
2566 u32 sid, newsid, clen;
2568 char *namep = NULL, *context;
2570 dsec = dir->i_security;
2571 sbsec = dir->i_sb->s_security;
2574 newsid = tsec->create_sid;
2576 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2577 rc = security_transition_sid(sid, dsec->sid,
2578 inode_mode_to_security_class(inode->i_mode),
2581 printk(KERN_WARNING "%s: "
2582 "security_transition_sid failed, rc=%d (dev=%s "
2585 -rc, inode->i_sb->s_id, inode->i_ino);
2590 /* Possibly defer initialization to selinux_complete_init. */
2591 if (sbsec->flags & SE_SBINITIALIZED) {
2592 struct inode_security_struct *isec = inode->i_security;
2593 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2595 isec->initialized = 1;
2598 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2602 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2609 rc = security_sid_to_context_force(newsid, &context, &clen);
2621 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2623 return may_create(dir, dentry, SECCLASS_FILE);
2626 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2628 return may_link(dir, old_dentry, MAY_LINK);
2631 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2633 return may_link(dir, dentry, MAY_UNLINK);
2636 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2638 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2641 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2643 return may_create(dir, dentry, SECCLASS_DIR);
2646 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2648 return may_link(dir, dentry, MAY_RMDIR);
2651 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2653 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2656 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2657 struct inode *new_inode, struct dentry *new_dentry)
2659 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2662 static int selinux_inode_readlink(struct dentry *dentry)
2664 const struct cred *cred = current_cred();
2666 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2669 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2671 const struct cred *cred = current_cred();
2673 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2676 static int selinux_inode_permission(struct inode *inode, int mask)
2678 const struct cred *cred = current_cred();
2681 /* No permission to check. Existence test. */
2685 return inode_has_perm(cred, inode,
2686 file_mask_to_av(inode->i_mode, mask), NULL);
2689 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2691 const struct cred *cred = current_cred();
2692 unsigned int ia_valid = iattr->ia_valid;
2694 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2695 if (ia_valid & ATTR_FORCE) {
2696 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2702 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2703 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2704 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2706 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
2709 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2711 const struct cred *cred = current_cred();
2713 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
2716 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2718 const struct cred *cred = current_cred();
2720 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2721 sizeof XATTR_SECURITY_PREFIX - 1)) {
2722 if (!strcmp(name, XATTR_NAME_CAPS)) {
2723 if (!capable(CAP_SETFCAP))
2725 } else if (!capable(CAP_SYS_ADMIN)) {
2726 /* A different attribute in the security namespace.
2727 Restrict to administrator. */
2732 /* Not an attribute we recognize, so just check the
2733 ordinary setattr permission. */
2734 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2737 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2738 const void *value, size_t size, int flags)
2740 struct inode *inode = dentry->d_inode;
2741 struct inode_security_struct *isec = inode->i_security;
2742 struct superblock_security_struct *sbsec;
2743 struct common_audit_data ad;
2744 u32 newsid, sid = current_sid();
2747 if (strcmp(name, XATTR_NAME_SELINUX))
2748 return selinux_inode_setotherxattr(dentry, name);
2750 sbsec = inode->i_sb->s_security;
2751 if (!(sbsec->flags & SE_SBLABELSUPP))
2754 if (!is_owner_or_cap(inode))
2757 COMMON_AUDIT_DATA_INIT(&ad, FS);
2758 ad.u.fs.path.dentry = dentry;
2760 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2761 FILE__RELABELFROM, &ad);
2765 rc = security_context_to_sid(value, size, &newsid);
2766 if (rc == -EINVAL) {
2767 if (!capable(CAP_MAC_ADMIN))
2769 rc = security_context_to_sid_force(value, size, &newsid);
2774 rc = avc_has_perm(sid, newsid, isec->sclass,
2775 FILE__RELABELTO, &ad);
2779 rc = security_validate_transition(isec->sid, newsid, sid,
2784 return avc_has_perm(newsid,
2786 SECCLASS_FILESYSTEM,
2787 FILESYSTEM__ASSOCIATE,
2791 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2792 const void *value, size_t size,
2795 struct inode *inode = dentry->d_inode;
2796 struct inode_security_struct *isec = inode->i_security;
2800 if (strcmp(name, XATTR_NAME_SELINUX)) {
2801 /* Not an attribute we recognize, so nothing to do. */
2805 rc = security_context_to_sid_force(value, size, &newsid);
2807 printk(KERN_ERR "SELinux: unable to map context to SID"
2808 "for (%s, %lu), rc=%d\n",
2809 inode->i_sb->s_id, inode->i_ino, -rc);
2817 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2819 const struct cred *cred = current_cred();
2821 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2824 static int selinux_inode_listxattr(struct dentry *dentry)
2826 const struct cred *cred = current_cred();
2828 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2831 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2833 if (strcmp(name, XATTR_NAME_SELINUX))
2834 return selinux_inode_setotherxattr(dentry, name);
2836 /* No one is allowed to remove a SELinux security label.
2837 You can change the label, but all data must be labeled. */
2842 * Copy the inode security context value to the user.
2844 * Permission check is handled by selinux_inode_getxattr hook.
2846 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2850 char *context = NULL;
2851 struct inode_security_struct *isec = inode->i_security;
2853 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2857 * If the caller has CAP_MAC_ADMIN, then get the raw context
2858 * value even if it is not defined by current policy; otherwise,
2859 * use the in-core value under current policy.
2860 * Use the non-auditing forms of the permission checks since
2861 * getxattr may be called by unprivileged processes commonly
2862 * and lack of permission just means that we fall back to the
2863 * in-core context value, not a denial.
2865 error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
2866 SECURITY_CAP_NOAUDIT);
2868 error = security_sid_to_context_force(isec->sid, &context,
2871 error = security_sid_to_context(isec->sid, &context, &size);
2884 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2885 const void *value, size_t size, int flags)
2887 struct inode_security_struct *isec = inode->i_security;
2891 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2894 if (!value || !size)
2897 rc = security_context_to_sid((void *)value, size, &newsid);
2902 isec->initialized = 1;
2906 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2908 const int len = sizeof(XATTR_NAME_SELINUX);
2909 if (buffer && len <= buffer_size)
2910 memcpy(buffer, XATTR_NAME_SELINUX, len);
2914 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2916 struct inode_security_struct *isec = inode->i_security;
2920 /* file security operations */
2922 static int selinux_revalidate_file_permission(struct file *file, int mask)
2924 const struct cred *cred = current_cred();
2925 struct inode *inode = file->f_path.dentry->d_inode;
2927 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2928 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2931 return file_has_perm(cred, file,
2932 file_mask_to_av(inode->i_mode, mask));
2935 static int selinux_file_permission(struct file *file, int mask)
2937 struct inode *inode = file->f_path.dentry->d_inode;
2938 struct file_security_struct *fsec = file->f_security;
2939 struct inode_security_struct *isec = inode->i_security;
2940 u32 sid = current_sid();
2943 /* No permission to check. Existence test. */
2946 if (sid == fsec->sid && fsec->isid == isec->sid &&
2947 fsec->pseqno == avc_policy_seqno())
2948 /* No change since dentry_open check. */
2951 return selinux_revalidate_file_permission(file, mask);
2954 static int selinux_file_alloc_security(struct file *file)
2956 return file_alloc_security(file);
2959 static void selinux_file_free_security(struct file *file)
2961 file_free_security(file);
2964 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2967 const struct cred *cred = current_cred();
2970 if (_IOC_DIR(cmd) & _IOC_WRITE)
2972 if (_IOC_DIR(cmd) & _IOC_READ)
2977 return file_has_perm(cred, file, av);
2980 static int default_noexec;
2982 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2984 const struct cred *cred = current_cred();
2987 if (default_noexec &&
2988 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2990 * We are making executable an anonymous mapping or a
2991 * private file mapping that will also be writable.
2992 * This has an additional check.
2994 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3000 /* read access is always possible with a mapping */
3001 u32 av = FILE__READ;
3003 /* write access only matters if the mapping is shared */
3004 if (shared && (prot & PROT_WRITE))
3007 if (prot & PROT_EXEC)
3008 av |= FILE__EXECUTE;
3010 return file_has_perm(cred, file, av);
3017 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3018 unsigned long prot, unsigned long flags,
3019 unsigned long addr, unsigned long addr_only)
3022 u32 sid = current_sid();
3025 * notice that we are intentionally putting the SELinux check before
3026 * the secondary cap_file_mmap check. This is such a likely attempt
3027 * at bad behaviour/exploit that we always want to get the AVC, even
3028 * if DAC would have also denied the operation.
3030 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3031 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3032 MEMPROTECT__MMAP_ZERO, NULL);
3037 /* do DAC check on address space usage */
3038 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3039 if (rc || addr_only)
3042 if (selinux_checkreqprot)
3045 return file_map_prot_check(file, prot,
3046 (flags & MAP_TYPE) == MAP_SHARED);
3049 static int selinux_file_mprotect(struct vm_area_struct *vma,
3050 unsigned long reqprot,
3053 const struct cred *cred = current_cred();
3055 if (selinux_checkreqprot)
3058 if (default_noexec &&
3059 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3061 if (vma->vm_start >= vma->vm_mm->start_brk &&
3062 vma->vm_end <= vma->vm_mm->brk) {
3063 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3064 } else if (!vma->vm_file &&
3065 vma->vm_start <= vma->vm_mm->start_stack &&
3066 vma->vm_end >= vma->vm_mm->start_stack) {
3067 rc = current_has_perm(current, PROCESS__EXECSTACK);
3068 } else if (vma->vm_file && vma->anon_vma) {
3070 * We are making executable a file mapping that has
3071 * had some COW done. Since pages might have been
3072 * written, check ability to execute the possibly
3073 * modified content. This typically should only
3074 * occur for text relocations.
3076 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3082 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3085 static int selinux_file_lock(struct file *file, unsigned int cmd)
3087 const struct cred *cred = current_cred();
3089 return file_has_perm(cred, file, FILE__LOCK);
3092 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3095 const struct cred *cred = current_cred();
3100 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3105 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3106 err = file_has_perm(cred, file, FILE__WRITE);
3115 /* Just check FD__USE permission */
3116 err = file_has_perm(cred, file, 0);
3121 #if BITS_PER_LONG == 32
3126 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3130 err = file_has_perm(cred, file, FILE__LOCK);
3137 static int selinux_file_set_fowner(struct file *file)
3139 struct file_security_struct *fsec;
3141 fsec = file->f_security;
3142 fsec->fown_sid = current_sid();
3147 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3148 struct fown_struct *fown, int signum)
3151 u32 sid = task_sid(tsk);
3153 struct file_security_struct *fsec;
3155 /* struct fown_struct is never outside the context of a struct file */
3156 file = container_of(fown, struct file, f_owner);
3158 fsec = file->f_security;
3161 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3163 perm = signal_to_av(signum);
3165 return avc_has_perm(fsec->fown_sid, sid,
3166 SECCLASS_PROCESS, perm, NULL);
3169 static int selinux_file_receive(struct file *file)
3171 const struct cred *cred = current_cred();
3173 return file_has_perm(cred, file, file_to_av(file));
3176 static int selinux_dentry_open(struct file *file, const struct cred *cred)
3178 struct file_security_struct *fsec;
3179 struct inode *inode;
3180 struct inode_security_struct *isec;
3182 inode = file->f_path.dentry->d_inode;
3183 fsec = file->f_security;
3184 isec = inode->i_security;
3186 * Save inode label and policy sequence number
3187 * at open-time so that selinux_file_permission
3188 * can determine whether revalidation is necessary.
3189 * Task label is already saved in the file security
3190 * struct as its SID.
3192 fsec->isid = isec->sid;
3193 fsec->pseqno = avc_policy_seqno();
3195 * Since the inode label or policy seqno may have changed
3196 * between the selinux_inode_permission check and the saving
3197 * of state above, recheck that access is still permitted.
3198 * Otherwise, access might never be revalidated against the
3199 * new inode label or new policy.
3200 * This check is not redundant - do not remove.
3202 return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
3205 /* task security operations */
3207 static int selinux_task_create(unsigned long clone_flags)
3209 return current_has_perm(current, PROCESS__FORK);
3213 * allocate the SELinux part of blank credentials
3215 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3217 struct task_security_struct *tsec;
3219 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3223 cred->security = tsec;
3228 * detach and free the LSM part of a set of credentials
3230 static void selinux_cred_free(struct cred *cred)
3232 struct task_security_struct *tsec = cred->security;
3234 BUG_ON((unsigned long) cred->security < PAGE_SIZE);
3235 cred->security = (void *) 0x7UL;
3240 * prepare a new set of credentials for modification
3242 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3245 const struct task_security_struct *old_tsec;
3246 struct task_security_struct *tsec;
3248 old_tsec = old->security;
3250 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3254 new->security = tsec;
3259 * transfer the SELinux data to a blank set of creds
3261 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3263 const struct task_security_struct *old_tsec = old->security;
3264 struct task_security_struct *tsec = new->security;
3270 * set the security data for a kernel service
3271 * - all the creation contexts are set to unlabelled
3273 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3275 struct task_security_struct *tsec = new->security;
3276 u32 sid = current_sid();
3279 ret = avc_has_perm(sid, secid,
3280 SECCLASS_KERNEL_SERVICE,
3281 KERNEL_SERVICE__USE_AS_OVERRIDE,
3285 tsec->create_sid = 0;
3286 tsec->keycreate_sid = 0;
3287 tsec->sockcreate_sid = 0;
3293 * set the file creation context in a security record to the same as the
3294 * objective context of the specified inode
3296 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3298 struct inode_security_struct *isec = inode->i_security;
3299 struct task_security_struct *tsec = new->security;
3300 u32 sid = current_sid();
3303 ret = avc_has_perm(sid, isec->sid,
3304 SECCLASS_KERNEL_SERVICE,
3305 KERNEL_SERVICE__CREATE_FILES_AS,
3309 tsec->create_sid = isec->sid;
3313 static int selinux_kernel_module_request(char *kmod_name)
3316 struct common_audit_data ad;
3318 sid = task_sid(current);
3320 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3321 ad.u.kmod_name = kmod_name;
3323 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3324 SYSTEM__MODULE_REQUEST, &ad);
3327 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3329 return current_has_perm(p, PROCESS__SETPGID);
3332 static int selinux_task_getpgid(struct task_struct *p)
3334 return current_has_perm(p, PROCESS__GETPGID);
3337 static int selinux_task_getsid(struct task_struct *p)
3339 return current_has_perm(p, PROCESS__GETSESSION);
3342 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3344 *secid = task_sid(p);
3347 static int selinux_task_setnice(struct task_struct *p, int nice)
3351 rc = cap_task_setnice(p, nice);
3355 return current_has_perm(p, PROCESS__SETSCHED);
3358 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3362 rc = cap_task_setioprio(p, ioprio);
3366 return current_has_perm(p, PROCESS__SETSCHED);
3369 static int selinux_task_getioprio(struct task_struct *p)
3371 return current_has_perm(p, PROCESS__GETSCHED);
3374 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3376 struct rlimit *old_rlim = current->signal->rlim + resource;
3378 /* Control the ability to change the hard limit (whether
3379 lowering or raising it), so that the hard limit can
3380 later be used as a safe reset point for the soft limit
3381 upon context transitions. See selinux_bprm_committing_creds. */
3382 if (old_rlim->rlim_max != new_rlim->rlim_max)
3383 return current_has_perm(current, PROCESS__SETRLIMIT);
3388 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3392 rc = cap_task_setscheduler(p, policy, lp);
3396 return current_has_perm(p, PROCESS__SETSCHED);
3399 static int selinux_task_getscheduler(struct task_struct *p)
3401 return current_has_perm(p, PROCESS__GETSCHED);
3404 static int selinux_task_movememory(struct task_struct *p)
3406 return current_has_perm(p, PROCESS__SETSCHED);
3409 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3416 perm = PROCESS__SIGNULL; /* null signal; existence test */
3418 perm = signal_to_av(sig);
3420 rc = avc_has_perm(secid, task_sid(p),
3421 SECCLASS_PROCESS, perm, NULL);
3423 rc = current_has_perm(p, perm);
3427 static int selinux_task_wait(struct task_struct *p)
3429 return task_has_perm(p, current, PROCESS__SIGCHLD);
3432 static void selinux_task_to_inode(struct task_struct *p,
3433 struct inode *inode)
3435 struct inode_security_struct *isec = inode->i_security;
3436 u32 sid = task_sid(p);
3439 isec->initialized = 1;
3442 /* Returns error only if unable to parse addresses */
3443 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3444 struct common_audit_data *ad, u8 *proto)
3446 int offset, ihlen, ret = -EINVAL;
3447 struct iphdr _iph, *ih;
3449 offset = skb_network_offset(skb);
3450 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3454 ihlen = ih->ihl * 4;
3455 if (ihlen < sizeof(_iph))
3458 ad->u.net.v4info.saddr = ih->saddr;
3459 ad->u.net.v4info.daddr = ih->daddr;
3463 *proto = ih->protocol;
3465 switch (ih->protocol) {
3467 struct tcphdr _tcph, *th;
3469 if (ntohs(ih->frag_off) & IP_OFFSET)
3473 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3477 ad->u.net.sport = th->source;
3478 ad->u.net.dport = th->dest;
3483 struct udphdr _udph, *uh;
3485 if (ntohs(ih->frag_off) & IP_OFFSET)
3489 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3493 ad->u.net.sport = uh->source;
3494 ad->u.net.dport = uh->dest;
3498 case IPPROTO_DCCP: {
3499 struct dccp_hdr _dccph, *dh;
3501 if (ntohs(ih->frag_off) & IP_OFFSET)
3505 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3509 ad->u.net.sport = dh->dccph_sport;
3510 ad->u.net.dport = dh->dccph_dport;
3521 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3523 /* Returns error only if unable to parse addresses */
3524 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3525 struct common_audit_data *ad, u8 *proto)
3528 int ret = -EINVAL, offset;
3529 struct ipv6hdr _ipv6h, *ip6;
3531 offset = skb_network_offset(skb);
3532 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3536 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3537 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3540 nexthdr = ip6->nexthdr;
3541 offset += sizeof(_ipv6h);
3542 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3551 struct tcphdr _tcph, *th;
3553 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3557 ad->u.net.sport = th->source;
3558 ad->u.net.dport = th->dest;
3563 struct udphdr _udph, *uh;
3565 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3569 ad->u.net.sport = uh->source;
3570 ad->u.net.dport = uh->dest;
3574 case IPPROTO_DCCP: {
3575 struct dccp_hdr _dccph, *dh;
3577 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3581 ad->u.net.sport = dh->dccph_sport;
3582 ad->u.net.dport = dh->dccph_dport;
3586 /* includes fragments */
3596 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3597 char **_addrp, int src, u8 *proto)
3602 switch (ad->u.net.family) {
3604 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3607 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3608 &ad->u.net.v4info.daddr);
3611 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3613 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3616 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3617 &ad->u.net.v6info.daddr);
3627 "SELinux: failure in selinux_parse_skb(),"
3628 " unable to parse packet\n");
3638 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3640 * @family: protocol family
3641 * @sid: the packet's peer label SID
3644 * Check the various different forms of network peer labeling and determine
3645 * the peer label/SID for the packet; most of the magic actually occurs in
3646 * the security server function security_net_peersid_cmp(). The function
3647 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3648 * or -EACCES if @sid is invalid due to inconsistencies with the different
3652 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3659 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3660 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3662 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3663 if (unlikely(err)) {
3665 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3666 " unable to determine packet's peer label\n");
3673 /* socket security operations */
3675 static u32 socket_sockcreate_sid(const struct task_security_struct *tsec)
3677 return tsec->sockcreate_sid ? : tsec->sid;
3680 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3683 struct inode_security_struct *isec;
3684 struct common_audit_data ad;
3688 isec = SOCK_INODE(sock)->i_security;
3690 if (isec->sid == SECINITSID_KERNEL)
3692 sid = task_sid(task);
3694 COMMON_AUDIT_DATA_INIT(&ad, NET);
3695 ad.u.net.sk = sock->sk;
3696 err = avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
3702 static int selinux_socket_create(int family, int type,
3703 int protocol, int kern)
3705 const struct cred *cred = current_cred();
3706 const struct task_security_struct *tsec = cred->security;
3713 newsid = socket_sockcreate_sid(tsec);
3714 secclass = socket_type_to_security_class(family, type, protocol);
3715 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3718 static int selinux_socket_post_create(struct socket *sock, int family,
3719 int type, int protocol, int kern)
3721 const struct cred *cred = current_cred();
3722 const struct task_security_struct *tsec = cred->security;
3723 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3724 struct sk_security_struct *sksec;
3728 isec->sid = SECINITSID_KERNEL;
3730 isec->sid = socket_sockcreate_sid(tsec);
3732 isec->sclass = socket_type_to_security_class(family, type, protocol);
3733 isec->initialized = 1;
3736 sksec = sock->sk->sk_security;
3737 sksec->sid = isec->sid;
3738 sksec->sclass = isec->sclass;
3739 err = selinux_netlbl_socket_post_create(sock->sk, family);
3745 /* Range of port numbers used to automatically bind.
3746 Need to determine whether we should perform a name_bind
3747 permission check between the socket and the port number. */
3749 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3754 err = socket_has_perm(current, sock, SOCKET__BIND);
3759 * If PF_INET or PF_INET6, check name_bind permission for the port.
3760 * Multiple address binding for SCTP is not supported yet: we just
3761 * check the first address now.
3763 family = sock->sk->sk_family;
3764 if (family == PF_INET || family == PF_INET6) {
3766 struct inode_security_struct *isec;
3767 struct common_audit_data ad;
3768 struct sockaddr_in *addr4 = NULL;
3769 struct sockaddr_in6 *addr6 = NULL;
3770 unsigned short snum;
3771 struct sock *sk = sock->sk;
3774 isec = SOCK_INODE(sock)->i_security;
3776 if (family == PF_INET) {
3777 addr4 = (struct sockaddr_in *)address;
3778 snum = ntohs(addr4->sin_port);
3779 addrp = (char *)&addr4->sin_addr.s_addr;
3781 addr6 = (struct sockaddr_in6 *)address;
3782 snum = ntohs(addr6->sin6_port);
3783 addrp = (char *)&addr6->sin6_addr.s6_addr;
3789 inet_get_local_port_range(&low, &high);
3791 if (snum < max(PROT_SOCK, low) || snum > high) {
3792 err = sel_netport_sid(sk->sk_protocol,
3796 COMMON_AUDIT_DATA_INIT(&ad, NET);
3797 ad.u.net.sport = htons(snum);
3798 ad.u.net.family = family;
3799 err = avc_has_perm(isec->sid, sid,
3801 SOCKET__NAME_BIND, &ad);
3807 switch (isec->sclass) {
3808 case SECCLASS_TCP_SOCKET:
3809 node_perm = TCP_SOCKET__NODE_BIND;
3812 case SECCLASS_UDP_SOCKET:
3813 node_perm = UDP_SOCKET__NODE_BIND;
3816 case SECCLASS_DCCP_SOCKET:
3817 node_perm = DCCP_SOCKET__NODE_BIND;
3821 node_perm = RAWIP_SOCKET__NODE_BIND;
3825 err = sel_netnode_sid(addrp, family, &sid);
3829 COMMON_AUDIT_DATA_INIT(&ad, NET);
3830 ad.u.net.sport = htons(snum);
3831 ad.u.net.family = family;
3833 if (family == PF_INET)
3834 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3836 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3838 err = avc_has_perm(isec->sid, sid,
3839 isec->sclass, node_perm, &ad);
3847 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3849 struct sock *sk = sock->sk;
3850 struct inode_security_struct *isec;
3853 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3858 * If a TCP or DCCP socket, check name_connect permission for the port.
3860 isec = SOCK_INODE(sock)->i_security;
3861 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3862 isec->sclass == SECCLASS_DCCP_SOCKET) {
3863 struct common_audit_data ad;
3864 struct sockaddr_in *addr4 = NULL;
3865 struct sockaddr_in6 *addr6 = NULL;
3866 unsigned short snum;
3869 if (sk->sk_family == PF_INET) {
3870 addr4 = (struct sockaddr_in *)address;
3871 if (addrlen < sizeof(struct sockaddr_in))
3873 snum = ntohs(addr4->sin_port);
3875 addr6 = (struct sockaddr_in6 *)address;
3876 if (addrlen < SIN6_LEN_RFC2133)
3878 snum = ntohs(addr6->sin6_port);
3881 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3885 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3886 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3888 COMMON_AUDIT_DATA_INIT(&ad, NET);
3889 ad.u.net.dport = htons(snum);
3890 ad.u.net.family = sk->sk_family;
3891 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3896 err = selinux_netlbl_socket_connect(sk, address);
3902 static int selinux_socket_listen(struct socket *sock, int backlog)
3904 return socket_has_perm(current, sock, SOCKET__LISTEN);
3907 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3910 struct inode_security_struct *isec;
3911 struct inode_security_struct *newisec;
3913 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3917 newisec = SOCK_INODE(newsock)->i_security;
3919 isec = SOCK_INODE(sock)->i_security;
3920 newisec->sclass = isec->sclass;
3921 newisec->sid = isec->sid;
3922 newisec->initialized = 1;
3927 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3930 return socket_has_perm(current, sock, SOCKET__WRITE);
3933 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3934 int size, int flags)
3936 return socket_has_perm(current, sock, SOCKET__READ);
3939 static int selinux_socket_getsockname(struct socket *sock)
3941 return socket_has_perm(current, sock, SOCKET__GETATTR);
3944 static int selinux_socket_getpeername(struct socket *sock)
3946 return socket_has_perm(current, sock, SOCKET__GETATTR);
3949 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3953 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3957 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3960 static int selinux_socket_getsockopt(struct socket *sock, int level,
3963 return socket_has_perm(current, sock, SOCKET__GETOPT);
3966 static int selinux_socket_shutdown(struct socket *sock, int how)
3968 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3971 static int selinux_socket_unix_stream_connect(struct socket *sock,
3972 struct socket *other,
3975 struct sk_security_struct *sksec_sock = sock->sk->sk_security;
3976 struct sk_security_struct *sksec_other = other->sk->sk_security;
3977 struct sk_security_struct *sksec_new = newsk->sk_security;
3978 struct common_audit_data ad;
3981 COMMON_AUDIT_DATA_INIT(&ad, NET);
3982 ad.u.net.sk = other->sk;
3984 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
3985 sksec_other->sclass,
3986 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3990 /* server child socket */
3991 sksec_new->peer_sid = sksec_sock->sid;
3992 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
3997 /* connecting socket */
3998 sksec_sock->peer_sid = sksec_new->sid;
4003 static int selinux_socket_unix_may_send(struct socket *sock,
4004 struct socket *other)
4006 struct inode_security_struct *isec;
4007 struct inode_security_struct *other_isec;
4008 struct common_audit_data ad;
4011 isec = SOCK_INODE(sock)->i_security;
4012 other_isec = SOCK_INODE(other)->i_security;
4014 COMMON_AUDIT_DATA_INIT(&ad, NET);
4015 ad.u.net.sk = other->sk;
4017 err = avc_has_perm(isec->sid, other_isec->sid,
4018 isec->sclass, SOCKET__SENDTO, &ad);
4025 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4027 struct common_audit_data *ad)
4033 err = sel_netif_sid(ifindex, &if_sid);
4036 err = avc_has_perm(peer_sid, if_sid,
4037 SECCLASS_NETIF, NETIF__INGRESS, ad);
4041 err = sel_netnode_sid(addrp, family, &node_sid);
4044 return avc_has_perm(peer_sid, node_sid,
4045 SECCLASS_NODE, NODE__RECVFROM, ad);
4048 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4052 struct sk_security_struct *sksec = sk->sk_security;
4054 u32 sk_sid = sksec->sid;
4055 struct common_audit_data ad;
4058 COMMON_AUDIT_DATA_INIT(&ad, NET);
4059 ad.u.net.netif = skb->skb_iif;
4060 ad.u.net.family = family;
4061 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4065 if (selinux_secmark_enabled()) {
4066 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4072 if (selinux_policycap_netpeer) {
4073 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4076 err = avc_has_perm(sk_sid, peer_sid,
4077 SECCLASS_PEER, PEER__RECV, &ad);
4079 selinux_netlbl_err(skb, err, 0);
4081 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4084 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4090 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4093 struct sk_security_struct *sksec = sk->sk_security;
4094 u16 family = sk->sk_family;
4095 u32 sk_sid = sksec->sid;
4096 struct common_audit_data ad;
4101 if (family != PF_INET && family != PF_INET6)
4104 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4105 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4108 /* If any sort of compatibility mode is enabled then handoff processing
4109 * to the selinux_sock_rcv_skb_compat() function to deal with the
4110 * special handling. We do this in an attempt to keep this function
4111 * as fast and as clean as possible. */
4112 if (!selinux_policycap_netpeer)
4113 return selinux_sock_rcv_skb_compat(sk, skb, family);
4115 secmark_active = selinux_secmark_enabled();
4116 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4117 if (!secmark_active && !peerlbl_active)
4120 COMMON_AUDIT_DATA_INIT(&ad, NET);
4121 ad.u.net.netif = skb->skb_iif;
4122 ad.u.net.family = family;
4123 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4127 if (peerlbl_active) {
4130 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4133 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4136 selinux_netlbl_err(skb, err, 0);
4139 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4142 selinux_netlbl_err(skb, err, 0);
4145 if (secmark_active) {
4146 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4155 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4156 int __user *optlen, unsigned len)
4161 struct sk_security_struct *sksec;
4162 struct inode_security_struct *isec;
4163 u32 peer_sid = SECSID_NULL;
4165 isec = SOCK_INODE(sock)->i_security;
4167 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4168 isec->sclass == SECCLASS_TCP_SOCKET) {
4169 sksec = sock->sk->sk_security;
4170 peer_sid = sksec->peer_sid;
4172 if (peer_sid == SECSID_NULL) {
4177 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4182 if (scontext_len > len) {
4187 if (copy_to_user(optval, scontext, scontext_len))
4191 if (put_user(scontext_len, optlen))
4199 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4201 u32 peer_secid = SECSID_NULL;
4204 if (skb && skb->protocol == htons(ETH_P_IP))
4206 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4209 family = sock->sk->sk_family;
4213 if (sock && family == PF_UNIX)
4214 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4216 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4219 *secid = peer_secid;
4220 if (peer_secid == SECSID_NULL)
4225 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4227 return sk_alloc_security(sk, family, priority);
4230 static void selinux_sk_free_security(struct sock *sk)
4232 sk_free_security(sk);
4235 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4237 struct sk_security_struct *sksec = sk->sk_security;
4238 struct sk_security_struct *newsksec = newsk->sk_security;
4240 newsksec->sid = sksec->sid;
4241 newsksec->peer_sid = sksec->peer_sid;
4242 newsksec->sclass = sksec->sclass;
4244 selinux_netlbl_sk_security_reset(newsksec);
4247 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4250 *secid = SECINITSID_ANY_SOCKET;
4252 struct sk_security_struct *sksec = sk->sk_security;
4254 *secid = sksec->sid;
4258 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4260 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4261 struct sk_security_struct *sksec = sk->sk_security;
4263 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4264 sk->sk_family == PF_UNIX)
4265 isec->sid = sksec->sid;
4266 sksec->sclass = isec->sclass;
4269 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4270 struct request_sock *req)
4272 struct sk_security_struct *sksec = sk->sk_security;
4274 u16 family = sk->sk_family;
4278 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4279 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4282 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4285 if (peersid == SECSID_NULL) {
4286 req->secid = sksec->sid;
4287 req->peer_secid = SECSID_NULL;
4289 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4292 req->secid = newsid;
4293 req->peer_secid = peersid;
4296 return selinux_netlbl_inet_conn_request(req, family);
4299 static void selinux_inet_csk_clone(struct sock *newsk,
4300 const struct request_sock *req)
4302 struct sk_security_struct *newsksec = newsk->sk_security;
4304 newsksec->sid = req->secid;
4305 newsksec->peer_sid = req->peer_secid;
4306 /* NOTE: Ideally, we should also get the isec->sid for the
4307 new socket in sync, but we don't have the isec available yet.
4308 So we will wait until sock_graft to do it, by which
4309 time it will have been created and available. */
4311 /* We don't need to take any sort of lock here as we are the only
4312 * thread with access to newsksec */
4313 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4316 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4318 u16 family = sk->sk_family;
4319 struct sk_security_struct *sksec = sk->sk_security;
4321 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4322 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4325 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4328 static void selinux_req_classify_flow(const struct request_sock *req,
4331 fl->secid = req->secid;
4334 static int selinux_tun_dev_create(void)
4336 u32 sid = current_sid();
4338 /* we aren't taking into account the "sockcreate" SID since the socket
4339 * that is being created here is not a socket in the traditional sense,
4340 * instead it is a private sock, accessible only to the kernel, and
4341 * representing a wide range of network traffic spanning multiple
4342 * connections unlike traditional sockets - check the TUN driver to
4343 * get a better understanding of why this socket is special */
4345 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4349 static void selinux_tun_dev_post_create(struct sock *sk)
4351 struct sk_security_struct *sksec = sk->sk_security;
4353 /* we don't currently perform any NetLabel based labeling here and it
4354 * isn't clear that we would want to do so anyway; while we could apply
4355 * labeling without the support of the TUN user the resulting labeled
4356 * traffic from the other end of the connection would almost certainly
4357 * cause confusion to the TUN user that had no idea network labeling
4358 * protocols were being used */
4360 /* see the comments in selinux_tun_dev_create() about why we don't use
4361 * the sockcreate SID here */
4363 sksec->sid = current_sid();
4364 sksec->sclass = SECCLASS_TUN_SOCKET;
4367 static int selinux_tun_dev_attach(struct sock *sk)
4369 struct sk_security_struct *sksec = sk->sk_security;
4370 u32 sid = current_sid();
4373 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4374 TUN_SOCKET__RELABELFROM, NULL);
4377 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4378 TUN_SOCKET__RELABELTO, NULL);
4387 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4391 struct nlmsghdr *nlh;
4392 struct socket *sock = sk->sk_socket;
4393 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4395 if (skb->len < NLMSG_SPACE(0)) {
4399 nlh = nlmsg_hdr(skb);
4401 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4403 if (err == -EINVAL) {
4404 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4405 "SELinux: unrecognized netlink message"
4406 " type=%hu for sclass=%hu\n",
4407 nlh->nlmsg_type, isec->sclass);
4408 if (!selinux_enforcing || security_get_allow_unknown())
4418 err = socket_has_perm(current, sock, perm);
4423 #ifdef CONFIG_NETFILTER
4425 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4431 struct common_audit_data ad;
4436 if (!selinux_policycap_netpeer)
4439 secmark_active = selinux_secmark_enabled();
4440 netlbl_active = netlbl_enabled();
4441 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4442 if (!secmark_active && !peerlbl_active)
4445 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4448 COMMON_AUDIT_DATA_INIT(&ad, NET);
4449 ad.u.net.netif = ifindex;
4450 ad.u.net.family = family;
4451 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4454 if (peerlbl_active) {
4455 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4458 selinux_netlbl_err(skb, err, 1);
4464 if (avc_has_perm(peer_sid, skb->secmark,
4465 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4469 /* we do this in the FORWARD path and not the POST_ROUTING
4470 * path because we want to make sure we apply the necessary
4471 * labeling before IPsec is applied so we can leverage AH
4473 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4479 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4480 struct sk_buff *skb,
4481 const struct net_device *in,
4482 const struct net_device *out,
4483 int (*okfn)(struct sk_buff *))
4485 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4488 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4489 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4490 struct sk_buff *skb,
4491 const struct net_device *in,
4492 const struct net_device *out,
4493 int (*okfn)(struct sk_buff *))
4495 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4499 static unsigned int selinux_ip_output(struct sk_buff *skb,
4504 if (!netlbl_enabled())
4507 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4508 * because we want to make sure we apply the necessary labeling
4509 * before IPsec is applied so we can leverage AH protection */
4511 struct sk_security_struct *sksec = skb->sk->sk_security;
4514 sid = SECINITSID_KERNEL;
4515 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4521 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4522 struct sk_buff *skb,
4523 const struct net_device *in,
4524 const struct net_device *out,
4525 int (*okfn)(struct sk_buff *))
4527 return selinux_ip_output(skb, PF_INET);
4530 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4534 struct sock *sk = skb->sk;
4535 struct sk_security_struct *sksec;
4536 struct common_audit_data ad;
4542 sksec = sk->sk_security;
4544 COMMON_AUDIT_DATA_INIT(&ad, NET);
4545 ad.u.net.netif = ifindex;
4546 ad.u.net.family = family;
4547 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4550 if (selinux_secmark_enabled())
4551 if (avc_has_perm(sksec->sid, skb->secmark,
4552 SECCLASS_PACKET, PACKET__SEND, &ad))
4555 if (selinux_policycap_netpeer)
4556 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4562 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4568 struct common_audit_data ad;
4573 /* If any sort of compatibility mode is enabled then handoff processing
4574 * to the selinux_ip_postroute_compat() function to deal with the
4575 * special handling. We do this in an attempt to keep this function
4576 * as fast and as clean as possible. */
4577 if (!selinux_policycap_netpeer)
4578 return selinux_ip_postroute_compat(skb, ifindex, family);
4580 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4581 * packet transformation so allow the packet to pass without any checks
4582 * since we'll have another chance to perform access control checks
4583 * when the packet is on it's final way out.
4584 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4585 * is NULL, in this case go ahead and apply access control. */
4586 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4589 secmark_active = selinux_secmark_enabled();
4590 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4591 if (!secmark_active && !peerlbl_active)
4594 /* if the packet is being forwarded then get the peer label from the
4595 * packet itself; otherwise check to see if it is from a local
4596 * application or the kernel, if from an application get the peer label
4597 * from the sending socket, otherwise use the kernel's sid */
4602 if (IPCB(skb)->flags & IPSKB_FORWARDED)
4603 secmark_perm = PACKET__FORWARD_OUT;
4605 secmark_perm = PACKET__SEND;
4608 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4609 secmark_perm = PACKET__FORWARD_OUT;
4611 secmark_perm = PACKET__SEND;
4616 if (secmark_perm == PACKET__FORWARD_OUT) {
4617 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4620 peer_sid = SECINITSID_KERNEL;
4622 struct sk_security_struct *sksec = sk->sk_security;
4623 peer_sid = sksec->sid;
4624 secmark_perm = PACKET__SEND;
4627 COMMON_AUDIT_DATA_INIT(&ad, NET);
4628 ad.u.net.netif = ifindex;
4629 ad.u.net.family = family;
4630 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4634 if (avc_has_perm(peer_sid, skb->secmark,
4635 SECCLASS_PACKET, secmark_perm, &ad))
4638 if (peerlbl_active) {
4642 if (sel_netif_sid(ifindex, &if_sid))
4644 if (avc_has_perm(peer_sid, if_sid,
4645 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4648 if (sel_netnode_sid(addrp, family, &node_sid))
4650 if (avc_has_perm(peer_sid, node_sid,
4651 SECCLASS_NODE, NODE__SENDTO, &ad))
4658 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4659 struct sk_buff *skb,
4660 const struct net_device *in,
4661 const struct net_device *out,
4662 int (*okfn)(struct sk_buff *))
4664 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4667 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4668 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4669 struct sk_buff *skb,
4670 const struct net_device *in,
4671 const struct net_device *out,
4672 int (*okfn)(struct sk_buff *))
4674 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4678 #endif /* CONFIG_NETFILTER */
4680 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4684 err = cap_netlink_send(sk, skb);
4688 return selinux_nlmsg_perm(sk, skb);
4691 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4694 struct common_audit_data ad;
4696 err = cap_netlink_recv(skb, capability);
4700 COMMON_AUDIT_DATA_INIT(&ad, CAP);
4701 ad.u.cap = capability;
4703 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4704 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4707 static int ipc_alloc_security(struct task_struct *task,
4708 struct kern_ipc_perm *perm,
4711 struct ipc_security_struct *isec;
4714 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4718 sid = task_sid(task);
4719 isec->sclass = sclass;
4721 perm->security = isec;
4726 static void ipc_free_security(struct kern_ipc_perm *perm)
4728 struct ipc_security_struct *isec = perm->security;
4729 perm->security = NULL;
4733 static int msg_msg_alloc_security(struct msg_msg *msg)
4735 struct msg_security_struct *msec;
4737 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4741 msec->sid = SECINITSID_UNLABELED;
4742 msg->security = msec;
4747 static void msg_msg_free_security(struct msg_msg *msg)
4749 struct msg_security_struct *msec = msg->security;
4751 msg->security = NULL;
4755 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4758 struct ipc_security_struct *isec;
4759 struct common_audit_data ad;
4760 u32 sid = current_sid();
4762 isec = ipc_perms->security;
4764 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4765 ad.u.ipc_id = ipc_perms->key;
4767 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4770 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4772 return msg_msg_alloc_security(msg);
4775 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4777 msg_msg_free_security(msg);
4780 /* message queue security operations */
4781 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4783 struct ipc_security_struct *isec;
4784 struct common_audit_data ad;
4785 u32 sid = current_sid();
4788 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4792 isec = msq->q_perm.security;
4794 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4795 ad.u.ipc_id = msq->q_perm.key;
4797 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4800 ipc_free_security(&msq->q_perm);
4806 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4808 ipc_free_security(&msq->q_perm);
4811 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4813 struct ipc_security_struct *isec;
4814 struct common_audit_data ad;
4815 u32 sid = current_sid();
4817 isec = msq->q_perm.security;
4819 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4820 ad.u.ipc_id = msq->q_perm.key;
4822 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4823 MSGQ__ASSOCIATE, &ad);
4826 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4834 /* No specific object, just general system-wide information. */
4835 return task_has_system(current, SYSTEM__IPC_INFO);
4838 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4841 perms = MSGQ__SETATTR;
4844 perms = MSGQ__DESTROY;
4850 err = ipc_has_perm(&msq->q_perm, perms);
4854 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4856 struct ipc_security_struct *isec;
4857 struct msg_security_struct *msec;
4858 struct common_audit_data ad;
4859 u32 sid = current_sid();
4862 isec = msq->q_perm.security;
4863 msec = msg->security;
4866 * First time through, need to assign label to the message
4868 if (msec->sid == SECINITSID_UNLABELED) {
4870 * Compute new sid based on current process and
4871 * message queue this message will be stored in
4873 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4879 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4880 ad.u.ipc_id = msq->q_perm.key;
4882 /* Can this process write to the queue? */
4883 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4886 /* Can this process send the message */
4887 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4890 /* Can the message be put in the queue? */
4891 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4892 MSGQ__ENQUEUE, &ad);
4897 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4898 struct task_struct *target,
4899 long type, int mode)
4901 struct ipc_security_struct *isec;
4902 struct msg_security_struct *msec;
4903 struct common_audit_data ad;
4904 u32 sid = task_sid(target);
4907 isec = msq->q_perm.security;
4908 msec = msg->security;
4910 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4911 ad.u.ipc_id = msq->q_perm.key;
4913 rc = avc_has_perm(sid, isec->sid,
4914 SECCLASS_MSGQ, MSGQ__READ, &ad);
4916 rc = avc_has_perm(sid, msec->sid,
4917 SECCLASS_MSG, MSG__RECEIVE, &ad);
4921 /* Shared Memory security operations */
4922 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4924 struct ipc_security_struct *isec;
4925 struct common_audit_data ad;
4926 u32 sid = current_sid();
4929 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4933 isec = shp->shm_perm.security;
4935 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4936 ad.u.ipc_id = shp->shm_perm.key;
4938 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4941 ipc_free_security(&shp->shm_perm);
4947 static void selinux_shm_free_security(struct shmid_kernel *shp)
4949 ipc_free_security(&shp->shm_perm);
4952 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4954 struct ipc_security_struct *isec;
4955 struct common_audit_data ad;
4956 u32 sid = current_sid();
4958 isec = shp->shm_perm.security;
4960 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4961 ad.u.ipc_id = shp->shm_perm.key;
4963 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4964 SHM__ASSOCIATE, &ad);
4967 /* Note, at this point, shp is locked down */
4968 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4976 /* No specific object, just general system-wide information. */
4977 return task_has_system(current, SYSTEM__IPC_INFO);
4980 perms = SHM__GETATTR | SHM__ASSOCIATE;
4983 perms = SHM__SETATTR;
4990 perms = SHM__DESTROY;
4996 err = ipc_has_perm(&shp->shm_perm, perms);
5000 static int selinux_shm_shmat(struct shmid_kernel *shp,
5001 char __user *shmaddr, int shmflg)
5005 if (shmflg & SHM_RDONLY)
5008 perms = SHM__READ | SHM__WRITE;
5010 return ipc_has_perm(&shp->shm_perm, perms);
5013 /* Semaphore security operations */
5014 static int selinux_sem_alloc_security(struct sem_array *sma)
5016 struct ipc_security_struct *isec;
5017 struct common_audit_data ad;
5018 u32 sid = current_sid();
5021 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5025 isec = sma->sem_perm.security;
5027 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5028 ad.u.ipc_id = sma->sem_perm.key;
5030 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5033 ipc_free_security(&sma->sem_perm);
5039 static void selinux_sem_free_security(struct sem_array *sma)
5041 ipc_free_security(&sma->sem_perm);
5044 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5046 struct ipc_security_struct *isec;
5047 struct common_audit_data ad;
5048 u32 sid = current_sid();
5050 isec = sma->sem_perm.security;
5052 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5053 ad.u.ipc_id = sma->sem_perm.key;
5055 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5056 SEM__ASSOCIATE, &ad);
5059 /* Note, at this point, sma is locked down */
5060 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5068 /* No specific object, just general system-wide information. */
5069 return task_has_system(current, SYSTEM__IPC_INFO);
5073 perms = SEM__GETATTR;
5084 perms = SEM__DESTROY;
5087 perms = SEM__SETATTR;
5091 perms = SEM__GETATTR | SEM__ASSOCIATE;
5097 err = ipc_has_perm(&sma->sem_perm, perms);
5101 static int selinux_sem_semop(struct sem_array *sma,
5102 struct sembuf *sops, unsigned nsops, int alter)
5107 perms = SEM__READ | SEM__WRITE;
5111 return ipc_has_perm(&sma->sem_perm, perms);
5114 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5120 av |= IPC__UNIX_READ;
5122 av |= IPC__UNIX_WRITE;
5127 return ipc_has_perm(ipcp, av);
5130 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5132 struct ipc_security_struct *isec = ipcp->security;
5136 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5139 inode_doinit_with_dentry(inode, dentry);
5142 static int selinux_getprocattr(struct task_struct *p,
5143 char *name, char **value)
5145 const struct task_security_struct *__tsec;
5151 error = current_has_perm(p, PROCESS__GETATTR);
5157 __tsec = __task_cred(p)->security;
5159 if (!strcmp(name, "current"))
5161 else if (!strcmp(name, "prev"))
5163 else if (!strcmp(name, "exec"))
5164 sid = __tsec->exec_sid;
5165 else if (!strcmp(name, "fscreate"))
5166 sid = __tsec->create_sid;
5167 else if (!strcmp(name, "keycreate"))
5168 sid = __tsec->keycreate_sid;
5169 else if (!strcmp(name, "sockcreate"))
5170 sid = __tsec->sockcreate_sid;
5178 error = security_sid_to_context(sid, value, &len);
5188 static int selinux_setprocattr(struct task_struct *p,
5189 char *name, void *value, size_t size)
5191 struct task_security_struct *tsec;
5192 struct task_struct *tracer;
5199 /* SELinux only allows a process to change its own
5200 security attributes. */
5205 * Basic control over ability to set these attributes at all.
5206 * current == p, but we'll pass them separately in case the
5207 * above restriction is ever removed.
5209 if (!strcmp(name, "exec"))
5210 error = current_has_perm(p, PROCESS__SETEXEC);
5211 else if (!strcmp(name, "fscreate"))
5212 error = current_has_perm(p, PROCESS__SETFSCREATE);
5213 else if (!strcmp(name, "keycreate"))
5214 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5215 else if (!strcmp(name, "sockcreate"))
5216 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5217 else if (!strcmp(name, "current"))
5218 error = current_has_perm(p, PROCESS__SETCURRENT);
5224 /* Obtain a SID for the context, if one was specified. */
5225 if (size && str[1] && str[1] != '\n') {
5226 if (str[size-1] == '\n') {
5230 error = security_context_to_sid(value, size, &sid);
5231 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5232 if (!capable(CAP_MAC_ADMIN))
5234 error = security_context_to_sid_force(value, size,
5241 new = prepare_creds();
5245 /* Permission checking based on the specified context is
5246 performed during the actual operation (execve,
5247 open/mkdir/...), when we know the full context of the
5248 operation. See selinux_bprm_set_creds for the execve
5249 checks and may_create for the file creation checks. The
5250 operation will then fail if the context is not permitted. */
5251 tsec = new->security;
5252 if (!strcmp(name, "exec")) {
5253 tsec->exec_sid = sid;
5254 } else if (!strcmp(name, "fscreate")) {
5255 tsec->create_sid = sid;
5256 } else if (!strcmp(name, "keycreate")) {
5257 error = may_create_key(sid, p);
5260 tsec->keycreate_sid = sid;
5261 } else if (!strcmp(name, "sockcreate")) {
5262 tsec->sockcreate_sid = sid;
5263 } else if (!strcmp(name, "current")) {
5268 /* Only allow single threaded processes to change context */
5270 if (!current_is_single_threaded()) {
5271 error = security_bounded_transition(tsec->sid, sid);
5276 /* Check permissions for the transition. */
5277 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5278 PROCESS__DYNTRANSITION, NULL);
5282 /* Check for ptracing, and update the task SID if ok.
5283 Otherwise, leave SID unchanged and fail. */
5286 tracer = tracehook_tracer_task(p);
5288 ptsid = task_sid(tracer);
5292 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5293 PROCESS__PTRACE, NULL);
5312 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5314 return security_sid_to_context(secid, secdata, seclen);
5317 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5319 return security_context_to_sid(secdata, seclen, secid);
5322 static void selinux_release_secctx(char *secdata, u32 seclen)
5328 * called with inode->i_mutex locked
5330 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5332 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5336 * called with inode->i_mutex locked
5338 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5340 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5343 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5346 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5355 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5356 unsigned long flags)
5358 const struct task_security_struct *tsec;
5359 struct key_security_struct *ksec;
5361 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5365 tsec = cred->security;
5366 if (tsec->keycreate_sid)
5367 ksec->sid = tsec->keycreate_sid;
5369 ksec->sid = tsec->sid;
5375 static void selinux_key_free(struct key *k)
5377 struct key_security_struct *ksec = k->security;
5383 static int selinux_key_permission(key_ref_t key_ref,
5384 const struct cred *cred,
5388 struct key_security_struct *ksec;
5391 /* if no specific permissions are requested, we skip the
5392 permission check. No serious, additional covert channels
5393 appear to be created. */
5397 sid = cred_sid(cred);
5399 key = key_ref_to_ptr(key_ref);
5400 ksec = key->security;
5402 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5405 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5407 struct key_security_struct *ksec = key->security;
5408 char *context = NULL;
5412 rc = security_sid_to_context(ksec->sid, &context, &len);
5421 static struct security_operations selinux_ops = {
5424 .ptrace_access_check = selinux_ptrace_access_check,
5425 .ptrace_traceme = selinux_ptrace_traceme,
5426 .capget = selinux_capget,
5427 .capset = selinux_capset,
5428 .sysctl = selinux_sysctl,
5429 .capable = selinux_capable,
5430 .quotactl = selinux_quotactl,
5431 .quota_on = selinux_quota_on,
5432 .syslog = selinux_syslog,
5433 .vm_enough_memory = selinux_vm_enough_memory,
5435 .netlink_send = selinux_netlink_send,
5436 .netlink_recv = selinux_netlink_recv,
5438 .bprm_set_creds = selinux_bprm_set_creds,
5439 .bprm_committing_creds = selinux_bprm_committing_creds,
5440 .bprm_committed_creds = selinux_bprm_committed_creds,
5441 .bprm_secureexec = selinux_bprm_secureexec,
5443 .sb_alloc_security = selinux_sb_alloc_security,
5444 .sb_free_security = selinux_sb_free_security,
5445 .sb_copy_data = selinux_sb_copy_data,
5446 .sb_kern_mount = selinux_sb_kern_mount,
5447 .sb_show_options = selinux_sb_show_options,
5448 .sb_statfs = selinux_sb_statfs,
5449 .sb_mount = selinux_mount,
5450 .sb_umount = selinux_umount,
5451 .sb_set_mnt_opts = selinux_set_mnt_opts,
5452 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5453 .sb_parse_opts_str = selinux_parse_opts_str,
5456 .inode_alloc_security = selinux_inode_alloc_security,
5457 .inode_free_security = selinux_inode_free_security,
5458 .inode_init_security = selinux_inode_init_security,
5459 .inode_create = selinux_inode_create,
5460 .inode_link = selinux_inode_link,
5461 .inode_unlink = selinux_inode_unlink,
5462 .inode_symlink = selinux_inode_symlink,
5463 .inode_mkdir = selinux_inode_mkdir,
5464 .inode_rmdir = selinux_inode_rmdir,
5465 .inode_mknod = selinux_inode_mknod,
5466 .inode_rename = selinux_inode_rename,
5467 .inode_readlink = selinux_inode_readlink,
5468 .inode_follow_link = selinux_inode_follow_link,
5469 .inode_permission = selinux_inode_permission,
5470 .inode_setattr = selinux_inode_setattr,
5471 .inode_getattr = selinux_inode_getattr,
5472 .inode_setxattr = selinux_inode_setxattr,
5473 .inode_post_setxattr = selinux_inode_post_setxattr,
5474 .inode_getxattr = selinux_inode_getxattr,
5475 .inode_listxattr = selinux_inode_listxattr,
5476 .inode_removexattr = selinux_inode_removexattr,
5477 .inode_getsecurity = selinux_inode_getsecurity,
5478 .inode_setsecurity = selinux_inode_setsecurity,
5479 .inode_listsecurity = selinux_inode_listsecurity,
5480 .inode_getsecid = selinux_inode_getsecid,
5482 .file_permission = selinux_file_permission,
5483 .file_alloc_security = selinux_file_alloc_security,
5484 .file_free_security = selinux_file_free_security,
5485 .file_ioctl = selinux_file_ioctl,
5486 .file_mmap = selinux_file_mmap,
5487 .file_mprotect = selinux_file_mprotect,
5488 .file_lock = selinux_file_lock,
5489 .file_fcntl = selinux_file_fcntl,
5490 .file_set_fowner = selinux_file_set_fowner,
5491 .file_send_sigiotask = selinux_file_send_sigiotask,
5492 .file_receive = selinux_file_receive,
5494 .dentry_open = selinux_dentry_open,
5496 .task_create = selinux_task_create,
5497 .cred_alloc_blank = selinux_cred_alloc_blank,
5498 .cred_free = selinux_cred_free,
5499 .cred_prepare = selinux_cred_prepare,
5500 .cred_transfer = selinux_cred_transfer,
5501 .kernel_act_as = selinux_kernel_act_as,
5502 .kernel_create_files_as = selinux_kernel_create_files_as,
5503 .kernel_module_request = selinux_kernel_module_request,
5504 .task_setpgid = selinux_task_setpgid,
5505 .task_getpgid = selinux_task_getpgid,
5506 .task_getsid = selinux_task_getsid,
5507 .task_getsecid = selinux_task_getsecid,
5508 .task_setnice = selinux_task_setnice,
5509 .task_setioprio = selinux_task_setioprio,
5510 .task_getioprio = selinux_task_getioprio,
5511 .task_setrlimit = selinux_task_setrlimit,
5512 .task_setscheduler = selinux_task_setscheduler,
5513 .task_getscheduler = selinux_task_getscheduler,
5514 .task_movememory = selinux_task_movememory,
5515 .task_kill = selinux_task_kill,
5516 .task_wait = selinux_task_wait,
5517 .task_to_inode = selinux_task_to_inode,
5519 .ipc_permission = selinux_ipc_permission,
5520 .ipc_getsecid = selinux_ipc_getsecid,
5522 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5523 .msg_msg_free_security = selinux_msg_msg_free_security,
5525 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5526 .msg_queue_free_security = selinux_msg_queue_free_security,
5527 .msg_queue_associate = selinux_msg_queue_associate,
5528 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5529 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5530 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5532 .shm_alloc_security = selinux_shm_alloc_security,
5533 .shm_free_security = selinux_shm_free_security,
5534 .shm_associate = selinux_shm_associate,
5535 .shm_shmctl = selinux_shm_shmctl,
5536 .shm_shmat = selinux_shm_shmat,
5538 .sem_alloc_security = selinux_sem_alloc_security,
5539 .sem_free_security = selinux_sem_free_security,
5540 .sem_associate = selinux_sem_associate,
5541 .sem_semctl = selinux_sem_semctl,
5542 .sem_semop = selinux_sem_semop,
5544 .d_instantiate = selinux_d_instantiate,
5546 .getprocattr = selinux_getprocattr,
5547 .setprocattr = selinux_setprocattr,
5549 .secid_to_secctx = selinux_secid_to_secctx,
5550 .secctx_to_secid = selinux_secctx_to_secid,
5551 .release_secctx = selinux_release_secctx,
5552 .inode_notifysecctx = selinux_inode_notifysecctx,
5553 .inode_setsecctx = selinux_inode_setsecctx,
5554 .inode_getsecctx = selinux_inode_getsecctx,
5556 .unix_stream_connect = selinux_socket_unix_stream_connect,
5557 .unix_may_send = selinux_socket_unix_may_send,
5559 .socket_create = selinux_socket_create,
5560 .socket_post_create = selinux_socket_post_create,
5561 .socket_bind = selinux_socket_bind,
5562 .socket_connect = selinux_socket_connect,
5563 .socket_listen = selinux_socket_listen,
5564 .socket_accept = selinux_socket_accept,
5565 .socket_sendmsg = selinux_socket_sendmsg,
5566 .socket_recvmsg = selinux_socket_recvmsg,
5567 .socket_getsockname = selinux_socket_getsockname,
5568 .socket_getpeername = selinux_socket_getpeername,
5569 .socket_getsockopt = selinux_socket_getsockopt,
5570 .socket_setsockopt = selinux_socket_setsockopt,
5571 .socket_shutdown = selinux_socket_shutdown,
5572 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5573 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5574 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5575 .sk_alloc_security = selinux_sk_alloc_security,
5576 .sk_free_security = selinux_sk_free_security,
5577 .sk_clone_security = selinux_sk_clone_security,
5578 .sk_getsecid = selinux_sk_getsecid,
5579 .sock_graft = selinux_sock_graft,
5580 .inet_conn_request = selinux_inet_conn_request,
5581 .inet_csk_clone = selinux_inet_csk_clone,
5582 .inet_conn_established = selinux_inet_conn_established,
5583 .req_classify_flow = selinux_req_classify_flow,
5584 .tun_dev_create = selinux_tun_dev_create,
5585 .tun_dev_post_create = selinux_tun_dev_post_create,
5586 .tun_dev_attach = selinux_tun_dev_attach,
5588 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5589 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5590 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5591 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5592 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5593 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5594 .xfrm_state_free_security = selinux_xfrm_state_free,
5595 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5596 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5597 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5598 .xfrm_decode_session = selinux_xfrm_decode_session,
5602 .key_alloc = selinux_key_alloc,
5603 .key_free = selinux_key_free,
5604 .key_permission = selinux_key_permission,
5605 .key_getsecurity = selinux_key_getsecurity,
5609 .audit_rule_init = selinux_audit_rule_init,
5610 .audit_rule_known = selinux_audit_rule_known,
5611 .audit_rule_match = selinux_audit_rule_match,
5612 .audit_rule_free = selinux_audit_rule_free,
5616 static __init int selinux_init(void)
5618 if (!security_module_enable(&selinux_ops)) {
5619 selinux_enabled = 0;
5623 if (!selinux_enabled) {
5624 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5628 printk(KERN_INFO "SELinux: Initializing.\n");
5630 /* Set the security state for the initial task. */
5631 cred_init_security();
5633 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5635 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5636 sizeof(struct inode_security_struct),
5637 0, SLAB_PANIC, NULL);
5640 if (register_security(&selinux_ops))
5641 panic("SELinux: Unable to register with kernel.\n");
5643 if (selinux_enforcing)
5644 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5646 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5651 static void delayed_superblock_init(struct super_block *sb, void *unused)
5653 superblock_doinit(sb, NULL);
5656 void selinux_complete_init(void)
5658 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5660 /* Set up any superblocks initialized prior to the policy load. */
5661 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5662 iterate_supers(delayed_superblock_init, NULL);
5665 /* SELinux requires early initialization in order to label
5666 all processes and objects when they are created. */
5667 security_initcall(selinux_init);
5669 #if defined(CONFIG_NETFILTER)
5671 static struct nf_hook_ops selinux_ipv4_ops[] = {
5673 .hook = selinux_ipv4_postroute,
5674 .owner = THIS_MODULE,
5676 .hooknum = NF_INET_POST_ROUTING,
5677 .priority = NF_IP_PRI_SELINUX_LAST,
5680 .hook = selinux_ipv4_forward,
5681 .owner = THIS_MODULE,
5683 .hooknum = NF_INET_FORWARD,
5684 .priority = NF_IP_PRI_SELINUX_FIRST,
5687 .hook = selinux_ipv4_output,
5688 .owner = THIS_MODULE,
5690 .hooknum = NF_INET_LOCAL_OUT,
5691 .priority = NF_IP_PRI_SELINUX_FIRST,
5695 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5697 static struct nf_hook_ops selinux_ipv6_ops[] = {
5699 .hook = selinux_ipv6_postroute,
5700 .owner = THIS_MODULE,
5702 .hooknum = NF_INET_POST_ROUTING,
5703 .priority = NF_IP6_PRI_SELINUX_LAST,
5706 .hook = selinux_ipv6_forward,
5707 .owner = THIS_MODULE,
5709 .hooknum = NF_INET_FORWARD,
5710 .priority = NF_IP6_PRI_SELINUX_FIRST,
5716 static int __init selinux_nf_ip_init(void)
5720 if (!selinux_enabled)
5723 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5725 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5727 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5729 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5730 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5732 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5739 __initcall(selinux_nf_ip_init);
5741 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5742 static void selinux_nf_ip_exit(void)
5744 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5746 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5747 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5748 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5753 #else /* CONFIG_NETFILTER */
5755 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5756 #define selinux_nf_ip_exit()
5759 #endif /* CONFIG_NETFILTER */
5761 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5762 static int selinux_disabled;
5764 int selinux_disable(void)
5766 extern void exit_sel_fs(void);
5768 if (ss_initialized) {
5769 /* Not permitted after initial policy load. */
5773 if (selinux_disabled) {
5774 /* Only do this once. */
5778 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5780 selinux_disabled = 1;
5781 selinux_enabled = 0;
5783 reset_security_ops();
5785 /* Try to destroy the avc node cache */
5788 /* Unregister netfilter hooks. */
5789 selinux_nf_ip_exit();
5791 /* Unregister selinuxfs. */