2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
77 #define XATTR_SELINUX_SUFFIX "selinux"
78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
80 extern unsigned int policydb_loaded_version;
81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
84 int selinux_enforcing = 0;
86 static int __init enforcing_setup(char *str)
88 selinux_enforcing = simple_strtol(str,NULL,0);
91 __setup("enforcing=", enforcing_setup);
94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
97 static int __init selinux_enabled_setup(char *str)
99 selinux_enabled = simple_strtol(str, NULL, 0);
102 __setup("selinux=", selinux_enabled_setup);
105 /* Original (dummy) security module. */
106 static struct security_operations *original_ops = NULL;
108 /* Minimal support for a secondary security module,
109 just to allow the use of the dummy or capability modules.
110 The owlsm module can alternatively be used as a secondary
111 module as long as CONFIG_OWLSM_FD is not enabled. */
112 static struct security_operations *secondary_ops = NULL;
114 /* Lists of inode and superblock security structures initialized
115 before the policy was loaded. */
116 static LIST_HEAD(superblock_security_head);
117 static DEFINE_SPINLOCK(sb_security_lock);
119 /* Allocate and free functions for each kind of security blob. */
121 static int task_alloc_security(struct task_struct *task)
123 struct task_security_struct *tsec;
125 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
129 tsec->magic = SELINUX_MAGIC;
131 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
132 task->security = tsec;
137 static void task_free_security(struct task_struct *task)
139 struct task_security_struct *tsec = task->security;
141 if (!tsec || tsec->magic != SELINUX_MAGIC)
144 task->security = NULL;
148 static int inode_alloc_security(struct inode *inode)
150 struct task_security_struct *tsec = current->security;
151 struct inode_security_struct *isec;
153 isec = kzalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
157 init_MUTEX(&isec->sem);
158 INIT_LIST_HEAD(&isec->list);
159 isec->magic = SELINUX_MAGIC;
161 isec->sid = SECINITSID_UNLABELED;
162 isec->sclass = SECCLASS_FILE;
163 if (tsec && tsec->magic == SELINUX_MAGIC)
164 isec->task_sid = tsec->sid;
166 isec->task_sid = SECINITSID_UNLABELED;
167 inode->i_security = isec;
172 static void inode_free_security(struct inode *inode)
174 struct inode_security_struct *isec = inode->i_security;
175 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
177 if (!isec || isec->magic != SELINUX_MAGIC)
180 spin_lock(&sbsec->isec_lock);
181 if (!list_empty(&isec->list))
182 list_del_init(&isec->list);
183 spin_unlock(&sbsec->isec_lock);
185 inode->i_security = NULL;
189 static int file_alloc_security(struct file *file)
191 struct task_security_struct *tsec = current->security;
192 struct file_security_struct *fsec;
194 fsec = kzalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
198 fsec->magic = SELINUX_MAGIC;
200 if (tsec && tsec->magic == SELINUX_MAGIC) {
201 fsec->sid = tsec->sid;
202 fsec->fown_sid = tsec->sid;
204 fsec->sid = SECINITSID_UNLABELED;
205 fsec->fown_sid = SECINITSID_UNLABELED;
207 file->f_security = fsec;
212 static void file_free_security(struct file *file)
214 struct file_security_struct *fsec = file->f_security;
216 if (!fsec || fsec->magic != SELINUX_MAGIC)
219 file->f_security = NULL;
223 static int superblock_alloc_security(struct super_block *sb)
225 struct superblock_security_struct *sbsec;
227 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
231 init_MUTEX(&sbsec->sem);
232 INIT_LIST_HEAD(&sbsec->list);
233 INIT_LIST_HEAD(&sbsec->isec_head);
234 spin_lock_init(&sbsec->isec_lock);
235 sbsec->magic = SELINUX_MAGIC;
237 sbsec->sid = SECINITSID_UNLABELED;
238 sbsec->def_sid = SECINITSID_FILE;
239 sb->s_security = sbsec;
244 static void superblock_free_security(struct super_block *sb)
246 struct superblock_security_struct *sbsec = sb->s_security;
248 if (!sbsec || sbsec->magic != SELINUX_MAGIC)
251 spin_lock(&sb_security_lock);
252 if (!list_empty(&sbsec->list))
253 list_del_init(&sbsec->list);
254 spin_unlock(&sb_security_lock);
256 sb->s_security = NULL;
260 #ifdef CONFIG_SECURITY_NETWORK
261 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
263 struct sk_security_struct *ssec;
265 if (family != PF_UNIX)
268 ssec = kzalloc(sizeof(*ssec), priority);
272 ssec->magic = SELINUX_MAGIC;
274 ssec->peer_sid = SECINITSID_UNLABELED;
275 sk->sk_security = ssec;
280 static void sk_free_security(struct sock *sk)
282 struct sk_security_struct *ssec = sk->sk_security;
284 if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
287 sk->sk_security = NULL;
290 #endif /* CONFIG_SECURITY_NETWORK */
292 /* The security server must be initialized before
293 any labeling or access decisions can be provided. */
294 extern int ss_initialized;
296 /* The file system's label must be initialized prior to use. */
298 static char *labeling_behaviors[6] = {
300 "uses transition SIDs",
302 "uses genfs_contexts",
303 "not configured for labeling",
304 "uses mountpoint labeling",
307 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
309 static inline int inode_doinit(struct inode *inode)
311 return inode_doinit_with_dentry(inode, NULL);
320 static match_table_t tokens = {
321 {Opt_context, "context=%s"},
322 {Opt_fscontext, "fscontext=%s"},
323 {Opt_defcontext, "defcontext=%s"},
326 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
328 static int try_context_mount(struct super_block *sb, void *data)
330 char *context = NULL, *defcontext = NULL;
333 int alloc = 0, rc = 0, seen = 0;
334 struct task_security_struct *tsec = current->security;
335 struct superblock_security_struct *sbsec = sb->s_security;
340 name = sb->s_type->name;
342 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
344 /* NFS we understand. */
345 if (!strcmp(name, "nfs")) {
346 struct nfs_mount_data *d = data;
348 if (d->version < NFS_MOUNT_VERSION)
352 context = d->context;
359 /* Standard string-based options. */
360 char *p, *options = data;
362 while ((p = strsep(&options, ",")) != NULL) {
364 substring_t args[MAX_OPT_ARGS];
369 token = match_token(p, tokens, args);
375 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
378 context = match_strdup(&args[0]);
389 if (seen & (Opt_context|Opt_fscontext)) {
391 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
394 context = match_strdup(&args[0]);
401 seen |= Opt_fscontext;
405 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
407 printk(KERN_WARNING "SELinux: "
408 "defcontext option is invalid "
409 "for this filesystem type\n");
412 if (seen & (Opt_context|Opt_defcontext)) {
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
417 defcontext = match_strdup(&args[0]);
424 seen |= Opt_defcontext;
429 printk(KERN_WARNING "SELinux: unknown mount "
441 rc = security_context_to_sid(context, strlen(context), &sid);
443 printk(KERN_WARNING "SELinux: security_context_to_sid"
444 "(%s) failed for (dev %s, type %s) errno=%d\n",
445 context, sb->s_id, name, rc);
449 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
450 FILESYSTEM__RELABELFROM, NULL);
454 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
455 FILESYSTEM__RELABELTO, NULL);
461 if (seen & Opt_context)
462 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
466 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
468 printk(KERN_WARNING "SELinux: security_context_to_sid"
469 "(%s) failed for (dev %s, type %s) errno=%d\n",
470 defcontext, sb->s_id, name, rc);
474 if (sid == sbsec->def_sid)
477 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
478 FILESYSTEM__RELABELFROM, NULL);
482 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
483 FILESYSTEM__ASSOCIATE, NULL);
487 sbsec->def_sid = sid;
499 static int superblock_doinit(struct super_block *sb, void *data)
501 struct superblock_security_struct *sbsec = sb->s_security;
502 struct dentry *root = sb->s_root;
503 struct inode *inode = root->d_inode;
507 if (sbsec->initialized)
510 if (!ss_initialized) {
511 /* Defer initialization until selinux_complete_init,
512 after the initial policy is loaded and the security
513 server is ready to handle calls. */
514 spin_lock(&sb_security_lock);
515 if (list_empty(&sbsec->list))
516 list_add(&sbsec->list, &superblock_security_head);
517 spin_unlock(&sb_security_lock);
521 /* Determine the labeling behavior to use for this filesystem type. */
522 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
524 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
525 __FUNCTION__, sb->s_type->name, rc);
529 rc = try_context_mount(sb, data);
533 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
534 /* Make sure that the xattr handler exists and that no
535 error other than -ENODATA is returned by getxattr on
536 the root directory. -ENODATA is ok, as this may be
537 the first boot of the SELinux kernel before we have
538 assigned xattr values to the filesystem. */
539 if (!inode->i_op->getxattr) {
540 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
541 "xattr support\n", sb->s_id, sb->s_type->name);
545 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
546 if (rc < 0 && rc != -ENODATA) {
547 if (rc == -EOPNOTSUPP)
548 printk(KERN_WARNING "SELinux: (dev %s, type "
549 "%s) has no security xattr handler\n",
550 sb->s_id, sb->s_type->name);
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) getxattr errno %d\n", sb->s_id,
554 sb->s_type->name, -rc);
559 if (strcmp(sb->s_type->name, "proc") == 0)
562 sbsec->initialized = 1;
564 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
565 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
566 sb->s_id, sb->s_type->name);
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
570 sb->s_id, sb->s_type->name,
571 labeling_behaviors[sbsec->behavior-1]);
574 /* Initialize the root inode. */
575 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
577 /* Initialize any other inodes associated with the superblock, e.g.
578 inodes created prior to initial policy load or inodes created
579 during get_sb by a pseudo filesystem that directly
581 spin_lock(&sbsec->isec_lock);
583 if (!list_empty(&sbsec->isec_head)) {
584 struct inode_security_struct *isec =
585 list_entry(sbsec->isec_head.next,
586 struct inode_security_struct, list);
587 struct inode *inode = isec->inode;
588 spin_unlock(&sbsec->isec_lock);
589 inode = igrab(inode);
591 if (!IS_PRIVATE (inode))
595 spin_lock(&sbsec->isec_lock);
596 list_del_init(&isec->list);
599 spin_unlock(&sbsec->isec_lock);
605 static inline u16 inode_mode_to_security_class(umode_t mode)
607 switch (mode & S_IFMT) {
609 return SECCLASS_SOCK_FILE;
611 return SECCLASS_LNK_FILE;
613 return SECCLASS_FILE;
615 return SECCLASS_BLK_FILE;
619 return SECCLASS_CHR_FILE;
621 return SECCLASS_FIFO_FILE;
625 return SECCLASS_FILE;
628 static inline int default_protocol_stream(int protocol)
630 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
633 static inline int default_protocol_dgram(int protocol)
635 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
638 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
645 return SECCLASS_UNIX_STREAM_SOCKET;
647 return SECCLASS_UNIX_DGRAM_SOCKET;
654 if (default_protocol_stream(protocol))
655 return SECCLASS_TCP_SOCKET;
657 return SECCLASS_RAWIP_SOCKET;
659 if (default_protocol_dgram(protocol))
660 return SECCLASS_UDP_SOCKET;
662 return SECCLASS_RAWIP_SOCKET;
664 return SECCLASS_RAWIP_SOCKET;
670 return SECCLASS_NETLINK_ROUTE_SOCKET;
671 case NETLINK_FIREWALL:
672 return SECCLASS_NETLINK_FIREWALL_SOCKET;
673 case NETLINK_INET_DIAG:
674 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
676 return SECCLASS_NETLINK_NFLOG_SOCKET;
678 return SECCLASS_NETLINK_XFRM_SOCKET;
679 case NETLINK_SELINUX:
680 return SECCLASS_NETLINK_SELINUX_SOCKET;
682 return SECCLASS_NETLINK_AUDIT_SOCKET;
684 return SECCLASS_NETLINK_IP6FW_SOCKET;
685 case NETLINK_DNRTMSG:
686 return SECCLASS_NETLINK_DNRT_SOCKET;
687 case NETLINK_KOBJECT_UEVENT:
688 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
690 return SECCLASS_NETLINK_SOCKET;
693 return SECCLASS_PACKET_SOCKET;
695 return SECCLASS_KEY_SOCKET;
698 return SECCLASS_SOCKET;
701 #ifdef CONFIG_PROC_FS
702 static int selinux_proc_get_sid(struct proc_dir_entry *de,
707 char *buffer, *path, *end;
709 buffer = (char*)__get_free_page(GFP_KERNEL);
719 while (de && de != de->parent) {
720 buflen -= de->namelen + 1;
724 memcpy(end, de->name, de->namelen);
729 rc = security_genfs_sid("proc", path, tclass, sid);
730 free_page((unsigned long)buffer);
734 static int selinux_proc_get_sid(struct proc_dir_entry *de,
742 /* The inode's security attributes must be initialized before first use. */
743 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
745 struct superblock_security_struct *sbsec = NULL;
746 struct inode_security_struct *isec = inode->i_security;
748 struct dentry *dentry;
749 #define INITCONTEXTLEN 255
750 char *context = NULL;
755 if (isec->initialized)
760 if (isec->initialized)
763 sbsec = inode->i_sb->s_security;
764 if (!sbsec->initialized) {
765 /* Defer initialization until selinux_complete_init,
766 after the initial policy is loaded and the security
767 server is ready to handle calls. */
768 spin_lock(&sbsec->isec_lock);
769 if (list_empty(&isec->list))
770 list_add(&isec->list, &sbsec->isec_head);
771 spin_unlock(&sbsec->isec_lock);
775 switch (sbsec->behavior) {
776 case SECURITY_FS_USE_XATTR:
777 if (!inode->i_op->getxattr) {
778 isec->sid = sbsec->def_sid;
782 /* Need a dentry, since the xattr API requires one.
783 Life would be simpler if we could just pass the inode. */
785 /* Called from d_instantiate or d_splice_alias. */
786 dentry = dget(opt_dentry);
788 /* Called from selinux_complete_init, try to find a dentry. */
789 dentry = d_find_alias(inode);
792 printk(KERN_WARNING "%s: no dentry for dev=%s "
793 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
798 len = INITCONTEXTLEN;
799 context = kmalloc(len, GFP_KERNEL);
805 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
808 /* Need a larger buffer. Query for the right size. */
809 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
817 context = kmalloc(len, GFP_KERNEL);
823 rc = inode->i_op->getxattr(dentry,
829 if (rc != -ENODATA) {
830 printk(KERN_WARNING "%s: getxattr returned "
831 "%d for dev=%s ino=%ld\n", __FUNCTION__,
832 -rc, inode->i_sb->s_id, inode->i_ino);
836 /* Map ENODATA to the default file SID */
837 sid = sbsec->def_sid;
840 rc = security_context_to_sid_default(context, rc, &sid,
843 printk(KERN_WARNING "%s: context_to_sid(%s) "
844 "returned %d for dev=%s ino=%ld\n",
845 __FUNCTION__, context, -rc,
846 inode->i_sb->s_id, inode->i_ino);
848 /* Leave with the unlabeled SID */
856 case SECURITY_FS_USE_TASK:
857 isec->sid = isec->task_sid;
859 case SECURITY_FS_USE_TRANS:
860 /* Default to the fs SID. */
861 isec->sid = sbsec->sid;
863 /* Try to obtain a transition SID. */
864 isec->sclass = inode_mode_to_security_class(inode->i_mode);
865 rc = security_transition_sid(isec->task_sid,
874 /* Default to the fs SID. */
875 isec->sid = sbsec->sid;
878 struct proc_inode *proci = PROC_I(inode);
880 isec->sclass = inode_mode_to_security_class(inode->i_mode);
881 rc = selinux_proc_get_sid(proci->pde,
892 isec->initialized = 1;
895 if (isec->sclass == SECCLASS_FILE)
896 isec->sclass = inode_mode_to_security_class(inode->i_mode);
903 /* Convert a Linux signal to an access vector. */
904 static inline u32 signal_to_av(int sig)
910 /* Commonly granted from child to parent. */
911 perm = PROCESS__SIGCHLD;
914 /* Cannot be caught or ignored */
915 perm = PROCESS__SIGKILL;
918 /* Cannot be caught or ignored */
919 perm = PROCESS__SIGSTOP;
922 /* All other signals. */
923 perm = PROCESS__SIGNAL;
930 /* Check permission betweeen a pair of tasks, e.g. signal checks,
931 fork check, ptrace check, etc. */
932 static int task_has_perm(struct task_struct *tsk1,
933 struct task_struct *tsk2,
936 struct task_security_struct *tsec1, *tsec2;
938 tsec1 = tsk1->security;
939 tsec2 = tsk2->security;
940 return avc_has_perm(tsec1->sid, tsec2->sid,
941 SECCLASS_PROCESS, perms, NULL);
944 /* Check whether a task is allowed to use a capability. */
945 static int task_has_capability(struct task_struct *tsk,
948 struct task_security_struct *tsec;
949 struct avc_audit_data ad;
951 tsec = tsk->security;
953 AVC_AUDIT_DATA_INIT(&ad,CAP);
957 return avc_has_perm(tsec->sid, tsec->sid,
958 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
961 /* Check whether a task is allowed to use a system operation. */
962 static int task_has_system(struct task_struct *tsk,
965 struct task_security_struct *tsec;
967 tsec = tsk->security;
969 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
970 SECCLASS_SYSTEM, perms, NULL);
973 /* Check whether a task has a particular permission to an inode.
974 The 'adp' parameter is optional and allows other audit
975 data to be passed (e.g. the dentry). */
976 static int inode_has_perm(struct task_struct *tsk,
979 struct avc_audit_data *adp)
981 struct task_security_struct *tsec;
982 struct inode_security_struct *isec;
983 struct avc_audit_data ad;
985 tsec = tsk->security;
986 isec = inode->i_security;
990 AVC_AUDIT_DATA_INIT(&ad, FS);
991 ad.u.fs.inode = inode;
994 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
997 /* Same as inode_has_perm, but pass explicit audit data containing
998 the dentry to help the auditing code to more easily generate the
999 pathname if needed. */
1000 static inline int dentry_has_perm(struct task_struct *tsk,
1001 struct vfsmount *mnt,
1002 struct dentry *dentry,
1005 struct inode *inode = dentry->d_inode;
1006 struct avc_audit_data ad;
1007 AVC_AUDIT_DATA_INIT(&ad,FS);
1009 ad.u.fs.dentry = dentry;
1010 return inode_has_perm(tsk, inode, av, &ad);
1013 /* Check whether a task can use an open file descriptor to
1014 access an inode in a given way. Check access to the
1015 descriptor itself, and then use dentry_has_perm to
1016 check a particular permission to the file.
1017 Access to the descriptor is implicitly granted if it
1018 has the same SID as the process. If av is zero, then
1019 access to the file is not checked, e.g. for cases
1020 where only the descriptor is affected like seek. */
1021 static inline int file_has_perm(struct task_struct *tsk,
1025 struct task_security_struct *tsec = tsk->security;
1026 struct file_security_struct *fsec = file->f_security;
1027 struct vfsmount *mnt = file->f_vfsmnt;
1028 struct dentry *dentry = file->f_dentry;
1029 struct inode *inode = dentry->d_inode;
1030 struct avc_audit_data ad;
1033 AVC_AUDIT_DATA_INIT(&ad, FS);
1035 ad.u.fs.dentry = dentry;
1037 if (tsec->sid != fsec->sid) {
1038 rc = avc_has_perm(tsec->sid, fsec->sid,
1046 /* av is zero if only checking access to the descriptor. */
1048 return inode_has_perm(tsk, inode, av, &ad);
1053 /* Check whether a task can create a file. */
1054 static int may_create(struct inode *dir,
1055 struct dentry *dentry,
1058 struct task_security_struct *tsec;
1059 struct inode_security_struct *dsec;
1060 struct superblock_security_struct *sbsec;
1062 struct avc_audit_data ad;
1065 tsec = current->security;
1066 dsec = dir->i_security;
1067 sbsec = dir->i_sb->s_security;
1069 AVC_AUDIT_DATA_INIT(&ad, FS);
1070 ad.u.fs.dentry = dentry;
1072 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1073 DIR__ADD_NAME | DIR__SEARCH,
1078 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1079 newsid = tsec->create_sid;
1081 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1087 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1091 return avc_has_perm(newsid, sbsec->sid,
1092 SECCLASS_FILESYSTEM,
1093 FILESYSTEM__ASSOCIATE, &ad);
1097 #define MAY_UNLINK 1
1100 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1101 static int may_link(struct inode *dir,
1102 struct dentry *dentry,
1106 struct task_security_struct *tsec;
1107 struct inode_security_struct *dsec, *isec;
1108 struct avc_audit_data ad;
1112 tsec = current->security;
1113 dsec = dir->i_security;
1114 isec = dentry->d_inode->i_security;
1116 AVC_AUDIT_DATA_INIT(&ad, FS);
1117 ad.u.fs.dentry = dentry;
1120 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1121 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1136 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1140 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1144 static inline int may_rename(struct inode *old_dir,
1145 struct dentry *old_dentry,
1146 struct inode *new_dir,
1147 struct dentry *new_dentry)
1149 struct task_security_struct *tsec;
1150 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1151 struct avc_audit_data ad;
1153 int old_is_dir, new_is_dir;
1156 tsec = current->security;
1157 old_dsec = old_dir->i_security;
1158 old_isec = old_dentry->d_inode->i_security;
1159 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1160 new_dsec = new_dir->i_security;
1162 AVC_AUDIT_DATA_INIT(&ad, FS);
1164 ad.u.fs.dentry = old_dentry;
1165 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1166 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1169 rc = avc_has_perm(tsec->sid, old_isec->sid,
1170 old_isec->sclass, FILE__RENAME, &ad);
1173 if (old_is_dir && new_dir != old_dir) {
1174 rc = avc_has_perm(tsec->sid, old_isec->sid,
1175 old_isec->sclass, DIR__REPARENT, &ad);
1180 ad.u.fs.dentry = new_dentry;
1181 av = DIR__ADD_NAME | DIR__SEARCH;
1182 if (new_dentry->d_inode)
1183 av |= DIR__REMOVE_NAME;
1184 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1187 if (new_dentry->d_inode) {
1188 new_isec = new_dentry->d_inode->i_security;
1189 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1190 rc = avc_has_perm(tsec->sid, new_isec->sid,
1192 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1200 /* Check whether a task can perform a filesystem operation. */
1201 static int superblock_has_perm(struct task_struct *tsk,
1202 struct super_block *sb,
1204 struct avc_audit_data *ad)
1206 struct task_security_struct *tsec;
1207 struct superblock_security_struct *sbsec;
1209 tsec = tsk->security;
1210 sbsec = sb->s_security;
1211 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1215 /* Convert a Linux mode and permission mask to an access vector. */
1216 static inline u32 file_mask_to_av(int mode, int mask)
1220 if ((mode & S_IFMT) != S_IFDIR) {
1221 if (mask & MAY_EXEC)
1222 av |= FILE__EXECUTE;
1223 if (mask & MAY_READ)
1226 if (mask & MAY_APPEND)
1228 else if (mask & MAY_WRITE)
1232 if (mask & MAY_EXEC)
1234 if (mask & MAY_WRITE)
1236 if (mask & MAY_READ)
1243 /* Convert a Linux file to an access vector. */
1244 static inline u32 file_to_av(struct file *file)
1248 if (file->f_mode & FMODE_READ)
1250 if (file->f_mode & FMODE_WRITE) {
1251 if (file->f_flags & O_APPEND)
1260 /* Set an inode's SID to a specified value. */
1261 static int inode_security_set_sid(struct inode *inode, u32 sid)
1263 struct inode_security_struct *isec = inode->i_security;
1264 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1266 if (!sbsec->initialized) {
1267 /* Defer initialization to selinux_complete_init. */
1272 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1274 isec->initialized = 1;
1279 /* Hook functions begin here. */
1281 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1283 struct task_security_struct *psec = parent->security;
1284 struct task_security_struct *csec = child->security;
1287 rc = secondary_ops->ptrace(parent,child);
1291 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1292 /* Save the SID of the tracing process for later use in apply_creds. */
1294 csec->ptrace_sid = psec->sid;
1298 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1299 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1303 error = task_has_perm(current, target, PROCESS__GETCAP);
1307 return secondary_ops->capget(target, effective, inheritable, permitted);
1310 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1311 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1315 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1319 return task_has_perm(current, target, PROCESS__SETCAP);
1322 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1323 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1325 secondary_ops->capset_set(target, effective, inheritable, permitted);
1328 static int selinux_capable(struct task_struct *tsk, int cap)
1332 rc = secondary_ops->capable(tsk, cap);
1336 return task_has_capability(tsk,cap);
1339 static int selinux_sysctl(ctl_table *table, int op)
1343 struct task_security_struct *tsec;
1347 rc = secondary_ops->sysctl(table, op);
1351 tsec = current->security;
1353 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1354 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1356 /* Default to the well-defined sysctl SID. */
1357 tsid = SECINITSID_SYSCTL;
1360 /* The op values are "defined" in sysctl.c, thereby creating
1361 * a bad coupling between this module and sysctl.c */
1363 error = avc_has_perm(tsec->sid, tsid,
1364 SECCLASS_DIR, DIR__SEARCH, NULL);
1372 error = avc_has_perm(tsec->sid, tsid,
1373 SECCLASS_FILE, av, NULL);
1379 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1392 rc = superblock_has_perm(current,
1394 FILESYSTEM__QUOTAMOD, NULL);
1399 rc = superblock_has_perm(current,
1401 FILESYSTEM__QUOTAGET, NULL);
1404 rc = 0; /* let the kernel handle invalid cmds */
1410 static int selinux_quota_on(struct dentry *dentry)
1412 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1415 static int selinux_syslog(int type)
1419 rc = secondary_ops->syslog(type);
1424 case 3: /* Read last kernel messages */
1425 case 10: /* Return size of the log buffer */
1426 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1428 case 6: /* Disable logging to console */
1429 case 7: /* Enable logging to console */
1430 case 8: /* Set level of messages printed to console */
1431 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1433 case 0: /* Close log */
1434 case 1: /* Open log */
1435 case 2: /* Read from log */
1436 case 4: /* Read/clear last kernel messages */
1437 case 5: /* Clear ring buffer */
1439 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1446 * Check that a process has enough memory to allocate a new virtual
1447 * mapping. 0 means there is enough memory for the allocation to
1448 * succeed and -ENOMEM implies there is not.
1450 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1451 * if the capability is granted, but __vm_enough_memory requires 1 if
1452 * the capability is granted.
1454 * Do not audit the selinux permission check, as this is applied to all
1455 * processes that allocate mappings.
1457 static int selinux_vm_enough_memory(long pages)
1459 int rc, cap_sys_admin = 0;
1460 struct task_security_struct *tsec = current->security;
1462 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1464 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1465 SECCLASS_CAPABILITY,
1466 CAP_TO_MASK(CAP_SYS_ADMIN),
1472 return __vm_enough_memory(pages, cap_sys_admin);
1475 /* binprm security operations */
1477 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1479 struct bprm_security_struct *bsec;
1481 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1485 bsec->magic = SELINUX_MAGIC;
1487 bsec->sid = SECINITSID_UNLABELED;
1490 bprm->security = bsec;
1494 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1496 struct task_security_struct *tsec;
1497 struct inode *inode = bprm->file->f_dentry->d_inode;
1498 struct inode_security_struct *isec;
1499 struct bprm_security_struct *bsec;
1501 struct avc_audit_data ad;
1504 rc = secondary_ops->bprm_set_security(bprm);
1508 bsec = bprm->security;
1513 tsec = current->security;
1514 isec = inode->i_security;
1516 /* Default to the current task SID. */
1517 bsec->sid = tsec->sid;
1519 /* Reset create SID on execve. */
1520 tsec->create_sid = 0;
1522 if (tsec->exec_sid) {
1523 newsid = tsec->exec_sid;
1524 /* Reset exec SID on execve. */
1527 /* Check for a default transition on this program. */
1528 rc = security_transition_sid(tsec->sid, isec->sid,
1529 SECCLASS_PROCESS, &newsid);
1534 AVC_AUDIT_DATA_INIT(&ad, FS);
1535 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1536 ad.u.fs.dentry = bprm->file->f_dentry;
1538 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1541 if (tsec->sid == newsid) {
1542 rc = avc_has_perm(tsec->sid, isec->sid,
1543 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1547 /* Check permissions for the transition. */
1548 rc = avc_has_perm(tsec->sid, newsid,
1549 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1553 rc = avc_has_perm(newsid, isec->sid,
1554 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1558 /* Clear any possibly unsafe personality bits on exec: */
1559 current->personality &= ~PER_CLEAR_ON_SETID;
1561 /* Set the security field to the new SID. */
1569 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1571 return secondary_ops->bprm_check_security(bprm);
1575 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1577 struct task_security_struct *tsec = current->security;
1580 if (tsec->osid != tsec->sid) {
1581 /* Enable secure mode for SIDs transitions unless
1582 the noatsecure permission is granted between
1583 the two SIDs, i.e. ahp returns 0. */
1584 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1586 PROCESS__NOATSECURE, NULL);
1589 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1592 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1594 kfree(bprm->security);
1595 bprm->security = NULL;
1598 extern struct vfsmount *selinuxfs_mount;
1599 extern struct dentry *selinux_null;
1601 /* Derived from fs/exec.c:flush_old_files. */
1602 static inline void flush_unauthorized_files(struct files_struct * files)
1604 struct avc_audit_data ad;
1605 struct file *file, *devnull = NULL;
1606 struct tty_struct *tty = current->signal->tty;
1607 struct fdtable *fdt;
1612 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1614 /* Revalidate access to controlling tty.
1615 Use inode_has_perm on the tty inode directly rather
1616 than using file_has_perm, as this particular open
1617 file may belong to another process and we are only
1618 interested in the inode-based check here. */
1619 struct inode *inode = file->f_dentry->d_inode;
1620 if (inode_has_perm(current, inode,
1621 FILE__READ | FILE__WRITE, NULL)) {
1622 /* Reset controlling tty. */
1623 current->signal->tty = NULL;
1624 current->signal->tty_old_pgrp = 0;
1630 /* Revalidate access to inherited open files. */
1632 AVC_AUDIT_DATA_INIT(&ad,FS);
1634 spin_lock(&files->file_lock);
1636 unsigned long set, i;
1641 fdt = files_fdtable(files);
1642 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1644 set = fdt->open_fds->fds_bits[j];
1647 spin_unlock(&files->file_lock);
1648 for ( ; set ; i++,set >>= 1) {
1653 if (file_has_perm(current,
1655 file_to_av(file))) {
1657 fd = get_unused_fd();
1665 rcuref_inc(&devnull->f_count);
1667 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1674 fd_install(fd, devnull);
1679 spin_lock(&files->file_lock);
1682 spin_unlock(&files->file_lock);
1685 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1687 struct task_security_struct *tsec;
1688 struct bprm_security_struct *bsec;
1692 secondary_ops->bprm_apply_creds(bprm, unsafe);
1694 tsec = current->security;
1696 bsec = bprm->security;
1699 tsec->osid = tsec->sid;
1701 if (tsec->sid != sid) {
1702 /* Check for shared state. If not ok, leave SID
1703 unchanged and kill. */
1704 if (unsafe & LSM_UNSAFE_SHARE) {
1705 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1706 PROCESS__SHARE, NULL);
1713 /* Check for ptracing, and update the task SID if ok.
1714 Otherwise, leave SID unchanged and kill. */
1715 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1716 rc = avc_has_perm(tsec->ptrace_sid, sid,
1717 SECCLASS_PROCESS, PROCESS__PTRACE,
1729 * called after apply_creds without the task lock held
1731 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1733 struct task_security_struct *tsec;
1734 struct rlimit *rlim, *initrlim;
1735 struct itimerval itimer;
1736 struct bprm_security_struct *bsec;
1739 tsec = current->security;
1740 bsec = bprm->security;
1743 force_sig_specific(SIGKILL, current);
1746 if (tsec->osid == tsec->sid)
1749 /* Close files for which the new task SID is not authorized. */
1750 flush_unauthorized_files(current->files);
1752 /* Check whether the new SID can inherit signal state
1753 from the old SID. If not, clear itimers to avoid
1754 subsequent signal generation and flush and unblock
1755 signals. This must occur _after_ the task SID has
1756 been updated so that any kill done after the flush
1757 will be checked against the new SID. */
1758 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1759 PROCESS__SIGINH, NULL);
1761 memset(&itimer, 0, sizeof itimer);
1762 for (i = 0; i < 3; i++)
1763 do_setitimer(i, &itimer, NULL);
1764 flush_signals(current);
1765 spin_lock_irq(¤t->sighand->siglock);
1766 flush_signal_handlers(current, 1);
1767 sigemptyset(¤t->blocked);
1768 recalc_sigpending();
1769 spin_unlock_irq(¤t->sighand->siglock);
1772 /* Check whether the new SID can inherit resource limits
1773 from the old SID. If not, reset all soft limits to
1774 the lower of the current task's hard limit and the init
1775 task's soft limit. Note that the setting of hard limits
1776 (even to lower them) can be controlled by the setrlimit
1777 check. The inclusion of the init task's soft limit into
1778 the computation is to avoid resetting soft limits higher
1779 than the default soft limit for cases where the default
1780 is lower than the hard limit, e.g. RLIMIT_CORE or
1782 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1783 PROCESS__RLIMITINH, NULL);
1785 for (i = 0; i < RLIM_NLIMITS; i++) {
1786 rlim = current->signal->rlim + i;
1787 initrlim = init_task.signal->rlim+i;
1788 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1790 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1792 * This will cause RLIMIT_CPU calculations
1795 current->it_prof_expires = jiffies_to_cputime(1);
1799 /* Wake up the parent if it is waiting so that it can
1800 recheck wait permission to the new task SID. */
1801 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1804 /* superblock security operations */
1806 static int selinux_sb_alloc_security(struct super_block *sb)
1808 return superblock_alloc_security(sb);
1811 static void selinux_sb_free_security(struct super_block *sb)
1813 superblock_free_security(sb);
1816 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1821 return !memcmp(prefix, option, plen);
1824 static inline int selinux_option(char *option, int len)
1826 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1827 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1828 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1831 static inline void take_option(char **to, char *from, int *first, int len)
1839 memcpy(*to, from, len);
1843 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1845 int fnosec, fsec, rc = 0;
1846 char *in_save, *in_curr, *in_end;
1847 char *sec_curr, *nosec_save, *nosec;
1852 /* Binary mount data: just copy */
1853 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1854 copy_page(sec_curr, in_curr);
1858 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1866 in_save = in_end = orig;
1869 if (*in_end == ',' || *in_end == '\0') {
1870 int len = in_end - in_curr;
1872 if (selinux_option(in_curr, len))
1873 take_option(&sec_curr, in_curr, &fsec, len);
1875 take_option(&nosec, in_curr, &fnosec, len);
1877 in_curr = in_end + 1;
1879 } while (*in_end++);
1881 strcpy(in_save, nosec_save);
1882 free_page((unsigned long)nosec_save);
1887 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1889 struct avc_audit_data ad;
1892 rc = superblock_doinit(sb, data);
1896 AVC_AUDIT_DATA_INIT(&ad,FS);
1897 ad.u.fs.dentry = sb->s_root;
1898 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1901 static int selinux_sb_statfs(struct super_block *sb)
1903 struct avc_audit_data ad;
1905 AVC_AUDIT_DATA_INIT(&ad,FS);
1906 ad.u.fs.dentry = sb->s_root;
1907 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1910 static int selinux_mount(char * dev_name,
1911 struct nameidata *nd,
1913 unsigned long flags,
1918 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1922 if (flags & MS_REMOUNT)
1923 return superblock_has_perm(current, nd->mnt->mnt_sb,
1924 FILESYSTEM__REMOUNT, NULL);
1926 return dentry_has_perm(current, nd->mnt, nd->dentry,
1930 static int selinux_umount(struct vfsmount *mnt, int flags)
1934 rc = secondary_ops->sb_umount(mnt, flags);
1938 return superblock_has_perm(current,mnt->mnt_sb,
1939 FILESYSTEM__UNMOUNT,NULL);
1942 /* inode security operations */
1944 static int selinux_inode_alloc_security(struct inode *inode)
1946 return inode_alloc_security(inode);
1949 static void selinux_inode_free_security(struct inode *inode)
1951 inode_free_security(inode);
1954 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1955 char **name, void **value,
1958 struct task_security_struct *tsec;
1959 struct inode_security_struct *dsec;
1960 struct superblock_security_struct *sbsec;
1961 struct inode_security_struct *isec;
1964 char *namep = NULL, *context;
1966 tsec = current->security;
1967 dsec = dir->i_security;
1968 sbsec = dir->i_sb->s_security;
1969 isec = inode->i_security;
1971 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1972 newsid = tsec->create_sid;
1974 rc = security_transition_sid(tsec->sid, dsec->sid,
1975 inode_mode_to_security_class(inode->i_mode),
1978 printk(KERN_WARNING "%s: "
1979 "security_transition_sid failed, rc=%d (dev=%s "
1982 -rc, inode->i_sb->s_id, inode->i_ino);
1987 inode_security_set_sid(inode, newsid);
1990 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
1997 rc = security_sid_to_context(newsid, &context, &clen);
2009 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2011 return may_create(dir, dentry, SECCLASS_FILE);
2014 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2018 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2021 return may_link(dir, old_dentry, MAY_LINK);
2024 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2028 rc = secondary_ops->inode_unlink(dir, dentry);
2031 return may_link(dir, dentry, MAY_UNLINK);
2034 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2036 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2039 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2041 return may_create(dir, dentry, SECCLASS_DIR);
2044 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2046 return may_link(dir, dentry, MAY_RMDIR);
2049 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2053 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2057 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2060 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2061 struct inode *new_inode, struct dentry *new_dentry)
2063 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2066 static int selinux_inode_readlink(struct dentry *dentry)
2068 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2071 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2075 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2078 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2081 static int selinux_inode_permission(struct inode *inode, int mask,
2082 struct nameidata *nd)
2086 rc = secondary_ops->inode_permission(inode, mask, nd);
2091 /* No permission to check. Existence test. */
2095 return inode_has_perm(current, inode,
2096 file_mask_to_av(inode->i_mode, mask), NULL);
2099 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2103 rc = secondary_ops->inode_setattr(dentry, iattr);
2107 if (iattr->ia_valid & ATTR_FORCE)
2110 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2111 ATTR_ATIME_SET | ATTR_MTIME_SET))
2112 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2114 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2117 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2119 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2122 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2124 struct task_security_struct *tsec = current->security;
2125 struct inode *inode = dentry->d_inode;
2126 struct inode_security_struct *isec = inode->i_security;
2127 struct superblock_security_struct *sbsec;
2128 struct avc_audit_data ad;
2132 if (strcmp(name, XATTR_NAME_SELINUX)) {
2133 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2134 sizeof XATTR_SECURITY_PREFIX - 1) &&
2135 !capable(CAP_SYS_ADMIN)) {
2136 /* A different attribute in the security namespace.
2137 Restrict to administrator. */
2141 /* Not an attribute we recognize, so just check the
2142 ordinary setattr permission. */
2143 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2146 sbsec = inode->i_sb->s_security;
2147 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2150 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2153 AVC_AUDIT_DATA_INIT(&ad,FS);
2154 ad.u.fs.dentry = dentry;
2156 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2157 FILE__RELABELFROM, &ad);
2161 rc = security_context_to_sid(value, size, &newsid);
2165 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2166 FILE__RELABELTO, &ad);
2170 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2175 return avc_has_perm(newsid,
2177 SECCLASS_FILESYSTEM,
2178 FILESYSTEM__ASSOCIATE,
2182 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2183 void *value, size_t size, int flags)
2185 struct inode *inode = dentry->d_inode;
2186 struct inode_security_struct *isec = inode->i_security;
2190 if (strcmp(name, XATTR_NAME_SELINUX)) {
2191 /* Not an attribute we recognize, so nothing to do. */
2195 rc = security_context_to_sid(value, size, &newsid);
2197 printk(KERN_WARNING "%s: unable to obtain SID for context "
2198 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2206 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2208 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2211 static int selinux_inode_listxattr (struct dentry *dentry)
2213 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2216 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2218 if (strcmp(name, XATTR_NAME_SELINUX)) {
2219 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2220 sizeof XATTR_SECURITY_PREFIX - 1) &&
2221 !capable(CAP_SYS_ADMIN)) {
2222 /* A different attribute in the security namespace.
2223 Restrict to administrator. */
2227 /* Not an attribute we recognize, so just check the
2228 ordinary setattr permission. Might want a separate
2229 permission for removexattr. */
2230 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2233 /* No one is allowed to remove a SELinux security label.
2234 You can change the label, but all data must be labeled. */
2239 * Copy the in-core inode security context value to the user. If the
2240 * getxattr() prior to this succeeded, check to see if we need to
2241 * canonicalize the value to be finally returned to the user.
2243 * Permission check is handled by selinux_inode_getxattr hook.
2245 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size, int err)
2247 struct inode_security_struct *isec = inode->i_security;
2252 if (strcmp(name, XATTR_SELINUX_SUFFIX)) {
2257 rc = security_sid_to_context(isec->sid, &context, &len);
2261 /* Probe for required buffer size */
2262 if (!buffer || !size) {
2273 if ((len == err) && !(memcmp(context, buffer, len))) {
2274 /* Don't need to canonicalize value */
2278 memset(buffer, 0, size);
2280 memcpy(buffer, context, len);
2288 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2289 const void *value, size_t size, int flags)
2291 struct inode_security_struct *isec = inode->i_security;
2295 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2298 if (!value || !size)
2301 rc = security_context_to_sid((void*)value, size, &newsid);
2309 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2311 const int len = sizeof(XATTR_NAME_SELINUX);
2312 if (buffer && len <= buffer_size)
2313 memcpy(buffer, XATTR_NAME_SELINUX, len);
2317 /* file security operations */
2319 static int selinux_file_permission(struct file *file, int mask)
2321 struct inode *inode = file->f_dentry->d_inode;
2324 /* No permission to check. Existence test. */
2328 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2329 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2332 return file_has_perm(current, file,
2333 file_mask_to_av(inode->i_mode, mask));
2336 static int selinux_file_alloc_security(struct file *file)
2338 return file_alloc_security(file);
2341 static void selinux_file_free_security(struct file *file)
2343 file_free_security(file);
2346 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2358 case EXT2_IOC_GETFLAGS:
2360 case EXT2_IOC_GETVERSION:
2361 error = file_has_perm(current, file, FILE__GETATTR);
2364 case EXT2_IOC_SETFLAGS:
2366 case EXT2_IOC_SETVERSION:
2367 error = file_has_perm(current, file, FILE__SETATTR);
2370 /* sys_ioctl() checks */
2374 error = file_has_perm(current, file, 0);
2379 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2382 /* default case assumes that the command will go
2383 * to the file's ioctl() function.
2386 error = file_has_perm(current, file, FILE__IOCTL);
2392 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2394 #ifndef CONFIG_PPC32
2395 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2397 * We are making executable an anonymous mapping or a
2398 * private file mapping that will also be writable.
2399 * This has an additional check.
2401 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2408 /* read access is always possible with a mapping */
2409 u32 av = FILE__READ;
2411 /* write access only matters if the mapping is shared */
2412 if (shared && (prot & PROT_WRITE))
2415 if (prot & PROT_EXEC)
2416 av |= FILE__EXECUTE;
2418 return file_has_perm(current, file, av);
2423 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2424 unsigned long prot, unsigned long flags)
2428 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2432 if (selinux_checkreqprot)
2435 return file_map_prot_check(file, prot,
2436 (flags & MAP_TYPE) == MAP_SHARED);
2439 static int selinux_file_mprotect(struct vm_area_struct *vma,
2440 unsigned long reqprot,
2445 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2449 if (selinux_checkreqprot)
2452 #ifndef CONFIG_PPC32
2453 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2454 (vma->vm_start >= vma->vm_mm->start_brk &&
2455 vma->vm_end <= vma->vm_mm->brk)) {
2457 * We are making an executable mapping in the brk region.
2458 * This has an additional execheap check.
2460 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2464 if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2466 * We are making executable a file mapping that has
2467 * had some COW done. Since pages might have been written,
2468 * check ability to execute the possibly modified content.
2469 * This typically should only occur for text relocations.
2471 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2475 if (!vma->vm_file && (prot & PROT_EXEC) &&
2476 vma->vm_start <= vma->vm_mm->start_stack &&
2477 vma->vm_end >= vma->vm_mm->start_stack) {
2478 /* Attempt to make the process stack executable.
2479 * This has an additional execstack check.
2481 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2487 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2490 static int selinux_file_lock(struct file *file, unsigned int cmd)
2492 return file_has_perm(current, file, FILE__LOCK);
2495 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2502 if (!file->f_dentry || !file->f_dentry->d_inode) {
2507 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2508 err = file_has_perm(current, file,FILE__WRITE);
2517 /* Just check FD__USE permission */
2518 err = file_has_perm(current, file, 0);
2523 #if BITS_PER_LONG == 32
2528 if (!file->f_dentry || !file->f_dentry->d_inode) {
2532 err = file_has_perm(current, file, FILE__LOCK);
2539 static int selinux_file_set_fowner(struct file *file)
2541 struct task_security_struct *tsec;
2542 struct file_security_struct *fsec;
2544 tsec = current->security;
2545 fsec = file->f_security;
2546 fsec->fown_sid = tsec->sid;
2551 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2552 struct fown_struct *fown, int signum)
2556 struct task_security_struct *tsec;
2557 struct file_security_struct *fsec;
2559 /* struct fown_struct is never outside the context of a struct file */
2560 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2562 tsec = tsk->security;
2563 fsec = file->f_security;
2566 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2568 perm = signal_to_av(signum);
2570 return avc_has_perm(fsec->fown_sid, tsec->sid,
2571 SECCLASS_PROCESS, perm, NULL);
2574 static int selinux_file_receive(struct file *file)
2576 return file_has_perm(current, file, file_to_av(file));
2579 /* task security operations */
2581 static int selinux_task_create(unsigned long clone_flags)
2585 rc = secondary_ops->task_create(clone_flags);
2589 return task_has_perm(current, current, PROCESS__FORK);
2592 static int selinux_task_alloc_security(struct task_struct *tsk)
2594 struct task_security_struct *tsec1, *tsec2;
2597 tsec1 = current->security;
2599 rc = task_alloc_security(tsk);
2602 tsec2 = tsk->security;
2604 tsec2->osid = tsec1->osid;
2605 tsec2->sid = tsec1->sid;
2607 /* Retain the exec and create SIDs across fork */
2608 tsec2->exec_sid = tsec1->exec_sid;
2609 tsec2->create_sid = tsec1->create_sid;
2611 /* Retain ptracer SID across fork, if any.
2612 This will be reset by the ptrace hook upon any
2613 subsequent ptrace_attach operations. */
2614 tsec2->ptrace_sid = tsec1->ptrace_sid;
2619 static void selinux_task_free_security(struct task_struct *tsk)
2621 task_free_security(tsk);
2624 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2626 /* Since setuid only affects the current process, and
2627 since the SELinux controls are not based on the Linux
2628 identity attributes, SELinux does not need to control
2629 this operation. However, SELinux does control the use
2630 of the CAP_SETUID and CAP_SETGID capabilities using the
2635 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2637 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2640 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2642 /* See the comment for setuid above. */
2646 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2648 return task_has_perm(current, p, PROCESS__SETPGID);
2651 static int selinux_task_getpgid(struct task_struct *p)
2653 return task_has_perm(current, p, PROCESS__GETPGID);
2656 static int selinux_task_getsid(struct task_struct *p)
2658 return task_has_perm(current, p, PROCESS__GETSESSION);
2661 static int selinux_task_setgroups(struct group_info *group_info)
2663 /* See the comment for setuid above. */
2667 static int selinux_task_setnice(struct task_struct *p, int nice)
2671 rc = secondary_ops->task_setnice(p, nice);
2675 return task_has_perm(current,p, PROCESS__SETSCHED);
2678 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2680 struct rlimit *old_rlim = current->signal->rlim + resource;
2683 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2687 /* Control the ability to change the hard limit (whether
2688 lowering or raising it), so that the hard limit can
2689 later be used as a safe reset point for the soft limit
2690 upon context transitions. See selinux_bprm_apply_creds. */
2691 if (old_rlim->rlim_max != new_rlim->rlim_max)
2692 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2697 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2699 return task_has_perm(current, p, PROCESS__SETSCHED);
2702 static int selinux_task_getscheduler(struct task_struct *p)
2704 return task_has_perm(current, p, PROCESS__GETSCHED);
2707 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2712 rc = secondary_ops->task_kill(p, info, sig);
2716 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2720 perm = PROCESS__SIGNULL; /* null signal; existence test */
2722 perm = signal_to_av(sig);
2724 return task_has_perm(current, p, perm);
2727 static int selinux_task_prctl(int option,
2733 /* The current prctl operations do not appear to require
2734 any SELinux controls since they merely observe or modify
2735 the state of the current process. */
2739 static int selinux_task_wait(struct task_struct *p)
2743 perm = signal_to_av(p->exit_signal);
2745 return task_has_perm(p, current, perm);
2748 static void selinux_task_reparent_to_init(struct task_struct *p)
2750 struct task_security_struct *tsec;
2752 secondary_ops->task_reparent_to_init(p);
2755 tsec->osid = tsec->sid;
2756 tsec->sid = SECINITSID_KERNEL;
2760 static void selinux_task_to_inode(struct task_struct *p,
2761 struct inode *inode)
2763 struct task_security_struct *tsec = p->security;
2764 struct inode_security_struct *isec = inode->i_security;
2766 isec->sid = tsec->sid;
2767 isec->initialized = 1;
2771 #ifdef CONFIG_SECURITY_NETWORK
2773 /* Returns error only if unable to parse addresses */
2774 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2776 int offset, ihlen, ret = -EINVAL;
2777 struct iphdr _iph, *ih;
2779 offset = skb->nh.raw - skb->data;
2780 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2784 ihlen = ih->ihl * 4;
2785 if (ihlen < sizeof(_iph))
2788 ad->u.net.v4info.saddr = ih->saddr;
2789 ad->u.net.v4info.daddr = ih->daddr;
2792 switch (ih->protocol) {
2794 struct tcphdr _tcph, *th;
2796 if (ntohs(ih->frag_off) & IP_OFFSET)
2800 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2804 ad->u.net.sport = th->source;
2805 ad->u.net.dport = th->dest;
2810 struct udphdr _udph, *uh;
2812 if (ntohs(ih->frag_off) & IP_OFFSET)
2816 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2820 ad->u.net.sport = uh->source;
2821 ad->u.net.dport = uh->dest;
2832 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2834 /* Returns error only if unable to parse addresses */
2835 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2838 int ret = -EINVAL, offset;
2839 struct ipv6hdr _ipv6h, *ip6;
2841 offset = skb->nh.raw - skb->data;
2842 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2846 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2847 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2850 nexthdr = ip6->nexthdr;
2851 offset += sizeof(_ipv6h);
2852 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2858 struct tcphdr _tcph, *th;
2860 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2864 ad->u.net.sport = th->source;
2865 ad->u.net.dport = th->dest;
2870 struct udphdr _udph, *uh;
2872 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2876 ad->u.net.sport = uh->source;
2877 ad->u.net.dport = uh->dest;
2881 /* includes fragments */
2891 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2892 char **addrp, int *len, int src)
2896 switch (ad->u.net.family) {
2898 ret = selinux_parse_skb_ipv4(skb, ad);
2902 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2903 &ad->u.net.v4info.daddr);
2906 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2908 ret = selinux_parse_skb_ipv6(skb, ad);
2912 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2913 &ad->u.net.v6info.daddr);
2923 /* socket security operations */
2924 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2927 struct inode_security_struct *isec;
2928 struct task_security_struct *tsec;
2929 struct avc_audit_data ad;
2932 tsec = task->security;
2933 isec = SOCK_INODE(sock)->i_security;
2935 if (isec->sid == SECINITSID_KERNEL)
2938 AVC_AUDIT_DATA_INIT(&ad,NET);
2939 ad.u.net.sk = sock->sk;
2940 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2946 static int selinux_socket_create(int family, int type,
2947 int protocol, int kern)
2950 struct task_security_struct *tsec;
2955 tsec = current->security;
2956 err = avc_has_perm(tsec->sid, tsec->sid,
2957 socket_type_to_security_class(family, type,
2958 protocol), SOCKET__CREATE, NULL);
2964 static void selinux_socket_post_create(struct socket *sock, int family,
2965 int type, int protocol, int kern)
2967 struct inode_security_struct *isec;
2968 struct task_security_struct *tsec;
2970 isec = SOCK_INODE(sock)->i_security;
2972 tsec = current->security;
2973 isec->sclass = socket_type_to_security_class(family, type, protocol);
2974 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2975 isec->initialized = 1;
2980 /* Range of port numbers used to automatically bind.
2981 Need to determine whether we should perform a name_bind
2982 permission check between the socket and the port number. */
2983 #define ip_local_port_range_0 sysctl_local_port_range[0]
2984 #define ip_local_port_range_1 sysctl_local_port_range[1]
2986 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2991 err = socket_has_perm(current, sock, SOCKET__BIND);
2996 * If PF_INET or PF_INET6, check name_bind permission for the port.
2997 * Multiple address binding for SCTP is not supported yet: we just
2998 * check the first address now.
3000 family = sock->sk->sk_family;
3001 if (family == PF_INET || family == PF_INET6) {
3003 struct inode_security_struct *isec;
3004 struct task_security_struct *tsec;
3005 struct avc_audit_data ad;
3006 struct sockaddr_in *addr4 = NULL;
3007 struct sockaddr_in6 *addr6 = NULL;
3008 unsigned short snum;
3009 struct sock *sk = sock->sk;
3010 u32 sid, node_perm, addrlen;
3012 tsec = current->security;
3013 isec = SOCK_INODE(sock)->i_security;
3015 if (family == PF_INET) {
3016 addr4 = (struct sockaddr_in *)address;
3017 snum = ntohs(addr4->sin_port);
3018 addrlen = sizeof(addr4->sin_addr.s_addr);
3019 addrp = (char *)&addr4->sin_addr.s_addr;
3021 addr6 = (struct sockaddr_in6 *)address;
3022 snum = ntohs(addr6->sin6_port);
3023 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3024 addrp = (char *)&addr6->sin6_addr.s6_addr;
3027 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3028 snum > ip_local_port_range_1)) {
3029 err = security_port_sid(sk->sk_family, sk->sk_type,
3030 sk->sk_protocol, snum, &sid);
3033 AVC_AUDIT_DATA_INIT(&ad,NET);
3034 ad.u.net.sport = htons(snum);
3035 ad.u.net.family = family;
3036 err = avc_has_perm(isec->sid, sid,
3038 SOCKET__NAME_BIND, &ad);
3043 switch(isec->sclass) {
3044 case SECCLASS_TCP_SOCKET:
3045 node_perm = TCP_SOCKET__NODE_BIND;
3048 case SECCLASS_UDP_SOCKET:
3049 node_perm = UDP_SOCKET__NODE_BIND;
3053 node_perm = RAWIP_SOCKET__NODE_BIND;
3057 err = security_node_sid(family, addrp, addrlen, &sid);
3061 AVC_AUDIT_DATA_INIT(&ad,NET);
3062 ad.u.net.sport = htons(snum);
3063 ad.u.net.family = family;
3065 if (family == PF_INET)
3066 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3068 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3070 err = avc_has_perm(isec->sid, sid,
3071 isec->sclass, node_perm, &ad);
3079 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3081 struct inode_security_struct *isec;
3084 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3089 * If a TCP socket, check name_connect permission for the port.
3091 isec = SOCK_INODE(sock)->i_security;
3092 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3093 struct sock *sk = sock->sk;
3094 struct avc_audit_data ad;
3095 struct sockaddr_in *addr4 = NULL;
3096 struct sockaddr_in6 *addr6 = NULL;
3097 unsigned short snum;
3100 if (sk->sk_family == PF_INET) {
3101 addr4 = (struct sockaddr_in *)address;
3102 if (addrlen < sizeof(struct sockaddr_in))
3104 snum = ntohs(addr4->sin_port);
3106 addr6 = (struct sockaddr_in6 *)address;
3107 if (addrlen < SIN6_LEN_RFC2133)
3109 snum = ntohs(addr6->sin6_port);
3112 err = security_port_sid(sk->sk_family, sk->sk_type,
3113 sk->sk_protocol, snum, &sid);
3117 AVC_AUDIT_DATA_INIT(&ad,NET);
3118 ad.u.net.dport = htons(snum);
3119 ad.u.net.family = sk->sk_family;
3120 err = avc_has_perm(isec->sid, sid, isec->sclass,
3121 TCP_SOCKET__NAME_CONNECT, &ad);
3130 static int selinux_socket_listen(struct socket *sock, int backlog)
3132 return socket_has_perm(current, sock, SOCKET__LISTEN);
3135 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3138 struct inode_security_struct *isec;
3139 struct inode_security_struct *newisec;
3141 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3145 newisec = SOCK_INODE(newsock)->i_security;
3147 isec = SOCK_INODE(sock)->i_security;
3148 newisec->sclass = isec->sclass;
3149 newisec->sid = isec->sid;
3150 newisec->initialized = 1;
3155 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3158 return socket_has_perm(current, sock, SOCKET__WRITE);
3161 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3162 int size, int flags)
3164 return socket_has_perm(current, sock, SOCKET__READ);
3167 static int selinux_socket_getsockname(struct socket *sock)
3169 return socket_has_perm(current, sock, SOCKET__GETATTR);
3172 static int selinux_socket_getpeername(struct socket *sock)
3174 return socket_has_perm(current, sock, SOCKET__GETATTR);
3177 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3179 return socket_has_perm(current, sock, SOCKET__SETOPT);
3182 static int selinux_socket_getsockopt(struct socket *sock, int level,
3185 return socket_has_perm(current, sock, SOCKET__GETOPT);
3188 static int selinux_socket_shutdown(struct socket *sock, int how)
3190 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3193 static int selinux_socket_unix_stream_connect(struct socket *sock,
3194 struct socket *other,
3197 struct sk_security_struct *ssec;
3198 struct inode_security_struct *isec;
3199 struct inode_security_struct *other_isec;
3200 struct avc_audit_data ad;
3203 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3207 isec = SOCK_INODE(sock)->i_security;
3208 other_isec = SOCK_INODE(other)->i_security;
3210 AVC_AUDIT_DATA_INIT(&ad,NET);
3211 ad.u.net.sk = other->sk;
3213 err = avc_has_perm(isec->sid, other_isec->sid,
3215 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3219 /* connecting socket */
3220 ssec = sock->sk->sk_security;
3221 ssec->peer_sid = other_isec->sid;
3223 /* server child socket */
3224 ssec = newsk->sk_security;
3225 ssec->peer_sid = isec->sid;
3230 static int selinux_socket_unix_may_send(struct socket *sock,
3231 struct socket *other)
3233 struct inode_security_struct *isec;
3234 struct inode_security_struct *other_isec;
3235 struct avc_audit_data ad;
3238 isec = SOCK_INODE(sock)->i_security;
3239 other_isec = SOCK_INODE(other)->i_security;
3241 AVC_AUDIT_DATA_INIT(&ad,NET);
3242 ad.u.net.sk = other->sk;
3244 err = avc_has_perm(isec->sid, other_isec->sid,
3245 isec->sclass, SOCKET__SENDTO, &ad);
3252 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3257 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3260 struct socket *sock;
3261 struct net_device *dev;
3262 struct avc_audit_data ad;
3264 family = sk->sk_family;
3265 if (family != PF_INET && family != PF_INET6)
3268 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3269 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3272 read_lock_bh(&sk->sk_callback_lock);
3273 sock = sk->sk_socket;
3275 struct inode *inode;
3276 inode = SOCK_INODE(sock);
3278 struct inode_security_struct *isec;
3279 isec = inode->i_security;
3280 sock_sid = isec->sid;
3281 sock_class = isec->sclass;
3284 read_unlock_bh(&sk->sk_callback_lock);
3292 err = sel_netif_sids(dev, &if_sid, NULL);
3296 switch (sock_class) {
3297 case SECCLASS_UDP_SOCKET:
3298 netif_perm = NETIF__UDP_RECV;
3299 node_perm = NODE__UDP_RECV;
3300 recv_perm = UDP_SOCKET__RECV_MSG;
3303 case SECCLASS_TCP_SOCKET:
3304 netif_perm = NETIF__TCP_RECV;
3305 node_perm = NODE__TCP_RECV;
3306 recv_perm = TCP_SOCKET__RECV_MSG;
3310 netif_perm = NETIF__RAWIP_RECV;
3311 node_perm = NODE__RAWIP_RECV;
3315 AVC_AUDIT_DATA_INIT(&ad, NET);
3316 ad.u.net.netif = dev->name;
3317 ad.u.net.family = family;
3319 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3323 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3327 /* Fixme: this lookup is inefficient */
3328 err = security_node_sid(family, addrp, len, &node_sid);
3332 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3339 /* Fixme: make this more efficient */
3340 err = security_port_sid(sk->sk_family, sk->sk_type,
3341 sk->sk_protocol, ntohs(ad.u.net.sport),
3346 err = avc_has_perm(sock_sid, port_sid,
3347 sock_class, recv_perm, &ad);
3353 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3354 int __user *optlen, unsigned len)
3359 struct sk_security_struct *ssec;
3360 struct inode_security_struct *isec;
3362 isec = SOCK_INODE(sock)->i_security;
3363 if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3368 ssec = sock->sk->sk_security;
3370 err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3374 if (scontext_len > len) {
3379 if (copy_to_user(optval, scontext, scontext_len))
3383 if (put_user(scontext_len, optlen))
3391 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3393 return sk_alloc_security(sk, family, priority);
3396 static void selinux_sk_free_security(struct sock *sk)
3398 sk_free_security(sk);
3401 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3405 struct nlmsghdr *nlh;
3406 struct socket *sock = sk->sk_socket;
3407 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3409 if (skb->len < NLMSG_SPACE(0)) {
3413 nlh = (struct nlmsghdr *)skb->data;
3415 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3417 if (err == -EINVAL) {
3418 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3419 "SELinux: unrecognized netlink message"
3420 " type=%hu for sclass=%hu\n",
3421 nlh->nlmsg_type, isec->sclass);
3422 if (!selinux_enforcing)
3432 err = socket_has_perm(current, sock, perm);
3437 #ifdef CONFIG_NETFILTER
3439 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3440 struct sk_buff **pskb,
3441 const struct net_device *in,
3442 const struct net_device *out,
3443 int (*okfn)(struct sk_buff *),
3447 int len, err = NF_ACCEPT;
3448 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3450 struct socket *sock;
3451 struct inode *inode;
3452 struct sk_buff *skb = *pskb;
3453 struct inode_security_struct *isec;
3454 struct avc_audit_data ad;
3455 struct net_device *dev = (struct net_device *)out;
3461 sock = sk->sk_socket;
3465 inode = SOCK_INODE(sock);
3469 err = sel_netif_sids(dev, &if_sid, NULL);
3473 isec = inode->i_security;
3475 switch (isec->sclass) {
3476 case SECCLASS_UDP_SOCKET:
3477 netif_perm = NETIF__UDP_SEND;
3478 node_perm = NODE__UDP_SEND;
3479 send_perm = UDP_SOCKET__SEND_MSG;
3482 case SECCLASS_TCP_SOCKET:
3483 netif_perm = NETIF__TCP_SEND;
3484 node_perm = NODE__TCP_SEND;
3485 send_perm = TCP_SOCKET__SEND_MSG;
3489 netif_perm = NETIF__RAWIP_SEND;
3490 node_perm = NODE__RAWIP_SEND;
3495 AVC_AUDIT_DATA_INIT(&ad, NET);
3496 ad.u.net.netif = dev->name;
3497 ad.u.net.family = family;
3499 err = selinux_parse_skb(skb, &ad, &addrp,
3500 &len, 0) ? NF_DROP : NF_ACCEPT;
3501 if (err != NF_ACCEPT)
3504 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3505 netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3506 if (err != NF_ACCEPT)
3509 /* Fixme: this lookup is inefficient */
3510 err = security_node_sid(family, addrp, len,
3511 &node_sid) ? NF_DROP : NF_ACCEPT;
3512 if (err != NF_ACCEPT)
3515 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3516 node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3517 if (err != NF_ACCEPT)
3523 /* Fixme: make this more efficient */
3524 err = security_port_sid(sk->sk_family,
3527 ntohs(ad.u.net.dport),
3528 &port_sid) ? NF_DROP : NF_ACCEPT;
3529 if (err != NF_ACCEPT)
3532 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3533 send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3540 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3541 struct sk_buff **pskb,
3542 const struct net_device *in,
3543 const struct net_device *out,
3544 int (*okfn)(struct sk_buff *))
3546 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3549 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3551 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3552 struct sk_buff **pskb,
3553 const struct net_device *in,
3554 const struct net_device *out,
3555 int (*okfn)(struct sk_buff *))
3557 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3562 #endif /* CONFIG_NETFILTER */
3566 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3571 #endif /* CONFIG_SECURITY_NETWORK */
3573 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3575 struct task_security_struct *tsec;
3576 struct av_decision avd;
3579 err = secondary_ops->netlink_send(sk, skb);
3583 tsec = current->security;
3586 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3587 SECCLASS_CAPABILITY, ~0, &avd);
3588 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3590 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3591 err = selinux_nlmsg_perm(sk, skb);
3596 static int selinux_netlink_recv(struct sk_buff *skb)
3598 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3603 static int ipc_alloc_security(struct task_struct *task,
3604 struct kern_ipc_perm *perm,
3607 struct task_security_struct *tsec = task->security;
3608 struct ipc_security_struct *isec;
3610 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3614 isec->magic = SELINUX_MAGIC;
3615 isec->sclass = sclass;
3616 isec->ipc_perm = perm;
3618 isec->sid = tsec->sid;
3620 isec->sid = SECINITSID_UNLABELED;
3622 perm->security = isec;
3627 static void ipc_free_security(struct kern_ipc_perm *perm)
3629 struct ipc_security_struct *isec = perm->security;
3630 if (!isec || isec->magic != SELINUX_MAGIC)
3633 perm->security = NULL;
3637 static int msg_msg_alloc_security(struct msg_msg *msg)
3639 struct msg_security_struct *msec;
3641 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3645 msec->magic = SELINUX_MAGIC;
3647 msec->sid = SECINITSID_UNLABELED;
3648 msg->security = msec;
3653 static void msg_msg_free_security(struct msg_msg *msg)
3655 struct msg_security_struct *msec = msg->security;
3656 if (!msec || msec->magic != SELINUX_MAGIC)
3659 msg->security = NULL;
3663 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3666 struct task_security_struct *tsec;
3667 struct ipc_security_struct *isec;
3668 struct avc_audit_data ad;
3670 tsec = current->security;
3671 isec = ipc_perms->security;
3673 AVC_AUDIT_DATA_INIT(&ad, IPC);
3674 ad.u.ipc_id = ipc_perms->key;
3676 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3679 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3681 return msg_msg_alloc_security(msg);
3684 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3686 msg_msg_free_security(msg);
3689 /* message queue security operations */
3690 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3692 struct task_security_struct *tsec;
3693 struct ipc_security_struct *isec;
3694 struct avc_audit_data ad;
3697 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3701 tsec = current->security;
3702 isec = msq->q_perm.security;
3704 AVC_AUDIT_DATA_INIT(&ad, IPC);
3705 ad.u.ipc_id = msq->q_perm.key;
3707 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3710 ipc_free_security(&msq->q_perm);
3716 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3718 ipc_free_security(&msq->q_perm);
3721 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3723 struct task_security_struct *tsec;
3724 struct ipc_security_struct *isec;
3725 struct avc_audit_data ad;
3727 tsec = current->security;
3728 isec = msq->q_perm.security;
3730 AVC_AUDIT_DATA_INIT(&ad, IPC);
3731 ad.u.ipc_id = msq->q_perm.key;
3733 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3734 MSGQ__ASSOCIATE, &ad);
3737 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3745 /* No specific object, just general system-wide information. */
3746 return task_has_system(current, SYSTEM__IPC_INFO);
3749 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3752 perms = MSGQ__SETATTR;
3755 perms = MSGQ__DESTROY;
3761 err = ipc_has_perm(&msq->q_perm, perms);
3765 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3767 struct task_security_struct *tsec;
3768 struct ipc_security_struct *isec;
3769 struct msg_security_struct *msec;
3770 struct avc_audit_data ad;
3773 tsec = current->security;
3774 isec = msq->q_perm.security;
3775 msec = msg->security;
3778 * First time through, need to assign label to the message
3780 if (msec->sid == SECINITSID_UNLABELED) {
3782 * Compute new sid based on current process and
3783 * message queue this message will be stored in
3785 rc = security_transition_sid(tsec->sid,
3793 AVC_AUDIT_DATA_INIT(&ad, IPC);
3794 ad.u.ipc_id = msq->q_perm.key;
3796 /* Can this process write to the queue? */
3797 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3800 /* Can this process send the message */
3801 rc = avc_has_perm(tsec->sid, msec->sid,
3802 SECCLASS_MSG, MSG__SEND, &ad);
3804 /* Can the message be put in the queue? */
3805 rc = avc_has_perm(msec->sid, isec->sid,
3806 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3811 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3812 struct task_struct *target,
3813 long type, int mode)
3815 struct task_security_struct *tsec;
3816 struct ipc_security_struct *isec;
3817 struct msg_security_struct *msec;
3818 struct avc_audit_data ad;
3821 tsec = target->security;
3822 isec = msq->q_perm.security;
3823 msec = msg->security;
3825 AVC_AUDIT_DATA_INIT(&ad, IPC);
3826 ad.u.ipc_id = msq->q_perm.key;
3828 rc = avc_has_perm(tsec->sid, isec->sid,
3829 SECCLASS_MSGQ, MSGQ__READ, &ad);
3831 rc = avc_has_perm(tsec->sid, msec->sid,
3832 SECCLASS_MSG, MSG__RECEIVE, &ad);
3836 /* Shared Memory security operations */
3837 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3839 struct task_security_struct *tsec;
3840 struct ipc_security_struct *isec;
3841 struct avc_audit_data ad;
3844 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3848 tsec = current->security;
3849 isec = shp->shm_perm.security;
3851 AVC_AUDIT_DATA_INIT(&ad, IPC);
3852 ad.u.ipc_id = shp->shm_perm.key;
3854 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3857 ipc_free_security(&shp->shm_perm);
3863 static void selinux_shm_free_security(struct shmid_kernel *shp)
3865 ipc_free_security(&shp->shm_perm);
3868 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3870 struct task_security_struct *tsec;
3871 struct ipc_security_struct *isec;
3872 struct avc_audit_data ad;
3874 tsec = current->security;
3875 isec = shp->shm_perm.security;
3877 AVC_AUDIT_DATA_INIT(&ad, IPC);
3878 ad.u.ipc_id = shp->shm_perm.key;
3880 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3881 SHM__ASSOCIATE, &ad);
3884 /* Note, at this point, shp is locked down */
3885 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3893 /* No specific object, just general system-wide information. */
3894 return task_has_system(current, SYSTEM__IPC_INFO);
3897 perms = SHM__GETATTR | SHM__ASSOCIATE;
3900 perms = SHM__SETATTR;
3907 perms = SHM__DESTROY;
3913 err = ipc_has_perm(&shp->shm_perm, perms);
3917 static int selinux_shm_shmat(struct shmid_kernel *shp,
3918 char __user *shmaddr, int shmflg)
3923 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3927 if (shmflg & SHM_RDONLY)
3930 perms = SHM__READ | SHM__WRITE;
3932 return ipc_has_perm(&shp->shm_perm, perms);
3935 /* Semaphore security operations */
3936 static int selinux_sem_alloc_security(struct sem_array *sma)
3938 struct task_security_struct *tsec;
3939 struct ipc_security_struct *isec;
3940 struct avc_audit_data ad;
3943 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3947 tsec = current->security;
3948 isec = sma->sem_perm.security;
3950 AVC_AUDIT_DATA_INIT(&ad, IPC);
3951 ad.u.ipc_id = sma->sem_perm.key;
3953 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3956 ipc_free_security(&sma->sem_perm);
3962 static void selinux_sem_free_security(struct sem_array *sma)
3964 ipc_free_security(&sma->sem_perm);
3967 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3969 struct task_security_struct *tsec;
3970 struct ipc_security_struct *isec;
3971 struct avc_audit_data ad;
3973 tsec = current->security;
3974 isec = sma->sem_perm.security;
3976 AVC_AUDIT_DATA_INIT(&ad, IPC);
3977 ad.u.ipc_id = sma->sem_perm.key;
3979 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3980 SEM__ASSOCIATE, &ad);
3983 /* Note, at this point, sma is locked down */
3984 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3992 /* No specific object, just general system-wide information. */
3993 return task_has_system(current, SYSTEM__IPC_INFO);
3997 perms = SEM__GETATTR;
4008 perms = SEM__DESTROY;
4011 perms = SEM__SETATTR;
4015 perms = SEM__GETATTR | SEM__ASSOCIATE;
4021 err = ipc_has_perm(&sma->sem_perm, perms);
4025 static int selinux_sem_semop(struct sem_array *sma,
4026 struct sembuf *sops, unsigned nsops, int alter)
4031 perms = SEM__READ | SEM__WRITE;
4035 return ipc_has_perm(&sma->sem_perm, perms);
4038 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4044 av |= IPC__UNIX_READ;
4046 av |= IPC__UNIX_WRITE;
4051 return ipc_has_perm(ipcp, av);
4054 /* module stacking operations */
4055 static int selinux_register_security (const char *name, struct security_operations *ops)
4057 if (secondary_ops != original_ops) {
4058 printk(KERN_INFO "%s: There is already a secondary security "
4059 "module registered.\n", __FUNCTION__);
4063 secondary_ops = ops;
4065 printk(KERN_INFO "%s: Registering secondary module %s\n",
4072 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4074 if (ops != secondary_ops) {
4075 printk (KERN_INFO "%s: trying to unregister a security module "
4076 "that is not registered.\n", __FUNCTION__);
4080 secondary_ops = original_ops;
4085 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4088 inode_doinit_with_dentry(inode, dentry);
4091 static int selinux_getprocattr(struct task_struct *p,
4092 char *name, void *value, size_t size)
4094 struct task_security_struct *tsec;
4100 error = task_has_perm(current, p, PROCESS__GETATTR);
4110 if (!strcmp(name, "current"))
4112 else if (!strcmp(name, "prev"))
4114 else if (!strcmp(name, "exec"))
4115 sid = tsec->exec_sid;
4116 else if (!strcmp(name, "fscreate"))
4117 sid = tsec->create_sid;
4124 error = security_sid_to_context(sid, &context, &len);
4131 memcpy(value, context, len);
4136 static int selinux_setprocattr(struct task_struct *p,
4137 char *name, void *value, size_t size)
4139 struct task_security_struct *tsec;
4145 /* SELinux only allows a process to change its own
4146 security attributes. */
4151 * Basic control over ability to set these attributes at all.
4152 * current == p, but we'll pass them separately in case the
4153 * above restriction is ever removed.
4155 if (!strcmp(name, "exec"))
4156 error = task_has_perm(current, p, PROCESS__SETEXEC);
4157 else if (!strcmp(name, "fscreate"))
4158 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4159 else if (!strcmp(name, "current"))
4160 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4166 /* Obtain a SID for the context, if one was specified. */
4167 if (size && str[1] && str[1] != '\n') {
4168 if (str[size-1] == '\n') {
4172 error = security_context_to_sid(value, size, &sid);
4177 /* Permission checking based on the specified context is
4178 performed during the actual operation (execve,
4179 open/mkdir/...), when we know the full context of the
4180 operation. See selinux_bprm_set_security for the execve
4181 checks and may_create for the file creation checks. The
4182 operation will then fail if the context is not permitted. */
4184 if (!strcmp(name, "exec"))
4185 tsec->exec_sid = sid;
4186 else if (!strcmp(name, "fscreate"))
4187 tsec->create_sid = sid;
4188 else if (!strcmp(name, "current")) {
4189 struct av_decision avd;
4194 /* Only allow single threaded processes to change context */
4195 if (atomic_read(&p->mm->mm_users) != 1) {
4196 struct task_struct *g, *t;
4197 struct mm_struct *mm = p->mm;
4198 read_lock(&tasklist_lock);
4199 do_each_thread(g, t)
4200 if (t->mm == mm && t != p) {
4201 read_unlock(&tasklist_lock);
4204 while_each_thread(g, t);
4205 read_unlock(&tasklist_lock);
4208 /* Check permissions for the transition. */
4209 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4210 PROCESS__DYNTRANSITION, NULL);
4214 /* Check for ptracing, and update the task SID if ok.
4215 Otherwise, leave SID unchanged and fail. */
4217 if (p->ptrace & PT_PTRACED) {
4218 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4220 PROCESS__PTRACE, &avd);
4224 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4225 PROCESS__PTRACE, &avd, error, NULL);
4239 static struct security_operations selinux_ops = {
4240 .ptrace = selinux_ptrace,
4241 .capget = selinux_capget,
4242 .capset_check = selinux_capset_check,
4243 .capset_set = selinux_capset_set,
4244 .sysctl = selinux_sysctl,
4245 .capable = selinux_capable,
4246 .quotactl = selinux_quotactl,
4247 .quota_on = selinux_quota_on,
4248 .syslog = selinux_syslog,
4249 .vm_enough_memory = selinux_vm_enough_memory,
4251 .netlink_send = selinux_netlink_send,
4252 .netlink_recv = selinux_netlink_recv,
4254 .bprm_alloc_security = selinux_bprm_alloc_security,
4255 .bprm_free_security = selinux_bprm_free_security,
4256 .bprm_apply_creds = selinux_bprm_apply_creds,
4257 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4258 .bprm_set_security = selinux_bprm_set_security,
4259 .bprm_check_security = selinux_bprm_check_security,
4260 .bprm_secureexec = selinux_bprm_secureexec,
4262 .sb_alloc_security = selinux_sb_alloc_security,
4263 .sb_free_security = selinux_sb_free_security,
4264 .sb_copy_data = selinux_sb_copy_data,
4265 .sb_kern_mount = selinux_sb_kern_mount,
4266 .sb_statfs = selinux_sb_statfs,
4267 .sb_mount = selinux_mount,
4268 .sb_umount = selinux_umount,
4270 .inode_alloc_security = selinux_inode_alloc_security,
4271 .inode_free_security = selinux_inode_free_security,
4272 .inode_init_security = selinux_inode_init_security,
4273 .inode_create = selinux_inode_create,
4274 .inode_link = selinux_inode_link,
4275 .inode_unlink = selinux_inode_unlink,
4276 .inode_symlink = selinux_inode_symlink,
4277 .inode_mkdir = selinux_inode_mkdir,
4278 .inode_rmdir = selinux_inode_rmdir,
4279 .inode_mknod = selinux_inode_mknod,
4280 .inode_rename = selinux_inode_rename,
4281 .inode_readlink = selinux_inode_readlink,
4282 .inode_follow_link = selinux_inode_follow_link,
4283 .inode_permission = selinux_inode_permission,
4284 .inode_setattr = selinux_inode_setattr,
4285 .inode_getattr = selinux_inode_getattr,
4286 .inode_setxattr = selinux_inode_setxattr,
4287 .inode_post_setxattr = selinux_inode_post_setxattr,
4288 .inode_getxattr = selinux_inode_getxattr,
4289 .inode_listxattr = selinux_inode_listxattr,
4290 .inode_removexattr = selinux_inode_removexattr,
4291 .inode_getsecurity = selinux_inode_getsecurity,
4292 .inode_setsecurity = selinux_inode_setsecurity,
4293 .inode_listsecurity = selinux_inode_listsecurity,
4295 .file_permission = selinux_file_permission,
4296 .file_alloc_security = selinux_file_alloc_security,
4297 .file_free_security = selinux_file_free_security,
4298 .file_ioctl = selinux_file_ioctl,
4299 .file_mmap = selinux_file_mmap,
4300 .file_mprotect = selinux_file_mprotect,
4301 .file_lock = selinux_file_lock,
4302 .file_fcntl = selinux_file_fcntl,
4303 .file_set_fowner = selinux_file_set_fowner,
4304 .file_send_sigiotask = selinux_file_send_sigiotask,
4305 .file_receive = selinux_file_receive,
4307 .task_create = selinux_task_create,
4308 .task_alloc_security = selinux_task_alloc_security,
4309 .task_free_security = selinux_task_free_security,
4310 .task_setuid = selinux_task_setuid,
4311 .task_post_setuid = selinux_task_post_setuid,
4312 .task_setgid = selinux_task_setgid,
4313 .task_setpgid = selinux_task_setpgid,
4314 .task_getpgid = selinux_task_getpgid,
4315 .task_getsid = selinux_task_getsid,
4316 .task_setgroups = selinux_task_setgroups,
4317 .task_setnice = selinux_task_setnice,
4318 .task_setrlimit = selinux_task_setrlimit,
4319 .task_setscheduler = selinux_task_setscheduler,
4320 .task_getscheduler = selinux_task_getscheduler,
4321 .task_kill = selinux_task_kill,
4322 .task_wait = selinux_task_wait,
4323 .task_prctl = selinux_task_prctl,
4324 .task_reparent_to_init = selinux_task_reparent_to_init,
4325 .task_to_inode = selinux_task_to_inode,
4327 .ipc_permission = selinux_ipc_permission,
4329 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4330 .msg_msg_free_security = selinux_msg_msg_free_security,
4332 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4333 .msg_queue_free_security = selinux_msg_queue_free_security,
4334 .msg_queue_associate = selinux_msg_queue_associate,
4335 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4336 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4337 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4339 .shm_alloc_security = selinux_shm_alloc_security,
4340 .shm_free_security = selinux_shm_free_security,
4341 .shm_associate = selinux_shm_associate,
4342 .shm_shmctl = selinux_shm_shmctl,
4343 .shm_shmat = selinux_shm_shmat,
4345 .sem_alloc_security = selinux_sem_alloc_security,
4346 .sem_free_security = selinux_sem_free_security,
4347 .sem_associate = selinux_sem_associate,
4348 .sem_semctl = selinux_sem_semctl,
4349 .sem_semop = selinux_sem_semop,
4351 .register_security = selinux_register_security,
4352 .unregister_security = selinux_unregister_security,
4354 .d_instantiate = selinux_d_instantiate,
4356 .getprocattr = selinux_getprocattr,
4357 .setprocattr = selinux_setprocattr,
4359 #ifdef CONFIG_SECURITY_NETWORK
4360 .unix_stream_connect = selinux_socket_unix_stream_connect,
4361 .unix_may_send = selinux_socket_unix_may_send,
4363 .socket_create = selinux_socket_create,
4364 .socket_post_create = selinux_socket_post_create,
4365 .socket_bind = selinux_socket_bind,
4366 .socket_connect = selinux_socket_connect,
4367 .socket_listen = selinux_socket_listen,
4368 .socket_accept = selinux_socket_accept,
4369 .socket_sendmsg = selinux_socket_sendmsg,
4370 .socket_recvmsg = selinux_socket_recvmsg,
4371 .socket_getsockname = selinux_socket_getsockname,
4372 .socket_getpeername = selinux_socket_getpeername,
4373 .socket_getsockopt = selinux_socket_getsockopt,
4374 .socket_setsockopt = selinux_socket_setsockopt,
4375 .socket_shutdown = selinux_socket_shutdown,
4376 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4377 .socket_getpeersec = selinux_socket_getpeersec,
4378 .sk_alloc_security = selinux_sk_alloc_security,
4379 .sk_free_security = selinux_sk_free_security,
4383 static __init int selinux_init(void)
4385 struct task_security_struct *tsec;
4387 if (!selinux_enabled) {
4388 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4392 printk(KERN_INFO "SELinux: Initializing.\n");
4394 /* Set the security state for the initial task. */
4395 if (task_alloc_security(current))
4396 panic("SELinux: Failed to initialize initial task.\n");
4397 tsec = current->security;
4398 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4402 original_ops = secondary_ops = security_ops;
4404 panic ("SELinux: No initial security operations\n");
4405 if (register_security (&selinux_ops))
4406 panic("SELinux: Unable to register with kernel.\n");
4408 if (selinux_enforcing) {
4409 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4411 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4416 void selinux_complete_init(void)
4418 printk(KERN_INFO "SELinux: Completing initialization.\n");
4420 /* Set up any superblocks initialized prior to the policy load. */
4421 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4422 spin_lock(&sb_security_lock);
4424 if (!list_empty(&superblock_security_head)) {
4425 struct superblock_security_struct *sbsec =
4426 list_entry(superblock_security_head.next,
4427 struct superblock_security_struct,
4429 struct super_block *sb = sbsec->sb;
4430 spin_lock(&sb_lock);
4432 spin_unlock(&sb_lock);
4433 spin_unlock(&sb_security_lock);
4434 down_read(&sb->s_umount);
4436 superblock_doinit(sb, NULL);
4438 spin_lock(&sb_security_lock);
4439 list_del_init(&sbsec->list);
4442 spin_unlock(&sb_security_lock);
4445 /* SELinux requires early initialization in order to label
4446 all processes and objects when they are created. */
4447 security_initcall(selinux_init);
4449 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4451 static struct nf_hook_ops selinux_ipv4_op = {
4452 .hook = selinux_ipv4_postroute_last,
4453 .owner = THIS_MODULE,
4455 .hooknum = NF_IP_POST_ROUTING,
4456 .priority = NF_IP_PRI_SELINUX_LAST,
4459 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4461 static struct nf_hook_ops selinux_ipv6_op = {
4462 .hook = selinux_ipv6_postroute_last,
4463 .owner = THIS_MODULE,
4465 .hooknum = NF_IP6_POST_ROUTING,
4466 .priority = NF_IP6_PRI_SELINUX_LAST,
4471 static int __init selinux_nf_ip_init(void)
4475 if (!selinux_enabled)
4478 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4480 err = nf_register_hook(&selinux_ipv4_op);
4482 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4484 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4486 err = nf_register_hook(&selinux_ipv6_op);
4488 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4495 __initcall(selinux_nf_ip_init);
4497 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4498 static void selinux_nf_ip_exit(void)
4500 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4502 nf_unregister_hook(&selinux_ipv4_op);
4503 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4504 nf_unregister_hook(&selinux_ipv6_op);
4509 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4511 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4512 #define selinux_nf_ip_exit()
4515 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4517 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4518 int selinux_disable(void)
4520 extern void exit_sel_fs(void);
4521 static int selinux_disabled = 0;
4523 if (ss_initialized) {
4524 /* Not permitted after initial policy load. */
4528 if (selinux_disabled) {
4529 /* Only do this once. */
4533 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4535 selinux_disabled = 1;
4537 /* Reset security_ops to the secondary module, dummy or capability. */
4538 security_ops = secondary_ops;
4540 /* Unregister netfilter hooks. */
4541 selinux_nf_ip_exit();
4543 /* Unregister selinuxfs. */