2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/ext2_fs.h>
32 #include <linux/sched.h>
33 #include <linux/security.h>
34 #include <linux/xattr.h>
35 #include <linux/capability.h>
36 #include <linux/unistd.h>
38 #include <linux/mman.h>
39 #include <linux/slab.h>
40 #include <linux/pagemap.h>
41 #include <linux/proc_fs.h>
42 #include <linux/swap.h>
43 #include <linux/spinlock.h>
44 #include <linux/syscalls.h>
45 #include <linux/dcache.h>
46 #include <linux/file.h>
47 #include <linux/fdtable.h>
48 #include <linux/namei.h>
49 #include <linux/mount.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <asm/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <linux/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
93 #define NUM_SEL_MNT_OPTS 5
95 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
96 extern struct security_operations *security_ops;
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
104 static int __init enforcing_setup(char *str)
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
111 __setup("enforcing=", enforcing_setup);
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117 static int __init selinux_enabled_setup(char *str)
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
124 __setup("selinux=", selinux_enabled_setup);
126 int selinux_enabled = 1;
129 static struct kmem_cache *sel_inode_cache;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
141 static int selinux_secmark_enabled(void)
143 return (atomic_read(&selinux_secmark_refcount) > 0);
147 * initialise the security for the init task
149 static void cred_init_security(void)
151 struct cred *cred = (struct cred *) current->real_cred;
152 struct task_security_struct *tsec;
154 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
156 panic("SELinux: Failed to initialize initial task.\n");
158 tsec->osid = tsec->sid = SECINITSID_KERNEL;
159 cred->security = tsec;
163 * get the security ID of a set of credentials
165 static inline u32 cred_sid(const struct cred *cred)
167 const struct task_security_struct *tsec;
169 tsec = cred->security;
174 * get the objective security ID of a task
176 static inline u32 task_sid(const struct task_struct *task)
181 sid = cred_sid(__task_cred(task));
187 * get the subjective security ID of the current task
189 static inline u32 current_sid(void)
191 const struct task_security_struct *tsec = current_security();
196 /* Allocate and free functions for each kind of security blob. */
198 static int inode_alloc_security(struct inode *inode)
200 struct inode_security_struct *isec;
201 u32 sid = current_sid();
203 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
207 mutex_init(&isec->lock);
208 INIT_LIST_HEAD(&isec->list);
210 isec->sid = SECINITSID_UNLABELED;
211 isec->sclass = SECCLASS_FILE;
212 isec->task_sid = sid;
213 inode->i_security = isec;
218 static void inode_free_security(struct inode *inode)
220 struct inode_security_struct *isec = inode->i_security;
221 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
223 spin_lock(&sbsec->isec_lock);
224 if (!list_empty(&isec->list))
225 list_del_init(&isec->list);
226 spin_unlock(&sbsec->isec_lock);
228 inode->i_security = NULL;
229 kmem_cache_free(sel_inode_cache, isec);
232 static int file_alloc_security(struct file *file)
234 struct file_security_struct *fsec;
235 u32 sid = current_sid();
237 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
242 fsec->fown_sid = sid;
243 file->f_security = fsec;
248 static void file_free_security(struct file *file)
250 struct file_security_struct *fsec = file->f_security;
251 file->f_security = NULL;
255 static int superblock_alloc_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec;
259 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
263 mutex_init(&sbsec->lock);
264 INIT_LIST_HEAD(&sbsec->isec_head);
265 spin_lock_init(&sbsec->isec_lock);
267 sbsec->sid = SECINITSID_UNLABELED;
268 sbsec->def_sid = SECINITSID_FILE;
269 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
270 sb->s_security = sbsec;
275 static void superblock_free_security(struct super_block *sb)
277 struct superblock_security_struct *sbsec = sb->s_security;
278 sb->s_security = NULL;
282 /* The security server must be initialized before
283 any labeling or access decisions can be provided. */
284 extern int ss_initialized;
286 /* The file system's label must be initialized prior to use. */
288 static const char *labeling_behaviors[6] = {
290 "uses transition SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
297 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
299 static inline int inode_doinit(struct inode *inode)
301 return inode_doinit_with_dentry(inode, NULL);
310 Opt_labelsupport = 5,
313 static const match_table_t tokens = {
314 {Opt_context, CONTEXT_STR "%s"},
315 {Opt_fscontext, FSCONTEXT_STR "%s"},
316 {Opt_defcontext, DEFCONTEXT_STR "%s"},
317 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
318 {Opt_labelsupport, LABELSUPP_STR},
322 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
324 static int may_context_mount_sb_relabel(u32 sid,
325 struct superblock_security_struct *sbsec,
326 const struct cred *cred)
328 const struct task_security_struct *tsec = cred->security;
331 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
332 FILESYSTEM__RELABELFROM, NULL);
336 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
337 FILESYSTEM__RELABELTO, NULL);
341 static int may_context_mount_inode_relabel(u32 sid,
342 struct superblock_security_struct *sbsec,
343 const struct cred *cred)
345 const struct task_security_struct *tsec = cred->security;
347 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELFROM, NULL);
352 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
353 FILESYSTEM__ASSOCIATE, NULL);
357 static int sb_finish_set_opts(struct super_block *sb)
359 struct superblock_security_struct *sbsec = sb->s_security;
360 struct dentry *root = sb->s_root;
361 struct inode *root_inode = root->d_inode;
364 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
365 /* Make sure that the xattr handler exists and that no
366 error other than -ENODATA is returned by getxattr on
367 the root directory. -ENODATA is ok, as this may be
368 the first boot of the SELinux kernel before we have
369 assigned xattr values to the filesystem. */
370 if (!root_inode->i_op->getxattr) {
371 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
372 "xattr support\n", sb->s_id, sb->s_type->name);
376 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
377 if (rc < 0 && rc != -ENODATA) {
378 if (rc == -EOPNOTSUPP)
379 printk(KERN_WARNING "SELinux: (dev %s, type "
380 "%s) has no security xattr handler\n",
381 sb->s_id, sb->s_type->name);
383 printk(KERN_WARNING "SELinux: (dev %s, type "
384 "%s) getxattr errno %d\n", sb->s_id,
385 sb->s_type->name, -rc);
390 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
392 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
393 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
394 sb->s_id, sb->s_type->name);
396 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
397 sb->s_id, sb->s_type->name,
398 labeling_behaviors[sbsec->behavior-1]);
400 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
401 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
402 sbsec->behavior == SECURITY_FS_USE_NONE ||
403 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
404 sbsec->flags &= ~SE_SBLABELSUPP;
406 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
407 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
408 sbsec->flags |= SE_SBLABELSUPP;
410 /* Initialize the root inode. */
411 rc = inode_doinit_with_dentry(root_inode, root);
413 /* Initialize any other inodes associated with the superblock, e.g.
414 inodes created prior to initial policy load or inodes created
415 during get_sb by a pseudo filesystem that directly
417 spin_lock(&sbsec->isec_lock);
419 if (!list_empty(&sbsec->isec_head)) {
420 struct inode_security_struct *isec =
421 list_entry(sbsec->isec_head.next,
422 struct inode_security_struct, list);
423 struct inode *inode = isec->inode;
424 spin_unlock(&sbsec->isec_lock);
425 inode = igrab(inode);
427 if (!IS_PRIVATE(inode))
431 spin_lock(&sbsec->isec_lock);
432 list_del_init(&isec->list);
435 spin_unlock(&sbsec->isec_lock);
441 * This function should allow an FS to ask what it's mount security
442 * options were so it can use those later for submounts, displaying
443 * mount options, or whatever.
445 static int selinux_get_mnt_opts(const struct super_block *sb,
446 struct security_mnt_opts *opts)
449 struct superblock_security_struct *sbsec = sb->s_security;
450 char *context = NULL;
454 security_init_mnt_opts(opts);
456 if (!(sbsec->flags & SE_SBINITIALIZED))
462 tmp = sbsec->flags & SE_MNTMASK;
463 /* count the number of mount options for this sb */
464 for (i = 0; i < 8; i++) {
466 opts->num_mnt_opts++;
469 /* Check if the Label support flag is set */
470 if (sbsec->flags & SE_SBLABELSUPP)
471 opts->num_mnt_opts++;
473 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
474 if (!opts->mnt_opts) {
479 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
480 if (!opts->mnt_opts_flags) {
486 if (sbsec->flags & FSCONTEXT_MNT) {
487 rc = security_sid_to_context(sbsec->sid, &context, &len);
490 opts->mnt_opts[i] = context;
491 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
493 if (sbsec->flags & CONTEXT_MNT) {
494 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
497 opts->mnt_opts[i] = context;
498 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
500 if (sbsec->flags & DEFCONTEXT_MNT) {
501 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
504 opts->mnt_opts[i] = context;
505 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
507 if (sbsec->flags & ROOTCONTEXT_MNT) {
508 struct inode *root = sbsec->sb->s_root->d_inode;
509 struct inode_security_struct *isec = root->i_security;
511 rc = security_sid_to_context(isec->sid, &context, &len);
514 opts->mnt_opts[i] = context;
515 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
517 if (sbsec->flags & SE_SBLABELSUPP) {
518 opts->mnt_opts[i] = NULL;
519 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
522 BUG_ON(i != opts->num_mnt_opts);
527 security_free_mnt_opts(opts);
531 static int bad_option(struct superblock_security_struct *sbsec, char flag,
532 u32 old_sid, u32 new_sid)
534 char mnt_flags = sbsec->flags & SE_MNTMASK;
536 /* check if the old mount command had the same options */
537 if (sbsec->flags & SE_SBINITIALIZED)
538 if (!(sbsec->flags & flag) ||
539 (old_sid != new_sid))
542 /* check if we were passed the same options twice,
543 * aka someone passed context=a,context=b
545 if (!(sbsec->flags & SE_SBINITIALIZED))
546 if (mnt_flags & flag)
552 * Allow filesystems with binary mount data to explicitly set mount point
553 * labeling information.
555 static int selinux_set_mnt_opts(struct super_block *sb,
556 struct security_mnt_opts *opts)
558 const struct cred *cred = current_cred();
560 struct superblock_security_struct *sbsec = sb->s_security;
561 const char *name = sb->s_type->name;
562 struct inode *inode = sbsec->sb->s_root->d_inode;
563 struct inode_security_struct *root_isec = inode->i_security;
564 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
565 u32 defcontext_sid = 0;
566 char **mount_options = opts->mnt_opts;
567 int *flags = opts->mnt_opts_flags;
568 int num_opts = opts->num_mnt_opts;
570 mutex_lock(&sbsec->lock);
572 if (!ss_initialized) {
574 /* Defer initialization until selinux_complete_init,
575 after the initial policy is loaded and the security
576 server is ready to handle calls. */
580 printk(KERN_WARNING "SELinux: Unable to set superblock options "
581 "before the security server is initialized\n");
586 * Binary mount data FS will come through this function twice. Once
587 * from an explicit call and once from the generic calls from the vfs.
588 * Since the generic VFS calls will not contain any security mount data
589 * we need to skip the double mount verification.
591 * This does open a hole in which we will not notice if the first
592 * mount using this sb set explict options and a second mount using
593 * this sb does not set any security options. (The first options
594 * will be used for both mounts)
596 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
601 * parse the mount options, check if they are valid sids.
602 * also check if someone is trying to mount the same sb more
603 * than once with different security options.
605 for (i = 0; i < num_opts; i++) {
608 if (flags[i] == SE_SBLABELSUPP)
610 rc = security_context_to_sid(mount_options[i],
611 strlen(mount_options[i]), &sid);
613 printk(KERN_WARNING "SELinux: security_context_to_sid"
614 "(%s) failed for (dev %s, type %s) errno=%d\n",
615 mount_options[i], sb->s_id, name, rc);
622 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
624 goto out_double_mount;
626 sbsec->flags |= FSCONTEXT_MNT;
631 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
633 goto out_double_mount;
635 sbsec->flags |= CONTEXT_MNT;
637 case ROOTCONTEXT_MNT:
638 rootcontext_sid = sid;
640 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
642 goto out_double_mount;
644 sbsec->flags |= ROOTCONTEXT_MNT;
648 defcontext_sid = sid;
650 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
652 goto out_double_mount;
654 sbsec->flags |= DEFCONTEXT_MNT;
663 if (sbsec->flags & SE_SBINITIALIZED) {
664 /* previously mounted with options, but not on this attempt? */
665 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
666 goto out_double_mount;
671 if (strcmp(sb->s_type->name, "proc") == 0)
672 sbsec->flags |= SE_SBPROC;
674 /* Determine the labeling behavior to use for this filesystem type. */
675 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
677 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
678 __func__, sb->s_type->name, rc);
682 /* sets the context of the superblock for the fs being mounted. */
684 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
688 sbsec->sid = fscontext_sid;
692 * Switch to using mount point labeling behavior.
693 * sets the label used on all file below the mountpoint, and will set
694 * the superblock context if not already set.
697 if (!fscontext_sid) {
698 rc = may_context_mount_sb_relabel(context_sid, sbsec,
702 sbsec->sid = context_sid;
704 rc = may_context_mount_inode_relabel(context_sid, sbsec,
709 if (!rootcontext_sid)
710 rootcontext_sid = context_sid;
712 sbsec->mntpoint_sid = context_sid;
713 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
716 if (rootcontext_sid) {
717 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
722 root_isec->sid = rootcontext_sid;
723 root_isec->initialized = 1;
726 if (defcontext_sid) {
727 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
729 printk(KERN_WARNING "SELinux: defcontext option is "
730 "invalid for this filesystem type\n");
734 if (defcontext_sid != sbsec->def_sid) {
735 rc = may_context_mount_inode_relabel(defcontext_sid,
741 sbsec->def_sid = defcontext_sid;
744 rc = sb_finish_set_opts(sb);
746 mutex_unlock(&sbsec->lock);
750 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
751 "security settings for (dev %s, type %s)\n", sb->s_id, name);
755 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
756 struct super_block *newsb)
758 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
759 struct superblock_security_struct *newsbsec = newsb->s_security;
761 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
762 int set_context = (oldsbsec->flags & CONTEXT_MNT);
763 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
766 * if the parent was able to be mounted it clearly had no special lsm
767 * mount options. thus we can safely deal with this superblock later
772 /* how can we clone if the old one wasn't set up?? */
773 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
775 /* if fs is reusing a sb, just let its options stand... */
776 if (newsbsec->flags & SE_SBINITIALIZED)
779 mutex_lock(&newsbsec->lock);
781 newsbsec->flags = oldsbsec->flags;
783 newsbsec->sid = oldsbsec->sid;
784 newsbsec->def_sid = oldsbsec->def_sid;
785 newsbsec->behavior = oldsbsec->behavior;
788 u32 sid = oldsbsec->mntpoint_sid;
792 if (!set_rootcontext) {
793 struct inode *newinode = newsb->s_root->d_inode;
794 struct inode_security_struct *newisec = newinode->i_security;
797 newsbsec->mntpoint_sid = sid;
799 if (set_rootcontext) {
800 const struct inode *oldinode = oldsb->s_root->d_inode;
801 const struct inode_security_struct *oldisec = oldinode->i_security;
802 struct inode *newinode = newsb->s_root->d_inode;
803 struct inode_security_struct *newisec = newinode->i_security;
805 newisec->sid = oldisec->sid;
808 sb_finish_set_opts(newsb);
809 mutex_unlock(&newsbsec->lock);
812 static int selinux_parse_opts_str(char *options,
813 struct security_mnt_opts *opts)
816 char *context = NULL, *defcontext = NULL;
817 char *fscontext = NULL, *rootcontext = NULL;
818 int rc, num_mnt_opts = 0;
820 opts->num_mnt_opts = 0;
822 /* Standard string-based options. */
823 while ((p = strsep(&options, "|")) != NULL) {
825 substring_t args[MAX_OPT_ARGS];
830 token = match_token(p, tokens, args);
834 if (context || defcontext) {
836 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
839 context = match_strdup(&args[0]);
849 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
852 fscontext = match_strdup(&args[0]);
859 case Opt_rootcontext:
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
865 rootcontext = match_strdup(&args[0]);
873 if (context || defcontext) {
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
878 defcontext = match_strdup(&args[0]);
884 case Opt_labelsupport:
888 printk(KERN_WARNING "SELinux: unknown mount option\n");
895 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
899 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
900 if (!opts->mnt_opts_flags) {
901 kfree(opts->mnt_opts);
906 opts->mnt_opts[num_mnt_opts] = fscontext;
907 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
910 opts->mnt_opts[num_mnt_opts] = context;
911 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
914 opts->mnt_opts[num_mnt_opts] = rootcontext;
915 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
918 opts->mnt_opts[num_mnt_opts] = defcontext;
919 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
922 opts->num_mnt_opts = num_mnt_opts;
933 * string mount options parsing and call set the sbsec
935 static int superblock_doinit(struct super_block *sb, void *data)
938 char *options = data;
939 struct security_mnt_opts opts;
941 security_init_mnt_opts(&opts);
946 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
948 rc = selinux_parse_opts_str(options, &opts);
953 rc = selinux_set_mnt_opts(sb, &opts);
956 security_free_mnt_opts(&opts);
960 static void selinux_write_opts(struct seq_file *m,
961 struct security_mnt_opts *opts)
966 for (i = 0; i < opts->num_mnt_opts; i++) {
969 if (opts->mnt_opts[i])
970 has_comma = strchr(opts->mnt_opts[i], ',');
974 switch (opts->mnt_opts_flags[i]) {
976 prefix = CONTEXT_STR;
979 prefix = FSCONTEXT_STR;
981 case ROOTCONTEXT_MNT:
982 prefix = ROOTCONTEXT_STR;
985 prefix = DEFCONTEXT_STR;
989 seq_puts(m, LABELSUPP_STR);
994 /* we need a comma before each option */
999 seq_puts(m, opts->mnt_opts[i]);
1005 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1007 struct security_mnt_opts opts;
1010 rc = selinux_get_mnt_opts(sb, &opts);
1012 /* before policy load we may get EINVAL, don't show anything */
1018 selinux_write_opts(m, &opts);
1020 security_free_mnt_opts(&opts);
1025 static inline u16 inode_mode_to_security_class(umode_t mode)
1027 switch (mode & S_IFMT) {
1029 return SECCLASS_SOCK_FILE;
1031 return SECCLASS_LNK_FILE;
1033 return SECCLASS_FILE;
1035 return SECCLASS_BLK_FILE;
1037 return SECCLASS_DIR;
1039 return SECCLASS_CHR_FILE;
1041 return SECCLASS_FIFO_FILE;
1045 return SECCLASS_FILE;
1048 static inline int default_protocol_stream(int protocol)
1050 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1053 static inline int default_protocol_dgram(int protocol)
1055 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1058 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1064 case SOCK_SEQPACKET:
1065 return SECCLASS_UNIX_STREAM_SOCKET;
1067 return SECCLASS_UNIX_DGRAM_SOCKET;
1074 if (default_protocol_stream(protocol))
1075 return SECCLASS_TCP_SOCKET;
1077 return SECCLASS_RAWIP_SOCKET;
1079 if (default_protocol_dgram(protocol))
1080 return SECCLASS_UDP_SOCKET;
1082 return SECCLASS_RAWIP_SOCKET;
1084 return SECCLASS_DCCP_SOCKET;
1086 return SECCLASS_RAWIP_SOCKET;
1092 return SECCLASS_NETLINK_ROUTE_SOCKET;
1093 case NETLINK_FIREWALL:
1094 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1095 case NETLINK_INET_DIAG:
1096 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1098 return SECCLASS_NETLINK_NFLOG_SOCKET;
1100 return SECCLASS_NETLINK_XFRM_SOCKET;
1101 case NETLINK_SELINUX:
1102 return SECCLASS_NETLINK_SELINUX_SOCKET;
1104 return SECCLASS_NETLINK_AUDIT_SOCKET;
1105 case NETLINK_IP6_FW:
1106 return SECCLASS_NETLINK_IP6FW_SOCKET;
1107 case NETLINK_DNRTMSG:
1108 return SECCLASS_NETLINK_DNRT_SOCKET;
1109 case NETLINK_KOBJECT_UEVENT:
1110 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1112 return SECCLASS_NETLINK_SOCKET;
1115 return SECCLASS_PACKET_SOCKET;
1117 return SECCLASS_KEY_SOCKET;
1119 return SECCLASS_APPLETALK_SOCKET;
1122 return SECCLASS_SOCKET;
1125 #ifdef CONFIG_PROC_FS
1126 static int selinux_proc_get_sid(struct dentry *dentry,
1131 char *buffer, *path;
1133 buffer = (char *)__get_free_page(GFP_KERNEL);
1137 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1141 /* each process gets a /proc/PID/ entry. Strip off the
1142 * PID part to get a valid selinux labeling.
1143 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1144 while (path[1] >= '0' && path[1] <= '9') {
1148 rc = security_genfs_sid("proc", path, tclass, sid);
1150 free_page((unsigned long)buffer);
1154 static int selinux_proc_get_sid(struct dentry *dentry,
1162 /* The inode's security attributes must be initialized before first use. */
1163 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1165 struct superblock_security_struct *sbsec = NULL;
1166 struct inode_security_struct *isec = inode->i_security;
1168 struct dentry *dentry;
1169 #define INITCONTEXTLEN 255
1170 char *context = NULL;
1174 if (isec->initialized)
1177 mutex_lock(&isec->lock);
1178 if (isec->initialized)
1181 sbsec = inode->i_sb->s_security;
1182 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1183 /* Defer initialization until selinux_complete_init,
1184 after the initial policy is loaded and the security
1185 server is ready to handle calls. */
1186 spin_lock(&sbsec->isec_lock);
1187 if (list_empty(&isec->list))
1188 list_add(&isec->list, &sbsec->isec_head);
1189 spin_unlock(&sbsec->isec_lock);
1193 switch (sbsec->behavior) {
1194 case SECURITY_FS_USE_XATTR:
1195 if (!inode->i_op->getxattr) {
1196 isec->sid = sbsec->def_sid;
1200 /* Need a dentry, since the xattr API requires one.
1201 Life would be simpler if we could just pass the inode. */
1203 /* Called from d_instantiate or d_splice_alias. */
1204 dentry = dget(opt_dentry);
1206 /* Called from selinux_complete_init, try to find a dentry. */
1207 dentry = d_find_alias(inode);
1211 * this is can be hit on boot when a file is accessed
1212 * before the policy is loaded. When we load policy we
1213 * may find inodes that have no dentry on the
1214 * sbsec->isec_head list. No reason to complain as these
1215 * will get fixed up the next time we go through
1216 * inode_doinit with a dentry, before these inodes could
1217 * be used again by userspace.
1222 len = INITCONTEXTLEN;
1223 context = kmalloc(len+1, GFP_NOFS);
1229 context[len] = '\0';
1230 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1232 if (rc == -ERANGE) {
1235 /* Need a larger buffer. Query for the right size. */
1236 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1243 context = kmalloc(len+1, GFP_NOFS);
1249 context[len] = '\0';
1250 rc = inode->i_op->getxattr(dentry,
1256 if (rc != -ENODATA) {
1257 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1258 "%d for dev=%s ino=%ld\n", __func__,
1259 -rc, inode->i_sb->s_id, inode->i_ino);
1263 /* Map ENODATA to the default file SID */
1264 sid = sbsec->def_sid;
1267 rc = security_context_to_sid_default(context, rc, &sid,
1271 char *dev = inode->i_sb->s_id;
1272 unsigned long ino = inode->i_ino;
1274 if (rc == -EINVAL) {
1275 if (printk_ratelimit())
1276 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1277 "context=%s. This indicates you may need to relabel the inode or the "
1278 "filesystem in question.\n", ino, dev, context);
1280 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1281 "returned %d for dev=%s ino=%ld\n",
1282 __func__, context, -rc, dev, ino);
1285 /* Leave with the unlabeled SID */
1293 case SECURITY_FS_USE_TASK:
1294 isec->sid = isec->task_sid;
1296 case SECURITY_FS_USE_TRANS:
1297 /* Default to the fs SID. */
1298 isec->sid = sbsec->sid;
1300 /* Try to obtain a transition SID. */
1301 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1302 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1303 isec->sclass, NULL, &sid);
1308 case SECURITY_FS_USE_MNTPOINT:
1309 isec->sid = sbsec->mntpoint_sid;
1312 /* Default to the fs superblock SID. */
1313 isec->sid = sbsec->sid;
1315 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1317 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1318 rc = selinux_proc_get_sid(opt_dentry,
1329 isec->initialized = 1;
1332 mutex_unlock(&isec->lock);
1334 if (isec->sclass == SECCLASS_FILE)
1335 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1339 /* Convert a Linux signal to an access vector. */
1340 static inline u32 signal_to_av(int sig)
1346 /* Commonly granted from child to parent. */
1347 perm = PROCESS__SIGCHLD;
1350 /* Cannot be caught or ignored */
1351 perm = PROCESS__SIGKILL;
1354 /* Cannot be caught or ignored */
1355 perm = PROCESS__SIGSTOP;
1358 /* All other signals. */
1359 perm = PROCESS__SIGNAL;
1367 * Check permission between a pair of credentials
1368 * fork check, ptrace check, etc.
1370 static int cred_has_perm(const struct cred *actor,
1371 const struct cred *target,
1374 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1376 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1380 * Check permission between a pair of tasks, e.g. signal checks,
1381 * fork check, ptrace check, etc.
1382 * tsk1 is the actor and tsk2 is the target
1383 * - this uses the default subjective creds of tsk1
1385 static int task_has_perm(const struct task_struct *tsk1,
1386 const struct task_struct *tsk2,
1389 const struct task_security_struct *__tsec1, *__tsec2;
1393 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1394 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1396 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1400 * Check permission between current and another task, e.g. signal checks,
1401 * fork check, ptrace check, etc.
1402 * current is the actor and tsk2 is the target
1403 * - this uses current's subjective creds
1405 static int current_has_perm(const struct task_struct *tsk,
1410 sid = current_sid();
1411 tsid = task_sid(tsk);
1412 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1415 #if CAP_LAST_CAP > 63
1416 #error Fix SELinux to handle capabilities > 63.
1419 /* Check whether a task is allowed to use a capability. */
1420 static int task_has_capability(struct task_struct *tsk,
1421 const struct cred *cred,
1424 struct common_audit_data ad;
1425 struct av_decision avd;
1427 u32 sid = cred_sid(cred);
1428 u32 av = CAP_TO_MASK(cap);
1431 COMMON_AUDIT_DATA_INIT(&ad, CAP);
1435 switch (CAP_TO_INDEX(cap)) {
1437 sclass = SECCLASS_CAPABILITY;
1440 sclass = SECCLASS_CAPABILITY2;
1444 "SELinux: out of range capability %d\n", cap);
1448 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1449 if (audit == SECURITY_CAP_AUDIT) {
1450 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1457 /* Check whether a task is allowed to use a system operation. */
1458 static int task_has_system(struct task_struct *tsk,
1461 u32 sid = task_sid(tsk);
1463 return avc_has_perm(sid, SECINITSID_KERNEL,
1464 SECCLASS_SYSTEM, perms, NULL);
1467 /* Check whether a task has a particular permission to an inode.
1468 The 'adp' parameter is optional and allows other audit
1469 data to be passed (e.g. the dentry). */
1470 static int inode_has_perm(const struct cred *cred,
1471 struct inode *inode,
1473 struct common_audit_data *adp,
1476 struct inode_security_struct *isec;
1477 struct common_audit_data ad;
1480 validate_creds(cred);
1482 if (unlikely(IS_PRIVATE(inode)))
1485 sid = cred_sid(cred);
1486 isec = inode->i_security;
1490 COMMON_AUDIT_DATA_INIT(&ad, FS);
1491 ad.u.fs.inode = inode;
1494 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1497 /* Same as inode_has_perm, but pass explicit audit data containing
1498 the dentry to help the auditing code to more easily generate the
1499 pathname if needed. */
1500 static inline int dentry_has_perm(const struct cred *cred,
1501 struct vfsmount *mnt,
1502 struct dentry *dentry,
1505 struct inode *inode = dentry->d_inode;
1506 struct common_audit_data ad;
1508 COMMON_AUDIT_DATA_INIT(&ad, FS);
1509 ad.u.fs.path.mnt = mnt;
1510 ad.u.fs.path.dentry = dentry;
1511 return inode_has_perm(cred, inode, av, &ad, 0);
1514 /* Check whether a task can use an open file descriptor to
1515 access an inode in a given way. Check access to the
1516 descriptor itself, and then use dentry_has_perm to
1517 check a particular permission to the file.
1518 Access to the descriptor is implicitly granted if it
1519 has the same SID as the process. If av is zero, then
1520 access to the file is not checked, e.g. for cases
1521 where only the descriptor is affected like seek. */
1522 static int file_has_perm(const struct cred *cred,
1526 struct file_security_struct *fsec = file->f_security;
1527 struct inode *inode = file->f_path.dentry->d_inode;
1528 struct common_audit_data ad;
1529 u32 sid = cred_sid(cred);
1532 COMMON_AUDIT_DATA_INIT(&ad, FS);
1533 ad.u.fs.path = file->f_path;
1535 if (sid != fsec->sid) {
1536 rc = avc_has_perm(sid, fsec->sid,
1544 /* av is zero if only checking access to the descriptor. */
1547 rc = inode_has_perm(cred, inode, av, &ad, 0);
1553 /* Check whether a task can create a file. */
1554 static int may_create(struct inode *dir,
1555 struct dentry *dentry,
1558 const struct task_security_struct *tsec = current_security();
1559 struct inode_security_struct *dsec;
1560 struct superblock_security_struct *sbsec;
1562 struct common_audit_data ad;
1565 dsec = dir->i_security;
1566 sbsec = dir->i_sb->s_security;
1569 newsid = tsec->create_sid;
1571 COMMON_AUDIT_DATA_INIT(&ad, FS);
1572 ad.u.fs.path.dentry = dentry;
1574 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1575 DIR__ADD_NAME | DIR__SEARCH,
1580 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1581 rc = security_transition_sid(sid, dsec->sid, tclass, NULL, &newsid);
1586 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1590 return avc_has_perm(newsid, sbsec->sid,
1591 SECCLASS_FILESYSTEM,
1592 FILESYSTEM__ASSOCIATE, &ad);
1595 /* Check whether a task can create a key. */
1596 static int may_create_key(u32 ksid,
1597 struct task_struct *ctx)
1599 u32 sid = task_sid(ctx);
1601 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1605 #define MAY_UNLINK 1
1608 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1609 static int may_link(struct inode *dir,
1610 struct dentry *dentry,
1614 struct inode_security_struct *dsec, *isec;
1615 struct common_audit_data ad;
1616 u32 sid = current_sid();
1620 dsec = dir->i_security;
1621 isec = dentry->d_inode->i_security;
1623 COMMON_AUDIT_DATA_INIT(&ad, FS);
1624 ad.u.fs.path.dentry = dentry;
1627 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1628 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1643 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1648 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1652 static inline int may_rename(struct inode *old_dir,
1653 struct dentry *old_dentry,
1654 struct inode *new_dir,
1655 struct dentry *new_dentry)
1657 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1658 struct common_audit_data ad;
1659 u32 sid = current_sid();
1661 int old_is_dir, new_is_dir;
1664 old_dsec = old_dir->i_security;
1665 old_isec = old_dentry->d_inode->i_security;
1666 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1667 new_dsec = new_dir->i_security;
1669 COMMON_AUDIT_DATA_INIT(&ad, FS);
1671 ad.u.fs.path.dentry = old_dentry;
1672 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1673 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1676 rc = avc_has_perm(sid, old_isec->sid,
1677 old_isec->sclass, FILE__RENAME, &ad);
1680 if (old_is_dir && new_dir != old_dir) {
1681 rc = avc_has_perm(sid, old_isec->sid,
1682 old_isec->sclass, DIR__REPARENT, &ad);
1687 ad.u.fs.path.dentry = new_dentry;
1688 av = DIR__ADD_NAME | DIR__SEARCH;
1689 if (new_dentry->d_inode)
1690 av |= DIR__REMOVE_NAME;
1691 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1694 if (new_dentry->d_inode) {
1695 new_isec = new_dentry->d_inode->i_security;
1696 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1697 rc = avc_has_perm(sid, new_isec->sid,
1699 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1707 /* Check whether a task can perform a filesystem operation. */
1708 static int superblock_has_perm(const struct cred *cred,
1709 struct super_block *sb,
1711 struct common_audit_data *ad)
1713 struct superblock_security_struct *sbsec;
1714 u32 sid = cred_sid(cred);
1716 sbsec = sb->s_security;
1717 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1720 /* Convert a Linux mode and permission mask to an access vector. */
1721 static inline u32 file_mask_to_av(int mode, int mask)
1725 if ((mode & S_IFMT) != S_IFDIR) {
1726 if (mask & MAY_EXEC)
1727 av |= FILE__EXECUTE;
1728 if (mask & MAY_READ)
1731 if (mask & MAY_APPEND)
1733 else if (mask & MAY_WRITE)
1737 if (mask & MAY_EXEC)
1739 if (mask & MAY_WRITE)
1741 if (mask & MAY_READ)
1748 /* Convert a Linux file to an access vector. */
1749 static inline u32 file_to_av(struct file *file)
1753 if (file->f_mode & FMODE_READ)
1755 if (file->f_mode & FMODE_WRITE) {
1756 if (file->f_flags & O_APPEND)
1763 * Special file opened with flags 3 for ioctl-only use.
1772 * Convert a file to an access vector and include the correct open
1775 static inline u32 open_file_to_av(struct file *file)
1777 u32 av = file_to_av(file);
1779 if (selinux_policycap_openperm)
1785 /* Hook functions begin here. */
1787 static int selinux_ptrace_access_check(struct task_struct *child,
1792 rc = cap_ptrace_access_check(child, mode);
1796 if (mode == PTRACE_MODE_READ) {
1797 u32 sid = current_sid();
1798 u32 csid = task_sid(child);
1799 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1802 return current_has_perm(child, PROCESS__PTRACE);
1805 static int selinux_ptrace_traceme(struct task_struct *parent)
1809 rc = cap_ptrace_traceme(parent);
1813 return task_has_perm(parent, current, PROCESS__PTRACE);
1816 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1817 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1821 error = current_has_perm(target, PROCESS__GETCAP);
1825 return cap_capget(target, effective, inheritable, permitted);
1828 static int selinux_capset(struct cred *new, const struct cred *old,
1829 const kernel_cap_t *effective,
1830 const kernel_cap_t *inheritable,
1831 const kernel_cap_t *permitted)
1835 error = cap_capset(new, old,
1836 effective, inheritable, permitted);
1840 return cred_has_perm(old, new, PROCESS__SETCAP);
1844 * (This comment used to live with the selinux_task_setuid hook,
1845 * which was removed).
1847 * Since setuid only affects the current process, and since the SELinux
1848 * controls are not based on the Linux identity attributes, SELinux does not
1849 * need to control this operation. However, SELinux does control the use of
1850 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1853 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1854 struct user_namespace *ns, int cap, int audit)
1858 rc = cap_capable(tsk, cred, ns, cap, audit);
1862 return task_has_capability(tsk, cred, cap, audit);
1865 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1867 const struct cred *cred = current_cred();
1879 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1884 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1887 rc = 0; /* let the kernel handle invalid cmds */
1893 static int selinux_quota_on(struct dentry *dentry)
1895 const struct cred *cred = current_cred();
1897 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
1900 static int selinux_syslog(int type)
1905 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1906 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1907 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1909 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1910 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1911 /* Set level of messages printed to console */
1912 case SYSLOG_ACTION_CONSOLE_LEVEL:
1913 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1915 case SYSLOG_ACTION_CLOSE: /* Close log */
1916 case SYSLOG_ACTION_OPEN: /* Open log */
1917 case SYSLOG_ACTION_READ: /* Read from log */
1918 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1919 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1921 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1928 * Check that a process has enough memory to allocate a new virtual
1929 * mapping. 0 means there is enough memory for the allocation to
1930 * succeed and -ENOMEM implies there is not.
1932 * Do not audit the selinux permission check, as this is applied to all
1933 * processes that allocate mappings.
1935 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1937 int rc, cap_sys_admin = 0;
1939 rc = selinux_capable(current, current_cred(),
1940 &init_user_ns, CAP_SYS_ADMIN,
1941 SECURITY_CAP_NOAUDIT);
1945 return __vm_enough_memory(mm, pages, cap_sys_admin);
1948 /* binprm security operations */
1950 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1952 const struct task_security_struct *old_tsec;
1953 struct task_security_struct *new_tsec;
1954 struct inode_security_struct *isec;
1955 struct common_audit_data ad;
1956 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1959 rc = cap_bprm_set_creds(bprm);
1963 /* SELinux context only depends on initial program or script and not
1964 * the script interpreter */
1965 if (bprm->cred_prepared)
1968 old_tsec = current_security();
1969 new_tsec = bprm->cred->security;
1970 isec = inode->i_security;
1972 /* Default to the current task SID. */
1973 new_tsec->sid = old_tsec->sid;
1974 new_tsec->osid = old_tsec->sid;
1976 /* Reset fs, key, and sock SIDs on execve. */
1977 new_tsec->create_sid = 0;
1978 new_tsec->keycreate_sid = 0;
1979 new_tsec->sockcreate_sid = 0;
1981 if (old_tsec->exec_sid) {
1982 new_tsec->sid = old_tsec->exec_sid;
1983 /* Reset exec SID on execve. */
1984 new_tsec->exec_sid = 0;
1986 /* Check for a default transition on this program. */
1987 rc = security_transition_sid(old_tsec->sid, isec->sid,
1988 SECCLASS_PROCESS, NULL,
1994 COMMON_AUDIT_DATA_INIT(&ad, FS);
1995 ad.u.fs.path = bprm->file->f_path;
1997 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1998 new_tsec->sid = old_tsec->sid;
2000 if (new_tsec->sid == old_tsec->sid) {
2001 rc = avc_has_perm(old_tsec->sid, isec->sid,
2002 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2006 /* Check permissions for the transition. */
2007 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2008 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2012 rc = avc_has_perm(new_tsec->sid, isec->sid,
2013 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2017 /* Check for shared state */
2018 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2019 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2020 SECCLASS_PROCESS, PROCESS__SHARE,
2026 /* Make sure that anyone attempting to ptrace over a task that
2027 * changes its SID has the appropriate permit */
2029 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2030 struct task_struct *tracer;
2031 struct task_security_struct *sec;
2035 tracer = tracehook_tracer_task(current);
2036 if (likely(tracer != NULL)) {
2037 sec = __task_cred(tracer)->security;
2043 rc = avc_has_perm(ptsid, new_tsec->sid,
2045 PROCESS__PTRACE, NULL);
2051 /* Clear any possibly unsafe personality bits on exec: */
2052 bprm->per_clear |= PER_CLEAR_ON_SETID;
2058 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2060 const struct task_security_struct *tsec = current_security();
2068 /* Enable secure mode for SIDs transitions unless
2069 the noatsecure permission is granted between
2070 the two SIDs, i.e. ahp returns 0. */
2071 atsecure = avc_has_perm(osid, sid,
2073 PROCESS__NOATSECURE, NULL);
2076 return (atsecure || cap_bprm_secureexec(bprm));
2079 extern struct vfsmount *selinuxfs_mount;
2080 extern struct dentry *selinux_null;
2082 /* Derived from fs/exec.c:flush_old_files. */
2083 static inline void flush_unauthorized_files(const struct cred *cred,
2084 struct files_struct *files)
2086 struct common_audit_data ad;
2087 struct file *file, *devnull = NULL;
2088 struct tty_struct *tty;
2089 struct fdtable *fdt;
2093 tty = get_current_tty();
2095 spin_lock(&tty_files_lock);
2096 if (!list_empty(&tty->tty_files)) {
2097 struct tty_file_private *file_priv;
2098 struct inode *inode;
2100 /* Revalidate access to controlling tty.
2101 Use inode_has_perm on the tty inode directly rather
2102 than using file_has_perm, as this particular open
2103 file may belong to another process and we are only
2104 interested in the inode-based check here. */
2105 file_priv = list_first_entry(&tty->tty_files,
2106 struct tty_file_private, list);
2107 file = file_priv->file;
2108 inode = file->f_path.dentry->d_inode;
2109 if (inode_has_perm(cred, inode,
2110 FILE__READ | FILE__WRITE, NULL, 0)) {
2114 spin_unlock(&tty_files_lock);
2117 /* Reset controlling tty. */
2121 /* Revalidate access to inherited open files. */
2123 COMMON_AUDIT_DATA_INIT(&ad, FS);
2125 spin_lock(&files->file_lock);
2127 unsigned long set, i;
2132 fdt = files_fdtable(files);
2133 if (i >= fdt->max_fds)
2135 set = fdt->open_fds->fds_bits[j];
2138 spin_unlock(&files->file_lock);
2139 for ( ; set ; i++, set >>= 1) {
2144 if (file_has_perm(cred,
2146 file_to_av(file))) {
2148 fd = get_unused_fd();
2158 devnull = dentry_open(
2160 mntget(selinuxfs_mount),
2162 if (IS_ERR(devnull)) {
2169 fd_install(fd, devnull);
2174 spin_lock(&files->file_lock);
2177 spin_unlock(&files->file_lock);
2181 * Prepare a process for imminent new credential changes due to exec
2183 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2185 struct task_security_struct *new_tsec;
2186 struct rlimit *rlim, *initrlim;
2189 new_tsec = bprm->cred->security;
2190 if (new_tsec->sid == new_tsec->osid)
2193 /* Close files for which the new task SID is not authorized. */
2194 flush_unauthorized_files(bprm->cred, current->files);
2196 /* Always clear parent death signal on SID transitions. */
2197 current->pdeath_signal = 0;
2199 /* Check whether the new SID can inherit resource limits from the old
2200 * SID. If not, reset all soft limits to the lower of the current
2201 * task's hard limit and the init task's soft limit.
2203 * Note that the setting of hard limits (even to lower them) can be
2204 * controlled by the setrlimit check. The inclusion of the init task's
2205 * soft limit into the computation is to avoid resetting soft limits
2206 * higher than the default soft limit for cases where the default is
2207 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2209 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2210 PROCESS__RLIMITINH, NULL);
2212 /* protect against do_prlimit() */
2214 for (i = 0; i < RLIM_NLIMITS; i++) {
2215 rlim = current->signal->rlim + i;
2216 initrlim = init_task.signal->rlim + i;
2217 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2219 task_unlock(current);
2220 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2225 * Clean up the process immediately after the installation of new credentials
2228 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2230 const struct task_security_struct *tsec = current_security();
2231 struct itimerval itimer;
2241 /* Check whether the new SID can inherit signal state from the old SID.
2242 * If not, clear itimers to avoid subsequent signal generation and
2243 * flush and unblock signals.
2245 * This must occur _after_ the task SID has been updated so that any
2246 * kill done after the flush will be checked against the new SID.
2248 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2250 memset(&itimer, 0, sizeof itimer);
2251 for (i = 0; i < 3; i++)
2252 do_setitimer(i, &itimer, NULL);
2253 spin_lock_irq(¤t->sighand->siglock);
2254 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2255 __flush_signals(current);
2256 flush_signal_handlers(current, 1);
2257 sigemptyset(¤t->blocked);
2259 spin_unlock_irq(¤t->sighand->siglock);
2262 /* Wake up the parent if it is waiting so that it can recheck
2263 * wait permission to the new task SID. */
2264 read_lock(&tasklist_lock);
2265 __wake_up_parent(current, current->real_parent);
2266 read_unlock(&tasklist_lock);
2269 /* superblock security operations */
2271 static int selinux_sb_alloc_security(struct super_block *sb)
2273 return superblock_alloc_security(sb);
2276 static void selinux_sb_free_security(struct super_block *sb)
2278 superblock_free_security(sb);
2281 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2286 return !memcmp(prefix, option, plen);
2289 static inline int selinux_option(char *option, int len)
2291 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2292 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2293 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2294 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2295 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2298 static inline void take_option(char **to, char *from, int *first, int len)
2305 memcpy(*to, from, len);
2309 static inline void take_selinux_option(char **to, char *from, int *first,
2312 int current_size = 0;
2320 while (current_size < len) {
2330 static int selinux_sb_copy_data(char *orig, char *copy)
2332 int fnosec, fsec, rc = 0;
2333 char *in_save, *in_curr, *in_end;
2334 char *sec_curr, *nosec_save, *nosec;
2340 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2348 in_save = in_end = orig;
2352 open_quote = !open_quote;
2353 if ((*in_end == ',' && open_quote == 0) ||
2355 int len = in_end - in_curr;
2357 if (selinux_option(in_curr, len))
2358 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2360 take_option(&nosec, in_curr, &fnosec, len);
2362 in_curr = in_end + 1;
2364 } while (*in_end++);
2366 strcpy(in_save, nosec_save);
2367 free_page((unsigned long)nosec_save);
2372 static int selinux_sb_remount(struct super_block *sb, void *data)
2375 struct security_mnt_opts opts;
2376 char *secdata, **mount_options;
2377 struct superblock_security_struct *sbsec = sb->s_security;
2379 if (!(sbsec->flags & SE_SBINITIALIZED))
2385 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2388 security_init_mnt_opts(&opts);
2389 secdata = alloc_secdata();
2392 rc = selinux_sb_copy_data(data, secdata);
2394 goto out_free_secdata;
2396 rc = selinux_parse_opts_str(secdata, &opts);
2398 goto out_free_secdata;
2400 mount_options = opts.mnt_opts;
2401 flags = opts.mnt_opts_flags;
2403 for (i = 0; i < opts.num_mnt_opts; i++) {
2407 if (flags[i] == SE_SBLABELSUPP)
2409 len = strlen(mount_options[i]);
2410 rc = security_context_to_sid(mount_options[i], len, &sid);
2412 printk(KERN_WARNING "SELinux: security_context_to_sid"
2413 "(%s) failed for (dev %s, type %s) errno=%d\n",
2414 mount_options[i], sb->s_id, sb->s_type->name, rc);
2420 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2421 goto out_bad_option;
2424 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2425 goto out_bad_option;
2427 case ROOTCONTEXT_MNT: {
2428 struct inode_security_struct *root_isec;
2429 root_isec = sb->s_root->d_inode->i_security;
2431 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2432 goto out_bad_option;
2435 case DEFCONTEXT_MNT:
2436 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2437 goto out_bad_option;
2446 security_free_mnt_opts(&opts);
2448 free_secdata(secdata);
2451 printk(KERN_WARNING "SELinux: unable to change security options "
2452 "during remount (dev %s, type=%s)\n", sb->s_id,
2457 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2459 const struct cred *cred = current_cred();
2460 struct common_audit_data ad;
2463 rc = superblock_doinit(sb, data);
2467 /* Allow all mounts performed by the kernel */
2468 if (flags & MS_KERNMOUNT)
2471 COMMON_AUDIT_DATA_INIT(&ad, FS);
2472 ad.u.fs.path.dentry = sb->s_root;
2473 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2476 static int selinux_sb_statfs(struct dentry *dentry)
2478 const struct cred *cred = current_cred();
2479 struct common_audit_data ad;
2481 COMMON_AUDIT_DATA_INIT(&ad, FS);
2482 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2483 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2486 static int selinux_mount(char *dev_name,
2489 unsigned long flags,
2492 const struct cred *cred = current_cred();
2494 if (flags & MS_REMOUNT)
2495 return superblock_has_perm(cred, path->mnt->mnt_sb,
2496 FILESYSTEM__REMOUNT, NULL);
2498 return dentry_has_perm(cred, path->mnt, path->dentry,
2502 static int selinux_umount(struct vfsmount *mnt, int flags)
2504 const struct cred *cred = current_cred();
2506 return superblock_has_perm(cred, mnt->mnt_sb,
2507 FILESYSTEM__UNMOUNT, NULL);
2510 /* inode security operations */
2512 static int selinux_inode_alloc_security(struct inode *inode)
2514 return inode_alloc_security(inode);
2517 static void selinux_inode_free_security(struct inode *inode)
2519 inode_free_security(inode);
2522 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2523 const struct qstr *qstr, char **name,
2524 void **value, size_t *len)
2526 const struct task_security_struct *tsec = current_security();
2527 struct inode_security_struct *dsec;
2528 struct superblock_security_struct *sbsec;
2529 u32 sid, newsid, clen;
2531 char *namep = NULL, *context;
2533 dsec = dir->i_security;
2534 sbsec = dir->i_sb->s_security;
2537 newsid = tsec->create_sid;
2539 if ((sbsec->flags & SE_SBINITIALIZED) &&
2540 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2541 newsid = sbsec->mntpoint_sid;
2542 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2543 rc = security_transition_sid(sid, dsec->sid,
2544 inode_mode_to_security_class(inode->i_mode),
2547 printk(KERN_WARNING "%s: "
2548 "security_transition_sid failed, rc=%d (dev=%s "
2551 -rc, inode->i_sb->s_id, inode->i_ino);
2556 /* Possibly defer initialization to selinux_complete_init. */
2557 if (sbsec->flags & SE_SBINITIALIZED) {
2558 struct inode_security_struct *isec = inode->i_security;
2559 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2561 isec->initialized = 1;
2564 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2568 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2575 rc = security_sid_to_context_force(newsid, &context, &clen);
2587 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2589 return may_create(dir, dentry, SECCLASS_FILE);
2592 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2594 return may_link(dir, old_dentry, MAY_LINK);
2597 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2599 return may_link(dir, dentry, MAY_UNLINK);
2602 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2604 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2607 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2609 return may_create(dir, dentry, SECCLASS_DIR);
2612 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2614 return may_link(dir, dentry, MAY_RMDIR);
2617 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2619 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2622 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2623 struct inode *new_inode, struct dentry *new_dentry)
2625 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2628 static int selinux_inode_readlink(struct dentry *dentry)
2630 const struct cred *cred = current_cred();
2632 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2635 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2637 const struct cred *cred = current_cred();
2639 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2642 static int selinux_inode_permission(struct inode *inode, int mask, unsigned flags)
2644 const struct cred *cred = current_cred();
2645 struct common_audit_data ad;
2649 from_access = mask & MAY_ACCESS;
2650 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2652 /* No permission to check. Existence test. */
2656 COMMON_AUDIT_DATA_INIT(&ad, FS);
2657 ad.u.fs.inode = inode;
2660 ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
2662 perms = file_mask_to_av(inode->i_mode, mask);
2664 return inode_has_perm(cred, inode, perms, &ad, flags);
2667 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2669 const struct cred *cred = current_cred();
2670 unsigned int ia_valid = iattr->ia_valid;
2672 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2673 if (ia_valid & ATTR_FORCE) {
2674 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2680 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2681 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2682 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2684 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
2687 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2689 const struct cred *cred = current_cred();
2691 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
2694 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2696 const struct cred *cred = current_cred();
2698 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2699 sizeof XATTR_SECURITY_PREFIX - 1)) {
2700 if (!strcmp(name, XATTR_NAME_CAPS)) {
2701 if (!capable(CAP_SETFCAP))
2703 } else if (!capable(CAP_SYS_ADMIN)) {
2704 /* A different attribute in the security namespace.
2705 Restrict to administrator. */
2710 /* Not an attribute we recognize, so just check the
2711 ordinary setattr permission. */
2712 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2715 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2716 const void *value, size_t size, int flags)
2718 struct inode *inode = dentry->d_inode;
2719 struct inode_security_struct *isec = inode->i_security;
2720 struct superblock_security_struct *sbsec;
2721 struct common_audit_data ad;
2722 u32 newsid, sid = current_sid();
2725 if (strcmp(name, XATTR_NAME_SELINUX))
2726 return selinux_inode_setotherxattr(dentry, name);
2728 sbsec = inode->i_sb->s_security;
2729 if (!(sbsec->flags & SE_SBLABELSUPP))
2732 if (!inode_owner_or_capable(inode))
2735 COMMON_AUDIT_DATA_INIT(&ad, FS);
2736 ad.u.fs.path.dentry = dentry;
2738 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2739 FILE__RELABELFROM, &ad);
2743 rc = security_context_to_sid(value, size, &newsid);
2744 if (rc == -EINVAL) {
2745 if (!capable(CAP_MAC_ADMIN))
2747 rc = security_context_to_sid_force(value, size, &newsid);
2752 rc = avc_has_perm(sid, newsid, isec->sclass,
2753 FILE__RELABELTO, &ad);
2757 rc = security_validate_transition(isec->sid, newsid, sid,
2762 return avc_has_perm(newsid,
2764 SECCLASS_FILESYSTEM,
2765 FILESYSTEM__ASSOCIATE,
2769 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2770 const void *value, size_t size,
2773 struct inode *inode = dentry->d_inode;
2774 struct inode_security_struct *isec = inode->i_security;
2778 if (strcmp(name, XATTR_NAME_SELINUX)) {
2779 /* Not an attribute we recognize, so nothing to do. */
2783 rc = security_context_to_sid_force(value, size, &newsid);
2785 printk(KERN_ERR "SELinux: unable to map context to SID"
2786 "for (%s, %lu), rc=%d\n",
2787 inode->i_sb->s_id, inode->i_ino, -rc);
2795 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2797 const struct cred *cred = current_cred();
2799 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2802 static int selinux_inode_listxattr(struct dentry *dentry)
2804 const struct cred *cred = current_cred();
2806 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2809 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2811 if (strcmp(name, XATTR_NAME_SELINUX))
2812 return selinux_inode_setotherxattr(dentry, name);
2814 /* No one is allowed to remove a SELinux security label.
2815 You can change the label, but all data must be labeled. */
2820 * Copy the inode security context value to the user.
2822 * Permission check is handled by selinux_inode_getxattr hook.
2824 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2828 char *context = NULL;
2829 struct inode_security_struct *isec = inode->i_security;
2831 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2835 * If the caller has CAP_MAC_ADMIN, then get the raw context
2836 * value even if it is not defined by current policy; otherwise,
2837 * use the in-core value under current policy.
2838 * Use the non-auditing forms of the permission checks since
2839 * getxattr may be called by unprivileged processes commonly
2840 * and lack of permission just means that we fall back to the
2841 * in-core context value, not a denial.
2843 error = selinux_capable(current, current_cred(),
2844 &init_user_ns, CAP_MAC_ADMIN,
2845 SECURITY_CAP_NOAUDIT);
2847 error = security_sid_to_context_force(isec->sid, &context,
2850 error = security_sid_to_context(isec->sid, &context, &size);
2863 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2864 const void *value, size_t size, int flags)
2866 struct inode_security_struct *isec = inode->i_security;
2870 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2873 if (!value || !size)
2876 rc = security_context_to_sid((void *)value, size, &newsid);
2881 isec->initialized = 1;
2885 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2887 const int len = sizeof(XATTR_NAME_SELINUX);
2888 if (buffer && len <= buffer_size)
2889 memcpy(buffer, XATTR_NAME_SELINUX, len);
2893 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2895 struct inode_security_struct *isec = inode->i_security;
2899 /* file security operations */
2901 static int selinux_revalidate_file_permission(struct file *file, int mask)
2903 const struct cred *cred = current_cred();
2904 struct inode *inode = file->f_path.dentry->d_inode;
2906 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2907 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2910 return file_has_perm(cred, file,
2911 file_mask_to_av(inode->i_mode, mask));
2914 static int selinux_file_permission(struct file *file, int mask)
2916 struct inode *inode = file->f_path.dentry->d_inode;
2917 struct file_security_struct *fsec = file->f_security;
2918 struct inode_security_struct *isec = inode->i_security;
2919 u32 sid = current_sid();
2922 /* No permission to check. Existence test. */
2925 if (sid == fsec->sid && fsec->isid == isec->sid &&
2926 fsec->pseqno == avc_policy_seqno())
2927 /* No change since dentry_open check. */
2930 return selinux_revalidate_file_permission(file, mask);
2933 static int selinux_file_alloc_security(struct file *file)
2935 return file_alloc_security(file);
2938 static void selinux_file_free_security(struct file *file)
2940 file_free_security(file);
2943 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2946 const struct cred *cred = current_cred();
2956 case EXT2_IOC_GETFLAGS:
2958 case EXT2_IOC_GETVERSION:
2959 error = file_has_perm(cred, file, FILE__GETATTR);
2962 case EXT2_IOC_SETFLAGS:
2964 case EXT2_IOC_SETVERSION:
2965 error = file_has_perm(cred, file, FILE__SETATTR);
2968 /* sys_ioctl() checks */
2972 error = file_has_perm(cred, file, 0);
2977 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
2978 SECURITY_CAP_AUDIT);
2981 /* default case assumes that the command will go
2982 * to the file's ioctl() function.
2985 error = file_has_perm(cred, file, FILE__IOCTL);
2990 static int default_noexec;
2992 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2994 const struct cred *cred = current_cred();
2997 if (default_noexec &&
2998 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3000 * We are making executable an anonymous mapping or a
3001 * private file mapping that will also be writable.
3002 * This has an additional check.
3004 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3010 /* read access is always possible with a mapping */
3011 u32 av = FILE__READ;
3013 /* write access only matters if the mapping is shared */
3014 if (shared && (prot & PROT_WRITE))
3017 if (prot & PROT_EXEC)
3018 av |= FILE__EXECUTE;
3020 return file_has_perm(cred, file, av);
3027 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3028 unsigned long prot, unsigned long flags,
3029 unsigned long addr, unsigned long addr_only)
3032 u32 sid = current_sid();
3035 * notice that we are intentionally putting the SELinux check before
3036 * the secondary cap_file_mmap check. This is such a likely attempt
3037 * at bad behaviour/exploit that we always want to get the AVC, even
3038 * if DAC would have also denied the operation.
3040 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3041 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3042 MEMPROTECT__MMAP_ZERO, NULL);
3047 /* do DAC check on address space usage */
3048 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3049 if (rc || addr_only)
3052 if (selinux_checkreqprot)
3055 return file_map_prot_check(file, prot,
3056 (flags & MAP_TYPE) == MAP_SHARED);
3059 static int selinux_file_mprotect(struct vm_area_struct *vma,
3060 unsigned long reqprot,
3063 const struct cred *cred = current_cred();
3065 if (selinux_checkreqprot)
3068 if (default_noexec &&
3069 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3071 if (vma->vm_start >= vma->vm_mm->start_brk &&
3072 vma->vm_end <= vma->vm_mm->brk) {
3073 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3074 } else if (!vma->vm_file &&
3075 vma->vm_start <= vma->vm_mm->start_stack &&
3076 vma->vm_end >= vma->vm_mm->start_stack) {
3077 rc = current_has_perm(current, PROCESS__EXECSTACK);
3078 } else if (vma->vm_file && vma->anon_vma) {
3080 * We are making executable a file mapping that has
3081 * had some COW done. Since pages might have been
3082 * written, check ability to execute the possibly
3083 * modified content. This typically should only
3084 * occur for text relocations.
3086 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3092 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3095 static int selinux_file_lock(struct file *file, unsigned int cmd)
3097 const struct cred *cred = current_cred();
3099 return file_has_perm(cred, file, FILE__LOCK);
3102 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3105 const struct cred *cred = current_cred();
3110 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3115 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3116 err = file_has_perm(cred, file, FILE__WRITE);
3125 /* Just check FD__USE permission */
3126 err = file_has_perm(cred, file, 0);
3131 #if BITS_PER_LONG == 32
3136 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3140 err = file_has_perm(cred, file, FILE__LOCK);
3147 static int selinux_file_set_fowner(struct file *file)
3149 struct file_security_struct *fsec;
3151 fsec = file->f_security;
3152 fsec->fown_sid = current_sid();
3157 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3158 struct fown_struct *fown, int signum)
3161 u32 sid = task_sid(tsk);
3163 struct file_security_struct *fsec;
3165 /* struct fown_struct is never outside the context of a struct file */
3166 file = container_of(fown, struct file, f_owner);
3168 fsec = file->f_security;
3171 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3173 perm = signal_to_av(signum);
3175 return avc_has_perm(fsec->fown_sid, sid,
3176 SECCLASS_PROCESS, perm, NULL);
3179 static int selinux_file_receive(struct file *file)
3181 const struct cred *cred = current_cred();
3183 return file_has_perm(cred, file, file_to_av(file));
3186 static int selinux_dentry_open(struct file *file, const struct cred *cred)
3188 struct file_security_struct *fsec;
3189 struct inode *inode;
3190 struct inode_security_struct *isec;
3192 inode = file->f_path.dentry->d_inode;
3193 fsec = file->f_security;
3194 isec = inode->i_security;
3196 * Save inode label and policy sequence number
3197 * at open-time so that selinux_file_permission
3198 * can determine whether revalidation is necessary.
3199 * Task label is already saved in the file security
3200 * struct as its SID.
3202 fsec->isid = isec->sid;
3203 fsec->pseqno = avc_policy_seqno();
3205 * Since the inode label or policy seqno may have changed
3206 * between the selinux_inode_permission check and the saving
3207 * of state above, recheck that access is still permitted.
3208 * Otherwise, access might never be revalidated against the
3209 * new inode label or new policy.
3210 * This check is not redundant - do not remove.
3212 return inode_has_perm(cred, inode, open_file_to_av(file), NULL, 0);
3215 /* task security operations */
3217 static int selinux_task_create(unsigned long clone_flags)
3219 return current_has_perm(current, PROCESS__FORK);
3223 * allocate the SELinux part of blank credentials
3225 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3227 struct task_security_struct *tsec;
3229 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3233 cred->security = tsec;
3238 * detach and free the LSM part of a set of credentials
3240 static void selinux_cred_free(struct cred *cred)
3242 struct task_security_struct *tsec = cred->security;
3245 * cred->security == NULL if security_cred_alloc_blank() or
3246 * security_prepare_creds() returned an error.
3248 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3249 cred->security = (void *) 0x7UL;
3254 * prepare a new set of credentials for modification
3256 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3259 const struct task_security_struct *old_tsec;
3260 struct task_security_struct *tsec;
3262 old_tsec = old->security;
3264 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3268 new->security = tsec;
3273 * transfer the SELinux data to a blank set of creds
3275 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3277 const struct task_security_struct *old_tsec = old->security;
3278 struct task_security_struct *tsec = new->security;
3284 * set the security data for a kernel service
3285 * - all the creation contexts are set to unlabelled
3287 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3289 struct task_security_struct *tsec = new->security;
3290 u32 sid = current_sid();
3293 ret = avc_has_perm(sid, secid,
3294 SECCLASS_KERNEL_SERVICE,
3295 KERNEL_SERVICE__USE_AS_OVERRIDE,
3299 tsec->create_sid = 0;
3300 tsec->keycreate_sid = 0;
3301 tsec->sockcreate_sid = 0;
3307 * set the file creation context in a security record to the same as the
3308 * objective context of the specified inode
3310 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3312 struct inode_security_struct *isec = inode->i_security;
3313 struct task_security_struct *tsec = new->security;
3314 u32 sid = current_sid();
3317 ret = avc_has_perm(sid, isec->sid,
3318 SECCLASS_KERNEL_SERVICE,
3319 KERNEL_SERVICE__CREATE_FILES_AS,
3323 tsec->create_sid = isec->sid;
3327 static int selinux_kernel_module_request(char *kmod_name)
3330 struct common_audit_data ad;
3332 sid = task_sid(current);
3334 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3335 ad.u.kmod_name = kmod_name;
3337 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3338 SYSTEM__MODULE_REQUEST, &ad);
3341 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3343 return current_has_perm(p, PROCESS__SETPGID);
3346 static int selinux_task_getpgid(struct task_struct *p)
3348 return current_has_perm(p, PROCESS__GETPGID);
3351 static int selinux_task_getsid(struct task_struct *p)
3353 return current_has_perm(p, PROCESS__GETSESSION);
3356 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3358 *secid = task_sid(p);
3361 static int selinux_task_setnice(struct task_struct *p, int nice)
3365 rc = cap_task_setnice(p, nice);
3369 return current_has_perm(p, PROCESS__SETSCHED);
3372 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3376 rc = cap_task_setioprio(p, ioprio);
3380 return current_has_perm(p, PROCESS__SETSCHED);
3383 static int selinux_task_getioprio(struct task_struct *p)
3385 return current_has_perm(p, PROCESS__GETSCHED);
3388 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3389 struct rlimit *new_rlim)
3391 struct rlimit *old_rlim = p->signal->rlim + resource;
3393 /* Control the ability to change the hard limit (whether
3394 lowering or raising it), so that the hard limit can
3395 later be used as a safe reset point for the soft limit
3396 upon context transitions. See selinux_bprm_committing_creds. */
3397 if (old_rlim->rlim_max != new_rlim->rlim_max)
3398 return current_has_perm(p, PROCESS__SETRLIMIT);
3403 static int selinux_task_setscheduler(struct task_struct *p)
3407 rc = cap_task_setscheduler(p);
3411 return current_has_perm(p, PROCESS__SETSCHED);
3414 static int selinux_task_getscheduler(struct task_struct *p)
3416 return current_has_perm(p, PROCESS__GETSCHED);
3419 static int selinux_task_movememory(struct task_struct *p)
3421 return current_has_perm(p, PROCESS__SETSCHED);
3424 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3431 perm = PROCESS__SIGNULL; /* null signal; existence test */
3433 perm = signal_to_av(sig);
3435 rc = avc_has_perm(secid, task_sid(p),
3436 SECCLASS_PROCESS, perm, NULL);
3438 rc = current_has_perm(p, perm);
3442 static int selinux_task_wait(struct task_struct *p)
3444 return task_has_perm(p, current, PROCESS__SIGCHLD);
3447 static void selinux_task_to_inode(struct task_struct *p,
3448 struct inode *inode)
3450 struct inode_security_struct *isec = inode->i_security;
3451 u32 sid = task_sid(p);
3454 isec->initialized = 1;
3457 /* Returns error only if unable to parse addresses */
3458 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3459 struct common_audit_data *ad, u8 *proto)
3461 int offset, ihlen, ret = -EINVAL;
3462 struct iphdr _iph, *ih;
3464 offset = skb_network_offset(skb);
3465 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3469 ihlen = ih->ihl * 4;
3470 if (ihlen < sizeof(_iph))
3473 ad->u.net.v4info.saddr = ih->saddr;
3474 ad->u.net.v4info.daddr = ih->daddr;
3478 *proto = ih->protocol;
3480 switch (ih->protocol) {
3482 struct tcphdr _tcph, *th;
3484 if (ntohs(ih->frag_off) & IP_OFFSET)
3488 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3492 ad->u.net.sport = th->source;
3493 ad->u.net.dport = th->dest;
3498 struct udphdr _udph, *uh;
3500 if (ntohs(ih->frag_off) & IP_OFFSET)
3504 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3508 ad->u.net.sport = uh->source;
3509 ad->u.net.dport = uh->dest;
3513 case IPPROTO_DCCP: {
3514 struct dccp_hdr _dccph, *dh;
3516 if (ntohs(ih->frag_off) & IP_OFFSET)
3520 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3524 ad->u.net.sport = dh->dccph_sport;
3525 ad->u.net.dport = dh->dccph_dport;
3536 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3538 /* Returns error only if unable to parse addresses */
3539 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3540 struct common_audit_data *ad, u8 *proto)
3543 int ret = -EINVAL, offset;
3544 struct ipv6hdr _ipv6h, *ip6;
3546 offset = skb_network_offset(skb);
3547 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3551 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3552 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3555 nexthdr = ip6->nexthdr;
3556 offset += sizeof(_ipv6h);
3557 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3566 struct tcphdr _tcph, *th;
3568 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3572 ad->u.net.sport = th->source;
3573 ad->u.net.dport = th->dest;
3578 struct udphdr _udph, *uh;
3580 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3584 ad->u.net.sport = uh->source;
3585 ad->u.net.dport = uh->dest;
3589 case IPPROTO_DCCP: {
3590 struct dccp_hdr _dccph, *dh;
3592 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3596 ad->u.net.sport = dh->dccph_sport;
3597 ad->u.net.dport = dh->dccph_dport;
3601 /* includes fragments */
3611 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3612 char **_addrp, int src, u8 *proto)
3617 switch (ad->u.net.family) {
3619 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3622 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3623 &ad->u.net.v4info.daddr);
3626 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3628 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3631 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3632 &ad->u.net.v6info.daddr);
3642 "SELinux: failure in selinux_parse_skb(),"
3643 " unable to parse packet\n");
3653 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3655 * @family: protocol family
3656 * @sid: the packet's peer label SID
3659 * Check the various different forms of network peer labeling and determine
3660 * the peer label/SID for the packet; most of the magic actually occurs in
3661 * the security server function security_net_peersid_cmp(). The function
3662 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3663 * or -EACCES if @sid is invalid due to inconsistencies with the different
3667 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3674 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3675 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3677 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3678 if (unlikely(err)) {
3680 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3681 " unable to determine packet's peer label\n");
3688 /* socket security operations */
3690 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3691 u16 secclass, u32 *socksid)
3693 if (tsec->sockcreate_sid > SECSID_NULL) {
3694 *socksid = tsec->sockcreate_sid;
3698 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3702 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3704 struct sk_security_struct *sksec = sk->sk_security;
3705 struct common_audit_data ad;
3706 u32 tsid = task_sid(task);
3708 if (sksec->sid == SECINITSID_KERNEL)
3711 COMMON_AUDIT_DATA_INIT(&ad, NET);
3714 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3717 static int selinux_socket_create(int family, int type,
3718 int protocol, int kern)
3720 const struct task_security_struct *tsec = current_security();
3728 secclass = socket_type_to_security_class(family, type, protocol);
3729 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3733 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3736 static int selinux_socket_post_create(struct socket *sock, int family,
3737 int type, int protocol, int kern)
3739 const struct task_security_struct *tsec = current_security();
3740 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3741 struct sk_security_struct *sksec;
3744 isec->sclass = socket_type_to_security_class(family, type, protocol);
3747 isec->sid = SECINITSID_KERNEL;
3749 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3754 isec->initialized = 1;
3757 sksec = sock->sk->sk_security;
3758 sksec->sid = isec->sid;
3759 sksec->sclass = isec->sclass;
3760 err = selinux_netlbl_socket_post_create(sock->sk, family);
3766 /* Range of port numbers used to automatically bind.
3767 Need to determine whether we should perform a name_bind
3768 permission check between the socket and the port number. */
3770 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3772 struct sock *sk = sock->sk;
3776 err = sock_has_perm(current, sk, SOCKET__BIND);
3781 * If PF_INET or PF_INET6, check name_bind permission for the port.
3782 * Multiple address binding for SCTP is not supported yet: we just
3783 * check the first address now.
3785 family = sk->sk_family;
3786 if (family == PF_INET || family == PF_INET6) {
3788 struct sk_security_struct *sksec = sk->sk_security;
3789 struct common_audit_data ad;
3790 struct sockaddr_in *addr4 = NULL;
3791 struct sockaddr_in6 *addr6 = NULL;
3792 unsigned short snum;
3795 if (family == PF_INET) {
3796 addr4 = (struct sockaddr_in *)address;
3797 snum = ntohs(addr4->sin_port);
3798 addrp = (char *)&addr4->sin_addr.s_addr;
3800 addr6 = (struct sockaddr_in6 *)address;
3801 snum = ntohs(addr6->sin6_port);
3802 addrp = (char *)&addr6->sin6_addr.s6_addr;
3808 inet_get_local_port_range(&low, &high);
3810 if (snum < max(PROT_SOCK, low) || snum > high) {
3811 err = sel_netport_sid(sk->sk_protocol,
3815 COMMON_AUDIT_DATA_INIT(&ad, NET);
3816 ad.u.net.sport = htons(snum);
3817 ad.u.net.family = family;
3818 err = avc_has_perm(sksec->sid, sid,
3820 SOCKET__NAME_BIND, &ad);
3826 switch (sksec->sclass) {
3827 case SECCLASS_TCP_SOCKET:
3828 node_perm = TCP_SOCKET__NODE_BIND;
3831 case SECCLASS_UDP_SOCKET:
3832 node_perm = UDP_SOCKET__NODE_BIND;
3835 case SECCLASS_DCCP_SOCKET:
3836 node_perm = DCCP_SOCKET__NODE_BIND;
3840 node_perm = RAWIP_SOCKET__NODE_BIND;
3844 err = sel_netnode_sid(addrp, family, &sid);
3848 COMMON_AUDIT_DATA_INIT(&ad, NET);
3849 ad.u.net.sport = htons(snum);
3850 ad.u.net.family = family;
3852 if (family == PF_INET)
3853 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3855 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3857 err = avc_has_perm(sksec->sid, sid,
3858 sksec->sclass, node_perm, &ad);
3866 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3868 struct sock *sk = sock->sk;
3869 struct sk_security_struct *sksec = sk->sk_security;
3872 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3877 * If a TCP or DCCP socket, check name_connect permission for the port.
3879 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3880 sksec->sclass == SECCLASS_DCCP_SOCKET) {
3881 struct common_audit_data ad;
3882 struct sockaddr_in *addr4 = NULL;
3883 struct sockaddr_in6 *addr6 = NULL;
3884 unsigned short snum;
3887 if (sk->sk_family == PF_INET) {
3888 addr4 = (struct sockaddr_in *)address;
3889 if (addrlen < sizeof(struct sockaddr_in))
3891 snum = ntohs(addr4->sin_port);
3893 addr6 = (struct sockaddr_in6 *)address;
3894 if (addrlen < SIN6_LEN_RFC2133)
3896 snum = ntohs(addr6->sin6_port);
3899 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3903 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3904 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3906 COMMON_AUDIT_DATA_INIT(&ad, NET);
3907 ad.u.net.dport = htons(snum);
3908 ad.u.net.family = sk->sk_family;
3909 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3914 err = selinux_netlbl_socket_connect(sk, address);
3920 static int selinux_socket_listen(struct socket *sock, int backlog)
3922 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3925 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3928 struct inode_security_struct *isec;
3929 struct inode_security_struct *newisec;
3931 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
3935 newisec = SOCK_INODE(newsock)->i_security;
3937 isec = SOCK_INODE(sock)->i_security;
3938 newisec->sclass = isec->sclass;
3939 newisec->sid = isec->sid;
3940 newisec->initialized = 1;
3945 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3948 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
3951 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3952 int size, int flags)
3954 return sock_has_perm(current, sock->sk, SOCKET__READ);
3957 static int selinux_socket_getsockname(struct socket *sock)
3959 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3962 static int selinux_socket_getpeername(struct socket *sock)
3964 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3967 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3971 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
3975 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3978 static int selinux_socket_getsockopt(struct socket *sock, int level,
3981 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
3984 static int selinux_socket_shutdown(struct socket *sock, int how)
3986 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
3989 static int selinux_socket_unix_stream_connect(struct sock *sock,
3993 struct sk_security_struct *sksec_sock = sock->sk_security;
3994 struct sk_security_struct *sksec_other = other->sk_security;
3995 struct sk_security_struct *sksec_new = newsk->sk_security;
3996 struct common_audit_data ad;
3999 COMMON_AUDIT_DATA_INIT(&ad, NET);
4000 ad.u.net.sk = other;
4002 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4003 sksec_other->sclass,
4004 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4008 /* server child socket */
4009 sksec_new->peer_sid = sksec_sock->sid;
4010 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4015 /* connecting socket */
4016 sksec_sock->peer_sid = sksec_new->sid;
4021 static int selinux_socket_unix_may_send(struct socket *sock,
4022 struct socket *other)
4024 struct sk_security_struct *ssec = sock->sk->sk_security;
4025 struct sk_security_struct *osec = other->sk->sk_security;
4026 struct common_audit_data ad;
4028 COMMON_AUDIT_DATA_INIT(&ad, NET);
4029 ad.u.net.sk = other->sk;
4031 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4035 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4037 struct common_audit_data *ad)
4043 err = sel_netif_sid(ifindex, &if_sid);
4046 err = avc_has_perm(peer_sid, if_sid,
4047 SECCLASS_NETIF, NETIF__INGRESS, ad);
4051 err = sel_netnode_sid(addrp, family, &node_sid);
4054 return avc_has_perm(peer_sid, node_sid,
4055 SECCLASS_NODE, NODE__RECVFROM, ad);
4058 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4062 struct sk_security_struct *sksec = sk->sk_security;
4063 u32 sk_sid = sksec->sid;
4064 struct common_audit_data ad;
4067 COMMON_AUDIT_DATA_INIT(&ad, NET);
4068 ad.u.net.netif = skb->skb_iif;
4069 ad.u.net.family = family;
4070 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4074 if (selinux_secmark_enabled()) {
4075 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4081 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4084 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4089 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4092 struct sk_security_struct *sksec = sk->sk_security;
4093 u16 family = sk->sk_family;
4094 u32 sk_sid = sksec->sid;
4095 struct common_audit_data ad;
4100 if (family != PF_INET && family != PF_INET6)
4103 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4104 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4107 /* If any sort of compatibility mode is enabled then handoff processing
4108 * to the selinux_sock_rcv_skb_compat() function to deal with the
4109 * special handling. We do this in an attempt to keep this function
4110 * as fast and as clean as possible. */
4111 if (!selinux_policycap_netpeer)
4112 return selinux_sock_rcv_skb_compat(sk, skb, family);
4114 secmark_active = selinux_secmark_enabled();
4115 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4116 if (!secmark_active && !peerlbl_active)
4119 COMMON_AUDIT_DATA_INIT(&ad, NET);
4120 ad.u.net.netif = skb->skb_iif;
4121 ad.u.net.family = family;
4122 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4126 if (peerlbl_active) {
4129 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4132 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4135 selinux_netlbl_err(skb, err, 0);
4138 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4141 selinux_netlbl_err(skb, err, 0);
4144 if (secmark_active) {
4145 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4154 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4155 int __user *optlen, unsigned len)
4160 struct sk_security_struct *sksec = sock->sk->sk_security;
4161 u32 peer_sid = SECSID_NULL;
4163 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4164 sksec->sclass == SECCLASS_TCP_SOCKET)
4165 peer_sid = sksec->peer_sid;
4166 if (peer_sid == SECSID_NULL)
4167 return -ENOPROTOOPT;
4169 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4173 if (scontext_len > len) {
4178 if (copy_to_user(optval, scontext, scontext_len))
4182 if (put_user(scontext_len, optlen))
4188 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4190 u32 peer_secid = SECSID_NULL;
4193 if (skb && skb->protocol == htons(ETH_P_IP))
4195 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4198 family = sock->sk->sk_family;
4202 if (sock && family == PF_UNIX)
4203 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4205 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4208 *secid = peer_secid;
4209 if (peer_secid == SECSID_NULL)
4214 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4216 struct sk_security_struct *sksec;
4218 sksec = kzalloc(sizeof(*sksec), priority);
4222 sksec->peer_sid = SECINITSID_UNLABELED;
4223 sksec->sid = SECINITSID_UNLABELED;
4224 selinux_netlbl_sk_security_reset(sksec);
4225 sk->sk_security = sksec;
4230 static void selinux_sk_free_security(struct sock *sk)
4232 struct sk_security_struct *sksec = sk->sk_security;
4234 sk->sk_security = NULL;
4235 selinux_netlbl_sk_security_free(sksec);
4239 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4241 struct sk_security_struct *sksec = sk->sk_security;
4242 struct sk_security_struct *newsksec = newsk->sk_security;
4244 newsksec->sid = sksec->sid;
4245 newsksec->peer_sid = sksec->peer_sid;
4246 newsksec->sclass = sksec->sclass;
4248 selinux_netlbl_sk_security_reset(newsksec);
4251 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4254 *secid = SECINITSID_ANY_SOCKET;
4256 struct sk_security_struct *sksec = sk->sk_security;
4258 *secid = sksec->sid;
4262 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4264 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4265 struct sk_security_struct *sksec = sk->sk_security;
4267 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4268 sk->sk_family == PF_UNIX)
4269 isec->sid = sksec->sid;
4270 sksec->sclass = isec->sclass;
4273 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4274 struct request_sock *req)
4276 struct sk_security_struct *sksec = sk->sk_security;
4278 u16 family = sk->sk_family;
4282 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4283 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4286 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4289 if (peersid == SECSID_NULL) {
4290 req->secid = sksec->sid;
4291 req->peer_secid = SECSID_NULL;
4293 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4296 req->secid = newsid;
4297 req->peer_secid = peersid;
4300 return selinux_netlbl_inet_conn_request(req, family);
4303 static void selinux_inet_csk_clone(struct sock *newsk,
4304 const struct request_sock *req)
4306 struct sk_security_struct *newsksec = newsk->sk_security;
4308 newsksec->sid = req->secid;
4309 newsksec->peer_sid = req->peer_secid;
4310 /* NOTE: Ideally, we should also get the isec->sid for the
4311 new socket in sync, but we don't have the isec available yet.
4312 So we will wait until sock_graft to do it, by which
4313 time it will have been created and available. */
4315 /* We don't need to take any sort of lock here as we are the only
4316 * thread with access to newsksec */
4317 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4320 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4322 u16 family = sk->sk_family;
4323 struct sk_security_struct *sksec = sk->sk_security;
4325 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4326 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4329 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4332 static int selinux_secmark_relabel_packet(u32 sid)
4334 const struct task_security_struct *__tsec;
4337 __tsec = current_security();
4340 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4343 static void selinux_secmark_refcount_inc(void)
4345 atomic_inc(&selinux_secmark_refcount);
4348 static void selinux_secmark_refcount_dec(void)
4350 atomic_dec(&selinux_secmark_refcount);
4353 static void selinux_req_classify_flow(const struct request_sock *req,
4356 fl->flowi_secid = req->secid;
4359 static int selinux_tun_dev_create(void)
4361 u32 sid = current_sid();
4363 /* we aren't taking into account the "sockcreate" SID since the socket
4364 * that is being created here is not a socket in the traditional sense,
4365 * instead it is a private sock, accessible only to the kernel, and
4366 * representing a wide range of network traffic spanning multiple
4367 * connections unlike traditional sockets - check the TUN driver to
4368 * get a better understanding of why this socket is special */
4370 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4374 static void selinux_tun_dev_post_create(struct sock *sk)
4376 struct sk_security_struct *sksec = sk->sk_security;
4378 /* we don't currently perform any NetLabel based labeling here and it
4379 * isn't clear that we would want to do so anyway; while we could apply
4380 * labeling without the support of the TUN user the resulting labeled
4381 * traffic from the other end of the connection would almost certainly
4382 * cause confusion to the TUN user that had no idea network labeling
4383 * protocols were being used */
4385 /* see the comments in selinux_tun_dev_create() about why we don't use
4386 * the sockcreate SID here */
4388 sksec->sid = current_sid();
4389 sksec->sclass = SECCLASS_TUN_SOCKET;
4392 static int selinux_tun_dev_attach(struct sock *sk)
4394 struct sk_security_struct *sksec = sk->sk_security;
4395 u32 sid = current_sid();
4398 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4399 TUN_SOCKET__RELABELFROM, NULL);
4402 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4403 TUN_SOCKET__RELABELTO, NULL);
4412 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4416 struct nlmsghdr *nlh;
4417 struct sk_security_struct *sksec = sk->sk_security;
4419 if (skb->len < NLMSG_SPACE(0)) {
4423 nlh = nlmsg_hdr(skb);
4425 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4427 if (err == -EINVAL) {
4428 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4429 "SELinux: unrecognized netlink message"
4430 " type=%hu for sclass=%hu\n",
4431 nlh->nlmsg_type, sksec->sclass);
4432 if (!selinux_enforcing || security_get_allow_unknown())
4442 err = sock_has_perm(current, sk, perm);
4447 #ifdef CONFIG_NETFILTER
4449 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4455 struct common_audit_data ad;
4460 if (!selinux_policycap_netpeer)
4463 secmark_active = selinux_secmark_enabled();
4464 netlbl_active = netlbl_enabled();
4465 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4466 if (!secmark_active && !peerlbl_active)
4469 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4472 COMMON_AUDIT_DATA_INIT(&ad, NET);
4473 ad.u.net.netif = ifindex;
4474 ad.u.net.family = family;
4475 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4478 if (peerlbl_active) {
4479 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4482 selinux_netlbl_err(skb, err, 1);
4488 if (avc_has_perm(peer_sid, skb->secmark,
4489 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4493 /* we do this in the FORWARD path and not the POST_ROUTING
4494 * path because we want to make sure we apply the necessary
4495 * labeling before IPsec is applied so we can leverage AH
4497 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4503 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4504 struct sk_buff *skb,
4505 const struct net_device *in,
4506 const struct net_device *out,
4507 int (*okfn)(struct sk_buff *))
4509 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4512 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4513 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4514 struct sk_buff *skb,
4515 const struct net_device *in,
4516 const struct net_device *out,
4517 int (*okfn)(struct sk_buff *))
4519 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4523 static unsigned int selinux_ip_output(struct sk_buff *skb,
4528 if (!netlbl_enabled())
4531 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4532 * because we want to make sure we apply the necessary labeling
4533 * before IPsec is applied so we can leverage AH protection */
4535 struct sk_security_struct *sksec = skb->sk->sk_security;
4538 sid = SECINITSID_KERNEL;
4539 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4545 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4546 struct sk_buff *skb,
4547 const struct net_device *in,
4548 const struct net_device *out,
4549 int (*okfn)(struct sk_buff *))
4551 return selinux_ip_output(skb, PF_INET);
4554 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4558 struct sock *sk = skb->sk;
4559 struct sk_security_struct *sksec;
4560 struct common_audit_data ad;
4566 sksec = sk->sk_security;
4568 COMMON_AUDIT_DATA_INIT(&ad, NET);
4569 ad.u.net.netif = ifindex;
4570 ad.u.net.family = family;
4571 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4574 if (selinux_secmark_enabled())
4575 if (avc_has_perm(sksec->sid, skb->secmark,
4576 SECCLASS_PACKET, PACKET__SEND, &ad))
4577 return NF_DROP_ERR(-ECONNREFUSED);
4579 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4580 return NF_DROP_ERR(-ECONNREFUSED);
4585 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4591 struct common_audit_data ad;
4596 /* If any sort of compatibility mode is enabled then handoff processing
4597 * to the selinux_ip_postroute_compat() function to deal with the
4598 * special handling. We do this in an attempt to keep this function
4599 * as fast and as clean as possible. */
4600 if (!selinux_policycap_netpeer)
4601 return selinux_ip_postroute_compat(skb, ifindex, family);
4603 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4604 * packet transformation so allow the packet to pass without any checks
4605 * since we'll have another chance to perform access control checks
4606 * when the packet is on it's final way out.
4607 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4608 * is NULL, in this case go ahead and apply access control. */
4609 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4612 secmark_active = selinux_secmark_enabled();
4613 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4614 if (!secmark_active && !peerlbl_active)
4617 /* if the packet is being forwarded then get the peer label from the
4618 * packet itself; otherwise check to see if it is from a local
4619 * application or the kernel, if from an application get the peer label
4620 * from the sending socket, otherwise use the kernel's sid */
4624 secmark_perm = PACKET__FORWARD_OUT;
4625 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4628 secmark_perm = PACKET__SEND;
4629 peer_sid = SECINITSID_KERNEL;
4632 struct sk_security_struct *sksec = sk->sk_security;
4633 peer_sid = sksec->sid;
4634 secmark_perm = PACKET__SEND;
4637 COMMON_AUDIT_DATA_INIT(&ad, NET);
4638 ad.u.net.netif = ifindex;
4639 ad.u.net.family = family;
4640 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4644 if (avc_has_perm(peer_sid, skb->secmark,
4645 SECCLASS_PACKET, secmark_perm, &ad))
4646 return NF_DROP_ERR(-ECONNREFUSED);
4648 if (peerlbl_active) {
4652 if (sel_netif_sid(ifindex, &if_sid))
4654 if (avc_has_perm(peer_sid, if_sid,
4655 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4656 return NF_DROP_ERR(-ECONNREFUSED);
4658 if (sel_netnode_sid(addrp, family, &node_sid))
4660 if (avc_has_perm(peer_sid, node_sid,
4661 SECCLASS_NODE, NODE__SENDTO, &ad))
4662 return NF_DROP_ERR(-ECONNREFUSED);
4668 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4669 struct sk_buff *skb,
4670 const struct net_device *in,
4671 const struct net_device *out,
4672 int (*okfn)(struct sk_buff *))
4674 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4677 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4678 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4679 struct sk_buff *skb,
4680 const struct net_device *in,
4681 const struct net_device *out,
4682 int (*okfn)(struct sk_buff *))
4684 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4688 #endif /* CONFIG_NETFILTER */
4690 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4694 err = cap_netlink_send(sk, skb);
4698 return selinux_nlmsg_perm(sk, skb);
4701 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4704 struct common_audit_data ad;
4707 err = cap_netlink_recv(skb, capability);
4711 COMMON_AUDIT_DATA_INIT(&ad, CAP);
4712 ad.u.cap = capability;
4714 security_task_getsecid(current, &sid);
4715 return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
4716 CAP_TO_MASK(capability), &ad);
4719 static int ipc_alloc_security(struct task_struct *task,
4720 struct kern_ipc_perm *perm,
4723 struct ipc_security_struct *isec;
4726 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4730 sid = task_sid(task);
4731 isec->sclass = sclass;
4733 perm->security = isec;
4738 static void ipc_free_security(struct kern_ipc_perm *perm)
4740 struct ipc_security_struct *isec = perm->security;
4741 perm->security = NULL;
4745 static int msg_msg_alloc_security(struct msg_msg *msg)
4747 struct msg_security_struct *msec;
4749 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4753 msec->sid = SECINITSID_UNLABELED;
4754 msg->security = msec;
4759 static void msg_msg_free_security(struct msg_msg *msg)
4761 struct msg_security_struct *msec = msg->security;
4763 msg->security = NULL;
4767 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4770 struct ipc_security_struct *isec;
4771 struct common_audit_data ad;
4772 u32 sid = current_sid();
4774 isec = ipc_perms->security;
4776 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4777 ad.u.ipc_id = ipc_perms->key;
4779 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4782 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4784 return msg_msg_alloc_security(msg);
4787 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4789 msg_msg_free_security(msg);
4792 /* message queue security operations */
4793 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4795 struct ipc_security_struct *isec;
4796 struct common_audit_data ad;
4797 u32 sid = current_sid();
4800 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4804 isec = msq->q_perm.security;
4806 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4807 ad.u.ipc_id = msq->q_perm.key;
4809 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4812 ipc_free_security(&msq->q_perm);
4818 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4820 ipc_free_security(&msq->q_perm);
4823 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4825 struct ipc_security_struct *isec;
4826 struct common_audit_data ad;
4827 u32 sid = current_sid();
4829 isec = msq->q_perm.security;
4831 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4832 ad.u.ipc_id = msq->q_perm.key;
4834 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4835 MSGQ__ASSOCIATE, &ad);
4838 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4846 /* No specific object, just general system-wide information. */
4847 return task_has_system(current, SYSTEM__IPC_INFO);
4850 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4853 perms = MSGQ__SETATTR;
4856 perms = MSGQ__DESTROY;
4862 err = ipc_has_perm(&msq->q_perm, perms);
4866 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4868 struct ipc_security_struct *isec;
4869 struct msg_security_struct *msec;
4870 struct common_audit_data ad;
4871 u32 sid = current_sid();
4874 isec = msq->q_perm.security;
4875 msec = msg->security;
4878 * First time through, need to assign label to the message
4880 if (msec->sid == SECINITSID_UNLABELED) {
4882 * Compute new sid based on current process and
4883 * message queue this message will be stored in
4885 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4891 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4892 ad.u.ipc_id = msq->q_perm.key;
4894 /* Can this process write to the queue? */
4895 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4898 /* Can this process send the message */
4899 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4902 /* Can the message be put in the queue? */
4903 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4904 MSGQ__ENQUEUE, &ad);
4909 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4910 struct task_struct *target,
4911 long type, int mode)
4913 struct ipc_security_struct *isec;
4914 struct msg_security_struct *msec;
4915 struct common_audit_data ad;
4916 u32 sid = task_sid(target);
4919 isec = msq->q_perm.security;
4920 msec = msg->security;
4922 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4923 ad.u.ipc_id = msq->q_perm.key;
4925 rc = avc_has_perm(sid, isec->sid,
4926 SECCLASS_MSGQ, MSGQ__READ, &ad);
4928 rc = avc_has_perm(sid, msec->sid,
4929 SECCLASS_MSG, MSG__RECEIVE, &ad);
4933 /* Shared Memory security operations */
4934 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4936 struct ipc_security_struct *isec;
4937 struct common_audit_data ad;
4938 u32 sid = current_sid();
4941 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4945 isec = shp->shm_perm.security;
4947 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4948 ad.u.ipc_id = shp->shm_perm.key;
4950 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4953 ipc_free_security(&shp->shm_perm);
4959 static void selinux_shm_free_security(struct shmid_kernel *shp)
4961 ipc_free_security(&shp->shm_perm);
4964 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4966 struct ipc_security_struct *isec;
4967 struct common_audit_data ad;
4968 u32 sid = current_sid();
4970 isec = shp->shm_perm.security;
4972 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4973 ad.u.ipc_id = shp->shm_perm.key;
4975 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4976 SHM__ASSOCIATE, &ad);
4979 /* Note, at this point, shp is locked down */
4980 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4988 /* No specific object, just general system-wide information. */
4989 return task_has_system(current, SYSTEM__IPC_INFO);
4992 perms = SHM__GETATTR | SHM__ASSOCIATE;
4995 perms = SHM__SETATTR;
5002 perms = SHM__DESTROY;
5008 err = ipc_has_perm(&shp->shm_perm, perms);
5012 static int selinux_shm_shmat(struct shmid_kernel *shp,
5013 char __user *shmaddr, int shmflg)
5017 if (shmflg & SHM_RDONLY)
5020 perms = SHM__READ | SHM__WRITE;
5022 return ipc_has_perm(&shp->shm_perm, perms);
5025 /* Semaphore security operations */
5026 static int selinux_sem_alloc_security(struct sem_array *sma)
5028 struct ipc_security_struct *isec;
5029 struct common_audit_data ad;
5030 u32 sid = current_sid();
5033 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5037 isec = sma->sem_perm.security;
5039 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5040 ad.u.ipc_id = sma->sem_perm.key;
5042 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5045 ipc_free_security(&sma->sem_perm);
5051 static void selinux_sem_free_security(struct sem_array *sma)
5053 ipc_free_security(&sma->sem_perm);
5056 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5058 struct ipc_security_struct *isec;
5059 struct common_audit_data ad;
5060 u32 sid = current_sid();
5062 isec = sma->sem_perm.security;
5064 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5065 ad.u.ipc_id = sma->sem_perm.key;
5067 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5068 SEM__ASSOCIATE, &ad);
5071 /* Note, at this point, sma is locked down */
5072 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5080 /* No specific object, just general system-wide information. */
5081 return task_has_system(current, SYSTEM__IPC_INFO);
5085 perms = SEM__GETATTR;
5096 perms = SEM__DESTROY;
5099 perms = SEM__SETATTR;
5103 perms = SEM__GETATTR | SEM__ASSOCIATE;
5109 err = ipc_has_perm(&sma->sem_perm, perms);
5113 static int selinux_sem_semop(struct sem_array *sma,
5114 struct sembuf *sops, unsigned nsops, int alter)
5119 perms = SEM__READ | SEM__WRITE;
5123 return ipc_has_perm(&sma->sem_perm, perms);
5126 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5132 av |= IPC__UNIX_READ;
5134 av |= IPC__UNIX_WRITE;
5139 return ipc_has_perm(ipcp, av);
5142 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5144 struct ipc_security_struct *isec = ipcp->security;
5148 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5151 inode_doinit_with_dentry(inode, dentry);
5154 static int selinux_getprocattr(struct task_struct *p,
5155 char *name, char **value)
5157 const struct task_security_struct *__tsec;
5163 error = current_has_perm(p, PROCESS__GETATTR);
5169 __tsec = __task_cred(p)->security;
5171 if (!strcmp(name, "current"))
5173 else if (!strcmp(name, "prev"))
5175 else if (!strcmp(name, "exec"))
5176 sid = __tsec->exec_sid;
5177 else if (!strcmp(name, "fscreate"))
5178 sid = __tsec->create_sid;
5179 else if (!strcmp(name, "keycreate"))
5180 sid = __tsec->keycreate_sid;
5181 else if (!strcmp(name, "sockcreate"))
5182 sid = __tsec->sockcreate_sid;
5190 error = security_sid_to_context(sid, value, &len);
5200 static int selinux_setprocattr(struct task_struct *p,
5201 char *name, void *value, size_t size)
5203 struct task_security_struct *tsec;
5204 struct task_struct *tracer;
5211 /* SELinux only allows a process to change its own
5212 security attributes. */
5217 * Basic control over ability to set these attributes at all.
5218 * current == p, but we'll pass them separately in case the
5219 * above restriction is ever removed.
5221 if (!strcmp(name, "exec"))
5222 error = current_has_perm(p, PROCESS__SETEXEC);
5223 else if (!strcmp(name, "fscreate"))
5224 error = current_has_perm(p, PROCESS__SETFSCREATE);
5225 else if (!strcmp(name, "keycreate"))
5226 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5227 else if (!strcmp(name, "sockcreate"))
5228 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5229 else if (!strcmp(name, "current"))
5230 error = current_has_perm(p, PROCESS__SETCURRENT);
5236 /* Obtain a SID for the context, if one was specified. */
5237 if (size && str[1] && str[1] != '\n') {
5238 if (str[size-1] == '\n') {
5242 error = security_context_to_sid(value, size, &sid);
5243 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5244 if (!capable(CAP_MAC_ADMIN))
5246 error = security_context_to_sid_force(value, size,
5253 new = prepare_creds();
5257 /* Permission checking based on the specified context is
5258 performed during the actual operation (execve,
5259 open/mkdir/...), when we know the full context of the
5260 operation. See selinux_bprm_set_creds for the execve
5261 checks and may_create for the file creation checks. The
5262 operation will then fail if the context is not permitted. */
5263 tsec = new->security;
5264 if (!strcmp(name, "exec")) {
5265 tsec->exec_sid = sid;
5266 } else if (!strcmp(name, "fscreate")) {
5267 tsec->create_sid = sid;
5268 } else if (!strcmp(name, "keycreate")) {
5269 error = may_create_key(sid, p);
5272 tsec->keycreate_sid = sid;
5273 } else if (!strcmp(name, "sockcreate")) {
5274 tsec->sockcreate_sid = sid;
5275 } else if (!strcmp(name, "current")) {
5280 /* Only allow single threaded processes to change context */
5282 if (!current_is_single_threaded()) {
5283 error = security_bounded_transition(tsec->sid, sid);
5288 /* Check permissions for the transition. */
5289 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5290 PROCESS__DYNTRANSITION, NULL);
5294 /* Check for ptracing, and update the task SID if ok.
5295 Otherwise, leave SID unchanged and fail. */
5298 tracer = tracehook_tracer_task(p);
5300 ptsid = task_sid(tracer);
5304 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5305 PROCESS__PTRACE, NULL);
5324 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5326 return security_sid_to_context(secid, secdata, seclen);
5329 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5331 return security_context_to_sid(secdata, seclen, secid);
5334 static void selinux_release_secctx(char *secdata, u32 seclen)
5340 * called with inode->i_mutex locked
5342 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5344 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5348 * called with inode->i_mutex locked
5350 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5352 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5355 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5358 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5367 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5368 unsigned long flags)
5370 const struct task_security_struct *tsec;
5371 struct key_security_struct *ksec;
5373 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5377 tsec = cred->security;
5378 if (tsec->keycreate_sid)
5379 ksec->sid = tsec->keycreate_sid;
5381 ksec->sid = tsec->sid;
5387 static void selinux_key_free(struct key *k)
5389 struct key_security_struct *ksec = k->security;
5395 static int selinux_key_permission(key_ref_t key_ref,
5396 const struct cred *cred,
5400 struct key_security_struct *ksec;
5403 /* if no specific permissions are requested, we skip the
5404 permission check. No serious, additional covert channels
5405 appear to be created. */
5409 sid = cred_sid(cred);
5411 key = key_ref_to_ptr(key_ref);
5412 ksec = key->security;
5414 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5417 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5419 struct key_security_struct *ksec = key->security;
5420 char *context = NULL;
5424 rc = security_sid_to_context(ksec->sid, &context, &len);
5433 static struct security_operations selinux_ops = {
5436 .ptrace_access_check = selinux_ptrace_access_check,
5437 .ptrace_traceme = selinux_ptrace_traceme,
5438 .capget = selinux_capget,
5439 .capset = selinux_capset,
5440 .capable = selinux_capable,
5441 .quotactl = selinux_quotactl,
5442 .quota_on = selinux_quota_on,
5443 .syslog = selinux_syslog,
5444 .vm_enough_memory = selinux_vm_enough_memory,
5446 .netlink_send = selinux_netlink_send,
5447 .netlink_recv = selinux_netlink_recv,
5449 .bprm_set_creds = selinux_bprm_set_creds,
5450 .bprm_committing_creds = selinux_bprm_committing_creds,
5451 .bprm_committed_creds = selinux_bprm_committed_creds,
5452 .bprm_secureexec = selinux_bprm_secureexec,
5454 .sb_alloc_security = selinux_sb_alloc_security,
5455 .sb_free_security = selinux_sb_free_security,
5456 .sb_copy_data = selinux_sb_copy_data,
5457 .sb_remount = selinux_sb_remount,
5458 .sb_kern_mount = selinux_sb_kern_mount,
5459 .sb_show_options = selinux_sb_show_options,
5460 .sb_statfs = selinux_sb_statfs,
5461 .sb_mount = selinux_mount,
5462 .sb_umount = selinux_umount,
5463 .sb_set_mnt_opts = selinux_set_mnt_opts,
5464 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5465 .sb_parse_opts_str = selinux_parse_opts_str,
5468 .inode_alloc_security = selinux_inode_alloc_security,
5469 .inode_free_security = selinux_inode_free_security,
5470 .inode_init_security = selinux_inode_init_security,
5471 .inode_create = selinux_inode_create,
5472 .inode_link = selinux_inode_link,
5473 .inode_unlink = selinux_inode_unlink,
5474 .inode_symlink = selinux_inode_symlink,
5475 .inode_mkdir = selinux_inode_mkdir,
5476 .inode_rmdir = selinux_inode_rmdir,
5477 .inode_mknod = selinux_inode_mknod,
5478 .inode_rename = selinux_inode_rename,
5479 .inode_readlink = selinux_inode_readlink,
5480 .inode_follow_link = selinux_inode_follow_link,
5481 .inode_permission = selinux_inode_permission,
5482 .inode_setattr = selinux_inode_setattr,
5483 .inode_getattr = selinux_inode_getattr,
5484 .inode_setxattr = selinux_inode_setxattr,
5485 .inode_post_setxattr = selinux_inode_post_setxattr,
5486 .inode_getxattr = selinux_inode_getxattr,
5487 .inode_listxattr = selinux_inode_listxattr,
5488 .inode_removexattr = selinux_inode_removexattr,
5489 .inode_getsecurity = selinux_inode_getsecurity,
5490 .inode_setsecurity = selinux_inode_setsecurity,
5491 .inode_listsecurity = selinux_inode_listsecurity,
5492 .inode_getsecid = selinux_inode_getsecid,
5494 .file_permission = selinux_file_permission,
5495 .file_alloc_security = selinux_file_alloc_security,
5496 .file_free_security = selinux_file_free_security,
5497 .file_ioctl = selinux_file_ioctl,
5498 .file_mmap = selinux_file_mmap,
5499 .file_mprotect = selinux_file_mprotect,
5500 .file_lock = selinux_file_lock,
5501 .file_fcntl = selinux_file_fcntl,
5502 .file_set_fowner = selinux_file_set_fowner,
5503 .file_send_sigiotask = selinux_file_send_sigiotask,
5504 .file_receive = selinux_file_receive,
5506 .dentry_open = selinux_dentry_open,
5508 .task_create = selinux_task_create,
5509 .cred_alloc_blank = selinux_cred_alloc_blank,
5510 .cred_free = selinux_cred_free,
5511 .cred_prepare = selinux_cred_prepare,
5512 .cred_transfer = selinux_cred_transfer,
5513 .kernel_act_as = selinux_kernel_act_as,
5514 .kernel_create_files_as = selinux_kernel_create_files_as,
5515 .kernel_module_request = selinux_kernel_module_request,
5516 .task_setpgid = selinux_task_setpgid,
5517 .task_getpgid = selinux_task_getpgid,
5518 .task_getsid = selinux_task_getsid,
5519 .task_getsecid = selinux_task_getsecid,
5520 .task_setnice = selinux_task_setnice,
5521 .task_setioprio = selinux_task_setioprio,
5522 .task_getioprio = selinux_task_getioprio,
5523 .task_setrlimit = selinux_task_setrlimit,
5524 .task_setscheduler = selinux_task_setscheduler,
5525 .task_getscheduler = selinux_task_getscheduler,
5526 .task_movememory = selinux_task_movememory,
5527 .task_kill = selinux_task_kill,
5528 .task_wait = selinux_task_wait,
5529 .task_to_inode = selinux_task_to_inode,
5531 .ipc_permission = selinux_ipc_permission,
5532 .ipc_getsecid = selinux_ipc_getsecid,
5534 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5535 .msg_msg_free_security = selinux_msg_msg_free_security,
5537 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5538 .msg_queue_free_security = selinux_msg_queue_free_security,
5539 .msg_queue_associate = selinux_msg_queue_associate,
5540 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5541 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5542 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5544 .shm_alloc_security = selinux_shm_alloc_security,
5545 .shm_free_security = selinux_shm_free_security,
5546 .shm_associate = selinux_shm_associate,
5547 .shm_shmctl = selinux_shm_shmctl,
5548 .shm_shmat = selinux_shm_shmat,
5550 .sem_alloc_security = selinux_sem_alloc_security,
5551 .sem_free_security = selinux_sem_free_security,
5552 .sem_associate = selinux_sem_associate,
5553 .sem_semctl = selinux_sem_semctl,
5554 .sem_semop = selinux_sem_semop,
5556 .d_instantiate = selinux_d_instantiate,
5558 .getprocattr = selinux_getprocattr,
5559 .setprocattr = selinux_setprocattr,
5561 .secid_to_secctx = selinux_secid_to_secctx,
5562 .secctx_to_secid = selinux_secctx_to_secid,
5563 .release_secctx = selinux_release_secctx,
5564 .inode_notifysecctx = selinux_inode_notifysecctx,
5565 .inode_setsecctx = selinux_inode_setsecctx,
5566 .inode_getsecctx = selinux_inode_getsecctx,
5568 .unix_stream_connect = selinux_socket_unix_stream_connect,
5569 .unix_may_send = selinux_socket_unix_may_send,
5571 .socket_create = selinux_socket_create,
5572 .socket_post_create = selinux_socket_post_create,
5573 .socket_bind = selinux_socket_bind,
5574 .socket_connect = selinux_socket_connect,
5575 .socket_listen = selinux_socket_listen,
5576 .socket_accept = selinux_socket_accept,
5577 .socket_sendmsg = selinux_socket_sendmsg,
5578 .socket_recvmsg = selinux_socket_recvmsg,
5579 .socket_getsockname = selinux_socket_getsockname,
5580 .socket_getpeername = selinux_socket_getpeername,
5581 .socket_getsockopt = selinux_socket_getsockopt,
5582 .socket_setsockopt = selinux_socket_setsockopt,
5583 .socket_shutdown = selinux_socket_shutdown,
5584 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5585 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5586 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5587 .sk_alloc_security = selinux_sk_alloc_security,
5588 .sk_free_security = selinux_sk_free_security,
5589 .sk_clone_security = selinux_sk_clone_security,
5590 .sk_getsecid = selinux_sk_getsecid,
5591 .sock_graft = selinux_sock_graft,
5592 .inet_conn_request = selinux_inet_conn_request,
5593 .inet_csk_clone = selinux_inet_csk_clone,
5594 .inet_conn_established = selinux_inet_conn_established,
5595 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5596 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5597 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5598 .req_classify_flow = selinux_req_classify_flow,
5599 .tun_dev_create = selinux_tun_dev_create,
5600 .tun_dev_post_create = selinux_tun_dev_post_create,
5601 .tun_dev_attach = selinux_tun_dev_attach,
5603 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5604 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5605 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5606 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5607 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5608 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5609 .xfrm_state_free_security = selinux_xfrm_state_free,
5610 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5611 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5612 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5613 .xfrm_decode_session = selinux_xfrm_decode_session,
5617 .key_alloc = selinux_key_alloc,
5618 .key_free = selinux_key_free,
5619 .key_permission = selinux_key_permission,
5620 .key_getsecurity = selinux_key_getsecurity,
5624 .audit_rule_init = selinux_audit_rule_init,
5625 .audit_rule_known = selinux_audit_rule_known,
5626 .audit_rule_match = selinux_audit_rule_match,
5627 .audit_rule_free = selinux_audit_rule_free,
5631 static __init int selinux_init(void)
5633 if (!security_module_enable(&selinux_ops)) {
5634 selinux_enabled = 0;
5638 if (!selinux_enabled) {
5639 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5643 printk(KERN_INFO "SELinux: Initializing.\n");
5645 /* Set the security state for the initial task. */
5646 cred_init_security();
5648 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5650 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5651 sizeof(struct inode_security_struct),
5652 0, SLAB_PANIC, NULL);
5655 if (register_security(&selinux_ops))
5656 panic("SELinux: Unable to register with kernel.\n");
5658 if (selinux_enforcing)
5659 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5661 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5666 static void delayed_superblock_init(struct super_block *sb, void *unused)
5668 superblock_doinit(sb, NULL);
5671 void selinux_complete_init(void)
5673 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5675 /* Set up any superblocks initialized prior to the policy load. */
5676 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5677 iterate_supers(delayed_superblock_init, NULL);
5680 /* SELinux requires early initialization in order to label
5681 all processes and objects when they are created. */
5682 security_initcall(selinux_init);
5684 #if defined(CONFIG_NETFILTER)
5686 static struct nf_hook_ops selinux_ipv4_ops[] = {
5688 .hook = selinux_ipv4_postroute,
5689 .owner = THIS_MODULE,
5691 .hooknum = NF_INET_POST_ROUTING,
5692 .priority = NF_IP_PRI_SELINUX_LAST,
5695 .hook = selinux_ipv4_forward,
5696 .owner = THIS_MODULE,
5698 .hooknum = NF_INET_FORWARD,
5699 .priority = NF_IP_PRI_SELINUX_FIRST,
5702 .hook = selinux_ipv4_output,
5703 .owner = THIS_MODULE,
5705 .hooknum = NF_INET_LOCAL_OUT,
5706 .priority = NF_IP_PRI_SELINUX_FIRST,
5710 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5712 static struct nf_hook_ops selinux_ipv6_ops[] = {
5714 .hook = selinux_ipv6_postroute,
5715 .owner = THIS_MODULE,
5717 .hooknum = NF_INET_POST_ROUTING,
5718 .priority = NF_IP6_PRI_SELINUX_LAST,
5721 .hook = selinux_ipv6_forward,
5722 .owner = THIS_MODULE,
5724 .hooknum = NF_INET_FORWARD,
5725 .priority = NF_IP6_PRI_SELINUX_FIRST,
5731 static int __init selinux_nf_ip_init(void)
5735 if (!selinux_enabled)
5738 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5740 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5742 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5744 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5745 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5747 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5754 __initcall(selinux_nf_ip_init);
5756 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5757 static void selinux_nf_ip_exit(void)
5759 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5761 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5762 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5763 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5768 #else /* CONFIG_NETFILTER */
5770 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5771 #define selinux_nf_ip_exit()
5774 #endif /* CONFIG_NETFILTER */
5776 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5777 static int selinux_disabled;
5779 int selinux_disable(void)
5781 extern void exit_sel_fs(void);
5783 if (ss_initialized) {
5784 /* Not permitted after initial policy load. */
5788 if (selinux_disabled) {
5789 /* Only do this once. */
5793 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5795 selinux_disabled = 1;
5796 selinux_enabled = 0;
5798 reset_security_ops();
5800 /* Try to destroy the avc node cache */
5803 /* Unregister netfilter hooks. */
5804 selinux_nf_ip_exit();
5806 /* Unregister selinuxfs. */