2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
103 static int __init enforcing_setup(char *str)
105 unsigned long enforcing;
106 if (!kstrtoul(str, 0, &enforcing))
107 selinux_enforcing = enforcing ? 1 : 0;
110 __setup("enforcing=", enforcing_setup);
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116 static int __init selinux_enabled_setup(char *str)
118 unsigned long enabled;
119 if (!kstrtoul(str, 0, &enabled))
120 selinux_enabled = enabled ? 1 : 0;
123 __setup("selinux=", selinux_enabled_setup);
125 int selinux_enabled = 1;
128 static struct kmem_cache *sel_inode_cache;
131 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
134 * This function checks the SECMARK reference counter to see if any SECMARK
135 * targets are currently configured, if the reference counter is greater than
136 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
137 * enabled, false (0) if SECMARK is disabled. If the always_check_network
138 * policy capability is enabled, SECMARK is always considered enabled.
141 static int selinux_secmark_enabled(void)
143 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
147 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
150 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
151 * (1) if any are enabled or false (0) if neither are enabled. If the
152 * always_check_network policy capability is enabled, peer labeling
153 * is always considered enabled.
156 static int selinux_peerlbl_enabled(void)
158 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
161 static int selinux_netcache_avc_callback(u32 event)
163 if (event == AVC_CALLBACK_RESET) {
173 * initialise the security for the init task
175 static void cred_init_security(void)
177 struct cred *cred = (struct cred *) current->real_cred;
178 struct task_security_struct *tsec;
180 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
182 panic("SELinux: Failed to initialize initial task.\n");
184 tsec->osid = tsec->sid = SECINITSID_KERNEL;
185 cred->security = tsec;
189 * get the security ID of a set of credentials
191 static inline u32 cred_sid(const struct cred *cred)
193 const struct task_security_struct *tsec;
195 tsec = cred->security;
200 * get the objective security ID of a task
202 static inline u32 task_sid(const struct task_struct *task)
207 sid = cred_sid(__task_cred(task));
213 * get the subjective security ID of the current task
215 static inline u32 current_sid(void)
217 const struct task_security_struct *tsec = current_security();
222 /* Allocate and free functions for each kind of security blob. */
224 static int inode_alloc_security(struct inode *inode)
226 struct inode_security_struct *isec;
227 u32 sid = current_sid();
229 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
233 mutex_init(&isec->lock);
234 INIT_LIST_HEAD(&isec->list);
236 isec->sid = SECINITSID_UNLABELED;
237 isec->sclass = SECCLASS_FILE;
238 isec->task_sid = sid;
239 inode->i_security = isec;
244 static void inode_free_rcu(struct rcu_head *head)
246 struct inode_security_struct *isec;
248 isec = container_of(head, struct inode_security_struct, rcu);
249 kmem_cache_free(sel_inode_cache, isec);
252 static void inode_free_security(struct inode *inode)
254 struct inode_security_struct *isec = inode->i_security;
255 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
258 * As not all inode security structures are in a list, we check for
259 * empty list outside of the lock to make sure that we won't waste
260 * time taking a lock doing nothing.
262 * The list_del_init() function can be safely called more than once.
263 * It should not be possible for this function to be called with
264 * concurrent list_add(), but for better safety against future changes
265 * in the code, we use list_empty_careful() here.
267 if (!list_empty_careful(&isec->list)) {
268 spin_lock(&sbsec->isec_lock);
269 list_del_init(&isec->list);
270 spin_unlock(&sbsec->isec_lock);
274 * The inode may still be referenced in a path walk and
275 * a call to selinux_inode_permission() can be made
276 * after inode_free_security() is called. Ideally, the VFS
277 * wouldn't do this, but fixing that is a much harder
278 * job. For now, simply free the i_security via RCU, and
279 * leave the current inode->i_security pointer intact.
280 * The inode will be freed after the RCU grace period too.
282 call_rcu(&isec->rcu, inode_free_rcu);
285 static int file_alloc_security(struct file *file)
287 struct file_security_struct *fsec;
288 u32 sid = current_sid();
290 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
295 fsec->fown_sid = sid;
296 file->f_security = fsec;
301 static void file_free_security(struct file *file)
303 struct file_security_struct *fsec = file->f_security;
304 file->f_security = NULL;
308 static int superblock_alloc_security(struct super_block *sb)
310 struct superblock_security_struct *sbsec;
312 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
316 mutex_init(&sbsec->lock);
317 INIT_LIST_HEAD(&sbsec->isec_head);
318 spin_lock_init(&sbsec->isec_lock);
320 sbsec->sid = SECINITSID_UNLABELED;
321 sbsec->def_sid = SECINITSID_FILE;
322 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
323 sb->s_security = sbsec;
328 static void superblock_free_security(struct super_block *sb)
330 struct superblock_security_struct *sbsec = sb->s_security;
331 sb->s_security = NULL;
335 /* The file system's label must be initialized prior to use. */
337 static const char *labeling_behaviors[7] = {
339 "uses transition SIDs",
341 "uses genfs_contexts",
342 "not configured for labeling",
343 "uses mountpoint labeling",
344 "uses native labeling",
347 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
349 static inline int inode_doinit(struct inode *inode)
351 return inode_doinit_with_dentry(inode, NULL);
360 Opt_labelsupport = 5,
364 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
366 static const match_table_t tokens = {
367 {Opt_context, CONTEXT_STR "%s"},
368 {Opt_fscontext, FSCONTEXT_STR "%s"},
369 {Opt_defcontext, DEFCONTEXT_STR "%s"},
370 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
371 {Opt_labelsupport, LABELSUPP_STR},
375 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
377 static int may_context_mount_sb_relabel(u32 sid,
378 struct superblock_security_struct *sbsec,
379 const struct cred *cred)
381 const struct task_security_struct *tsec = cred->security;
384 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
385 FILESYSTEM__RELABELFROM, NULL);
389 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
390 FILESYSTEM__RELABELTO, NULL);
394 static int may_context_mount_inode_relabel(u32 sid,
395 struct superblock_security_struct *sbsec,
396 const struct cred *cred)
398 const struct task_security_struct *tsec = cred->security;
400 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
401 FILESYSTEM__RELABELFROM, NULL);
405 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
406 FILESYSTEM__ASSOCIATE, NULL);
410 static int selinux_is_sblabel_mnt(struct super_block *sb)
412 struct superblock_security_struct *sbsec = sb->s_security;
414 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
415 sbsec->behavior == SECURITY_FS_USE_TRANS ||
416 sbsec->behavior == SECURITY_FS_USE_TASK ||
417 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
418 /* Special handling. Genfs but also in-core setxattr handler */
419 !strcmp(sb->s_type->name, "sysfs") ||
420 !strcmp(sb->s_type->name, "pstore") ||
421 !strcmp(sb->s_type->name, "debugfs") ||
422 !strcmp(sb->s_type->name, "rootfs");
425 static int sb_finish_set_opts(struct super_block *sb)
427 struct superblock_security_struct *sbsec = sb->s_security;
428 struct dentry *root = sb->s_root;
429 struct inode *root_inode = d_backing_inode(root);
432 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
433 /* Make sure that the xattr handler exists and that no
434 error other than -ENODATA is returned by getxattr on
435 the root directory. -ENODATA is ok, as this may be
436 the first boot of the SELinux kernel before we have
437 assigned xattr values to the filesystem. */
438 if (!root_inode->i_op->getxattr) {
439 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
440 "xattr support\n", sb->s_id, sb->s_type->name);
444 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
445 if (rc < 0 && rc != -ENODATA) {
446 if (rc == -EOPNOTSUPP)
447 printk(KERN_WARNING "SELinux: (dev %s, type "
448 "%s) has no security xattr handler\n",
449 sb->s_id, sb->s_type->name);
451 printk(KERN_WARNING "SELinux: (dev %s, type "
452 "%s) getxattr errno %d\n", sb->s_id,
453 sb->s_type->name, -rc);
458 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
459 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
460 sb->s_id, sb->s_type->name);
462 sbsec->flags |= SE_SBINITIALIZED;
463 if (selinux_is_sblabel_mnt(sb))
464 sbsec->flags |= SBLABEL_MNT;
466 /* Initialize the root inode. */
467 rc = inode_doinit_with_dentry(root_inode, root);
469 /* Initialize any other inodes associated with the superblock, e.g.
470 inodes created prior to initial policy load or inodes created
471 during get_sb by a pseudo filesystem that directly
473 spin_lock(&sbsec->isec_lock);
475 if (!list_empty(&sbsec->isec_head)) {
476 struct inode_security_struct *isec =
477 list_entry(sbsec->isec_head.next,
478 struct inode_security_struct, list);
479 struct inode *inode = isec->inode;
480 list_del_init(&isec->list);
481 spin_unlock(&sbsec->isec_lock);
482 inode = igrab(inode);
484 if (!IS_PRIVATE(inode))
488 spin_lock(&sbsec->isec_lock);
491 spin_unlock(&sbsec->isec_lock);
497 * This function should allow an FS to ask what it's mount security
498 * options were so it can use those later for submounts, displaying
499 * mount options, or whatever.
501 static int selinux_get_mnt_opts(const struct super_block *sb,
502 struct security_mnt_opts *opts)
505 struct superblock_security_struct *sbsec = sb->s_security;
506 char *context = NULL;
510 security_init_mnt_opts(opts);
512 if (!(sbsec->flags & SE_SBINITIALIZED))
518 /* make sure we always check enough bits to cover the mask */
519 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
521 tmp = sbsec->flags & SE_MNTMASK;
522 /* count the number of mount options for this sb */
523 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
525 opts->num_mnt_opts++;
528 /* Check if the Label support flag is set */
529 if (sbsec->flags & SBLABEL_MNT)
530 opts->num_mnt_opts++;
532 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
533 if (!opts->mnt_opts) {
538 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
539 if (!opts->mnt_opts_flags) {
545 if (sbsec->flags & FSCONTEXT_MNT) {
546 rc = security_sid_to_context(sbsec->sid, &context, &len);
549 opts->mnt_opts[i] = context;
550 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
552 if (sbsec->flags & CONTEXT_MNT) {
553 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
556 opts->mnt_opts[i] = context;
557 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
559 if (sbsec->flags & DEFCONTEXT_MNT) {
560 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
563 opts->mnt_opts[i] = context;
564 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
566 if (sbsec->flags & ROOTCONTEXT_MNT) {
567 struct inode *root = d_backing_inode(sbsec->sb->s_root);
568 struct inode_security_struct *isec = root->i_security;
570 rc = security_sid_to_context(isec->sid, &context, &len);
573 opts->mnt_opts[i] = context;
574 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
576 if (sbsec->flags & SBLABEL_MNT) {
577 opts->mnt_opts[i] = NULL;
578 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
581 BUG_ON(i != opts->num_mnt_opts);
586 security_free_mnt_opts(opts);
590 static int bad_option(struct superblock_security_struct *sbsec, char flag,
591 u32 old_sid, u32 new_sid)
593 char mnt_flags = sbsec->flags & SE_MNTMASK;
595 /* check if the old mount command had the same options */
596 if (sbsec->flags & SE_SBINITIALIZED)
597 if (!(sbsec->flags & flag) ||
598 (old_sid != new_sid))
601 /* check if we were passed the same options twice,
602 * aka someone passed context=a,context=b
604 if (!(sbsec->flags & SE_SBINITIALIZED))
605 if (mnt_flags & flag)
611 * Allow filesystems with binary mount data to explicitly set mount point
612 * labeling information.
614 static int selinux_set_mnt_opts(struct super_block *sb,
615 struct security_mnt_opts *opts,
616 unsigned long kern_flags,
617 unsigned long *set_kern_flags)
619 const struct cred *cred = current_cred();
621 struct superblock_security_struct *sbsec = sb->s_security;
622 const char *name = sb->s_type->name;
623 struct inode *inode = d_backing_inode(sbsec->sb->s_root);
624 struct inode_security_struct *root_isec = inode->i_security;
625 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
626 u32 defcontext_sid = 0;
627 char **mount_options = opts->mnt_opts;
628 int *flags = opts->mnt_opts_flags;
629 int num_opts = opts->num_mnt_opts;
631 mutex_lock(&sbsec->lock);
633 if (!ss_initialized) {
635 /* Defer initialization until selinux_complete_init,
636 after the initial policy is loaded and the security
637 server is ready to handle calls. */
641 printk(KERN_WARNING "SELinux: Unable to set superblock options "
642 "before the security server is initialized\n");
645 if (kern_flags && !set_kern_flags) {
646 /* Specifying internal flags without providing a place to
647 * place the results is not allowed */
653 * Binary mount data FS will come through this function twice. Once
654 * from an explicit call and once from the generic calls from the vfs.
655 * Since the generic VFS calls will not contain any security mount data
656 * we need to skip the double mount verification.
658 * This does open a hole in which we will not notice if the first
659 * mount using this sb set explict options and a second mount using
660 * this sb does not set any security options. (The first options
661 * will be used for both mounts)
663 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
668 * parse the mount options, check if they are valid sids.
669 * also check if someone is trying to mount the same sb more
670 * than once with different security options.
672 for (i = 0; i < num_opts; i++) {
675 if (flags[i] == SBLABEL_MNT)
677 rc = security_context_to_sid(mount_options[i],
678 strlen(mount_options[i]), &sid, GFP_KERNEL);
680 printk(KERN_WARNING "SELinux: security_context_to_sid"
681 "(%s) failed for (dev %s, type %s) errno=%d\n",
682 mount_options[i], sb->s_id, name, rc);
689 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
691 goto out_double_mount;
693 sbsec->flags |= FSCONTEXT_MNT;
698 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
700 goto out_double_mount;
702 sbsec->flags |= CONTEXT_MNT;
704 case ROOTCONTEXT_MNT:
705 rootcontext_sid = sid;
707 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
709 goto out_double_mount;
711 sbsec->flags |= ROOTCONTEXT_MNT;
715 defcontext_sid = sid;
717 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
719 goto out_double_mount;
721 sbsec->flags |= DEFCONTEXT_MNT;
730 if (sbsec->flags & SE_SBINITIALIZED) {
731 /* previously mounted with options, but not on this attempt? */
732 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
733 goto out_double_mount;
738 if (strcmp(sb->s_type->name, "proc") == 0)
739 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
741 if (!strcmp(sb->s_type->name, "debugfs") ||
742 !strcmp(sb->s_type->name, "sysfs") ||
743 !strcmp(sb->s_type->name, "pstore"))
744 sbsec->flags |= SE_SBGENFS;
746 if (!sbsec->behavior) {
748 * Determine the labeling behavior to use for this
751 rc = security_fs_use(sb);
754 "%s: security_fs_use(%s) returned %d\n",
755 __func__, sb->s_type->name, rc);
759 /* sets the context of the superblock for the fs being mounted. */
761 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
765 sbsec->sid = fscontext_sid;
769 * Switch to using mount point labeling behavior.
770 * sets the label used on all file below the mountpoint, and will set
771 * the superblock context if not already set.
773 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
774 sbsec->behavior = SECURITY_FS_USE_NATIVE;
775 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
779 if (!fscontext_sid) {
780 rc = may_context_mount_sb_relabel(context_sid, sbsec,
784 sbsec->sid = context_sid;
786 rc = may_context_mount_inode_relabel(context_sid, sbsec,
791 if (!rootcontext_sid)
792 rootcontext_sid = context_sid;
794 sbsec->mntpoint_sid = context_sid;
795 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
798 if (rootcontext_sid) {
799 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
804 root_isec->sid = rootcontext_sid;
805 root_isec->initialized = 1;
808 if (defcontext_sid) {
809 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
810 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
812 printk(KERN_WARNING "SELinux: defcontext option is "
813 "invalid for this filesystem type\n");
817 if (defcontext_sid != sbsec->def_sid) {
818 rc = may_context_mount_inode_relabel(defcontext_sid,
824 sbsec->def_sid = defcontext_sid;
827 rc = sb_finish_set_opts(sb);
829 mutex_unlock(&sbsec->lock);
833 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
834 "security settings for (dev %s, type %s)\n", sb->s_id, name);
838 static int selinux_cmp_sb_context(const struct super_block *oldsb,
839 const struct super_block *newsb)
841 struct superblock_security_struct *old = oldsb->s_security;
842 struct superblock_security_struct *new = newsb->s_security;
843 char oldflags = old->flags & SE_MNTMASK;
844 char newflags = new->flags & SE_MNTMASK;
846 if (oldflags != newflags)
848 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
850 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
852 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
854 if (oldflags & ROOTCONTEXT_MNT) {
855 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
856 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
857 if (oldroot->sid != newroot->sid)
862 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
863 "different security settings for (dev %s, "
864 "type %s)\n", newsb->s_id, newsb->s_type->name);
868 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
869 struct super_block *newsb)
871 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
872 struct superblock_security_struct *newsbsec = newsb->s_security;
874 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
875 int set_context = (oldsbsec->flags & CONTEXT_MNT);
876 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
879 * if the parent was able to be mounted it clearly had no special lsm
880 * mount options. thus we can safely deal with this superblock later
885 /* how can we clone if the old one wasn't set up?? */
886 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
888 /* if fs is reusing a sb, make sure that the contexts match */
889 if (newsbsec->flags & SE_SBINITIALIZED)
890 return selinux_cmp_sb_context(oldsb, newsb);
892 mutex_lock(&newsbsec->lock);
894 newsbsec->flags = oldsbsec->flags;
896 newsbsec->sid = oldsbsec->sid;
897 newsbsec->def_sid = oldsbsec->def_sid;
898 newsbsec->behavior = oldsbsec->behavior;
901 u32 sid = oldsbsec->mntpoint_sid;
905 if (!set_rootcontext) {
906 struct inode *newinode = d_backing_inode(newsb->s_root);
907 struct inode_security_struct *newisec = newinode->i_security;
910 newsbsec->mntpoint_sid = sid;
912 if (set_rootcontext) {
913 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
914 const struct inode_security_struct *oldisec = oldinode->i_security;
915 struct inode *newinode = d_backing_inode(newsb->s_root);
916 struct inode_security_struct *newisec = newinode->i_security;
918 newisec->sid = oldisec->sid;
921 sb_finish_set_opts(newsb);
922 mutex_unlock(&newsbsec->lock);
926 static int selinux_parse_opts_str(char *options,
927 struct security_mnt_opts *opts)
930 char *context = NULL, *defcontext = NULL;
931 char *fscontext = NULL, *rootcontext = NULL;
932 int rc, num_mnt_opts = 0;
934 opts->num_mnt_opts = 0;
936 /* Standard string-based options. */
937 while ((p = strsep(&options, "|")) != NULL) {
939 substring_t args[MAX_OPT_ARGS];
944 token = match_token(p, tokens, args);
948 if (context || defcontext) {
950 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
953 context = match_strdup(&args[0]);
963 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
966 fscontext = match_strdup(&args[0]);
973 case Opt_rootcontext:
976 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
979 rootcontext = match_strdup(&args[0]);
987 if (context || defcontext) {
989 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
992 defcontext = match_strdup(&args[0]);
998 case Opt_labelsupport:
1002 printk(KERN_WARNING "SELinux: unknown mount option\n");
1009 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1010 if (!opts->mnt_opts)
1013 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1014 if (!opts->mnt_opts_flags) {
1015 kfree(opts->mnt_opts);
1020 opts->mnt_opts[num_mnt_opts] = fscontext;
1021 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1024 opts->mnt_opts[num_mnt_opts] = context;
1025 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1028 opts->mnt_opts[num_mnt_opts] = rootcontext;
1029 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1032 opts->mnt_opts[num_mnt_opts] = defcontext;
1033 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1036 opts->num_mnt_opts = num_mnt_opts;
1047 * string mount options parsing and call set the sbsec
1049 static int superblock_doinit(struct super_block *sb, void *data)
1052 char *options = data;
1053 struct security_mnt_opts opts;
1055 security_init_mnt_opts(&opts);
1060 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1062 rc = selinux_parse_opts_str(options, &opts);
1067 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1070 security_free_mnt_opts(&opts);
1074 static void selinux_write_opts(struct seq_file *m,
1075 struct security_mnt_opts *opts)
1080 for (i = 0; i < opts->num_mnt_opts; i++) {
1083 if (opts->mnt_opts[i])
1084 has_comma = strchr(opts->mnt_opts[i], ',');
1088 switch (opts->mnt_opts_flags[i]) {
1090 prefix = CONTEXT_STR;
1093 prefix = FSCONTEXT_STR;
1095 case ROOTCONTEXT_MNT:
1096 prefix = ROOTCONTEXT_STR;
1098 case DEFCONTEXT_MNT:
1099 prefix = DEFCONTEXT_STR;
1103 seq_puts(m, LABELSUPP_STR);
1109 /* we need a comma before each option */
1111 seq_puts(m, prefix);
1114 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1120 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1122 struct security_mnt_opts opts;
1125 rc = selinux_get_mnt_opts(sb, &opts);
1127 /* before policy load we may get EINVAL, don't show anything */
1133 selinux_write_opts(m, &opts);
1135 security_free_mnt_opts(&opts);
1140 static inline u16 inode_mode_to_security_class(umode_t mode)
1142 switch (mode & S_IFMT) {
1144 return SECCLASS_SOCK_FILE;
1146 return SECCLASS_LNK_FILE;
1148 return SECCLASS_FILE;
1150 return SECCLASS_BLK_FILE;
1152 return SECCLASS_DIR;
1154 return SECCLASS_CHR_FILE;
1156 return SECCLASS_FIFO_FILE;
1160 return SECCLASS_FILE;
1163 static inline int default_protocol_stream(int protocol)
1165 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1168 static inline int default_protocol_dgram(int protocol)
1170 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1173 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1179 case SOCK_SEQPACKET:
1180 return SECCLASS_UNIX_STREAM_SOCKET;
1182 return SECCLASS_UNIX_DGRAM_SOCKET;
1189 if (default_protocol_stream(protocol))
1190 return SECCLASS_TCP_SOCKET;
1192 return SECCLASS_RAWIP_SOCKET;
1194 if (default_protocol_dgram(protocol))
1195 return SECCLASS_UDP_SOCKET;
1197 return SECCLASS_RAWIP_SOCKET;
1199 return SECCLASS_DCCP_SOCKET;
1201 return SECCLASS_RAWIP_SOCKET;
1207 return SECCLASS_NETLINK_ROUTE_SOCKET;
1208 case NETLINK_SOCK_DIAG:
1209 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1211 return SECCLASS_NETLINK_NFLOG_SOCKET;
1213 return SECCLASS_NETLINK_XFRM_SOCKET;
1214 case NETLINK_SELINUX:
1215 return SECCLASS_NETLINK_SELINUX_SOCKET;
1217 return SECCLASS_NETLINK_ISCSI_SOCKET;
1219 return SECCLASS_NETLINK_AUDIT_SOCKET;
1220 case NETLINK_FIB_LOOKUP:
1221 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1222 case NETLINK_CONNECTOR:
1223 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1224 case NETLINK_NETFILTER:
1225 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1226 case NETLINK_DNRTMSG:
1227 return SECCLASS_NETLINK_DNRT_SOCKET;
1228 case NETLINK_KOBJECT_UEVENT:
1229 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1230 case NETLINK_GENERIC:
1231 return SECCLASS_NETLINK_GENERIC_SOCKET;
1232 case NETLINK_SCSITRANSPORT:
1233 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1235 return SECCLASS_NETLINK_RDMA_SOCKET;
1236 case NETLINK_CRYPTO:
1237 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1239 return SECCLASS_NETLINK_SOCKET;
1242 return SECCLASS_PACKET_SOCKET;
1244 return SECCLASS_KEY_SOCKET;
1246 return SECCLASS_APPLETALK_SOCKET;
1249 return SECCLASS_SOCKET;
1252 static int selinux_genfs_get_sid(struct dentry *dentry,
1258 struct super_block *sb = dentry->d_inode->i_sb;
1259 char *buffer, *path;
1261 buffer = (char *)__get_free_page(GFP_KERNEL);
1265 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1269 if (flags & SE_SBPROC) {
1270 /* each process gets a /proc/PID/ entry. Strip off the
1271 * PID part to get a valid selinux labeling.
1272 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1273 while (path[1] >= '0' && path[1] <= '9') {
1278 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1280 free_page((unsigned long)buffer);
1284 /* The inode's security attributes must be initialized before first use. */
1285 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1287 struct superblock_security_struct *sbsec = NULL;
1288 struct inode_security_struct *isec = inode->i_security;
1290 struct dentry *dentry;
1291 #define INITCONTEXTLEN 255
1292 char *context = NULL;
1296 if (isec->initialized)
1299 mutex_lock(&isec->lock);
1300 if (isec->initialized)
1303 sbsec = inode->i_sb->s_security;
1304 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1305 /* Defer initialization until selinux_complete_init,
1306 after the initial policy is loaded and the security
1307 server is ready to handle calls. */
1308 spin_lock(&sbsec->isec_lock);
1309 if (list_empty(&isec->list))
1310 list_add(&isec->list, &sbsec->isec_head);
1311 spin_unlock(&sbsec->isec_lock);
1315 switch (sbsec->behavior) {
1316 case SECURITY_FS_USE_NATIVE:
1318 case SECURITY_FS_USE_XATTR:
1319 if (!inode->i_op->getxattr) {
1320 isec->sid = sbsec->def_sid;
1324 /* Need a dentry, since the xattr API requires one.
1325 Life would be simpler if we could just pass the inode. */
1327 /* Called from d_instantiate or d_splice_alias. */
1328 dentry = dget(opt_dentry);
1330 /* Called from selinux_complete_init, try to find a dentry. */
1331 dentry = d_find_alias(inode);
1335 * this is can be hit on boot when a file is accessed
1336 * before the policy is loaded. When we load policy we
1337 * may find inodes that have no dentry on the
1338 * sbsec->isec_head list. No reason to complain as these
1339 * will get fixed up the next time we go through
1340 * inode_doinit with a dentry, before these inodes could
1341 * be used again by userspace.
1346 len = INITCONTEXTLEN;
1347 context = kmalloc(len+1, GFP_NOFS);
1353 context[len] = '\0';
1354 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1356 if (rc == -ERANGE) {
1359 /* Need a larger buffer. Query for the right size. */
1360 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1367 context = kmalloc(len+1, GFP_NOFS);
1373 context[len] = '\0';
1374 rc = inode->i_op->getxattr(dentry,
1380 if (rc != -ENODATA) {
1381 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1382 "%d for dev=%s ino=%ld\n", __func__,
1383 -rc, inode->i_sb->s_id, inode->i_ino);
1387 /* Map ENODATA to the default file SID */
1388 sid = sbsec->def_sid;
1391 rc = security_context_to_sid_default(context, rc, &sid,
1395 char *dev = inode->i_sb->s_id;
1396 unsigned long ino = inode->i_ino;
1398 if (rc == -EINVAL) {
1399 if (printk_ratelimit())
1400 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1401 "context=%s. This indicates you may need to relabel the inode or the "
1402 "filesystem in question.\n", ino, dev, context);
1404 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1405 "returned %d for dev=%s ino=%ld\n",
1406 __func__, context, -rc, dev, ino);
1409 /* Leave with the unlabeled SID */
1417 case SECURITY_FS_USE_TASK:
1418 isec->sid = isec->task_sid;
1420 case SECURITY_FS_USE_TRANS:
1421 /* Default to the fs SID. */
1422 isec->sid = sbsec->sid;
1424 /* Try to obtain a transition SID. */
1425 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1426 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1427 isec->sclass, NULL, &sid);
1432 case SECURITY_FS_USE_MNTPOINT:
1433 isec->sid = sbsec->mntpoint_sid;
1436 /* Default to the fs superblock SID. */
1437 isec->sid = sbsec->sid;
1439 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1440 /* We must have a dentry to determine the label on
1443 /* Called from d_instantiate or
1444 * d_splice_alias. */
1445 dentry = dget(opt_dentry);
1447 /* Called from selinux_complete_init, try to
1449 dentry = d_find_alias(inode);
1451 * This can be hit on boot when a file is accessed
1452 * before the policy is loaded. When we load policy we
1453 * may find inodes that have no dentry on the
1454 * sbsec->isec_head list. No reason to complain as
1455 * these will get fixed up the next time we go through
1456 * inode_doinit() with a dentry, before these inodes
1457 * could be used again by userspace.
1461 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462 rc = selinux_genfs_get_sid(dentry, isec->sclass,
1463 sbsec->flags, &sid);
1472 isec->initialized = 1;
1475 mutex_unlock(&isec->lock);
1477 if (isec->sclass == SECCLASS_FILE)
1478 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1482 /* Convert a Linux signal to an access vector. */
1483 static inline u32 signal_to_av(int sig)
1489 /* Commonly granted from child to parent. */
1490 perm = PROCESS__SIGCHLD;
1493 /* Cannot be caught or ignored */
1494 perm = PROCESS__SIGKILL;
1497 /* Cannot be caught or ignored */
1498 perm = PROCESS__SIGSTOP;
1501 /* All other signals. */
1502 perm = PROCESS__SIGNAL;
1510 * Check permission between a pair of credentials
1511 * fork check, ptrace check, etc.
1513 static int cred_has_perm(const struct cred *actor,
1514 const struct cred *target,
1517 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1519 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1523 * Check permission between a pair of tasks, e.g. signal checks,
1524 * fork check, ptrace check, etc.
1525 * tsk1 is the actor and tsk2 is the target
1526 * - this uses the default subjective creds of tsk1
1528 static int task_has_perm(const struct task_struct *tsk1,
1529 const struct task_struct *tsk2,
1532 const struct task_security_struct *__tsec1, *__tsec2;
1536 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1537 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1539 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1543 * Check permission between current and another task, e.g. signal checks,
1544 * fork check, ptrace check, etc.
1545 * current is the actor and tsk2 is the target
1546 * - this uses current's subjective creds
1548 static int current_has_perm(const struct task_struct *tsk,
1553 sid = current_sid();
1554 tsid = task_sid(tsk);
1555 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1558 #if CAP_LAST_CAP > 63
1559 #error Fix SELinux to handle capabilities > 63.
1562 /* Check whether a task is allowed to use a capability. */
1563 static int cred_has_capability(const struct cred *cred,
1566 struct common_audit_data ad;
1567 struct av_decision avd;
1569 u32 sid = cred_sid(cred);
1570 u32 av = CAP_TO_MASK(cap);
1573 ad.type = LSM_AUDIT_DATA_CAP;
1576 switch (CAP_TO_INDEX(cap)) {
1578 sclass = SECCLASS_CAPABILITY;
1581 sclass = SECCLASS_CAPABILITY2;
1585 "SELinux: out of range capability %d\n", cap);
1590 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1591 if (audit == SECURITY_CAP_AUDIT) {
1592 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1599 /* Check whether a task is allowed to use a system operation. */
1600 static int task_has_system(struct task_struct *tsk,
1603 u32 sid = task_sid(tsk);
1605 return avc_has_perm(sid, SECINITSID_KERNEL,
1606 SECCLASS_SYSTEM, perms, NULL);
1609 /* Check whether a task has a particular permission to an inode.
1610 The 'adp' parameter is optional and allows other audit
1611 data to be passed (e.g. the dentry). */
1612 static int inode_has_perm(const struct cred *cred,
1613 struct inode *inode,
1615 struct common_audit_data *adp)
1617 struct inode_security_struct *isec;
1620 validate_creds(cred);
1622 if (unlikely(IS_PRIVATE(inode)))
1625 sid = cred_sid(cred);
1626 isec = inode->i_security;
1628 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1631 /* Same as inode_has_perm, but pass explicit audit data containing
1632 the dentry to help the auditing code to more easily generate the
1633 pathname if needed. */
1634 static inline int dentry_has_perm(const struct cred *cred,
1635 struct dentry *dentry,
1638 struct inode *inode = d_backing_inode(dentry);
1639 struct common_audit_data ad;
1641 ad.type = LSM_AUDIT_DATA_DENTRY;
1642 ad.u.dentry = dentry;
1643 return inode_has_perm(cred, inode, av, &ad);
1646 /* Same as inode_has_perm, but pass explicit audit data containing
1647 the path to help the auditing code to more easily generate the
1648 pathname if needed. */
1649 static inline int path_has_perm(const struct cred *cred,
1650 const struct path *path,
1653 struct inode *inode = d_backing_inode(path->dentry);
1654 struct common_audit_data ad;
1656 ad.type = LSM_AUDIT_DATA_PATH;
1658 return inode_has_perm(cred, inode, av, &ad);
1661 /* Same as path_has_perm, but uses the inode from the file struct. */
1662 static inline int file_path_has_perm(const struct cred *cred,
1666 struct common_audit_data ad;
1668 ad.type = LSM_AUDIT_DATA_PATH;
1669 ad.u.path = file->f_path;
1670 return inode_has_perm(cred, file_inode(file), av, &ad);
1673 /* Check whether a task can use an open file descriptor to
1674 access an inode in a given way. Check access to the
1675 descriptor itself, and then use dentry_has_perm to
1676 check a particular permission to the file.
1677 Access to the descriptor is implicitly granted if it
1678 has the same SID as the process. If av is zero, then
1679 access to the file is not checked, e.g. for cases
1680 where only the descriptor is affected like seek. */
1681 static int file_has_perm(const struct cred *cred,
1685 struct file_security_struct *fsec = file->f_security;
1686 struct inode *inode = file_inode(file);
1687 struct common_audit_data ad;
1688 u32 sid = cred_sid(cred);
1691 ad.type = LSM_AUDIT_DATA_PATH;
1692 ad.u.path = file->f_path;
1694 if (sid != fsec->sid) {
1695 rc = avc_has_perm(sid, fsec->sid,
1703 /* av is zero if only checking access to the descriptor. */
1706 rc = inode_has_perm(cred, inode, av, &ad);
1713 * Determine the label for an inode that might be unioned.
1715 static int selinux_determine_inode_label(const struct inode *dir,
1716 const struct qstr *name,
1720 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1721 const struct inode_security_struct *dsec = dir->i_security;
1722 const struct task_security_struct *tsec = current_security();
1724 if ((sbsec->flags & SE_SBINITIALIZED) &&
1725 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1726 *_new_isid = sbsec->mntpoint_sid;
1727 } else if ((sbsec->flags & SBLABEL_MNT) &&
1729 *_new_isid = tsec->create_sid;
1731 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1738 /* Check whether a task can create a file. */
1739 static int may_create(struct inode *dir,
1740 struct dentry *dentry,
1743 const struct task_security_struct *tsec = current_security();
1744 struct inode_security_struct *dsec;
1745 struct superblock_security_struct *sbsec;
1747 struct common_audit_data ad;
1750 dsec = dir->i_security;
1751 sbsec = dir->i_sb->s_security;
1755 ad.type = LSM_AUDIT_DATA_DENTRY;
1756 ad.u.dentry = dentry;
1758 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1759 DIR__ADD_NAME | DIR__SEARCH,
1764 rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1769 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1773 return avc_has_perm(newsid, sbsec->sid,
1774 SECCLASS_FILESYSTEM,
1775 FILESYSTEM__ASSOCIATE, &ad);
1778 /* Check whether a task can create a key. */
1779 static int may_create_key(u32 ksid,
1780 struct task_struct *ctx)
1782 u32 sid = task_sid(ctx);
1784 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1788 #define MAY_UNLINK 1
1791 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1792 static int may_link(struct inode *dir,
1793 struct dentry *dentry,
1797 struct inode_security_struct *dsec, *isec;
1798 struct common_audit_data ad;
1799 u32 sid = current_sid();
1803 dsec = dir->i_security;
1804 isec = d_backing_inode(dentry)->i_security;
1806 ad.type = LSM_AUDIT_DATA_DENTRY;
1807 ad.u.dentry = dentry;
1810 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1811 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1826 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1831 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1835 static inline int may_rename(struct inode *old_dir,
1836 struct dentry *old_dentry,
1837 struct inode *new_dir,
1838 struct dentry *new_dentry)
1840 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1841 struct common_audit_data ad;
1842 u32 sid = current_sid();
1844 int old_is_dir, new_is_dir;
1847 old_dsec = old_dir->i_security;
1848 old_isec = d_backing_inode(old_dentry)->i_security;
1849 old_is_dir = d_is_dir(old_dentry);
1850 new_dsec = new_dir->i_security;
1852 ad.type = LSM_AUDIT_DATA_DENTRY;
1854 ad.u.dentry = old_dentry;
1855 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1856 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1859 rc = avc_has_perm(sid, old_isec->sid,
1860 old_isec->sclass, FILE__RENAME, &ad);
1863 if (old_is_dir && new_dir != old_dir) {
1864 rc = avc_has_perm(sid, old_isec->sid,
1865 old_isec->sclass, DIR__REPARENT, &ad);
1870 ad.u.dentry = new_dentry;
1871 av = DIR__ADD_NAME | DIR__SEARCH;
1872 if (d_is_positive(new_dentry))
1873 av |= DIR__REMOVE_NAME;
1874 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1877 if (d_is_positive(new_dentry)) {
1878 new_isec = d_backing_inode(new_dentry)->i_security;
1879 new_is_dir = d_is_dir(new_dentry);
1880 rc = avc_has_perm(sid, new_isec->sid,
1882 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1890 /* Check whether a task can perform a filesystem operation. */
1891 static int superblock_has_perm(const struct cred *cred,
1892 struct super_block *sb,
1894 struct common_audit_data *ad)
1896 struct superblock_security_struct *sbsec;
1897 u32 sid = cred_sid(cred);
1899 sbsec = sb->s_security;
1900 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1903 /* Convert a Linux mode and permission mask to an access vector. */
1904 static inline u32 file_mask_to_av(int mode, int mask)
1908 if (!S_ISDIR(mode)) {
1909 if (mask & MAY_EXEC)
1910 av |= FILE__EXECUTE;
1911 if (mask & MAY_READ)
1914 if (mask & MAY_APPEND)
1916 else if (mask & MAY_WRITE)
1920 if (mask & MAY_EXEC)
1922 if (mask & MAY_WRITE)
1924 if (mask & MAY_READ)
1931 /* Convert a Linux file to an access vector. */
1932 static inline u32 file_to_av(struct file *file)
1936 if (file->f_mode & FMODE_READ)
1938 if (file->f_mode & FMODE_WRITE) {
1939 if (file->f_flags & O_APPEND)
1946 * Special file opened with flags 3 for ioctl-only use.
1955 * Convert a file to an access vector and include the correct open
1958 static inline u32 open_file_to_av(struct file *file)
1960 u32 av = file_to_av(file);
1962 if (selinux_policycap_openperm)
1968 /* Hook functions begin here. */
1970 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1972 u32 mysid = current_sid();
1973 u32 mgrsid = task_sid(mgr);
1975 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1976 BINDER__SET_CONTEXT_MGR, NULL);
1979 static int selinux_binder_transaction(struct task_struct *from,
1980 struct task_struct *to)
1982 u32 mysid = current_sid();
1983 u32 fromsid = task_sid(from);
1984 u32 tosid = task_sid(to);
1987 if (mysid != fromsid) {
1988 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1989 BINDER__IMPERSONATE, NULL);
1994 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1998 static int selinux_binder_transfer_binder(struct task_struct *from,
1999 struct task_struct *to)
2001 u32 fromsid = task_sid(from);
2002 u32 tosid = task_sid(to);
2004 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2008 static int selinux_binder_transfer_file(struct task_struct *from,
2009 struct task_struct *to,
2012 u32 sid = task_sid(to);
2013 struct file_security_struct *fsec = file->f_security;
2014 struct inode *inode = d_backing_inode(file->f_path.dentry);
2015 struct inode_security_struct *isec = inode->i_security;
2016 struct common_audit_data ad;
2019 ad.type = LSM_AUDIT_DATA_PATH;
2020 ad.u.path = file->f_path;
2022 if (sid != fsec->sid) {
2023 rc = avc_has_perm(sid, fsec->sid,
2031 if (unlikely(IS_PRIVATE(inode)))
2034 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2038 static int selinux_ptrace_access_check(struct task_struct *child,
2041 if (mode & PTRACE_MODE_READ) {
2042 u32 sid = current_sid();
2043 u32 csid = task_sid(child);
2044 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2047 return current_has_perm(child, PROCESS__PTRACE);
2050 static int selinux_ptrace_traceme(struct task_struct *parent)
2052 return task_has_perm(parent, current, PROCESS__PTRACE);
2055 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2056 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2058 return current_has_perm(target, PROCESS__GETCAP);
2061 static int selinux_capset(struct cred *new, const struct cred *old,
2062 const kernel_cap_t *effective,
2063 const kernel_cap_t *inheritable,
2064 const kernel_cap_t *permitted)
2066 return cred_has_perm(old, new, PROCESS__SETCAP);
2070 * (This comment used to live with the selinux_task_setuid hook,
2071 * which was removed).
2073 * Since setuid only affects the current process, and since the SELinux
2074 * controls are not based on the Linux identity attributes, SELinux does not
2075 * need to control this operation. However, SELinux does control the use of
2076 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2079 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2082 return cred_has_capability(cred, cap, audit);
2085 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2087 const struct cred *cred = current_cred();
2099 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2104 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2107 rc = 0; /* let the kernel handle invalid cmds */
2113 static int selinux_quota_on(struct dentry *dentry)
2115 const struct cred *cred = current_cred();
2117 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2120 static int selinux_syslog(int type)
2125 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2126 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2127 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2129 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2130 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2131 /* Set level of messages printed to console */
2132 case SYSLOG_ACTION_CONSOLE_LEVEL:
2133 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2135 case SYSLOG_ACTION_CLOSE: /* Close log */
2136 case SYSLOG_ACTION_OPEN: /* Open log */
2137 case SYSLOG_ACTION_READ: /* Read from log */
2138 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2139 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2141 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2148 * Check that a process has enough memory to allocate a new virtual
2149 * mapping. 0 means there is enough memory for the allocation to
2150 * succeed and -ENOMEM implies there is not.
2152 * Do not audit the selinux permission check, as this is applied to all
2153 * processes that allocate mappings.
2155 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2157 int rc, cap_sys_admin = 0;
2159 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2160 SECURITY_CAP_NOAUDIT);
2164 return cap_sys_admin;
2167 /* binprm security operations */
2169 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2170 const struct task_security_struct *old_tsec,
2171 const struct task_security_struct *new_tsec)
2173 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2174 int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2177 if (!nnp && !nosuid)
2178 return 0; /* neither NNP nor nosuid */
2180 if (new_tsec->sid == old_tsec->sid)
2181 return 0; /* No change in credentials */
2184 * The only transitions we permit under NNP or nosuid
2185 * are transitions to bounded SIDs, i.e. SIDs that are
2186 * guaranteed to only be allowed a subset of the permissions
2187 * of the current SID.
2189 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2192 * On failure, preserve the errno values for NNP vs nosuid.
2193 * NNP: Operation not permitted for caller.
2194 * nosuid: Permission denied to file.
2204 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2206 const struct task_security_struct *old_tsec;
2207 struct task_security_struct *new_tsec;
2208 struct inode_security_struct *isec;
2209 struct common_audit_data ad;
2210 struct inode *inode = file_inode(bprm->file);
2213 /* SELinux context only depends on initial program or script and not
2214 * the script interpreter */
2215 if (bprm->cred_prepared)
2218 old_tsec = current_security();
2219 new_tsec = bprm->cred->security;
2220 isec = inode->i_security;
2222 /* Default to the current task SID. */
2223 new_tsec->sid = old_tsec->sid;
2224 new_tsec->osid = old_tsec->sid;
2226 /* Reset fs, key, and sock SIDs on execve. */
2227 new_tsec->create_sid = 0;
2228 new_tsec->keycreate_sid = 0;
2229 new_tsec->sockcreate_sid = 0;
2231 if (old_tsec->exec_sid) {
2232 new_tsec->sid = old_tsec->exec_sid;
2233 /* Reset exec SID on execve. */
2234 new_tsec->exec_sid = 0;
2236 /* Fail on NNP or nosuid if not an allowed transition. */
2237 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2241 /* Check for a default transition on this program. */
2242 rc = security_transition_sid(old_tsec->sid, isec->sid,
2243 SECCLASS_PROCESS, NULL,
2249 * Fallback to old SID on NNP or nosuid if not an allowed
2252 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2254 new_tsec->sid = old_tsec->sid;
2257 ad.type = LSM_AUDIT_DATA_PATH;
2258 ad.u.path = bprm->file->f_path;
2260 if (new_tsec->sid == old_tsec->sid) {
2261 rc = avc_has_perm(old_tsec->sid, isec->sid,
2262 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2266 /* Check permissions for the transition. */
2267 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2272 rc = avc_has_perm(new_tsec->sid, isec->sid,
2273 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2277 /* Check for shared state */
2278 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2279 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2280 SECCLASS_PROCESS, PROCESS__SHARE,
2286 /* Make sure that anyone attempting to ptrace over a task that
2287 * changes its SID has the appropriate permit */
2289 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2290 struct task_struct *tracer;
2291 struct task_security_struct *sec;
2295 tracer = ptrace_parent(current);
2296 if (likely(tracer != NULL)) {
2297 sec = __task_cred(tracer)->security;
2303 rc = avc_has_perm(ptsid, new_tsec->sid,
2305 PROCESS__PTRACE, NULL);
2311 /* Clear any possibly unsafe personality bits on exec: */
2312 bprm->per_clear |= PER_CLEAR_ON_SETID;
2318 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2320 const struct task_security_struct *tsec = current_security();
2328 /* Enable secure mode for SIDs transitions unless
2329 the noatsecure permission is granted between
2330 the two SIDs, i.e. ahp returns 0. */
2331 atsecure = avc_has_perm(osid, sid,
2333 PROCESS__NOATSECURE, NULL);
2339 static int match_file(const void *p, struct file *file, unsigned fd)
2341 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2344 /* Derived from fs/exec.c:flush_old_files. */
2345 static inline void flush_unauthorized_files(const struct cred *cred,
2346 struct files_struct *files)
2348 struct file *file, *devnull = NULL;
2349 struct tty_struct *tty;
2353 tty = get_current_tty();
2355 spin_lock(&tty_files_lock);
2356 if (!list_empty(&tty->tty_files)) {
2357 struct tty_file_private *file_priv;
2359 /* Revalidate access to controlling tty.
2360 Use file_path_has_perm on the tty path directly
2361 rather than using file_has_perm, as this particular
2362 open file may belong to another process and we are
2363 only interested in the inode-based check here. */
2364 file_priv = list_first_entry(&tty->tty_files,
2365 struct tty_file_private, list);
2366 file = file_priv->file;
2367 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2370 spin_unlock(&tty_files_lock);
2373 /* Reset controlling tty. */
2377 /* Revalidate access to inherited open files. */
2378 n = iterate_fd(files, 0, match_file, cred);
2379 if (!n) /* none found? */
2382 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2383 if (IS_ERR(devnull))
2385 /* replace all the matching ones with this */
2387 replace_fd(n - 1, devnull, 0);
2388 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2394 * Prepare a process for imminent new credential changes due to exec
2396 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2398 struct task_security_struct *new_tsec;
2399 struct rlimit *rlim, *initrlim;
2402 new_tsec = bprm->cred->security;
2403 if (new_tsec->sid == new_tsec->osid)
2406 /* Close files for which the new task SID is not authorized. */
2407 flush_unauthorized_files(bprm->cred, current->files);
2409 /* Always clear parent death signal on SID transitions. */
2410 current->pdeath_signal = 0;
2412 /* Check whether the new SID can inherit resource limits from the old
2413 * SID. If not, reset all soft limits to the lower of the current
2414 * task's hard limit and the init task's soft limit.
2416 * Note that the setting of hard limits (even to lower them) can be
2417 * controlled by the setrlimit check. The inclusion of the init task's
2418 * soft limit into the computation is to avoid resetting soft limits
2419 * higher than the default soft limit for cases where the default is
2420 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2422 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2423 PROCESS__RLIMITINH, NULL);
2425 /* protect against do_prlimit() */
2427 for (i = 0; i < RLIM_NLIMITS; i++) {
2428 rlim = current->signal->rlim + i;
2429 initrlim = init_task.signal->rlim + i;
2430 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2432 task_unlock(current);
2433 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2438 * Clean up the process immediately after the installation of new credentials
2441 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2443 const struct task_security_struct *tsec = current_security();
2444 struct itimerval itimer;
2454 /* Check whether the new SID can inherit signal state from the old SID.
2455 * If not, clear itimers to avoid subsequent signal generation and
2456 * flush and unblock signals.
2458 * This must occur _after_ the task SID has been updated so that any
2459 * kill done after the flush will be checked against the new SID.
2461 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2463 memset(&itimer, 0, sizeof itimer);
2464 for (i = 0; i < 3; i++)
2465 do_setitimer(i, &itimer, NULL);
2466 spin_lock_irq(¤t->sighand->siglock);
2467 if (!fatal_signal_pending(current)) {
2468 flush_sigqueue(¤t->pending);
2469 flush_sigqueue(¤t->signal->shared_pending);
2470 flush_signal_handlers(current, 1);
2471 sigemptyset(¤t->blocked);
2472 recalc_sigpending();
2474 spin_unlock_irq(¤t->sighand->siglock);
2477 /* Wake up the parent if it is waiting so that it can recheck
2478 * wait permission to the new task SID. */
2479 read_lock(&tasklist_lock);
2480 __wake_up_parent(current, current->real_parent);
2481 read_unlock(&tasklist_lock);
2484 /* superblock security operations */
2486 static int selinux_sb_alloc_security(struct super_block *sb)
2488 return superblock_alloc_security(sb);
2491 static void selinux_sb_free_security(struct super_block *sb)
2493 superblock_free_security(sb);
2496 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2501 return !memcmp(prefix, option, plen);
2504 static inline int selinux_option(char *option, int len)
2506 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2507 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2508 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2509 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2510 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2513 static inline void take_option(char **to, char *from, int *first, int len)
2520 memcpy(*to, from, len);
2524 static inline void take_selinux_option(char **to, char *from, int *first,
2527 int current_size = 0;
2535 while (current_size < len) {
2545 static int selinux_sb_copy_data(char *orig, char *copy)
2547 int fnosec, fsec, rc = 0;
2548 char *in_save, *in_curr, *in_end;
2549 char *sec_curr, *nosec_save, *nosec;
2555 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2563 in_save = in_end = orig;
2567 open_quote = !open_quote;
2568 if ((*in_end == ',' && open_quote == 0) ||
2570 int len = in_end - in_curr;
2572 if (selinux_option(in_curr, len))
2573 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2575 take_option(&nosec, in_curr, &fnosec, len);
2577 in_curr = in_end + 1;
2579 } while (*in_end++);
2581 strcpy(in_save, nosec_save);
2582 free_page((unsigned long)nosec_save);
2587 static int selinux_sb_remount(struct super_block *sb, void *data)
2590 struct security_mnt_opts opts;
2591 char *secdata, **mount_options;
2592 struct superblock_security_struct *sbsec = sb->s_security;
2594 if (!(sbsec->flags & SE_SBINITIALIZED))
2600 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2603 security_init_mnt_opts(&opts);
2604 secdata = alloc_secdata();
2607 rc = selinux_sb_copy_data(data, secdata);
2609 goto out_free_secdata;
2611 rc = selinux_parse_opts_str(secdata, &opts);
2613 goto out_free_secdata;
2615 mount_options = opts.mnt_opts;
2616 flags = opts.mnt_opts_flags;
2618 for (i = 0; i < opts.num_mnt_opts; i++) {
2622 if (flags[i] == SBLABEL_MNT)
2624 len = strlen(mount_options[i]);
2625 rc = security_context_to_sid(mount_options[i], len, &sid,
2628 printk(KERN_WARNING "SELinux: security_context_to_sid"
2629 "(%s) failed for (dev %s, type %s) errno=%d\n",
2630 mount_options[i], sb->s_id, sb->s_type->name, rc);
2636 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2637 goto out_bad_option;
2640 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2641 goto out_bad_option;
2643 case ROOTCONTEXT_MNT: {
2644 struct inode_security_struct *root_isec;
2645 root_isec = d_backing_inode(sb->s_root)->i_security;
2647 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2648 goto out_bad_option;
2651 case DEFCONTEXT_MNT:
2652 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2653 goto out_bad_option;
2662 security_free_mnt_opts(&opts);
2664 free_secdata(secdata);
2667 printk(KERN_WARNING "SELinux: unable to change security options "
2668 "during remount (dev %s, type=%s)\n", sb->s_id,
2673 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2675 const struct cred *cred = current_cred();
2676 struct common_audit_data ad;
2679 rc = superblock_doinit(sb, data);
2683 /* Allow all mounts performed by the kernel */
2684 if (flags & MS_KERNMOUNT)
2687 ad.type = LSM_AUDIT_DATA_DENTRY;
2688 ad.u.dentry = sb->s_root;
2689 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2692 static int selinux_sb_statfs(struct dentry *dentry)
2694 const struct cred *cred = current_cred();
2695 struct common_audit_data ad;
2697 ad.type = LSM_AUDIT_DATA_DENTRY;
2698 ad.u.dentry = dentry->d_sb->s_root;
2699 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2702 static int selinux_mount(const char *dev_name,
2705 unsigned long flags,
2708 const struct cred *cred = current_cred();
2710 if (flags & MS_REMOUNT)
2711 return superblock_has_perm(cred, path->dentry->d_sb,
2712 FILESYSTEM__REMOUNT, NULL);
2714 return path_has_perm(cred, path, FILE__MOUNTON);
2717 static int selinux_umount(struct vfsmount *mnt, int flags)
2719 const struct cred *cred = current_cred();
2721 return superblock_has_perm(cred, mnt->mnt_sb,
2722 FILESYSTEM__UNMOUNT, NULL);
2725 /* inode security operations */
2727 static int selinux_inode_alloc_security(struct inode *inode)
2729 return inode_alloc_security(inode);
2732 static void selinux_inode_free_security(struct inode *inode)
2734 inode_free_security(inode);
2737 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2738 struct qstr *name, void **ctx,
2744 rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2745 inode_mode_to_security_class(mode),
2750 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2753 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2754 const struct qstr *qstr,
2756 void **value, size_t *len)
2758 const struct task_security_struct *tsec = current_security();
2759 struct inode_security_struct *dsec;
2760 struct superblock_security_struct *sbsec;
2761 u32 sid, newsid, clen;
2765 dsec = dir->i_security;
2766 sbsec = dir->i_sb->s_security;
2769 newsid = tsec->create_sid;
2771 rc = selinux_determine_inode_label(
2773 inode_mode_to_security_class(inode->i_mode),
2778 /* Possibly defer initialization to selinux_complete_init. */
2779 if (sbsec->flags & SE_SBINITIALIZED) {
2780 struct inode_security_struct *isec = inode->i_security;
2781 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2783 isec->initialized = 1;
2786 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2790 *name = XATTR_SELINUX_SUFFIX;
2793 rc = security_sid_to_context_force(newsid, &context, &clen);
2803 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2805 return may_create(dir, dentry, SECCLASS_FILE);
2808 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2810 return may_link(dir, old_dentry, MAY_LINK);
2813 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2815 return may_link(dir, dentry, MAY_UNLINK);
2818 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2820 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2823 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2825 return may_create(dir, dentry, SECCLASS_DIR);
2828 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2830 return may_link(dir, dentry, MAY_RMDIR);
2833 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2835 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2838 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2839 struct inode *new_inode, struct dentry *new_dentry)
2841 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2844 static int selinux_inode_readlink(struct dentry *dentry)
2846 const struct cred *cred = current_cred();
2848 return dentry_has_perm(cred, dentry, FILE__READ);
2851 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2854 const struct cred *cred = current_cred();
2855 struct common_audit_data ad;
2856 struct inode_security_struct *isec;
2859 validate_creds(cred);
2861 ad.type = LSM_AUDIT_DATA_DENTRY;
2862 ad.u.dentry = dentry;
2863 sid = cred_sid(cred);
2864 isec = inode->i_security;
2866 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2867 rcu ? MAY_NOT_BLOCK : 0);
2870 static noinline int audit_inode_permission(struct inode *inode,
2871 u32 perms, u32 audited, u32 denied,
2875 struct common_audit_data ad;
2876 struct inode_security_struct *isec = inode->i_security;
2879 ad.type = LSM_AUDIT_DATA_INODE;
2882 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2883 audited, denied, result, &ad, flags);
2889 static int selinux_inode_permission(struct inode *inode, int mask)
2891 const struct cred *cred = current_cred();
2894 unsigned flags = mask & MAY_NOT_BLOCK;
2895 struct inode_security_struct *isec;
2897 struct av_decision avd;
2899 u32 audited, denied;
2901 from_access = mask & MAY_ACCESS;
2902 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2904 /* No permission to check. Existence test. */
2908 validate_creds(cred);
2910 if (unlikely(IS_PRIVATE(inode)))
2913 perms = file_mask_to_av(inode->i_mode, mask);
2915 sid = cred_sid(cred);
2916 isec = inode->i_security;
2918 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2919 audited = avc_audit_required(perms, &avd, rc,
2920 from_access ? FILE__AUDIT_ACCESS : 0,
2922 if (likely(!audited))
2925 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2931 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2933 const struct cred *cred = current_cred();
2934 unsigned int ia_valid = iattr->ia_valid;
2935 __u32 av = FILE__WRITE;
2937 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2938 if (ia_valid & ATTR_FORCE) {
2939 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2945 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2946 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2947 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2949 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2952 return dentry_has_perm(cred, dentry, av);
2955 static int selinux_inode_getattr(const struct path *path)
2957 return path_has_perm(current_cred(), path, FILE__GETATTR);
2960 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2962 const struct cred *cred = current_cred();
2964 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2965 sizeof XATTR_SECURITY_PREFIX - 1)) {
2966 if (!strcmp(name, XATTR_NAME_CAPS)) {
2967 if (!capable(CAP_SETFCAP))
2969 } else if (!capable(CAP_SYS_ADMIN)) {
2970 /* A different attribute in the security namespace.
2971 Restrict to administrator. */
2976 /* Not an attribute we recognize, so just check the
2977 ordinary setattr permission. */
2978 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2981 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2982 const void *value, size_t size, int flags)
2984 struct inode *inode = d_backing_inode(dentry);
2985 struct inode_security_struct *isec = inode->i_security;
2986 struct superblock_security_struct *sbsec;
2987 struct common_audit_data ad;
2988 u32 newsid, sid = current_sid();
2991 if (strcmp(name, XATTR_NAME_SELINUX))
2992 return selinux_inode_setotherxattr(dentry, name);
2994 sbsec = inode->i_sb->s_security;
2995 if (!(sbsec->flags & SBLABEL_MNT))
2998 if (!inode_owner_or_capable(inode))
3001 ad.type = LSM_AUDIT_DATA_DENTRY;
3002 ad.u.dentry = dentry;
3004 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3005 FILE__RELABELFROM, &ad);
3009 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3010 if (rc == -EINVAL) {
3011 if (!capable(CAP_MAC_ADMIN)) {
3012 struct audit_buffer *ab;
3016 /* We strip a nul only if it is at the end, otherwise the
3017 * context contains a nul and we should audit that */
3020 if (str[size - 1] == '\0')
3021 audit_size = size - 1;
3028 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3029 audit_log_format(ab, "op=setxattr invalid_context=");
3030 audit_log_n_untrustedstring(ab, value, audit_size);
3035 rc = security_context_to_sid_force(value, size, &newsid);
3040 rc = avc_has_perm(sid, newsid, isec->sclass,
3041 FILE__RELABELTO, &ad);
3045 rc = security_validate_transition(isec->sid, newsid, sid,
3050 return avc_has_perm(newsid,
3052 SECCLASS_FILESYSTEM,
3053 FILESYSTEM__ASSOCIATE,
3057 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3058 const void *value, size_t size,
3061 struct inode *inode = d_backing_inode(dentry);
3062 struct inode_security_struct *isec = inode->i_security;
3066 if (strcmp(name, XATTR_NAME_SELINUX)) {
3067 /* Not an attribute we recognize, so nothing to do. */
3071 rc = security_context_to_sid_force(value, size, &newsid);
3073 printk(KERN_ERR "SELinux: unable to map context to SID"
3074 "for (%s, %lu), rc=%d\n",
3075 inode->i_sb->s_id, inode->i_ino, -rc);
3079 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3081 isec->initialized = 1;
3086 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3088 const struct cred *cred = current_cred();
3090 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3093 static int selinux_inode_listxattr(struct dentry *dentry)
3095 const struct cred *cred = current_cred();
3097 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3100 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3102 if (strcmp(name, XATTR_NAME_SELINUX))
3103 return selinux_inode_setotherxattr(dentry, name);
3105 /* No one is allowed to remove a SELinux security label.
3106 You can change the label, but all data must be labeled. */
3111 * Copy the inode security context value to the user.
3113 * Permission check is handled by selinux_inode_getxattr hook.
3115 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3119 char *context = NULL;
3120 struct inode_security_struct *isec = inode->i_security;
3122 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3126 * If the caller has CAP_MAC_ADMIN, then get the raw context
3127 * value even if it is not defined by current policy; otherwise,
3128 * use the in-core value under current policy.
3129 * Use the non-auditing forms of the permission checks since
3130 * getxattr may be called by unprivileged processes commonly
3131 * and lack of permission just means that we fall back to the
3132 * in-core context value, not a denial.
3134 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3135 SECURITY_CAP_NOAUDIT);
3137 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3138 SECURITY_CAP_NOAUDIT);
3140 error = security_sid_to_context_force(isec->sid, &context,
3143 error = security_sid_to_context(isec->sid, &context, &size);
3156 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3157 const void *value, size_t size, int flags)
3159 struct inode_security_struct *isec = inode->i_security;
3163 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3166 if (!value || !size)
3169 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3173 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3175 isec->initialized = 1;
3179 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3181 const int len = sizeof(XATTR_NAME_SELINUX);
3182 if (buffer && len <= buffer_size)
3183 memcpy(buffer, XATTR_NAME_SELINUX, len);
3187 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3189 struct inode_security_struct *isec = inode->i_security;
3193 /* file security operations */
3195 static int selinux_revalidate_file_permission(struct file *file, int mask)
3197 const struct cred *cred = current_cred();
3198 struct inode *inode = file_inode(file);
3200 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3201 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3204 return file_has_perm(cred, file,
3205 file_mask_to_av(inode->i_mode, mask));
3208 static int selinux_file_permission(struct file *file, int mask)
3210 struct inode *inode = file_inode(file);
3211 struct file_security_struct *fsec = file->f_security;
3212 struct inode_security_struct *isec = inode->i_security;
3213 u32 sid = current_sid();
3216 /* No permission to check. Existence test. */
3219 if (sid == fsec->sid && fsec->isid == isec->sid &&
3220 fsec->pseqno == avc_policy_seqno())
3221 /* No change since file_open check. */
3224 return selinux_revalidate_file_permission(file, mask);
3227 static int selinux_file_alloc_security(struct file *file)
3229 return file_alloc_security(file);
3232 static void selinux_file_free_security(struct file *file)
3234 file_free_security(file);
3238 * Check whether a task has the ioctl permission and cmd
3239 * operation to an inode.
3241 int ioctl_has_perm(const struct cred *cred, struct file *file,
3242 u32 requested, u16 cmd)
3244 struct common_audit_data ad;
3245 struct file_security_struct *fsec = file->f_security;
3246 struct inode *inode = file_inode(file);
3247 struct inode_security_struct *isec = inode->i_security;
3248 struct lsm_ioctlop_audit ioctl;
3249 u32 ssid = cred_sid(cred);
3251 u8 driver = cmd >> 8;
3252 u8 xperm = cmd & 0xff;
3254 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3257 ad.u.op->path = file->f_path;
3259 if (ssid != fsec->sid) {
3260 rc = avc_has_perm(ssid, fsec->sid,
3268 if (unlikely(IS_PRIVATE(inode)))
3271 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3272 requested, driver, xperm, &ad);
3277 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3280 const struct cred *cred = current_cred();
3290 case FS_IOC_GETFLAGS:
3292 case FS_IOC_GETVERSION:
3293 error = file_has_perm(cred, file, FILE__GETATTR);
3296 case FS_IOC_SETFLAGS:
3298 case FS_IOC_SETVERSION:
3299 error = file_has_perm(cred, file, FILE__SETATTR);
3302 /* sys_ioctl() checks */
3306 error = file_has_perm(cred, file, 0);
3311 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3312 SECURITY_CAP_AUDIT);
3315 /* default case assumes that the command will go
3316 * to the file's ioctl() function.
3319 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3324 static int default_noexec;
3326 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3328 const struct cred *cred = current_cred();
3331 if (default_noexec &&
3332 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3333 (!shared && (prot & PROT_WRITE)))) {
3335 * We are making executable an anonymous mapping or a
3336 * private file mapping that will also be writable.
3337 * This has an additional check.
3339 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3345 /* read access is always possible with a mapping */
3346 u32 av = FILE__READ;
3348 /* write access only matters if the mapping is shared */
3349 if (shared && (prot & PROT_WRITE))
3352 if (prot & PROT_EXEC)
3353 av |= FILE__EXECUTE;
3355 return file_has_perm(cred, file, av);
3362 static int selinux_mmap_addr(unsigned long addr)
3366 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3367 u32 sid = current_sid();
3368 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3369 MEMPROTECT__MMAP_ZERO, NULL);
3375 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3376 unsigned long prot, unsigned long flags)
3378 if (selinux_checkreqprot)
3381 return file_map_prot_check(file, prot,
3382 (flags & MAP_TYPE) == MAP_SHARED);
3385 static int selinux_file_mprotect(struct vm_area_struct *vma,
3386 unsigned long reqprot,
3389 const struct cred *cred = current_cred();
3391 if (selinux_checkreqprot)
3394 if (default_noexec &&
3395 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3397 if (vma->vm_start >= vma->vm_mm->start_brk &&
3398 vma->vm_end <= vma->vm_mm->brk) {
3399 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3400 } else if (!vma->vm_file &&
3401 vma->vm_start <= vma->vm_mm->start_stack &&
3402 vma->vm_end >= vma->vm_mm->start_stack) {
3403 rc = current_has_perm(current, PROCESS__EXECSTACK);
3404 } else if (vma->vm_file && vma->anon_vma) {
3406 * We are making executable a file mapping that has
3407 * had some COW done. Since pages might have been
3408 * written, check ability to execute the possibly
3409 * modified content. This typically should only
3410 * occur for text relocations.
3412 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3418 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3421 static int selinux_file_lock(struct file *file, unsigned int cmd)
3423 const struct cred *cred = current_cred();
3425 return file_has_perm(cred, file, FILE__LOCK);
3428 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3431 const struct cred *cred = current_cred();
3436 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3437 err = file_has_perm(cred, file, FILE__WRITE);
3446 case F_GETOWNER_UIDS:
3447 /* Just check FD__USE permission */
3448 err = file_has_perm(cred, file, 0);
3456 #if BITS_PER_LONG == 32
3461 err = file_has_perm(cred, file, FILE__LOCK);
3468 static void selinux_file_set_fowner(struct file *file)
3470 struct file_security_struct *fsec;
3472 fsec = file->f_security;
3473 fsec->fown_sid = current_sid();
3476 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3477 struct fown_struct *fown, int signum)
3480 u32 sid = task_sid(tsk);
3482 struct file_security_struct *fsec;
3484 /* struct fown_struct is never outside the context of a struct file */
3485 file = container_of(fown, struct file, f_owner);
3487 fsec = file->f_security;
3490 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3492 perm = signal_to_av(signum);
3494 return avc_has_perm(fsec->fown_sid, sid,
3495 SECCLASS_PROCESS, perm, NULL);
3498 static int selinux_file_receive(struct file *file)
3500 const struct cred *cred = current_cred();
3502 return file_has_perm(cred, file, file_to_av(file));
3505 static int selinux_file_open(struct file *file, const struct cred *cred)
3507 struct file_security_struct *fsec;
3508 struct inode_security_struct *isec;
3510 fsec = file->f_security;
3511 isec = file_inode(file)->i_security;
3513 * Save inode label and policy sequence number
3514 * at open-time so that selinux_file_permission
3515 * can determine whether revalidation is necessary.
3516 * Task label is already saved in the file security
3517 * struct as its SID.
3519 fsec->isid = isec->sid;
3520 fsec->pseqno = avc_policy_seqno();
3522 * Since the inode label or policy seqno may have changed
3523 * between the selinux_inode_permission check and the saving
3524 * of state above, recheck that access is still permitted.
3525 * Otherwise, access might never be revalidated against the
3526 * new inode label or new policy.
3527 * This check is not redundant - do not remove.
3529 return file_path_has_perm(cred, file, open_file_to_av(file));
3532 /* task security operations */
3534 static int selinux_task_create(unsigned long clone_flags)
3536 return current_has_perm(current, PROCESS__FORK);
3540 * allocate the SELinux part of blank credentials
3542 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3544 struct task_security_struct *tsec;
3546 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3550 cred->security = tsec;
3555 * detach and free the LSM part of a set of credentials
3557 static void selinux_cred_free(struct cred *cred)
3559 struct task_security_struct *tsec = cred->security;
3562 * cred->security == NULL if security_cred_alloc_blank() or
3563 * security_prepare_creds() returned an error.
3565 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3566 cred->security = (void *) 0x7UL;
3571 * prepare a new set of credentials for modification
3573 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3576 const struct task_security_struct *old_tsec;
3577 struct task_security_struct *tsec;
3579 old_tsec = old->security;
3581 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3585 new->security = tsec;
3590 * transfer the SELinux data to a blank set of creds
3592 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3594 const struct task_security_struct *old_tsec = old->security;
3595 struct task_security_struct *tsec = new->security;
3601 * set the security data for a kernel service
3602 * - all the creation contexts are set to unlabelled
3604 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3606 struct task_security_struct *tsec = new->security;
3607 u32 sid = current_sid();
3610 ret = avc_has_perm(sid, secid,
3611 SECCLASS_KERNEL_SERVICE,
3612 KERNEL_SERVICE__USE_AS_OVERRIDE,
3616 tsec->create_sid = 0;
3617 tsec->keycreate_sid = 0;
3618 tsec->sockcreate_sid = 0;
3624 * set the file creation context in a security record to the same as the
3625 * objective context of the specified inode
3627 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3629 struct inode_security_struct *isec = inode->i_security;
3630 struct task_security_struct *tsec = new->security;
3631 u32 sid = current_sid();
3634 ret = avc_has_perm(sid, isec->sid,
3635 SECCLASS_KERNEL_SERVICE,
3636 KERNEL_SERVICE__CREATE_FILES_AS,
3640 tsec->create_sid = isec->sid;
3644 static int selinux_kernel_module_request(char *kmod_name)
3647 struct common_audit_data ad;
3649 sid = task_sid(current);
3651 ad.type = LSM_AUDIT_DATA_KMOD;
3652 ad.u.kmod_name = kmod_name;
3654 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3655 SYSTEM__MODULE_REQUEST, &ad);
3658 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3660 return current_has_perm(p, PROCESS__SETPGID);
3663 static int selinux_task_getpgid(struct task_struct *p)
3665 return current_has_perm(p, PROCESS__GETPGID);
3668 static int selinux_task_getsid(struct task_struct *p)
3670 return current_has_perm(p, PROCESS__GETSESSION);
3673 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3675 *secid = task_sid(p);
3678 static int selinux_task_setnice(struct task_struct *p, int nice)
3680 return current_has_perm(p, PROCESS__SETSCHED);
3683 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3685 return current_has_perm(p, PROCESS__SETSCHED);
3688 static int selinux_task_getioprio(struct task_struct *p)
3690 return current_has_perm(p, PROCESS__GETSCHED);
3693 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3694 struct rlimit *new_rlim)
3696 struct rlimit *old_rlim = p->signal->rlim + resource;
3698 /* Control the ability to change the hard limit (whether
3699 lowering or raising it), so that the hard limit can
3700 later be used as a safe reset point for the soft limit
3701 upon context transitions. See selinux_bprm_committing_creds. */
3702 if (old_rlim->rlim_max != new_rlim->rlim_max)
3703 return current_has_perm(p, PROCESS__SETRLIMIT);
3708 static int selinux_task_setscheduler(struct task_struct *p)
3710 return current_has_perm(p, PROCESS__SETSCHED);
3713 static int selinux_task_getscheduler(struct task_struct *p)
3715 return current_has_perm(p, PROCESS__GETSCHED);
3718 static int selinux_task_movememory(struct task_struct *p)
3720 return current_has_perm(p, PROCESS__SETSCHED);
3723 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3730 perm = PROCESS__SIGNULL; /* null signal; existence test */
3732 perm = signal_to_av(sig);
3734 rc = avc_has_perm(secid, task_sid(p),
3735 SECCLASS_PROCESS, perm, NULL);
3737 rc = current_has_perm(p, perm);
3741 static int selinux_task_wait(struct task_struct *p)
3743 return task_has_perm(p, current, PROCESS__SIGCHLD);
3746 static void selinux_task_to_inode(struct task_struct *p,
3747 struct inode *inode)
3749 struct inode_security_struct *isec = inode->i_security;
3750 u32 sid = task_sid(p);
3753 isec->initialized = 1;
3756 /* Returns error only if unable to parse addresses */
3757 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3758 struct common_audit_data *ad, u8 *proto)
3760 int offset, ihlen, ret = -EINVAL;
3761 struct iphdr _iph, *ih;
3763 offset = skb_network_offset(skb);
3764 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3768 ihlen = ih->ihl * 4;
3769 if (ihlen < sizeof(_iph))
3772 ad->u.net->v4info.saddr = ih->saddr;
3773 ad->u.net->v4info.daddr = ih->daddr;
3777 *proto = ih->protocol;
3779 switch (ih->protocol) {
3781 struct tcphdr _tcph, *th;
3783 if (ntohs(ih->frag_off) & IP_OFFSET)
3787 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3791 ad->u.net->sport = th->source;
3792 ad->u.net->dport = th->dest;
3797 struct udphdr _udph, *uh;
3799 if (ntohs(ih->frag_off) & IP_OFFSET)
3803 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3807 ad->u.net->sport = uh->source;
3808 ad->u.net->dport = uh->dest;
3812 case IPPROTO_DCCP: {
3813 struct dccp_hdr _dccph, *dh;
3815 if (ntohs(ih->frag_off) & IP_OFFSET)
3819 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3823 ad->u.net->sport = dh->dccph_sport;
3824 ad->u.net->dport = dh->dccph_dport;
3835 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3837 /* Returns error only if unable to parse addresses */
3838 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3839 struct common_audit_data *ad, u8 *proto)
3842 int ret = -EINVAL, offset;
3843 struct ipv6hdr _ipv6h, *ip6;
3846 offset = skb_network_offset(skb);
3847 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3851 ad->u.net->v6info.saddr = ip6->saddr;
3852 ad->u.net->v6info.daddr = ip6->daddr;
3855 nexthdr = ip6->nexthdr;
3856 offset += sizeof(_ipv6h);
3857 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3866 struct tcphdr _tcph, *th;
3868 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3872 ad->u.net->sport = th->source;
3873 ad->u.net->dport = th->dest;
3878 struct udphdr _udph, *uh;
3880 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3884 ad->u.net->sport = uh->source;
3885 ad->u.net->dport = uh->dest;
3889 case IPPROTO_DCCP: {
3890 struct dccp_hdr _dccph, *dh;
3892 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3896 ad->u.net->sport = dh->dccph_sport;
3897 ad->u.net->dport = dh->dccph_dport;
3901 /* includes fragments */
3911 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3912 char **_addrp, int src, u8 *proto)
3917 switch (ad->u.net->family) {
3919 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3922 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3923 &ad->u.net->v4info.daddr);
3926 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3928 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3931 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3932 &ad->u.net->v6info.daddr);
3942 "SELinux: failure in selinux_parse_skb(),"
3943 " unable to parse packet\n");
3953 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3955 * @family: protocol family
3956 * @sid: the packet's peer label SID
3959 * Check the various different forms of network peer labeling and determine
3960 * the peer label/SID for the packet; most of the magic actually occurs in
3961 * the security server function security_net_peersid_cmp(). The function
3962 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3963 * or -EACCES if @sid is invalid due to inconsistencies with the different
3967 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3974 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3977 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3981 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3982 if (unlikely(err)) {
3984 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3985 " unable to determine packet's peer label\n");
3993 * selinux_conn_sid - Determine the child socket label for a connection
3994 * @sk_sid: the parent socket's SID
3995 * @skb_sid: the packet's SID
3996 * @conn_sid: the resulting connection SID
3998 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3999 * combined with the MLS information from @skb_sid in order to create
4000 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4001 * of @sk_sid. Returns zero on success, negative values on failure.
4004 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4008 if (skb_sid != SECSID_NULL)
4009 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4016 /* socket security operations */
4018 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4019 u16 secclass, u32 *socksid)
4021 if (tsec->sockcreate_sid > SECSID_NULL) {
4022 *socksid = tsec->sockcreate_sid;
4026 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4030 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4032 struct sk_security_struct *sksec = sk->sk_security;
4033 struct common_audit_data ad;
4034 struct lsm_network_audit net = {0,};
4035 u32 tsid = task_sid(task);
4037 if (sksec->sid == SECINITSID_KERNEL)
4040 ad.type = LSM_AUDIT_DATA_NET;
4044 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4047 static int selinux_socket_create(int family, int type,
4048 int protocol, int kern)
4050 const struct task_security_struct *tsec = current_security();
4058 secclass = socket_type_to_security_class(family, type, protocol);
4059 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4063 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4066 static int selinux_socket_post_create(struct socket *sock, int family,
4067 int type, int protocol, int kern)
4069 const struct task_security_struct *tsec = current_security();
4070 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4071 struct sk_security_struct *sksec;
4074 isec->sclass = socket_type_to_security_class(family, type, protocol);
4077 isec->sid = SECINITSID_KERNEL;
4079 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4084 isec->initialized = 1;
4087 sksec = sock->sk->sk_security;
4088 sksec->sid = isec->sid;
4089 sksec->sclass = isec->sclass;
4090 err = selinux_netlbl_socket_post_create(sock->sk, family);
4096 /* Range of port numbers used to automatically bind.
4097 Need to determine whether we should perform a name_bind
4098 permission check between the socket and the port number. */
4100 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4102 struct sock *sk = sock->sk;
4106 err = sock_has_perm(current, sk, SOCKET__BIND);
4111 * If PF_INET or PF_INET6, check name_bind permission for the port.
4112 * Multiple address binding for SCTP is not supported yet: we just
4113 * check the first address now.
4115 family = sk->sk_family;
4116 if (family == PF_INET || family == PF_INET6) {
4118 struct sk_security_struct *sksec = sk->sk_security;
4119 struct common_audit_data ad;
4120 struct lsm_network_audit net = {0,};
4121 struct sockaddr_in *addr4 = NULL;
4122 struct sockaddr_in6 *addr6 = NULL;
4123 unsigned short snum;
4126 if (family == PF_INET) {
4127 addr4 = (struct sockaddr_in *)address;
4128 snum = ntohs(addr4->sin_port);
4129 addrp = (char *)&addr4->sin_addr.s_addr;
4131 addr6 = (struct sockaddr_in6 *)address;
4132 snum = ntohs(addr6->sin6_port);
4133 addrp = (char *)&addr6->sin6_addr.s6_addr;
4139 inet_get_local_port_range(sock_net(sk), &low, &high);
4141 if (snum < max(PROT_SOCK, low) || snum > high) {
4142 err = sel_netport_sid(sk->sk_protocol,
4146 ad.type = LSM_AUDIT_DATA_NET;
4148 ad.u.net->sport = htons(snum);
4149 ad.u.net->family = family;
4150 err = avc_has_perm(sksec->sid, sid,
4152 SOCKET__NAME_BIND, &ad);
4158 switch (sksec->sclass) {
4159 case SECCLASS_TCP_SOCKET:
4160 node_perm = TCP_SOCKET__NODE_BIND;
4163 case SECCLASS_UDP_SOCKET:
4164 node_perm = UDP_SOCKET__NODE_BIND;
4167 case SECCLASS_DCCP_SOCKET:
4168 node_perm = DCCP_SOCKET__NODE_BIND;
4172 node_perm = RAWIP_SOCKET__NODE_BIND;
4176 err = sel_netnode_sid(addrp, family, &sid);
4180 ad.type = LSM_AUDIT_DATA_NET;
4182 ad.u.net->sport = htons(snum);
4183 ad.u.net->family = family;
4185 if (family == PF_INET)
4186 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4188 ad.u.net->v6info.saddr = addr6->sin6_addr;
4190 err = avc_has_perm(sksec->sid, sid,
4191 sksec->sclass, node_perm, &ad);
4199 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4201 struct sock *sk = sock->sk;
4202 struct sk_security_struct *sksec = sk->sk_security;
4205 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4210 * If a TCP or DCCP socket, check name_connect permission for the port.
4212 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4213 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4214 struct common_audit_data ad;
4215 struct lsm_network_audit net = {0,};
4216 struct sockaddr_in *addr4 = NULL;
4217 struct sockaddr_in6 *addr6 = NULL;
4218 unsigned short snum;
4221 if (sk->sk_family == PF_INET) {
4222 addr4 = (struct sockaddr_in *)address;
4223 if (addrlen < sizeof(struct sockaddr_in))
4225 snum = ntohs(addr4->sin_port);
4227 addr6 = (struct sockaddr_in6 *)address;
4228 if (addrlen < SIN6_LEN_RFC2133)
4230 snum = ntohs(addr6->sin6_port);
4233 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4237 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4238 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4240 ad.type = LSM_AUDIT_DATA_NET;
4242 ad.u.net->dport = htons(snum);
4243 ad.u.net->family = sk->sk_family;
4244 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4249 err = selinux_netlbl_socket_connect(sk, address);
4255 static int selinux_socket_listen(struct socket *sock, int backlog)
4257 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4260 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4263 struct inode_security_struct *isec;
4264 struct inode_security_struct *newisec;
4266 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4270 newisec = SOCK_INODE(newsock)->i_security;
4272 isec = SOCK_INODE(sock)->i_security;
4273 newisec->sclass = isec->sclass;
4274 newisec->sid = isec->sid;
4275 newisec->initialized = 1;
4280 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4283 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4286 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4287 int size, int flags)
4289 return sock_has_perm(current, sock->sk, SOCKET__READ);
4292 static int selinux_socket_getsockname(struct socket *sock)
4294 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4297 static int selinux_socket_getpeername(struct socket *sock)
4299 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4302 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4306 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4310 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4313 static int selinux_socket_getsockopt(struct socket *sock, int level,
4316 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4319 static int selinux_socket_shutdown(struct socket *sock, int how)
4321 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4324 static int selinux_socket_unix_stream_connect(struct sock *sock,
4328 struct sk_security_struct *sksec_sock = sock->sk_security;
4329 struct sk_security_struct *sksec_other = other->sk_security;
4330 struct sk_security_struct *sksec_new = newsk->sk_security;
4331 struct common_audit_data ad;
4332 struct lsm_network_audit net = {0,};
4335 ad.type = LSM_AUDIT_DATA_NET;
4337 ad.u.net->sk = other;
4339 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4340 sksec_other->sclass,
4341 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4345 /* server child socket */
4346 sksec_new->peer_sid = sksec_sock->sid;
4347 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4352 /* connecting socket */
4353 sksec_sock->peer_sid = sksec_new->sid;
4358 static int selinux_socket_unix_may_send(struct socket *sock,
4359 struct socket *other)
4361 struct sk_security_struct *ssec = sock->sk->sk_security;
4362 struct sk_security_struct *osec = other->sk->sk_security;
4363 struct common_audit_data ad;
4364 struct lsm_network_audit net = {0,};
4366 ad.type = LSM_AUDIT_DATA_NET;
4368 ad.u.net->sk = other->sk;
4370 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4374 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4375 char *addrp, u16 family, u32 peer_sid,
4376 struct common_audit_data *ad)
4382 err = sel_netif_sid(ns, ifindex, &if_sid);
4385 err = avc_has_perm(peer_sid, if_sid,
4386 SECCLASS_NETIF, NETIF__INGRESS, ad);
4390 err = sel_netnode_sid(addrp, family, &node_sid);
4393 return avc_has_perm(peer_sid, node_sid,
4394 SECCLASS_NODE, NODE__RECVFROM, ad);
4397 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4401 struct sk_security_struct *sksec = sk->sk_security;
4402 u32 sk_sid = sksec->sid;
4403 struct common_audit_data ad;
4404 struct lsm_network_audit net = {0,};
4407 ad.type = LSM_AUDIT_DATA_NET;
4409 ad.u.net->netif = skb->skb_iif;
4410 ad.u.net->family = family;
4411 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4415 if (selinux_secmark_enabled()) {
4416 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4422 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4425 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4430 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4433 struct sk_security_struct *sksec = sk->sk_security;
4434 u16 family = sk->sk_family;
4435 u32 sk_sid = sksec->sid;
4436 struct common_audit_data ad;
4437 struct lsm_network_audit net = {0,};
4442 if (family != PF_INET && family != PF_INET6)
4445 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4446 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4449 /* If any sort of compatibility mode is enabled then handoff processing
4450 * to the selinux_sock_rcv_skb_compat() function to deal with the
4451 * special handling. We do this in an attempt to keep this function
4452 * as fast and as clean as possible. */
4453 if (!selinux_policycap_netpeer)
4454 return selinux_sock_rcv_skb_compat(sk, skb, family);
4456 secmark_active = selinux_secmark_enabled();
4457 peerlbl_active = selinux_peerlbl_enabled();
4458 if (!secmark_active && !peerlbl_active)
4461 ad.type = LSM_AUDIT_DATA_NET;
4463 ad.u.net->netif = skb->skb_iif;
4464 ad.u.net->family = family;
4465 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4469 if (peerlbl_active) {
4472 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4475 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4476 addrp, family, peer_sid, &ad);
4478 selinux_netlbl_err(skb, err, 0);
4481 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4484 selinux_netlbl_err(skb, err, 0);
4489 if (secmark_active) {
4490 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4499 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4500 int __user *optlen, unsigned len)
4505 struct sk_security_struct *sksec = sock->sk->sk_security;
4506 u32 peer_sid = SECSID_NULL;
4508 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4509 sksec->sclass == SECCLASS_TCP_SOCKET)
4510 peer_sid = sksec->peer_sid;
4511 if (peer_sid == SECSID_NULL)
4512 return -ENOPROTOOPT;
4514 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4518 if (scontext_len > len) {
4523 if (copy_to_user(optval, scontext, scontext_len))
4527 if (put_user(scontext_len, optlen))
4533 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4535 u32 peer_secid = SECSID_NULL;
4538 if (skb && skb->protocol == htons(ETH_P_IP))
4540 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4543 family = sock->sk->sk_family;
4547 if (sock && family == PF_UNIX)
4548 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4550 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4553 *secid = peer_secid;
4554 if (peer_secid == SECSID_NULL)
4559 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4561 struct sk_security_struct *sksec;
4563 sksec = kzalloc(sizeof(*sksec), priority);
4567 sksec->peer_sid = SECINITSID_UNLABELED;
4568 sksec->sid = SECINITSID_UNLABELED;
4569 sksec->sclass = SECCLASS_SOCKET;
4570 selinux_netlbl_sk_security_reset(sksec);
4571 sk->sk_security = sksec;
4576 static void selinux_sk_free_security(struct sock *sk)
4578 struct sk_security_struct *sksec = sk->sk_security;
4580 sk->sk_security = NULL;
4581 selinux_netlbl_sk_security_free(sksec);
4585 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4587 struct sk_security_struct *sksec = sk->sk_security;
4588 struct sk_security_struct *newsksec = newsk->sk_security;
4590 newsksec->sid = sksec->sid;
4591 newsksec->peer_sid = sksec->peer_sid;
4592 newsksec->sclass = sksec->sclass;
4594 selinux_netlbl_sk_security_reset(newsksec);
4597 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4600 *secid = SECINITSID_ANY_SOCKET;
4602 struct sk_security_struct *sksec = sk->sk_security;
4604 *secid = sksec->sid;
4608 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4610 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4611 struct sk_security_struct *sksec = sk->sk_security;
4613 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4614 sk->sk_family == PF_UNIX)
4615 isec->sid = sksec->sid;
4616 sksec->sclass = isec->sclass;
4619 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4620 struct request_sock *req)
4622 struct sk_security_struct *sksec = sk->sk_security;
4624 u16 family = req->rsk_ops->family;
4628 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4631 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4634 req->secid = connsid;
4635 req->peer_secid = peersid;
4637 return selinux_netlbl_inet_conn_request(req, family);
4640 static void selinux_inet_csk_clone(struct sock *newsk,
4641 const struct request_sock *req)
4643 struct sk_security_struct *newsksec = newsk->sk_security;
4645 newsksec->sid = req->secid;
4646 newsksec->peer_sid = req->peer_secid;
4647 /* NOTE: Ideally, we should also get the isec->sid for the
4648 new socket in sync, but we don't have the isec available yet.
4649 So we will wait until sock_graft to do it, by which
4650 time it will have been created and available. */
4652 /* We don't need to take any sort of lock here as we are the only
4653 * thread with access to newsksec */
4654 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4657 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4659 u16 family = sk->sk_family;
4660 struct sk_security_struct *sksec = sk->sk_security;
4662 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4663 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4666 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4669 static int selinux_secmark_relabel_packet(u32 sid)
4671 const struct task_security_struct *__tsec;
4674 __tsec = current_security();
4677 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4680 static void selinux_secmark_refcount_inc(void)
4682 atomic_inc(&selinux_secmark_refcount);
4685 static void selinux_secmark_refcount_dec(void)
4687 atomic_dec(&selinux_secmark_refcount);
4690 static void selinux_req_classify_flow(const struct request_sock *req,
4693 fl->flowi_secid = req->secid;
4696 static int selinux_tun_dev_alloc_security(void **security)
4698 struct tun_security_struct *tunsec;
4700 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4703 tunsec->sid = current_sid();
4709 static void selinux_tun_dev_free_security(void *security)
4714 static int selinux_tun_dev_create(void)
4716 u32 sid = current_sid();
4718 /* we aren't taking into account the "sockcreate" SID since the socket
4719 * that is being created here is not a socket in the traditional sense,
4720 * instead it is a private sock, accessible only to the kernel, and
4721 * representing a wide range of network traffic spanning multiple
4722 * connections unlike traditional sockets - check the TUN driver to
4723 * get a better understanding of why this socket is special */
4725 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4729 static int selinux_tun_dev_attach_queue(void *security)
4731 struct tun_security_struct *tunsec = security;
4733 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4734 TUN_SOCKET__ATTACH_QUEUE, NULL);
4737 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4739 struct tun_security_struct *tunsec = security;
4740 struct sk_security_struct *sksec = sk->sk_security;
4742 /* we don't currently perform any NetLabel based labeling here and it
4743 * isn't clear that we would want to do so anyway; while we could apply
4744 * labeling without the support of the TUN user the resulting labeled
4745 * traffic from the other end of the connection would almost certainly
4746 * cause confusion to the TUN user that had no idea network labeling
4747 * protocols were being used */
4749 sksec->sid = tunsec->sid;
4750 sksec->sclass = SECCLASS_TUN_SOCKET;
4755 static int selinux_tun_dev_open(void *security)
4757 struct tun_security_struct *tunsec = security;
4758 u32 sid = current_sid();
4761 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4762 TUN_SOCKET__RELABELFROM, NULL);
4765 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4766 TUN_SOCKET__RELABELTO, NULL);
4774 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4778 struct nlmsghdr *nlh;
4779 struct sk_security_struct *sksec = sk->sk_security;
4781 if (skb->len < NLMSG_HDRLEN) {
4785 nlh = nlmsg_hdr(skb);
4787 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4789 if (err == -EINVAL) {
4791 "SELinux: unrecognized netlink message:"
4792 " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4793 sk->sk_protocol, nlh->nlmsg_type,
4794 secclass_map[sksec->sclass - 1].name);
4795 if (!selinux_enforcing || security_get_allow_unknown())
4805 err = sock_has_perm(current, sk, perm);
4810 #ifdef CONFIG_NETFILTER
4812 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4813 const struct net_device *indev,
4819 struct common_audit_data ad;
4820 struct lsm_network_audit net = {0,};
4825 if (!selinux_policycap_netpeer)
4828 secmark_active = selinux_secmark_enabled();
4829 netlbl_active = netlbl_enabled();
4830 peerlbl_active = selinux_peerlbl_enabled();
4831 if (!secmark_active && !peerlbl_active)
4834 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4837 ad.type = LSM_AUDIT_DATA_NET;
4839 ad.u.net->netif = indev->ifindex;
4840 ad.u.net->family = family;
4841 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4844 if (peerlbl_active) {
4845 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4846 addrp, family, peer_sid, &ad);
4848 selinux_netlbl_err(skb, err, 1);
4854 if (avc_has_perm(peer_sid, skb->secmark,
4855 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4859 /* we do this in the FORWARD path and not the POST_ROUTING
4860 * path because we want to make sure we apply the necessary
4861 * labeling before IPsec is applied so we can leverage AH
4863 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4869 static unsigned int selinux_ipv4_forward(void *priv,
4870 struct sk_buff *skb,
4871 const struct nf_hook_state *state)
4873 return selinux_ip_forward(skb, state->in, PF_INET);
4876 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4877 static unsigned int selinux_ipv6_forward(void *priv,
4878 struct sk_buff *skb,
4879 const struct nf_hook_state *state)
4881 return selinux_ip_forward(skb, state->in, PF_INET6);
4885 static unsigned int selinux_ip_output(struct sk_buff *skb,
4891 if (!netlbl_enabled())
4894 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4895 * because we want to make sure we apply the necessary labeling
4896 * before IPsec is applied so we can leverage AH protection */
4899 struct sk_security_struct *sksec;
4901 if (sk_listener(sk))
4902 /* if the socket is the listening state then this
4903 * packet is a SYN-ACK packet which means it needs to
4904 * be labeled based on the connection/request_sock and
4905 * not the parent socket. unfortunately, we can't
4906 * lookup the request_sock yet as it isn't queued on
4907 * the parent socket until after the SYN-ACK is sent.
4908 * the "solution" is to simply pass the packet as-is
4909 * as any IP option based labeling should be copied
4910 * from the initial connection request (in the IP
4911 * layer). it is far from ideal, but until we get a
4912 * security label in the packet itself this is the
4913 * best we can do. */
4916 /* standard practice, label using the parent socket */
4917 sksec = sk->sk_security;
4920 sid = SECINITSID_KERNEL;
4921 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4927 static unsigned int selinux_ipv4_output(void *priv,
4928 struct sk_buff *skb,
4929 const struct nf_hook_state *state)
4931 return selinux_ip_output(skb, PF_INET);
4934 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4938 struct sock *sk = skb->sk;
4939 struct sk_security_struct *sksec;
4940 struct common_audit_data ad;
4941 struct lsm_network_audit net = {0,};
4947 sksec = sk->sk_security;
4949 ad.type = LSM_AUDIT_DATA_NET;
4951 ad.u.net->netif = ifindex;
4952 ad.u.net->family = family;
4953 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4956 if (selinux_secmark_enabled())
4957 if (avc_has_perm(sksec->sid, skb->secmark,
4958 SECCLASS_PACKET, PACKET__SEND, &ad))
4959 return NF_DROP_ERR(-ECONNREFUSED);
4961 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4962 return NF_DROP_ERR(-ECONNREFUSED);
4967 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4968 const struct net_device *outdev,
4973 int ifindex = outdev->ifindex;
4975 struct common_audit_data ad;
4976 struct lsm_network_audit net = {0,};
4981 /* If any sort of compatibility mode is enabled then handoff processing
4982 * to the selinux_ip_postroute_compat() function to deal with the
4983 * special handling. We do this in an attempt to keep this function
4984 * as fast and as clean as possible. */
4985 if (!selinux_policycap_netpeer)
4986 return selinux_ip_postroute_compat(skb, ifindex, family);
4988 secmark_active = selinux_secmark_enabled();
4989 peerlbl_active = selinux_peerlbl_enabled();
4990 if (!secmark_active && !peerlbl_active)
4996 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4997 * packet transformation so allow the packet to pass without any checks
4998 * since we'll have another chance to perform access control checks
4999 * when the packet is on it's final way out.
5000 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5001 * is NULL, in this case go ahead and apply access control.
5002 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5003 * TCP listening state we cannot wait until the XFRM processing
5004 * is done as we will miss out on the SA label if we do;
5005 * unfortunately, this means more work, but it is only once per
5007 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5008 !(sk && sk_listener(sk)))
5013 /* Without an associated socket the packet is either coming
5014 * from the kernel or it is being forwarded; check the packet
5015 * to determine which and if the packet is being forwarded
5016 * query the packet directly to determine the security label. */
5018 secmark_perm = PACKET__FORWARD_OUT;
5019 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5022 secmark_perm = PACKET__SEND;
5023 peer_sid = SECINITSID_KERNEL;
5025 } else if (sk_listener(sk)) {
5026 /* Locally generated packet but the associated socket is in the
5027 * listening state which means this is a SYN-ACK packet. In
5028 * this particular case the correct security label is assigned
5029 * to the connection/request_sock but unfortunately we can't
5030 * query the request_sock as it isn't queued on the parent
5031 * socket until after the SYN-ACK packet is sent; the only
5032 * viable choice is to regenerate the label like we do in
5033 * selinux_inet_conn_request(). See also selinux_ip_output()
5034 * for similar problems. */
5036 struct sk_security_struct *sksec;
5038 if (sk->sk_state == TCP_NEW_SYN_RECV)
5039 sk = inet_reqsk(sk)->rsk_listener;
5040 sksec = sk->sk_security;
5041 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5043 /* At this point, if the returned skb peerlbl is SECSID_NULL
5044 * and the packet has been through at least one XFRM
5045 * transformation then we must be dealing with the "final"
5046 * form of labeled IPsec packet; since we've already applied
5047 * all of our access controls on this packet we can safely
5048 * pass the packet. */
5049 if (skb_sid == SECSID_NULL) {
5052 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5056 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5060 return NF_DROP_ERR(-ECONNREFUSED);
5063 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5065 secmark_perm = PACKET__SEND;
5067 /* Locally generated packet, fetch the security label from the
5068 * associated socket. */
5069 struct sk_security_struct *sksec = sk->sk_security;
5070 peer_sid = sksec->sid;
5071 secmark_perm = PACKET__SEND;
5074 ad.type = LSM_AUDIT_DATA_NET;
5076 ad.u.net->netif = ifindex;
5077 ad.u.net->family = family;
5078 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5082 if (avc_has_perm(peer_sid, skb->secmark,
5083 SECCLASS_PACKET, secmark_perm, &ad))
5084 return NF_DROP_ERR(-ECONNREFUSED);
5086 if (peerlbl_active) {
5090 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5092 if (avc_has_perm(peer_sid, if_sid,
5093 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5094 return NF_DROP_ERR(-ECONNREFUSED);
5096 if (sel_netnode_sid(addrp, family, &node_sid))
5098 if (avc_has_perm(peer_sid, node_sid,
5099 SECCLASS_NODE, NODE__SENDTO, &ad))
5100 return NF_DROP_ERR(-ECONNREFUSED);
5106 static unsigned int selinux_ipv4_postroute(void *priv,
5107 struct sk_buff *skb,
5108 const struct nf_hook_state *state)
5110 return selinux_ip_postroute(skb, state->out, PF_INET);
5113 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5114 static unsigned int selinux_ipv6_postroute(void *priv,
5115 struct sk_buff *skb,
5116 const struct nf_hook_state *state)
5118 return selinux_ip_postroute(skb, state->out, PF_INET6);
5122 #endif /* CONFIG_NETFILTER */
5124 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5126 return selinux_nlmsg_perm(sk, skb);
5129 static int ipc_alloc_security(struct task_struct *task,
5130 struct kern_ipc_perm *perm,
5133 struct ipc_security_struct *isec;
5136 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5140 sid = task_sid(task);
5141 isec->sclass = sclass;
5143 perm->security = isec;
5148 static void ipc_free_security(struct kern_ipc_perm *perm)
5150 struct ipc_security_struct *isec = perm->security;
5151 perm->security = NULL;
5155 static int msg_msg_alloc_security(struct msg_msg *msg)
5157 struct msg_security_struct *msec;
5159 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5163 msec->sid = SECINITSID_UNLABELED;
5164 msg->security = msec;
5169 static void msg_msg_free_security(struct msg_msg *msg)
5171 struct msg_security_struct *msec = msg->security;
5173 msg->security = NULL;
5177 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5180 struct ipc_security_struct *isec;
5181 struct common_audit_data ad;
5182 u32 sid = current_sid();
5184 isec = ipc_perms->security;
5186 ad.type = LSM_AUDIT_DATA_IPC;
5187 ad.u.ipc_id = ipc_perms->key;
5189 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5192 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5194 return msg_msg_alloc_security(msg);
5197 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5199 msg_msg_free_security(msg);
5202 /* message queue security operations */
5203 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5205 struct ipc_security_struct *isec;
5206 struct common_audit_data ad;
5207 u32 sid = current_sid();
5210 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5214 isec = msq->q_perm.security;
5216 ad.type = LSM_AUDIT_DATA_IPC;
5217 ad.u.ipc_id = msq->q_perm.key;
5219 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5222 ipc_free_security(&msq->q_perm);
5228 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5230 ipc_free_security(&msq->q_perm);
5233 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5235 struct ipc_security_struct *isec;
5236 struct common_audit_data ad;
5237 u32 sid = current_sid();
5239 isec = msq->q_perm.security;
5241 ad.type = LSM_AUDIT_DATA_IPC;
5242 ad.u.ipc_id = msq->q_perm.key;
5244 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5245 MSGQ__ASSOCIATE, &ad);
5248 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5256 /* No specific object, just general system-wide information. */
5257 return task_has_system(current, SYSTEM__IPC_INFO);
5260 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5263 perms = MSGQ__SETATTR;
5266 perms = MSGQ__DESTROY;
5272 err = ipc_has_perm(&msq->q_perm, perms);
5276 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5278 struct ipc_security_struct *isec;
5279 struct msg_security_struct *msec;
5280 struct common_audit_data ad;
5281 u32 sid = current_sid();
5284 isec = msq->q_perm.security;
5285 msec = msg->security;
5288 * First time through, need to assign label to the message
5290 if (msec->sid == SECINITSID_UNLABELED) {
5292 * Compute new sid based on current process and
5293 * message queue this message will be stored in
5295 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5301 ad.type = LSM_AUDIT_DATA_IPC;
5302 ad.u.ipc_id = msq->q_perm.key;
5304 /* Can this process write to the queue? */
5305 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5308 /* Can this process send the message */
5309 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5312 /* Can the message be put in the queue? */
5313 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5314 MSGQ__ENQUEUE, &ad);
5319 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5320 struct task_struct *target,
5321 long type, int mode)
5323 struct ipc_security_struct *isec;
5324 struct msg_security_struct *msec;
5325 struct common_audit_data ad;
5326 u32 sid = task_sid(target);
5329 isec = msq->q_perm.security;
5330 msec = msg->security;
5332 ad.type = LSM_AUDIT_DATA_IPC;
5333 ad.u.ipc_id = msq->q_perm.key;
5335 rc = avc_has_perm(sid, isec->sid,
5336 SECCLASS_MSGQ, MSGQ__READ, &ad);
5338 rc = avc_has_perm(sid, msec->sid,
5339 SECCLASS_MSG, MSG__RECEIVE, &ad);
5343 /* Shared Memory security operations */
5344 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5346 struct ipc_security_struct *isec;
5347 struct common_audit_data ad;
5348 u32 sid = current_sid();
5351 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5355 isec = shp->shm_perm.security;
5357 ad.type = LSM_AUDIT_DATA_IPC;
5358 ad.u.ipc_id = shp->shm_perm.key;
5360 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5363 ipc_free_security(&shp->shm_perm);
5369 static void selinux_shm_free_security(struct shmid_kernel *shp)
5371 ipc_free_security(&shp->shm_perm);
5374 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5376 struct ipc_security_struct *isec;
5377 struct common_audit_data ad;
5378 u32 sid = current_sid();
5380 isec = shp->shm_perm.security;
5382 ad.type = LSM_AUDIT_DATA_IPC;
5383 ad.u.ipc_id = shp->shm_perm.key;
5385 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5386 SHM__ASSOCIATE, &ad);
5389 /* Note, at this point, shp is locked down */
5390 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5398 /* No specific object, just general system-wide information. */
5399 return task_has_system(current, SYSTEM__IPC_INFO);
5402 perms = SHM__GETATTR | SHM__ASSOCIATE;
5405 perms = SHM__SETATTR;
5412 perms = SHM__DESTROY;
5418 err = ipc_has_perm(&shp->shm_perm, perms);
5422 static int selinux_shm_shmat(struct shmid_kernel *shp,
5423 char __user *shmaddr, int shmflg)
5427 if (shmflg & SHM_RDONLY)
5430 perms = SHM__READ | SHM__WRITE;
5432 return ipc_has_perm(&shp->shm_perm, perms);
5435 /* Semaphore security operations */
5436 static int selinux_sem_alloc_security(struct sem_array *sma)
5438 struct ipc_security_struct *isec;
5439 struct common_audit_data ad;
5440 u32 sid = current_sid();
5443 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5447 isec = sma->sem_perm.security;
5449 ad.type = LSM_AUDIT_DATA_IPC;
5450 ad.u.ipc_id = sma->sem_perm.key;
5452 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5455 ipc_free_security(&sma->sem_perm);
5461 static void selinux_sem_free_security(struct sem_array *sma)
5463 ipc_free_security(&sma->sem_perm);
5466 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5468 struct ipc_security_struct *isec;
5469 struct common_audit_data ad;
5470 u32 sid = current_sid();
5472 isec = sma->sem_perm.security;
5474 ad.type = LSM_AUDIT_DATA_IPC;
5475 ad.u.ipc_id = sma->sem_perm.key;
5477 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5478 SEM__ASSOCIATE, &ad);
5481 /* Note, at this point, sma is locked down */
5482 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5490 /* No specific object, just general system-wide information. */
5491 return task_has_system(current, SYSTEM__IPC_INFO);
5495 perms = SEM__GETATTR;
5506 perms = SEM__DESTROY;
5509 perms = SEM__SETATTR;
5513 perms = SEM__GETATTR | SEM__ASSOCIATE;
5519 err = ipc_has_perm(&sma->sem_perm, perms);
5523 static int selinux_sem_semop(struct sem_array *sma,
5524 struct sembuf *sops, unsigned nsops, int alter)
5529 perms = SEM__READ | SEM__WRITE;
5533 return ipc_has_perm(&sma->sem_perm, perms);
5536 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5542 av |= IPC__UNIX_READ;
5544 av |= IPC__UNIX_WRITE;
5549 return ipc_has_perm(ipcp, av);
5552 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5554 struct ipc_security_struct *isec = ipcp->security;
5558 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5561 inode_doinit_with_dentry(inode, dentry);
5564 static int selinux_getprocattr(struct task_struct *p,
5565 char *name, char **value)
5567 const struct task_security_struct *__tsec;
5573 error = current_has_perm(p, PROCESS__GETATTR);
5579 __tsec = __task_cred(p)->security;
5581 if (!strcmp(name, "current"))
5583 else if (!strcmp(name, "prev"))
5585 else if (!strcmp(name, "exec"))
5586 sid = __tsec->exec_sid;
5587 else if (!strcmp(name, "fscreate"))
5588 sid = __tsec->create_sid;
5589 else if (!strcmp(name, "keycreate"))
5590 sid = __tsec->keycreate_sid;
5591 else if (!strcmp(name, "sockcreate"))
5592 sid = __tsec->sockcreate_sid;
5600 error = security_sid_to_context(sid, value, &len);
5610 static int selinux_setprocattr(struct task_struct *p,
5611 char *name, void *value, size_t size)
5613 struct task_security_struct *tsec;
5614 struct task_struct *tracer;
5621 /* SELinux only allows a process to change its own
5622 security attributes. */
5627 * Basic control over ability to set these attributes at all.
5628 * current == p, but we'll pass them separately in case the
5629 * above restriction is ever removed.
5631 if (!strcmp(name, "exec"))
5632 error = current_has_perm(p, PROCESS__SETEXEC);
5633 else if (!strcmp(name, "fscreate"))
5634 error = current_has_perm(p, PROCESS__SETFSCREATE);
5635 else if (!strcmp(name, "keycreate"))
5636 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5637 else if (!strcmp(name, "sockcreate"))
5638 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5639 else if (!strcmp(name, "current"))
5640 error = current_has_perm(p, PROCESS__SETCURRENT);
5646 /* Obtain a SID for the context, if one was specified. */
5647 if (size && str[1] && str[1] != '\n') {
5648 if (str[size-1] == '\n') {
5652 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5653 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5654 if (!capable(CAP_MAC_ADMIN)) {
5655 struct audit_buffer *ab;
5658 /* We strip a nul only if it is at the end, otherwise the
5659 * context contains a nul and we should audit that */
5660 if (str[size - 1] == '\0')
5661 audit_size = size - 1;
5664 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5665 audit_log_format(ab, "op=fscreate invalid_context=");
5666 audit_log_n_untrustedstring(ab, value, audit_size);
5671 error = security_context_to_sid_force(value, size,
5678 new = prepare_creds();
5682 /* Permission checking based on the specified context is
5683 performed during the actual operation (execve,
5684 open/mkdir/...), when we know the full context of the
5685 operation. See selinux_bprm_set_creds for the execve
5686 checks and may_create for the file creation checks. The
5687 operation will then fail if the context is not permitted. */
5688 tsec = new->security;
5689 if (!strcmp(name, "exec")) {
5690 tsec->exec_sid = sid;
5691 } else if (!strcmp(name, "fscreate")) {
5692 tsec->create_sid = sid;
5693 } else if (!strcmp(name, "keycreate")) {
5694 error = may_create_key(sid, p);
5697 tsec->keycreate_sid = sid;
5698 } else if (!strcmp(name, "sockcreate")) {
5699 tsec->sockcreate_sid = sid;
5700 } else if (!strcmp(name, "current")) {
5705 /* Only allow single threaded processes to change context */
5707 if (!current_is_single_threaded()) {
5708 error = security_bounded_transition(tsec->sid, sid);
5713 /* Check permissions for the transition. */
5714 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5715 PROCESS__DYNTRANSITION, NULL);
5719 /* Check for ptracing, and update the task SID if ok.
5720 Otherwise, leave SID unchanged and fail. */
5723 tracer = ptrace_parent(p);
5725 ptsid = task_sid(tracer);
5729 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5730 PROCESS__PTRACE, NULL);
5749 static int selinux_ismaclabel(const char *name)
5751 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5754 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5756 return security_sid_to_context(secid, secdata, seclen);
5759 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5761 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5764 static void selinux_release_secctx(char *secdata, u32 seclen)
5770 * called with inode->i_mutex locked
5772 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5774 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5778 * called with inode->i_mutex locked
5780 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5782 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5785 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5788 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5797 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5798 unsigned long flags)
5800 const struct task_security_struct *tsec;
5801 struct key_security_struct *ksec;
5803 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5807 tsec = cred->security;
5808 if (tsec->keycreate_sid)
5809 ksec->sid = tsec->keycreate_sid;
5811 ksec->sid = tsec->sid;
5817 static void selinux_key_free(struct key *k)
5819 struct key_security_struct *ksec = k->security;
5825 static int selinux_key_permission(key_ref_t key_ref,
5826 const struct cred *cred,
5830 struct key_security_struct *ksec;
5833 /* if no specific permissions are requested, we skip the
5834 permission check. No serious, additional covert channels
5835 appear to be created. */
5839 sid = cred_sid(cred);
5841 key = key_ref_to_ptr(key_ref);
5842 ksec = key->security;
5844 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5847 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5849 struct key_security_struct *ksec = key->security;
5850 char *context = NULL;
5854 rc = security_sid_to_context(ksec->sid, &context, &len);
5863 static struct security_hook_list selinux_hooks[] = {
5864 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5865 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5866 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5867 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5869 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5870 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5871 LSM_HOOK_INIT(capget, selinux_capget),
5872 LSM_HOOK_INIT(capset, selinux_capset),
5873 LSM_HOOK_INIT(capable, selinux_capable),
5874 LSM_HOOK_INIT(quotactl, selinux_quotactl),
5875 LSM_HOOK_INIT(quota_on, selinux_quota_on),
5876 LSM_HOOK_INIT(syslog, selinux_syslog),
5877 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5879 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5881 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5882 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5883 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5884 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5886 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5887 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5888 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5889 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5890 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5891 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5892 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5893 LSM_HOOK_INIT(sb_mount, selinux_mount),
5894 LSM_HOOK_INIT(sb_umount, selinux_umount),
5895 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5896 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5897 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5899 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5901 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5902 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5903 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5904 LSM_HOOK_INIT(inode_create, selinux_inode_create),
5905 LSM_HOOK_INIT(inode_link, selinux_inode_link),
5906 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5907 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5908 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5909 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5910 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5911 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5912 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5913 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5914 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5915 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5916 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5917 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5918 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5919 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5920 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5921 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5922 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5923 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5924 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5925 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5927 LSM_HOOK_INIT(file_permission, selinux_file_permission),
5928 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5929 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5930 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5931 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5932 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5933 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5934 LSM_HOOK_INIT(file_lock, selinux_file_lock),
5935 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5936 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5937 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5938 LSM_HOOK_INIT(file_receive, selinux_file_receive),
5940 LSM_HOOK_INIT(file_open, selinux_file_open),
5942 LSM_HOOK_INIT(task_create, selinux_task_create),
5943 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5944 LSM_HOOK_INIT(cred_free, selinux_cred_free),
5945 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5946 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5947 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5948 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5949 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5950 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5951 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5952 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5953 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5954 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5955 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5956 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5957 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5958 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5959 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5960 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5961 LSM_HOOK_INIT(task_kill, selinux_task_kill),
5962 LSM_HOOK_INIT(task_wait, selinux_task_wait),
5963 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5965 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5966 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5968 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5969 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5971 LSM_HOOK_INIT(msg_queue_alloc_security,
5972 selinux_msg_queue_alloc_security),
5973 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5974 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5975 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5976 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5977 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5979 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5980 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5981 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5982 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5983 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5985 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5986 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5987 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5988 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5989 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5991 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5993 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5994 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5996 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5997 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5998 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5999 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6000 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6001 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6002 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6004 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6005 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6007 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6008 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6009 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6010 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6011 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6012 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6013 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6014 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6015 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6016 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6017 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6018 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6019 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6020 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6021 LSM_HOOK_INIT(socket_getpeersec_stream,
6022 selinux_socket_getpeersec_stream),
6023 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6024 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6025 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6026 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6027 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6028 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6029 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6030 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6031 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6032 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6033 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6034 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6035 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6036 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6037 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6038 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6039 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6040 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6041 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6043 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6044 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6045 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6046 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6047 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6048 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6049 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6050 selinux_xfrm_state_alloc_acquire),
6051 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6052 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6053 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6054 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6055 selinux_xfrm_state_pol_flow_match),
6056 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6060 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6061 LSM_HOOK_INIT(key_free, selinux_key_free),
6062 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6063 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6067 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6068 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6069 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6070 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6074 static __init int selinux_init(void)
6076 if (!security_module_enable("selinux")) {
6077 selinux_enabled = 0;
6081 if (!selinux_enabled) {
6082 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6086 printk(KERN_INFO "SELinux: Initializing.\n");
6088 /* Set the security state for the initial task. */
6089 cred_init_security();
6091 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6093 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6094 sizeof(struct inode_security_struct),
6095 0, SLAB_PANIC, NULL);
6098 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6100 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6101 panic("SELinux: Unable to register AVC netcache callback\n");
6103 if (selinux_enforcing)
6104 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6106 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6111 static void delayed_superblock_init(struct super_block *sb, void *unused)
6113 superblock_doinit(sb, NULL);
6116 void selinux_complete_init(void)
6118 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6120 /* Set up any superblocks initialized prior to the policy load. */
6121 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6122 iterate_supers(delayed_superblock_init, NULL);
6125 /* SELinux requires early initialization in order to label
6126 all processes and objects when they are created. */
6127 security_initcall(selinux_init);
6129 #if defined(CONFIG_NETFILTER)
6131 static struct nf_hook_ops selinux_nf_ops[] = {
6133 .hook = selinux_ipv4_postroute,
6134 .owner = THIS_MODULE,
6136 .hooknum = NF_INET_POST_ROUTING,
6137 .priority = NF_IP_PRI_SELINUX_LAST,
6140 .hook = selinux_ipv4_forward,
6141 .owner = THIS_MODULE,
6143 .hooknum = NF_INET_FORWARD,
6144 .priority = NF_IP_PRI_SELINUX_FIRST,
6147 .hook = selinux_ipv4_output,
6148 .owner = THIS_MODULE,
6150 .hooknum = NF_INET_LOCAL_OUT,
6151 .priority = NF_IP_PRI_SELINUX_FIRST,
6153 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6155 .hook = selinux_ipv6_postroute,
6156 .owner = THIS_MODULE,
6158 .hooknum = NF_INET_POST_ROUTING,
6159 .priority = NF_IP6_PRI_SELINUX_LAST,
6162 .hook = selinux_ipv6_forward,
6163 .owner = THIS_MODULE,
6165 .hooknum = NF_INET_FORWARD,
6166 .priority = NF_IP6_PRI_SELINUX_FIRST,
6171 static int __init selinux_nf_ip_init(void)
6175 if (!selinux_enabled)
6178 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6180 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6182 panic("SELinux: nf_register_hooks: error %d\n", err);
6187 __initcall(selinux_nf_ip_init);
6189 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6190 static void selinux_nf_ip_exit(void)
6192 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6194 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6198 #else /* CONFIG_NETFILTER */
6200 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6201 #define selinux_nf_ip_exit()
6204 #endif /* CONFIG_NETFILTER */
6206 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6207 static int selinux_disabled;
6209 int selinux_disable(void)
6211 if (ss_initialized) {
6212 /* Not permitted after initial policy load. */
6216 if (selinux_disabled) {
6217 /* Only do this once. */
6221 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6223 selinux_disabled = 1;
6224 selinux_enabled = 0;
6226 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6228 /* Try to destroy the avc node cache */
6231 /* Unregister netfilter hooks. */
6232 selinux_nf_ip_exit();
6234 /* Unregister selinuxfs. */