2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/security.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
98 #define SB_TYPE_FMT "%s%s%s"
99 #define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])
100 #define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""
102 extern struct security_operations *security_ops;
104 /* SECMARK reference count */
105 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
107 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
108 int selinux_enforcing;
110 static int __init enforcing_setup(char *str)
112 unsigned long enforcing;
113 if (!strict_strtoul(str, 0, &enforcing))
114 selinux_enforcing = enforcing ? 1 : 0;
117 __setup("enforcing=", enforcing_setup);
120 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
121 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
123 static int __init selinux_enabled_setup(char *str)
125 unsigned long enabled;
126 if (!strict_strtoul(str, 0, &enabled))
127 selinux_enabled = enabled ? 1 : 0;
130 __setup("selinux=", selinux_enabled_setup);
132 int selinux_enabled = 1;
135 static struct kmem_cache *sel_inode_cache;
138 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
141 * This function checks the SECMARK reference counter to see if any SECMARK
142 * targets are currently configured, if the reference counter is greater than
143 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
144 * enabled, false (0) if SECMARK is disabled. If the always_check_network
145 * policy capability is enabled, SECMARK is always considered enabled.
148 static int selinux_secmark_enabled(void)
150 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
154 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
157 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
158 * (1) if any are enabled or false (0) if neither are enabled. If the
159 * always_check_network policy capability is enabled, peer labeling
160 * is always considered enabled.
163 static int selinux_peerlbl_enabled(void)
165 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
169 * initialise the security for the init task
171 static void cred_init_security(void)
173 struct cred *cred = (struct cred *) current->real_cred;
174 struct task_security_struct *tsec;
176 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
178 panic("SELinux: Failed to initialize initial task.\n");
180 tsec->osid = tsec->sid = SECINITSID_KERNEL;
181 cred->security = tsec;
185 * get the security ID of a set of credentials
187 static inline u32 cred_sid(const struct cred *cred)
189 const struct task_security_struct *tsec;
191 tsec = cred->security;
196 * get the objective security ID of a task
198 static inline u32 task_sid(const struct task_struct *task)
203 sid = cred_sid(__task_cred(task));
209 * get the subjective security ID of the current task
211 static inline u32 current_sid(void)
213 const struct task_security_struct *tsec = current_security();
218 /* Allocate and free functions for each kind of security blob. */
220 static int inode_alloc_security(struct inode *inode)
222 struct inode_security_struct *isec;
223 u32 sid = current_sid();
225 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
229 mutex_init(&isec->lock);
230 INIT_LIST_HEAD(&isec->list);
232 isec->sid = SECINITSID_UNLABELED;
233 isec->sclass = SECCLASS_FILE;
234 isec->task_sid = sid;
235 inode->i_security = isec;
240 static void inode_free_security(struct inode *inode)
242 struct inode_security_struct *isec = inode->i_security;
243 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
245 spin_lock(&sbsec->isec_lock);
246 if (!list_empty(&isec->list))
247 list_del_init(&isec->list);
248 spin_unlock(&sbsec->isec_lock);
250 inode->i_security = NULL;
251 kmem_cache_free(sel_inode_cache, isec);
254 static int file_alloc_security(struct file *file)
256 struct file_security_struct *fsec;
257 u32 sid = current_sid();
259 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
264 fsec->fown_sid = sid;
265 file->f_security = fsec;
270 static void file_free_security(struct file *file)
272 struct file_security_struct *fsec = file->f_security;
273 file->f_security = NULL;
277 static int superblock_alloc_security(struct super_block *sb)
279 struct superblock_security_struct *sbsec;
281 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
285 mutex_init(&sbsec->lock);
286 INIT_LIST_HEAD(&sbsec->isec_head);
287 spin_lock_init(&sbsec->isec_lock);
289 sbsec->sid = SECINITSID_UNLABELED;
290 sbsec->def_sid = SECINITSID_FILE;
291 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
292 sb->s_security = sbsec;
297 static void superblock_free_security(struct super_block *sb)
299 struct superblock_security_struct *sbsec = sb->s_security;
300 sb->s_security = NULL;
304 /* The file system's label must be initialized prior to use. */
306 static const char *labeling_behaviors[7] = {
308 "uses transition SIDs",
310 "uses genfs_contexts",
311 "not configured for labeling",
312 "uses mountpoint labeling",
313 "uses native labeling",
316 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
318 static inline int inode_doinit(struct inode *inode)
320 return inode_doinit_with_dentry(inode, NULL);
329 Opt_labelsupport = 5,
333 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
335 static const match_table_t tokens = {
336 {Opt_context, CONTEXT_STR "%s"},
337 {Opt_fscontext, FSCONTEXT_STR "%s"},
338 {Opt_defcontext, DEFCONTEXT_STR "%s"},
339 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
340 {Opt_labelsupport, LABELSUPP_STR},
344 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
346 static int may_context_mount_sb_relabel(u32 sid,
347 struct superblock_security_struct *sbsec,
348 const struct cred *cred)
350 const struct task_security_struct *tsec = cred->security;
353 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__RELABELFROM, NULL);
358 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
359 FILESYSTEM__RELABELTO, NULL);
363 static int may_context_mount_inode_relabel(u32 sid,
364 struct superblock_security_struct *sbsec,
365 const struct cred *cred)
367 const struct task_security_struct *tsec = cred->security;
369 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
370 FILESYSTEM__RELABELFROM, NULL);
374 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
375 FILESYSTEM__ASSOCIATE, NULL);
379 static int selinux_is_sblabel_mnt(struct super_block *sb)
381 struct superblock_security_struct *sbsec = sb->s_security;
383 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
384 sbsec->behavior == SECURITY_FS_USE_TRANS ||
385 sbsec->behavior == SECURITY_FS_USE_TASK)
388 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
389 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
393 * Special handling for rootfs. Is genfs but supports
394 * setting SELinux context on in-core inodes.
396 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
402 static int sb_finish_set_opts(struct super_block *sb)
404 struct superblock_security_struct *sbsec = sb->s_security;
405 struct dentry *root = sb->s_root;
406 struct inode *root_inode = root->d_inode;
409 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
410 /* Make sure that the xattr handler exists and that no
411 error other than -ENODATA is returned by getxattr on
412 the root directory. -ENODATA is ok, as this may be
413 the first boot of the SELinux kernel before we have
414 assigned xattr values to the filesystem. */
415 if (!root_inode->i_op->getxattr) {
416 printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "
417 "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));
421 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
422 if (rc < 0 && rc != -ENODATA) {
423 if (rc == -EOPNOTSUPP)
424 printk(KERN_WARNING "SELinux: (dev %s, type "
425 SB_TYPE_FMT") has no security xattr handler\n",
426 sb->s_id, SB_TYPE_ARGS(sb));
428 printk(KERN_WARNING "SELinux: (dev %s, type "
429 SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,
430 SB_TYPE_ARGS(sb), -rc);
435 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
436 printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",
437 sb->s_id, SB_TYPE_ARGS(sb));
439 printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",
440 sb->s_id, SB_TYPE_ARGS(sb),
441 labeling_behaviors[sbsec->behavior-1]);
443 sbsec->flags |= SE_SBINITIALIZED;
444 if (selinux_is_sblabel_mnt(sb))
445 sbsec->flags |= SBLABEL_MNT;
447 /* Initialize the root inode. */
448 rc = inode_doinit_with_dentry(root_inode, root);
450 /* Initialize any other inodes associated with the superblock, e.g.
451 inodes created prior to initial policy load or inodes created
452 during get_sb by a pseudo filesystem that directly
454 spin_lock(&sbsec->isec_lock);
456 if (!list_empty(&sbsec->isec_head)) {
457 struct inode_security_struct *isec =
458 list_entry(sbsec->isec_head.next,
459 struct inode_security_struct, list);
460 struct inode *inode = isec->inode;
461 spin_unlock(&sbsec->isec_lock);
462 inode = igrab(inode);
464 if (!IS_PRIVATE(inode))
468 spin_lock(&sbsec->isec_lock);
469 list_del_init(&isec->list);
472 spin_unlock(&sbsec->isec_lock);
478 * This function should allow an FS to ask what it's mount security
479 * options were so it can use those later for submounts, displaying
480 * mount options, or whatever.
482 static int selinux_get_mnt_opts(const struct super_block *sb,
483 struct security_mnt_opts *opts)
486 struct superblock_security_struct *sbsec = sb->s_security;
487 char *context = NULL;
491 security_init_mnt_opts(opts);
493 if (!(sbsec->flags & SE_SBINITIALIZED))
499 /* make sure we always check enough bits to cover the mask */
500 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
502 tmp = sbsec->flags & SE_MNTMASK;
503 /* count the number of mount options for this sb */
504 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
506 opts->num_mnt_opts++;
509 /* Check if the Label support flag is set */
510 if (sbsec->flags & SBLABEL_MNT)
511 opts->num_mnt_opts++;
513 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
514 if (!opts->mnt_opts) {
519 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
520 if (!opts->mnt_opts_flags) {
526 if (sbsec->flags & FSCONTEXT_MNT) {
527 rc = security_sid_to_context(sbsec->sid, &context, &len);
530 opts->mnt_opts[i] = context;
531 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
533 if (sbsec->flags & CONTEXT_MNT) {
534 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
537 opts->mnt_opts[i] = context;
538 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
540 if (sbsec->flags & DEFCONTEXT_MNT) {
541 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
544 opts->mnt_opts[i] = context;
545 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
547 if (sbsec->flags & ROOTCONTEXT_MNT) {
548 struct inode *root = sbsec->sb->s_root->d_inode;
549 struct inode_security_struct *isec = root->i_security;
551 rc = security_sid_to_context(isec->sid, &context, &len);
554 opts->mnt_opts[i] = context;
555 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
557 if (sbsec->flags & SBLABEL_MNT) {
558 opts->mnt_opts[i] = NULL;
559 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
562 BUG_ON(i != opts->num_mnt_opts);
567 security_free_mnt_opts(opts);
571 static int bad_option(struct superblock_security_struct *sbsec, char flag,
572 u32 old_sid, u32 new_sid)
574 char mnt_flags = sbsec->flags & SE_MNTMASK;
576 /* check if the old mount command had the same options */
577 if (sbsec->flags & SE_SBINITIALIZED)
578 if (!(sbsec->flags & flag) ||
579 (old_sid != new_sid))
582 /* check if we were passed the same options twice,
583 * aka someone passed context=a,context=b
585 if (!(sbsec->flags & SE_SBINITIALIZED))
586 if (mnt_flags & flag)
592 * Allow filesystems with binary mount data to explicitly set mount point
593 * labeling information.
595 static int selinux_set_mnt_opts(struct super_block *sb,
596 struct security_mnt_opts *opts,
597 unsigned long kern_flags,
598 unsigned long *set_kern_flags)
600 const struct cred *cred = current_cred();
602 struct superblock_security_struct *sbsec = sb->s_security;
603 struct inode *inode = sbsec->sb->s_root->d_inode;
604 struct inode_security_struct *root_isec = inode->i_security;
605 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
606 u32 defcontext_sid = 0;
607 char **mount_options = opts->mnt_opts;
608 int *flags = opts->mnt_opts_flags;
609 int num_opts = opts->num_mnt_opts;
611 mutex_lock(&sbsec->lock);
613 if (!ss_initialized) {
615 /* Defer initialization until selinux_complete_init,
616 after the initial policy is loaded and the security
617 server is ready to handle calls. */
621 printk(KERN_WARNING "SELinux: Unable to set superblock options "
622 "before the security server is initialized\n");
625 if (kern_flags && !set_kern_flags) {
626 /* Specifying internal flags without providing a place to
627 * place the results is not allowed */
633 * Binary mount data FS will come through this function twice. Once
634 * from an explicit call and once from the generic calls from the vfs.
635 * Since the generic VFS calls will not contain any security mount data
636 * we need to skip the double mount verification.
638 * This does open a hole in which we will not notice if the first
639 * mount using this sb set explict options and a second mount using
640 * this sb does not set any security options. (The first options
641 * will be used for both mounts)
643 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
648 * parse the mount options, check if they are valid sids.
649 * also check if someone is trying to mount the same sb more
650 * than once with different security options.
652 for (i = 0; i < num_opts; i++) {
655 if (flags[i] == SBLABEL_MNT)
657 rc = security_context_to_sid(mount_options[i],
658 strlen(mount_options[i]), &sid);
660 printk(KERN_WARNING "SELinux: security_context_to_sid"
661 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
662 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
669 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
671 goto out_double_mount;
673 sbsec->flags |= FSCONTEXT_MNT;
678 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
680 goto out_double_mount;
682 sbsec->flags |= CONTEXT_MNT;
684 case ROOTCONTEXT_MNT:
685 rootcontext_sid = sid;
687 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
689 goto out_double_mount;
691 sbsec->flags |= ROOTCONTEXT_MNT;
695 defcontext_sid = sid;
697 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
699 goto out_double_mount;
701 sbsec->flags |= DEFCONTEXT_MNT;
710 if (sbsec->flags & SE_SBINITIALIZED) {
711 /* previously mounted with options, but not on this attempt? */
712 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
713 goto out_double_mount;
718 if (strcmp(sb->s_type->name, "proc") == 0)
719 sbsec->flags |= SE_SBPROC;
721 if (!sbsec->behavior) {
723 * Determine the labeling behavior to use for this
726 rc = security_fs_use(sb);
729 "%s: security_fs_use(%s) returned %d\n",
730 __func__, sb->s_type->name, rc);
734 /* sets the context of the superblock for the fs being mounted. */
736 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
740 sbsec->sid = fscontext_sid;
744 * Switch to using mount point labeling behavior.
745 * sets the label used on all file below the mountpoint, and will set
746 * the superblock context if not already set.
748 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
749 sbsec->behavior = SECURITY_FS_USE_NATIVE;
750 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
754 if (!fscontext_sid) {
755 rc = may_context_mount_sb_relabel(context_sid, sbsec,
759 sbsec->sid = context_sid;
761 rc = may_context_mount_inode_relabel(context_sid, sbsec,
766 if (!rootcontext_sid)
767 rootcontext_sid = context_sid;
769 sbsec->mntpoint_sid = context_sid;
770 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
773 if (rootcontext_sid) {
774 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
779 root_isec->sid = rootcontext_sid;
780 root_isec->initialized = 1;
783 if (defcontext_sid) {
784 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
785 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
787 printk(KERN_WARNING "SELinux: defcontext option is "
788 "invalid for this filesystem type\n");
792 if (defcontext_sid != sbsec->def_sid) {
793 rc = may_context_mount_inode_relabel(defcontext_sid,
799 sbsec->def_sid = defcontext_sid;
802 rc = sb_finish_set_opts(sb);
804 mutex_unlock(&sbsec->lock);
808 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
809 "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
814 static int selinux_cmp_sb_context(const struct super_block *oldsb,
815 const struct super_block *newsb)
817 struct superblock_security_struct *old = oldsb->s_security;
818 struct superblock_security_struct *new = newsb->s_security;
819 char oldflags = old->flags & SE_MNTMASK;
820 char newflags = new->flags & SE_MNTMASK;
822 if (oldflags != newflags)
824 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
826 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
828 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
830 if (oldflags & ROOTCONTEXT_MNT) {
831 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
832 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
833 if (oldroot->sid != newroot->sid)
838 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
839 "different security settings for (dev %s, "
840 "type %s)\n", newsb->s_id, newsb->s_type->name);
844 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
845 struct super_block *newsb)
847 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
848 struct superblock_security_struct *newsbsec = newsb->s_security;
850 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
851 int set_context = (oldsbsec->flags & CONTEXT_MNT);
852 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
855 * if the parent was able to be mounted it clearly had no special lsm
856 * mount options. thus we can safely deal with this superblock later
861 /* how can we clone if the old one wasn't set up?? */
862 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
864 /* if fs is reusing a sb, make sure that the contexts match */
865 if (newsbsec->flags & SE_SBINITIALIZED)
866 return selinux_cmp_sb_context(oldsb, newsb);
868 mutex_lock(&newsbsec->lock);
870 newsbsec->flags = oldsbsec->flags;
872 newsbsec->sid = oldsbsec->sid;
873 newsbsec->def_sid = oldsbsec->def_sid;
874 newsbsec->behavior = oldsbsec->behavior;
877 u32 sid = oldsbsec->mntpoint_sid;
881 if (!set_rootcontext) {
882 struct inode *newinode = newsb->s_root->d_inode;
883 struct inode_security_struct *newisec = newinode->i_security;
886 newsbsec->mntpoint_sid = sid;
888 if (set_rootcontext) {
889 const struct inode *oldinode = oldsb->s_root->d_inode;
890 const struct inode_security_struct *oldisec = oldinode->i_security;
891 struct inode *newinode = newsb->s_root->d_inode;
892 struct inode_security_struct *newisec = newinode->i_security;
894 newisec->sid = oldisec->sid;
897 sb_finish_set_opts(newsb);
898 mutex_unlock(&newsbsec->lock);
902 static int selinux_parse_opts_str(char *options,
903 struct security_mnt_opts *opts)
906 char *context = NULL, *defcontext = NULL;
907 char *fscontext = NULL, *rootcontext = NULL;
908 int rc, num_mnt_opts = 0;
910 opts->num_mnt_opts = 0;
912 /* Standard string-based options. */
913 while ((p = strsep(&options, "|")) != NULL) {
915 substring_t args[MAX_OPT_ARGS];
920 token = match_token(p, tokens, args);
924 if (context || defcontext) {
926 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
929 context = match_strdup(&args[0]);
939 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
942 fscontext = match_strdup(&args[0]);
949 case Opt_rootcontext:
952 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
955 rootcontext = match_strdup(&args[0]);
963 if (context || defcontext) {
965 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
968 defcontext = match_strdup(&args[0]);
974 case Opt_labelsupport:
978 printk(KERN_WARNING "SELinux: unknown mount option\n");
985 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
989 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
990 if (!opts->mnt_opts_flags) {
991 kfree(opts->mnt_opts);
996 opts->mnt_opts[num_mnt_opts] = fscontext;
997 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1000 opts->mnt_opts[num_mnt_opts] = context;
1001 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1004 opts->mnt_opts[num_mnt_opts] = rootcontext;
1005 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1008 opts->mnt_opts[num_mnt_opts] = defcontext;
1009 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1012 opts->num_mnt_opts = num_mnt_opts;
1023 * string mount options parsing and call set the sbsec
1025 static int superblock_doinit(struct super_block *sb, void *data)
1028 char *options = data;
1029 struct security_mnt_opts opts;
1031 security_init_mnt_opts(&opts);
1036 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1038 rc = selinux_parse_opts_str(options, &opts);
1043 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1046 security_free_mnt_opts(&opts);
1050 static void selinux_write_opts(struct seq_file *m,
1051 struct security_mnt_opts *opts)
1056 for (i = 0; i < opts->num_mnt_opts; i++) {
1059 if (opts->mnt_opts[i])
1060 has_comma = strchr(opts->mnt_opts[i], ',');
1064 switch (opts->mnt_opts_flags[i]) {
1066 prefix = CONTEXT_STR;
1069 prefix = FSCONTEXT_STR;
1071 case ROOTCONTEXT_MNT:
1072 prefix = ROOTCONTEXT_STR;
1074 case DEFCONTEXT_MNT:
1075 prefix = DEFCONTEXT_STR;
1079 seq_puts(m, LABELSUPP_STR);
1085 /* we need a comma before each option */
1087 seq_puts(m, prefix);
1090 seq_puts(m, opts->mnt_opts[i]);
1096 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1098 struct security_mnt_opts opts;
1101 rc = selinux_get_mnt_opts(sb, &opts);
1103 /* before policy load we may get EINVAL, don't show anything */
1109 selinux_write_opts(m, &opts);
1111 security_free_mnt_opts(&opts);
1116 static inline u16 inode_mode_to_security_class(umode_t mode)
1118 switch (mode & S_IFMT) {
1120 return SECCLASS_SOCK_FILE;
1122 return SECCLASS_LNK_FILE;
1124 return SECCLASS_FILE;
1126 return SECCLASS_BLK_FILE;
1128 return SECCLASS_DIR;
1130 return SECCLASS_CHR_FILE;
1132 return SECCLASS_FIFO_FILE;
1136 return SECCLASS_FILE;
1139 static inline int default_protocol_stream(int protocol)
1141 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1144 static inline int default_protocol_dgram(int protocol)
1146 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1149 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1155 case SOCK_SEQPACKET:
1156 return SECCLASS_UNIX_STREAM_SOCKET;
1158 return SECCLASS_UNIX_DGRAM_SOCKET;
1165 if (default_protocol_stream(protocol))
1166 return SECCLASS_TCP_SOCKET;
1168 return SECCLASS_RAWIP_SOCKET;
1170 if (default_protocol_dgram(protocol))
1171 return SECCLASS_UDP_SOCKET;
1173 return SECCLASS_RAWIP_SOCKET;
1175 return SECCLASS_DCCP_SOCKET;
1177 return SECCLASS_RAWIP_SOCKET;
1183 return SECCLASS_NETLINK_ROUTE_SOCKET;
1184 case NETLINK_FIREWALL:
1185 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1186 case NETLINK_SOCK_DIAG:
1187 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1189 return SECCLASS_NETLINK_NFLOG_SOCKET;
1191 return SECCLASS_NETLINK_XFRM_SOCKET;
1192 case NETLINK_SELINUX:
1193 return SECCLASS_NETLINK_SELINUX_SOCKET;
1195 return SECCLASS_NETLINK_AUDIT_SOCKET;
1196 case NETLINK_IP6_FW:
1197 return SECCLASS_NETLINK_IP6FW_SOCKET;
1198 case NETLINK_DNRTMSG:
1199 return SECCLASS_NETLINK_DNRT_SOCKET;
1200 case NETLINK_KOBJECT_UEVENT:
1201 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1203 return SECCLASS_NETLINK_SOCKET;
1206 return SECCLASS_PACKET_SOCKET;
1208 return SECCLASS_KEY_SOCKET;
1210 return SECCLASS_APPLETALK_SOCKET;
1213 return SECCLASS_SOCKET;
1216 #ifdef CONFIG_PROC_FS
1217 static int selinux_proc_get_sid(struct dentry *dentry,
1222 char *buffer, *path;
1224 buffer = (char *)__get_free_page(GFP_KERNEL);
1228 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1232 /* each process gets a /proc/PID/ entry. Strip off the
1233 * PID part to get a valid selinux labeling.
1234 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1235 while (path[1] >= '0' && path[1] <= '9') {
1239 rc = security_genfs_sid("proc", path, tclass, sid);
1241 free_page((unsigned long)buffer);
1245 static int selinux_proc_get_sid(struct dentry *dentry,
1253 /* The inode's security attributes must be initialized before first use. */
1254 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1256 struct superblock_security_struct *sbsec = NULL;
1257 struct inode_security_struct *isec = inode->i_security;
1259 struct dentry *dentry;
1260 #define INITCONTEXTLEN 255
1261 char *context = NULL;
1265 if (isec->initialized)
1268 mutex_lock(&isec->lock);
1269 if (isec->initialized)
1272 sbsec = inode->i_sb->s_security;
1273 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1274 /* Defer initialization until selinux_complete_init,
1275 after the initial policy is loaded and the security
1276 server is ready to handle calls. */
1277 spin_lock(&sbsec->isec_lock);
1278 if (list_empty(&isec->list))
1279 list_add(&isec->list, &sbsec->isec_head);
1280 spin_unlock(&sbsec->isec_lock);
1284 switch (sbsec->behavior) {
1285 case SECURITY_FS_USE_NATIVE:
1287 case SECURITY_FS_USE_XATTR:
1288 if (!inode->i_op->getxattr) {
1289 isec->sid = sbsec->def_sid;
1293 /* Need a dentry, since the xattr API requires one.
1294 Life would be simpler if we could just pass the inode. */
1296 /* Called from d_instantiate or d_splice_alias. */
1297 dentry = dget(opt_dentry);
1299 /* Called from selinux_complete_init, try to find a dentry. */
1300 dentry = d_find_alias(inode);
1304 * this is can be hit on boot when a file is accessed
1305 * before the policy is loaded. When we load policy we
1306 * may find inodes that have no dentry on the
1307 * sbsec->isec_head list. No reason to complain as these
1308 * will get fixed up the next time we go through
1309 * inode_doinit with a dentry, before these inodes could
1310 * be used again by userspace.
1315 len = INITCONTEXTLEN;
1316 context = kmalloc(len+1, GFP_NOFS);
1322 context[len] = '\0';
1323 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1325 if (rc == -ERANGE) {
1328 /* Need a larger buffer. Query for the right size. */
1329 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336 context = kmalloc(len+1, GFP_NOFS);
1342 context[len] = '\0';
1343 rc = inode->i_op->getxattr(dentry,
1349 if (rc != -ENODATA) {
1350 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1351 "%d for dev=%s ino=%ld\n", __func__,
1352 -rc, inode->i_sb->s_id, inode->i_ino);
1356 /* Map ENODATA to the default file SID */
1357 sid = sbsec->def_sid;
1360 rc = security_context_to_sid_default(context, rc, &sid,
1364 char *dev = inode->i_sb->s_id;
1365 unsigned long ino = inode->i_ino;
1367 if (rc == -EINVAL) {
1368 if (printk_ratelimit())
1369 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1370 "context=%s. This indicates you may need to relabel the inode or the "
1371 "filesystem in question.\n", ino, dev, context);
1373 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1374 "returned %d for dev=%s ino=%ld\n",
1375 __func__, context, -rc, dev, ino);
1378 /* Leave with the unlabeled SID */
1386 case SECURITY_FS_USE_TASK:
1387 isec->sid = isec->task_sid;
1389 case SECURITY_FS_USE_TRANS:
1390 /* Default to the fs SID. */
1391 isec->sid = sbsec->sid;
1393 /* Try to obtain a transition SID. */
1394 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1395 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1396 isec->sclass, NULL, &sid);
1401 case SECURITY_FS_USE_MNTPOINT:
1402 isec->sid = sbsec->mntpoint_sid;
1405 /* Default to the fs superblock SID. */
1406 isec->sid = sbsec->sid;
1408 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1410 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1411 rc = selinux_proc_get_sid(opt_dentry,
1422 isec->initialized = 1;
1425 mutex_unlock(&isec->lock);
1427 if (isec->sclass == SECCLASS_FILE)
1428 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1432 /* Convert a Linux signal to an access vector. */
1433 static inline u32 signal_to_av(int sig)
1439 /* Commonly granted from child to parent. */
1440 perm = PROCESS__SIGCHLD;
1443 /* Cannot be caught or ignored */
1444 perm = PROCESS__SIGKILL;
1447 /* Cannot be caught or ignored */
1448 perm = PROCESS__SIGSTOP;
1451 /* All other signals. */
1452 perm = PROCESS__SIGNAL;
1460 * Check permission between a pair of credentials
1461 * fork check, ptrace check, etc.
1463 static int cred_has_perm(const struct cred *actor,
1464 const struct cred *target,
1467 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1469 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1473 * Check permission between a pair of tasks, e.g. signal checks,
1474 * fork check, ptrace check, etc.
1475 * tsk1 is the actor and tsk2 is the target
1476 * - this uses the default subjective creds of tsk1
1478 static int task_has_perm(const struct task_struct *tsk1,
1479 const struct task_struct *tsk2,
1482 const struct task_security_struct *__tsec1, *__tsec2;
1486 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1487 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1489 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1493 * Check permission between current and another task, e.g. signal checks,
1494 * fork check, ptrace check, etc.
1495 * current is the actor and tsk2 is the target
1496 * - this uses current's subjective creds
1498 static int current_has_perm(const struct task_struct *tsk,
1503 sid = current_sid();
1504 tsid = task_sid(tsk);
1505 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1508 #if CAP_LAST_CAP > 63
1509 #error Fix SELinux to handle capabilities > 63.
1512 /* Check whether a task is allowed to use a capability. */
1513 static int cred_has_capability(const struct cred *cred,
1516 struct common_audit_data ad;
1517 struct av_decision avd;
1519 u32 sid = cred_sid(cred);
1520 u32 av = CAP_TO_MASK(cap);
1523 ad.type = LSM_AUDIT_DATA_CAP;
1526 switch (CAP_TO_INDEX(cap)) {
1528 sclass = SECCLASS_CAPABILITY;
1531 sclass = SECCLASS_CAPABILITY2;
1535 "SELinux: out of range capability %d\n", cap);
1540 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1541 if (audit == SECURITY_CAP_AUDIT) {
1542 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1549 /* Check whether a task is allowed to use a system operation. */
1550 static int task_has_system(struct task_struct *tsk,
1553 u32 sid = task_sid(tsk);
1555 return avc_has_perm(sid, SECINITSID_KERNEL,
1556 SECCLASS_SYSTEM, perms, NULL);
1559 /* Check whether a task has a particular permission to an inode.
1560 The 'adp' parameter is optional and allows other audit
1561 data to be passed (e.g. the dentry). */
1562 static int inode_has_perm(const struct cred *cred,
1563 struct inode *inode,
1565 struct common_audit_data *adp)
1567 struct inode_security_struct *isec;
1570 validate_creds(cred);
1572 if (unlikely(IS_PRIVATE(inode)))
1575 sid = cred_sid(cred);
1576 isec = inode->i_security;
1578 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1581 /* Same as inode_has_perm, but pass explicit audit data containing
1582 the dentry to help the auditing code to more easily generate the
1583 pathname if needed. */
1584 static inline int dentry_has_perm(const struct cred *cred,
1585 struct dentry *dentry,
1588 struct inode *inode = dentry->d_inode;
1589 struct common_audit_data ad;
1591 ad.type = LSM_AUDIT_DATA_DENTRY;
1592 ad.u.dentry = dentry;
1593 return inode_has_perm(cred, inode, av, &ad);
1596 /* Same as inode_has_perm, but pass explicit audit data containing
1597 the path to help the auditing code to more easily generate the
1598 pathname if needed. */
1599 static inline int path_has_perm(const struct cred *cred,
1603 struct inode *inode = path->dentry->d_inode;
1604 struct common_audit_data ad;
1606 ad.type = LSM_AUDIT_DATA_PATH;
1608 return inode_has_perm(cred, inode, av, &ad);
1611 /* Same as path_has_perm, but uses the inode from the file struct. */
1612 static inline int file_path_has_perm(const struct cred *cred,
1616 struct common_audit_data ad;
1618 ad.type = LSM_AUDIT_DATA_PATH;
1619 ad.u.path = file->f_path;
1620 return inode_has_perm(cred, file_inode(file), av, &ad);
1623 /* Check whether a task can use an open file descriptor to
1624 access an inode in a given way. Check access to the
1625 descriptor itself, and then use dentry_has_perm to
1626 check a particular permission to the file.
1627 Access to the descriptor is implicitly granted if it
1628 has the same SID as the process. If av is zero, then
1629 access to the file is not checked, e.g. for cases
1630 where only the descriptor is affected like seek. */
1631 static int file_has_perm(const struct cred *cred,
1635 struct file_security_struct *fsec = file->f_security;
1636 struct inode *inode = file_inode(file);
1637 struct common_audit_data ad;
1638 u32 sid = cred_sid(cred);
1641 ad.type = LSM_AUDIT_DATA_PATH;
1642 ad.u.path = file->f_path;
1644 if (sid != fsec->sid) {
1645 rc = avc_has_perm(sid, fsec->sid,
1653 /* av is zero if only checking access to the descriptor. */
1656 rc = inode_has_perm(cred, inode, av, &ad);
1662 /* Check whether a task can create a file. */
1663 static int may_create(struct inode *dir,
1664 struct dentry *dentry,
1667 const struct task_security_struct *tsec = current_security();
1668 struct inode_security_struct *dsec;
1669 struct superblock_security_struct *sbsec;
1671 struct common_audit_data ad;
1674 dsec = dir->i_security;
1675 sbsec = dir->i_sb->s_security;
1678 newsid = tsec->create_sid;
1680 ad.type = LSM_AUDIT_DATA_DENTRY;
1681 ad.u.dentry = dentry;
1683 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1684 DIR__ADD_NAME | DIR__SEARCH,
1689 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1690 rc = security_transition_sid(sid, dsec->sid, tclass,
1691 &dentry->d_name, &newsid);
1696 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1700 return avc_has_perm(newsid, sbsec->sid,
1701 SECCLASS_FILESYSTEM,
1702 FILESYSTEM__ASSOCIATE, &ad);
1705 /* Check whether a task can create a key. */
1706 static int may_create_key(u32 ksid,
1707 struct task_struct *ctx)
1709 u32 sid = task_sid(ctx);
1711 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1715 #define MAY_UNLINK 1
1718 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1719 static int may_link(struct inode *dir,
1720 struct dentry *dentry,
1724 struct inode_security_struct *dsec, *isec;
1725 struct common_audit_data ad;
1726 u32 sid = current_sid();
1730 dsec = dir->i_security;
1731 isec = dentry->d_inode->i_security;
1733 ad.type = LSM_AUDIT_DATA_DENTRY;
1734 ad.u.dentry = dentry;
1737 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1738 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1753 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1758 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1762 static inline int may_rename(struct inode *old_dir,
1763 struct dentry *old_dentry,
1764 struct inode *new_dir,
1765 struct dentry *new_dentry)
1767 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1768 struct common_audit_data ad;
1769 u32 sid = current_sid();
1771 int old_is_dir, new_is_dir;
1774 old_dsec = old_dir->i_security;
1775 old_isec = old_dentry->d_inode->i_security;
1776 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1777 new_dsec = new_dir->i_security;
1779 ad.type = LSM_AUDIT_DATA_DENTRY;
1781 ad.u.dentry = old_dentry;
1782 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1783 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1786 rc = avc_has_perm(sid, old_isec->sid,
1787 old_isec->sclass, FILE__RENAME, &ad);
1790 if (old_is_dir && new_dir != old_dir) {
1791 rc = avc_has_perm(sid, old_isec->sid,
1792 old_isec->sclass, DIR__REPARENT, &ad);
1797 ad.u.dentry = new_dentry;
1798 av = DIR__ADD_NAME | DIR__SEARCH;
1799 if (new_dentry->d_inode)
1800 av |= DIR__REMOVE_NAME;
1801 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1804 if (new_dentry->d_inode) {
1805 new_isec = new_dentry->d_inode->i_security;
1806 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1807 rc = avc_has_perm(sid, new_isec->sid,
1809 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1817 /* Check whether a task can perform a filesystem operation. */
1818 static int superblock_has_perm(const struct cred *cred,
1819 struct super_block *sb,
1821 struct common_audit_data *ad)
1823 struct superblock_security_struct *sbsec;
1824 u32 sid = cred_sid(cred);
1826 sbsec = sb->s_security;
1827 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1830 /* Convert a Linux mode and permission mask to an access vector. */
1831 static inline u32 file_mask_to_av(int mode, int mask)
1835 if (!S_ISDIR(mode)) {
1836 if (mask & MAY_EXEC)
1837 av |= FILE__EXECUTE;
1838 if (mask & MAY_READ)
1841 if (mask & MAY_APPEND)
1843 else if (mask & MAY_WRITE)
1847 if (mask & MAY_EXEC)
1849 if (mask & MAY_WRITE)
1851 if (mask & MAY_READ)
1858 /* Convert a Linux file to an access vector. */
1859 static inline u32 file_to_av(struct file *file)
1863 if (file->f_mode & FMODE_READ)
1865 if (file->f_mode & FMODE_WRITE) {
1866 if (file->f_flags & O_APPEND)
1873 * Special file opened with flags 3 for ioctl-only use.
1882 * Convert a file to an access vector and include the correct open
1885 static inline u32 open_file_to_av(struct file *file)
1887 u32 av = file_to_av(file);
1889 if (selinux_policycap_openperm)
1895 /* Hook functions begin here. */
1897 static int selinux_ptrace_access_check(struct task_struct *child,
1902 rc = cap_ptrace_access_check(child, mode);
1906 if (mode & PTRACE_MODE_READ) {
1907 u32 sid = current_sid();
1908 u32 csid = task_sid(child);
1909 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1912 return current_has_perm(child, PROCESS__PTRACE);
1915 static int selinux_ptrace_traceme(struct task_struct *parent)
1919 rc = cap_ptrace_traceme(parent);
1923 return task_has_perm(parent, current, PROCESS__PTRACE);
1926 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1927 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1931 error = current_has_perm(target, PROCESS__GETCAP);
1935 return cap_capget(target, effective, inheritable, permitted);
1938 static int selinux_capset(struct cred *new, const struct cred *old,
1939 const kernel_cap_t *effective,
1940 const kernel_cap_t *inheritable,
1941 const kernel_cap_t *permitted)
1945 error = cap_capset(new, old,
1946 effective, inheritable, permitted);
1950 return cred_has_perm(old, new, PROCESS__SETCAP);
1954 * (This comment used to live with the selinux_task_setuid hook,
1955 * which was removed).
1957 * Since setuid only affects the current process, and since the SELinux
1958 * controls are not based on the Linux identity attributes, SELinux does not
1959 * need to control this operation. However, SELinux does control the use of
1960 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1963 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1968 rc = cap_capable(cred, ns, cap, audit);
1972 return cred_has_capability(cred, cap, audit);
1975 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1977 const struct cred *cred = current_cred();
1989 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1994 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1997 rc = 0; /* let the kernel handle invalid cmds */
2003 static int selinux_quota_on(struct dentry *dentry)
2005 const struct cred *cred = current_cred();
2007 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2010 static int selinux_syslog(int type)
2015 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2016 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2017 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2019 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2020 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2021 /* Set level of messages printed to console */
2022 case SYSLOG_ACTION_CONSOLE_LEVEL:
2023 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2025 case SYSLOG_ACTION_CLOSE: /* Close log */
2026 case SYSLOG_ACTION_OPEN: /* Open log */
2027 case SYSLOG_ACTION_READ: /* Read from log */
2028 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2029 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2031 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2038 * Check that a process has enough memory to allocate a new virtual
2039 * mapping. 0 means there is enough memory for the allocation to
2040 * succeed and -ENOMEM implies there is not.
2042 * Do not audit the selinux permission check, as this is applied to all
2043 * processes that allocate mappings.
2045 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2047 int rc, cap_sys_admin = 0;
2049 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2050 SECURITY_CAP_NOAUDIT);
2054 return __vm_enough_memory(mm, pages, cap_sys_admin);
2057 /* binprm security operations */
2059 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2061 const struct task_security_struct *old_tsec;
2062 struct task_security_struct *new_tsec;
2063 struct inode_security_struct *isec;
2064 struct common_audit_data ad;
2065 struct inode *inode = file_inode(bprm->file);
2068 rc = cap_bprm_set_creds(bprm);
2072 /* SELinux context only depends on initial program or script and not
2073 * the script interpreter */
2074 if (bprm->cred_prepared)
2077 old_tsec = current_security();
2078 new_tsec = bprm->cred->security;
2079 isec = inode->i_security;
2081 /* Default to the current task SID. */
2082 new_tsec->sid = old_tsec->sid;
2083 new_tsec->osid = old_tsec->sid;
2085 /* Reset fs, key, and sock SIDs on execve. */
2086 new_tsec->create_sid = 0;
2087 new_tsec->keycreate_sid = 0;
2088 new_tsec->sockcreate_sid = 0;
2090 if (old_tsec->exec_sid) {
2091 new_tsec->sid = old_tsec->exec_sid;
2092 /* Reset exec SID on execve. */
2093 new_tsec->exec_sid = 0;
2096 * Minimize confusion: if no_new_privs and a transition is
2097 * explicitly requested, then fail the exec.
2099 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2102 /* Check for a default transition on this program. */
2103 rc = security_transition_sid(old_tsec->sid, isec->sid,
2104 SECCLASS_PROCESS, NULL,
2110 ad.type = LSM_AUDIT_DATA_PATH;
2111 ad.u.path = bprm->file->f_path;
2113 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2114 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2115 new_tsec->sid = old_tsec->sid;
2117 if (new_tsec->sid == old_tsec->sid) {
2118 rc = avc_has_perm(old_tsec->sid, isec->sid,
2119 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2123 /* Check permissions for the transition. */
2124 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2125 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2129 rc = avc_has_perm(new_tsec->sid, isec->sid,
2130 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2134 /* Check for shared state */
2135 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2136 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2137 SECCLASS_PROCESS, PROCESS__SHARE,
2143 /* Make sure that anyone attempting to ptrace over a task that
2144 * changes its SID has the appropriate permit */
2146 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2147 struct task_struct *tracer;
2148 struct task_security_struct *sec;
2152 tracer = ptrace_parent(current);
2153 if (likely(tracer != NULL)) {
2154 sec = __task_cred(tracer)->security;
2160 rc = avc_has_perm(ptsid, new_tsec->sid,
2162 PROCESS__PTRACE, NULL);
2168 /* Clear any possibly unsafe personality bits on exec: */
2169 bprm->per_clear |= PER_CLEAR_ON_SETID;
2175 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2177 const struct task_security_struct *tsec = current_security();
2185 /* Enable secure mode for SIDs transitions unless
2186 the noatsecure permission is granted between
2187 the two SIDs, i.e. ahp returns 0. */
2188 atsecure = avc_has_perm(osid, sid,
2190 PROCESS__NOATSECURE, NULL);
2193 return (atsecure || cap_bprm_secureexec(bprm));
2196 static int match_file(const void *p, struct file *file, unsigned fd)
2198 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2201 /* Derived from fs/exec.c:flush_old_files. */
2202 static inline void flush_unauthorized_files(const struct cred *cred,
2203 struct files_struct *files)
2205 struct file *file, *devnull = NULL;
2206 struct tty_struct *tty;
2210 tty = get_current_tty();
2212 spin_lock(&tty_files_lock);
2213 if (!list_empty(&tty->tty_files)) {
2214 struct tty_file_private *file_priv;
2216 /* Revalidate access to controlling tty.
2217 Use file_path_has_perm on the tty path directly
2218 rather than using file_has_perm, as this particular
2219 open file may belong to another process and we are
2220 only interested in the inode-based check here. */
2221 file_priv = list_first_entry(&tty->tty_files,
2222 struct tty_file_private, list);
2223 file = file_priv->file;
2224 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2227 spin_unlock(&tty_files_lock);
2230 /* Reset controlling tty. */
2234 /* Revalidate access to inherited open files. */
2235 n = iterate_fd(files, 0, match_file, cred);
2236 if (!n) /* none found? */
2239 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2240 if (IS_ERR(devnull))
2242 /* replace all the matching ones with this */
2244 replace_fd(n - 1, devnull, 0);
2245 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2251 * Prepare a process for imminent new credential changes due to exec
2253 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2255 struct task_security_struct *new_tsec;
2256 struct rlimit *rlim, *initrlim;
2259 new_tsec = bprm->cred->security;
2260 if (new_tsec->sid == new_tsec->osid)
2263 /* Close files for which the new task SID is not authorized. */
2264 flush_unauthorized_files(bprm->cred, current->files);
2266 /* Always clear parent death signal on SID transitions. */
2267 current->pdeath_signal = 0;
2269 /* Check whether the new SID can inherit resource limits from the old
2270 * SID. If not, reset all soft limits to the lower of the current
2271 * task's hard limit and the init task's soft limit.
2273 * Note that the setting of hard limits (even to lower them) can be
2274 * controlled by the setrlimit check. The inclusion of the init task's
2275 * soft limit into the computation is to avoid resetting soft limits
2276 * higher than the default soft limit for cases where the default is
2277 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2279 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2280 PROCESS__RLIMITINH, NULL);
2282 /* protect against do_prlimit() */
2284 for (i = 0; i < RLIM_NLIMITS; i++) {
2285 rlim = current->signal->rlim + i;
2286 initrlim = init_task.signal->rlim + i;
2287 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2289 task_unlock(current);
2290 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2295 * Clean up the process immediately after the installation of new credentials
2298 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2300 const struct task_security_struct *tsec = current_security();
2301 struct itimerval itimer;
2311 /* Check whether the new SID can inherit signal state from the old SID.
2312 * If not, clear itimers to avoid subsequent signal generation and
2313 * flush and unblock signals.
2315 * This must occur _after_ the task SID has been updated so that any
2316 * kill done after the flush will be checked against the new SID.
2318 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2320 memset(&itimer, 0, sizeof itimer);
2321 for (i = 0; i < 3; i++)
2322 do_setitimer(i, &itimer, NULL);
2323 spin_lock_irq(¤t->sighand->siglock);
2324 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2325 __flush_signals(current);
2326 flush_signal_handlers(current, 1);
2327 sigemptyset(¤t->blocked);
2329 spin_unlock_irq(¤t->sighand->siglock);
2332 /* Wake up the parent if it is waiting so that it can recheck
2333 * wait permission to the new task SID. */
2334 read_lock(&tasklist_lock);
2335 __wake_up_parent(current, current->real_parent);
2336 read_unlock(&tasklist_lock);
2339 /* superblock security operations */
2341 static int selinux_sb_alloc_security(struct super_block *sb)
2343 return superblock_alloc_security(sb);
2346 static void selinux_sb_free_security(struct super_block *sb)
2348 superblock_free_security(sb);
2351 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2356 return !memcmp(prefix, option, plen);
2359 static inline int selinux_option(char *option, int len)
2361 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2362 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2363 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2364 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2365 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2368 static inline void take_option(char **to, char *from, int *first, int len)
2375 memcpy(*to, from, len);
2379 static inline void take_selinux_option(char **to, char *from, int *first,
2382 int current_size = 0;
2390 while (current_size < len) {
2400 static int selinux_sb_copy_data(char *orig, char *copy)
2402 int fnosec, fsec, rc = 0;
2403 char *in_save, *in_curr, *in_end;
2404 char *sec_curr, *nosec_save, *nosec;
2410 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2418 in_save = in_end = orig;
2422 open_quote = !open_quote;
2423 if ((*in_end == ',' && open_quote == 0) ||
2425 int len = in_end - in_curr;
2427 if (selinux_option(in_curr, len))
2428 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2430 take_option(&nosec, in_curr, &fnosec, len);
2432 in_curr = in_end + 1;
2434 } while (*in_end++);
2436 strcpy(in_save, nosec_save);
2437 free_page((unsigned long)nosec_save);
2442 static int selinux_sb_remount(struct super_block *sb, void *data)
2445 struct security_mnt_opts opts;
2446 char *secdata, **mount_options;
2447 struct superblock_security_struct *sbsec = sb->s_security;
2449 if (!(sbsec->flags & SE_SBINITIALIZED))
2455 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2458 security_init_mnt_opts(&opts);
2459 secdata = alloc_secdata();
2462 rc = selinux_sb_copy_data(data, secdata);
2464 goto out_free_secdata;
2466 rc = selinux_parse_opts_str(secdata, &opts);
2468 goto out_free_secdata;
2470 mount_options = opts.mnt_opts;
2471 flags = opts.mnt_opts_flags;
2473 for (i = 0; i < opts.num_mnt_opts; i++) {
2477 if (flags[i] == SBLABEL_MNT)
2479 len = strlen(mount_options[i]);
2480 rc = security_context_to_sid(mount_options[i], len, &sid);
2482 printk(KERN_WARNING "SELinux: security_context_to_sid"
2483 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
2484 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
2490 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2491 goto out_bad_option;
2494 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2495 goto out_bad_option;
2497 case ROOTCONTEXT_MNT: {
2498 struct inode_security_struct *root_isec;
2499 root_isec = sb->s_root->d_inode->i_security;
2501 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2502 goto out_bad_option;
2505 case DEFCONTEXT_MNT:
2506 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2507 goto out_bad_option;
2516 security_free_mnt_opts(&opts);
2518 free_secdata(secdata);
2521 printk(KERN_WARNING "SELinux: unable to change security options "
2522 "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
2527 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2529 const struct cred *cred = current_cred();
2530 struct common_audit_data ad;
2533 rc = superblock_doinit(sb, data);
2537 /* Allow all mounts performed by the kernel */
2538 if (flags & MS_KERNMOUNT)
2541 ad.type = LSM_AUDIT_DATA_DENTRY;
2542 ad.u.dentry = sb->s_root;
2543 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2546 static int selinux_sb_statfs(struct dentry *dentry)
2548 const struct cred *cred = current_cred();
2549 struct common_audit_data ad;
2551 ad.type = LSM_AUDIT_DATA_DENTRY;
2552 ad.u.dentry = dentry->d_sb->s_root;
2553 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2556 static int selinux_mount(const char *dev_name,
2559 unsigned long flags,
2562 const struct cred *cred = current_cred();
2564 if (flags & MS_REMOUNT)
2565 return superblock_has_perm(cred, path->dentry->d_sb,
2566 FILESYSTEM__REMOUNT, NULL);
2568 return path_has_perm(cred, path, FILE__MOUNTON);
2571 static int selinux_umount(struct vfsmount *mnt, int flags)
2573 const struct cred *cred = current_cred();
2575 return superblock_has_perm(cred, mnt->mnt_sb,
2576 FILESYSTEM__UNMOUNT, NULL);
2579 /* inode security operations */
2581 static int selinux_inode_alloc_security(struct inode *inode)
2583 return inode_alloc_security(inode);
2586 static void selinux_inode_free_security(struct inode *inode)
2588 inode_free_security(inode);
2591 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2592 struct qstr *name, void **ctx,
2595 const struct cred *cred = current_cred();
2596 struct task_security_struct *tsec;
2597 struct inode_security_struct *dsec;
2598 struct superblock_security_struct *sbsec;
2599 struct inode *dir = dentry->d_parent->d_inode;
2603 tsec = cred->security;
2604 dsec = dir->i_security;
2605 sbsec = dir->i_sb->s_security;
2607 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2608 newsid = tsec->create_sid;
2610 rc = security_transition_sid(tsec->sid, dsec->sid,
2611 inode_mode_to_security_class(mode),
2616 "%s: security_transition_sid failed, rc=%d\n",
2622 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2625 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2626 const struct qstr *qstr,
2628 void **value, size_t *len)
2630 const struct task_security_struct *tsec = current_security();
2631 struct inode_security_struct *dsec;
2632 struct superblock_security_struct *sbsec;
2633 u32 sid, newsid, clen;
2637 dsec = dir->i_security;
2638 sbsec = dir->i_sb->s_security;
2641 newsid = tsec->create_sid;
2643 if ((sbsec->flags & SE_SBINITIALIZED) &&
2644 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2645 newsid = sbsec->mntpoint_sid;
2646 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2647 rc = security_transition_sid(sid, dsec->sid,
2648 inode_mode_to_security_class(inode->i_mode),
2651 printk(KERN_WARNING "%s: "
2652 "security_transition_sid failed, rc=%d (dev=%s "
2655 -rc, inode->i_sb->s_id, inode->i_ino);
2660 /* Possibly defer initialization to selinux_complete_init. */
2661 if (sbsec->flags & SE_SBINITIALIZED) {
2662 struct inode_security_struct *isec = inode->i_security;
2663 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2665 isec->initialized = 1;
2668 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2672 *name = XATTR_SELINUX_SUFFIX;
2675 rc = security_sid_to_context_force(newsid, &context, &clen);
2685 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2687 return may_create(dir, dentry, SECCLASS_FILE);
2690 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2692 return may_link(dir, old_dentry, MAY_LINK);
2695 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2697 return may_link(dir, dentry, MAY_UNLINK);
2700 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2702 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2705 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2707 return may_create(dir, dentry, SECCLASS_DIR);
2710 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2712 return may_link(dir, dentry, MAY_RMDIR);
2715 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2717 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2720 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2721 struct inode *new_inode, struct dentry *new_dentry)
2723 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2726 static int selinux_inode_readlink(struct dentry *dentry)
2728 const struct cred *cred = current_cred();
2730 return dentry_has_perm(cred, dentry, FILE__READ);
2733 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2735 const struct cred *cred = current_cred();
2737 return dentry_has_perm(cred, dentry, FILE__READ);
2740 static noinline int audit_inode_permission(struct inode *inode,
2741 u32 perms, u32 audited, u32 denied,
2744 struct common_audit_data ad;
2745 struct inode_security_struct *isec = inode->i_security;
2748 ad.type = LSM_AUDIT_DATA_INODE;
2751 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2752 audited, denied, &ad, flags);
2758 static int selinux_inode_permission(struct inode *inode, int mask)
2760 const struct cred *cred = current_cred();
2763 unsigned flags = mask & MAY_NOT_BLOCK;
2764 struct inode_security_struct *isec;
2766 struct av_decision avd;
2768 u32 audited, denied;
2770 from_access = mask & MAY_ACCESS;
2771 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2773 /* No permission to check. Existence test. */
2777 validate_creds(cred);
2779 if (unlikely(IS_PRIVATE(inode)))
2782 perms = file_mask_to_av(inode->i_mode, mask);
2784 sid = cred_sid(cred);
2785 isec = inode->i_security;
2787 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2788 audited = avc_audit_required(perms, &avd, rc,
2789 from_access ? FILE__AUDIT_ACCESS : 0,
2791 if (likely(!audited))
2794 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2800 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2802 const struct cred *cred = current_cred();
2803 unsigned int ia_valid = iattr->ia_valid;
2804 __u32 av = FILE__WRITE;
2806 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2807 if (ia_valid & ATTR_FORCE) {
2808 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2814 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2815 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2816 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2818 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2821 return dentry_has_perm(cred, dentry, av);
2824 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2826 const struct cred *cred = current_cred();
2829 path.dentry = dentry;
2832 return path_has_perm(cred, &path, FILE__GETATTR);
2835 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2837 const struct cred *cred = current_cred();
2839 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2840 sizeof XATTR_SECURITY_PREFIX - 1)) {
2841 if (!strcmp(name, XATTR_NAME_CAPS)) {
2842 if (!capable(CAP_SETFCAP))
2844 } else if (!capable(CAP_SYS_ADMIN)) {
2845 /* A different attribute in the security namespace.
2846 Restrict to administrator. */
2851 /* Not an attribute we recognize, so just check the
2852 ordinary setattr permission. */
2853 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2856 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2857 const void *value, size_t size, int flags)
2859 struct inode *inode = dentry->d_inode;
2860 struct inode_security_struct *isec = inode->i_security;
2861 struct superblock_security_struct *sbsec;
2862 struct common_audit_data ad;
2863 u32 newsid, sid = current_sid();
2866 if (strcmp(name, XATTR_NAME_SELINUX))
2867 return selinux_inode_setotherxattr(dentry, name);
2869 sbsec = inode->i_sb->s_security;
2870 if (!(sbsec->flags & SBLABEL_MNT))
2873 if (!inode_owner_or_capable(inode))
2876 ad.type = LSM_AUDIT_DATA_DENTRY;
2877 ad.u.dentry = dentry;
2879 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2880 FILE__RELABELFROM, &ad);
2884 rc = security_context_to_sid(value, size, &newsid);
2885 if (rc == -EINVAL) {
2886 if (!capable(CAP_MAC_ADMIN)) {
2887 struct audit_buffer *ab;
2891 /* We strip a nul only if it is at the end, otherwise the
2892 * context contains a nul and we should audit that */
2895 if (str[size - 1] == '\0')
2896 audit_size = size - 1;
2903 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2904 audit_log_format(ab, "op=setxattr invalid_context=");
2905 audit_log_n_untrustedstring(ab, value, audit_size);
2910 rc = security_context_to_sid_force(value, size, &newsid);
2915 rc = avc_has_perm(sid, newsid, isec->sclass,
2916 FILE__RELABELTO, &ad);
2920 rc = security_validate_transition(isec->sid, newsid, sid,
2925 return avc_has_perm(newsid,
2927 SECCLASS_FILESYSTEM,
2928 FILESYSTEM__ASSOCIATE,
2932 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2933 const void *value, size_t size,
2936 struct inode *inode = dentry->d_inode;
2937 struct inode_security_struct *isec = inode->i_security;
2941 if (strcmp(name, XATTR_NAME_SELINUX)) {
2942 /* Not an attribute we recognize, so nothing to do. */
2946 rc = security_context_to_sid_force(value, size, &newsid);
2948 printk(KERN_ERR "SELinux: unable to map context to SID"
2949 "for (%s, %lu), rc=%d\n",
2950 inode->i_sb->s_id, inode->i_ino, -rc);
2954 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2956 isec->initialized = 1;
2961 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2963 const struct cred *cred = current_cred();
2965 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2968 static int selinux_inode_listxattr(struct dentry *dentry)
2970 const struct cred *cred = current_cred();
2972 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2975 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2977 if (strcmp(name, XATTR_NAME_SELINUX))
2978 return selinux_inode_setotherxattr(dentry, name);
2980 /* No one is allowed to remove a SELinux security label.
2981 You can change the label, but all data must be labeled. */
2986 * Copy the inode security context value to the user.
2988 * Permission check is handled by selinux_inode_getxattr hook.
2990 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2994 char *context = NULL;
2995 struct inode_security_struct *isec = inode->i_security;
2997 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3001 * If the caller has CAP_MAC_ADMIN, then get the raw context
3002 * value even if it is not defined by current policy; otherwise,
3003 * use the in-core value under current policy.
3004 * Use the non-auditing forms of the permission checks since
3005 * getxattr may be called by unprivileged processes commonly
3006 * and lack of permission just means that we fall back to the
3007 * in-core context value, not a denial.
3009 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3010 SECURITY_CAP_NOAUDIT);
3012 error = security_sid_to_context_force(isec->sid, &context,
3015 error = security_sid_to_context(isec->sid, &context, &size);
3028 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3029 const void *value, size_t size, int flags)
3031 struct inode_security_struct *isec = inode->i_security;
3035 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3038 if (!value || !size)
3041 rc = security_context_to_sid((void *)value, size, &newsid);
3045 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3047 isec->initialized = 1;
3051 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3053 const int len = sizeof(XATTR_NAME_SELINUX);
3054 if (buffer && len <= buffer_size)
3055 memcpy(buffer, XATTR_NAME_SELINUX, len);
3059 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3061 struct inode_security_struct *isec = inode->i_security;
3065 /* file security operations */
3067 static int selinux_revalidate_file_permission(struct file *file, int mask)
3069 const struct cred *cred = current_cred();
3070 struct inode *inode = file_inode(file);
3072 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3073 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3076 return file_has_perm(cred, file,
3077 file_mask_to_av(inode->i_mode, mask));
3080 static int selinux_file_permission(struct file *file, int mask)
3082 struct inode *inode = file_inode(file);
3083 struct file_security_struct *fsec = file->f_security;
3084 struct inode_security_struct *isec = inode->i_security;
3085 u32 sid = current_sid();
3088 /* No permission to check. Existence test. */
3091 if (sid == fsec->sid && fsec->isid == isec->sid &&
3092 fsec->pseqno == avc_policy_seqno())
3093 /* No change since file_open check. */
3096 return selinux_revalidate_file_permission(file, mask);
3099 static int selinux_file_alloc_security(struct file *file)
3101 return file_alloc_security(file);
3104 static void selinux_file_free_security(struct file *file)
3106 file_free_security(file);
3109 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3112 const struct cred *cred = current_cred();
3122 case FS_IOC_GETFLAGS:
3124 case FS_IOC_GETVERSION:
3125 error = file_has_perm(cred, file, FILE__GETATTR);
3128 case FS_IOC_SETFLAGS:
3130 case FS_IOC_SETVERSION:
3131 error = file_has_perm(cred, file, FILE__SETATTR);
3134 /* sys_ioctl() checks */
3138 error = file_has_perm(cred, file, 0);
3143 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3144 SECURITY_CAP_AUDIT);
3147 /* default case assumes that the command will go
3148 * to the file's ioctl() function.
3151 error = file_has_perm(cred, file, FILE__IOCTL);
3156 static int default_noexec;
3158 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3160 const struct cred *cred = current_cred();
3163 if (default_noexec &&
3164 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3166 * We are making executable an anonymous mapping or a
3167 * private file mapping that will also be writable.
3168 * This has an additional check.
3170 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3176 /* read access is always possible with a mapping */
3177 u32 av = FILE__READ;
3179 /* write access only matters if the mapping is shared */
3180 if (shared && (prot & PROT_WRITE))
3183 if (prot & PROT_EXEC)
3184 av |= FILE__EXECUTE;
3186 return file_has_perm(cred, file, av);
3193 static int selinux_mmap_addr(unsigned long addr)
3196 u32 sid = current_sid();
3199 * notice that we are intentionally putting the SELinux check before
3200 * the secondary cap_file_mmap check. This is such a likely attempt
3201 * at bad behaviour/exploit that we always want to get the AVC, even
3202 * if DAC would have also denied the operation.
3204 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3205 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3206 MEMPROTECT__MMAP_ZERO, NULL);
3211 /* do DAC check on address space usage */
3212 return cap_mmap_addr(addr);
3215 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3216 unsigned long prot, unsigned long flags)
3218 if (selinux_checkreqprot)
3221 return file_map_prot_check(file, prot,
3222 (flags & MAP_TYPE) == MAP_SHARED);
3225 static int selinux_file_mprotect(struct vm_area_struct *vma,
3226 unsigned long reqprot,
3229 const struct cred *cred = current_cred();
3231 if (selinux_checkreqprot)
3234 if (default_noexec &&
3235 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3237 if (vma->vm_start >= vma->vm_mm->start_brk &&
3238 vma->vm_end <= vma->vm_mm->brk) {
3239 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3240 } else if (!vma->vm_file &&
3241 vma->vm_start <= vma->vm_mm->start_stack &&
3242 vma->vm_end >= vma->vm_mm->start_stack) {
3243 rc = current_has_perm(current, PROCESS__EXECSTACK);
3244 } else if (vma->vm_file && vma->anon_vma) {
3246 * We are making executable a file mapping that has
3247 * had some COW done. Since pages might have been
3248 * written, check ability to execute the possibly
3249 * modified content. This typically should only
3250 * occur for text relocations.
3252 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3258 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3261 static int selinux_file_lock(struct file *file, unsigned int cmd)
3263 const struct cred *cred = current_cred();
3265 return file_has_perm(cred, file, FILE__LOCK);
3268 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3271 const struct cred *cred = current_cred();
3276 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3277 err = file_has_perm(cred, file, FILE__WRITE);
3286 case F_GETOWNER_UIDS:
3287 /* Just check FD__USE permission */
3288 err = file_has_perm(cred, file, 0);
3293 #if BITS_PER_LONG == 32
3298 err = file_has_perm(cred, file, FILE__LOCK);
3305 static int selinux_file_set_fowner(struct file *file)
3307 struct file_security_struct *fsec;
3309 fsec = file->f_security;
3310 fsec->fown_sid = current_sid();
3315 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3316 struct fown_struct *fown, int signum)
3319 u32 sid = task_sid(tsk);
3321 struct file_security_struct *fsec;
3323 /* struct fown_struct is never outside the context of a struct file */
3324 file = container_of(fown, struct file, f_owner);
3326 fsec = file->f_security;
3329 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3331 perm = signal_to_av(signum);
3333 return avc_has_perm(fsec->fown_sid, sid,
3334 SECCLASS_PROCESS, perm, NULL);
3337 static int selinux_file_receive(struct file *file)
3339 const struct cred *cred = current_cred();
3341 return file_has_perm(cred, file, file_to_av(file));
3344 static int selinux_file_open(struct file *file, const struct cred *cred)
3346 struct file_security_struct *fsec;
3347 struct inode_security_struct *isec;
3349 fsec = file->f_security;
3350 isec = file_inode(file)->i_security;
3352 * Save inode label and policy sequence number
3353 * at open-time so that selinux_file_permission
3354 * can determine whether revalidation is necessary.
3355 * Task label is already saved in the file security
3356 * struct as its SID.
3358 fsec->isid = isec->sid;
3359 fsec->pseqno = avc_policy_seqno();
3361 * Since the inode label or policy seqno may have changed
3362 * between the selinux_inode_permission check and the saving
3363 * of state above, recheck that access is still permitted.
3364 * Otherwise, access might never be revalidated against the
3365 * new inode label or new policy.
3366 * This check is not redundant - do not remove.
3368 return file_path_has_perm(cred, file, open_file_to_av(file));
3371 /* task security operations */
3373 static int selinux_task_create(unsigned long clone_flags)
3375 return current_has_perm(current, PROCESS__FORK);
3379 * allocate the SELinux part of blank credentials
3381 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3383 struct task_security_struct *tsec;
3385 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3389 cred->security = tsec;
3394 * detach and free the LSM part of a set of credentials
3396 static void selinux_cred_free(struct cred *cred)
3398 struct task_security_struct *tsec = cred->security;
3401 * cred->security == NULL if security_cred_alloc_blank() or
3402 * security_prepare_creds() returned an error.
3404 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3405 cred->security = (void *) 0x7UL;
3410 * prepare a new set of credentials for modification
3412 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3415 const struct task_security_struct *old_tsec;
3416 struct task_security_struct *tsec;
3418 old_tsec = old->security;
3420 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3424 new->security = tsec;
3429 * transfer the SELinux data to a blank set of creds
3431 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3433 const struct task_security_struct *old_tsec = old->security;
3434 struct task_security_struct *tsec = new->security;
3440 * set the security data for a kernel service
3441 * - all the creation contexts are set to unlabelled
3443 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3445 struct task_security_struct *tsec = new->security;
3446 u32 sid = current_sid();
3449 ret = avc_has_perm(sid, secid,
3450 SECCLASS_KERNEL_SERVICE,
3451 KERNEL_SERVICE__USE_AS_OVERRIDE,
3455 tsec->create_sid = 0;
3456 tsec->keycreate_sid = 0;
3457 tsec->sockcreate_sid = 0;
3463 * set the file creation context in a security record to the same as the
3464 * objective context of the specified inode
3466 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3468 struct inode_security_struct *isec = inode->i_security;
3469 struct task_security_struct *tsec = new->security;
3470 u32 sid = current_sid();
3473 ret = avc_has_perm(sid, isec->sid,
3474 SECCLASS_KERNEL_SERVICE,
3475 KERNEL_SERVICE__CREATE_FILES_AS,
3479 tsec->create_sid = isec->sid;
3483 static int selinux_kernel_module_request(char *kmod_name)
3486 struct common_audit_data ad;
3488 sid = task_sid(current);
3490 ad.type = LSM_AUDIT_DATA_KMOD;
3491 ad.u.kmod_name = kmod_name;
3493 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3494 SYSTEM__MODULE_REQUEST, &ad);
3497 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3499 return current_has_perm(p, PROCESS__SETPGID);
3502 static int selinux_task_getpgid(struct task_struct *p)
3504 return current_has_perm(p, PROCESS__GETPGID);
3507 static int selinux_task_getsid(struct task_struct *p)
3509 return current_has_perm(p, PROCESS__GETSESSION);
3512 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3514 *secid = task_sid(p);
3517 static int selinux_task_setnice(struct task_struct *p, int nice)
3521 rc = cap_task_setnice(p, nice);
3525 return current_has_perm(p, PROCESS__SETSCHED);
3528 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3532 rc = cap_task_setioprio(p, ioprio);
3536 return current_has_perm(p, PROCESS__SETSCHED);
3539 static int selinux_task_getioprio(struct task_struct *p)
3541 return current_has_perm(p, PROCESS__GETSCHED);
3544 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3545 struct rlimit *new_rlim)
3547 struct rlimit *old_rlim = p->signal->rlim + resource;
3549 /* Control the ability to change the hard limit (whether
3550 lowering or raising it), so that the hard limit can
3551 later be used as a safe reset point for the soft limit
3552 upon context transitions. See selinux_bprm_committing_creds. */
3553 if (old_rlim->rlim_max != new_rlim->rlim_max)
3554 return current_has_perm(p, PROCESS__SETRLIMIT);
3559 static int selinux_task_setscheduler(struct task_struct *p)
3563 rc = cap_task_setscheduler(p);
3567 return current_has_perm(p, PROCESS__SETSCHED);
3570 static int selinux_task_getscheduler(struct task_struct *p)
3572 return current_has_perm(p, PROCESS__GETSCHED);
3575 static int selinux_task_movememory(struct task_struct *p)
3577 return current_has_perm(p, PROCESS__SETSCHED);
3580 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3587 perm = PROCESS__SIGNULL; /* null signal; existence test */
3589 perm = signal_to_av(sig);
3591 rc = avc_has_perm(secid, task_sid(p),
3592 SECCLASS_PROCESS, perm, NULL);
3594 rc = current_has_perm(p, perm);
3598 static int selinux_task_wait(struct task_struct *p)
3600 return task_has_perm(p, current, PROCESS__SIGCHLD);
3603 static void selinux_task_to_inode(struct task_struct *p,
3604 struct inode *inode)
3606 struct inode_security_struct *isec = inode->i_security;
3607 u32 sid = task_sid(p);
3610 isec->initialized = 1;
3613 /* Returns error only if unable to parse addresses */
3614 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3615 struct common_audit_data *ad, u8 *proto)
3617 int offset, ihlen, ret = -EINVAL;
3618 struct iphdr _iph, *ih;
3620 offset = skb_network_offset(skb);
3621 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3625 ihlen = ih->ihl * 4;
3626 if (ihlen < sizeof(_iph))
3629 ad->u.net->v4info.saddr = ih->saddr;
3630 ad->u.net->v4info.daddr = ih->daddr;
3634 *proto = ih->protocol;
3636 switch (ih->protocol) {
3638 struct tcphdr _tcph, *th;
3640 if (ntohs(ih->frag_off) & IP_OFFSET)
3644 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3648 ad->u.net->sport = th->source;
3649 ad->u.net->dport = th->dest;
3654 struct udphdr _udph, *uh;
3656 if (ntohs(ih->frag_off) & IP_OFFSET)
3660 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3664 ad->u.net->sport = uh->source;
3665 ad->u.net->dport = uh->dest;
3669 case IPPROTO_DCCP: {
3670 struct dccp_hdr _dccph, *dh;
3672 if (ntohs(ih->frag_off) & IP_OFFSET)
3676 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3680 ad->u.net->sport = dh->dccph_sport;
3681 ad->u.net->dport = dh->dccph_dport;
3692 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3694 /* Returns error only if unable to parse addresses */
3695 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3696 struct common_audit_data *ad, u8 *proto)
3699 int ret = -EINVAL, offset;
3700 struct ipv6hdr _ipv6h, *ip6;
3703 offset = skb_network_offset(skb);
3704 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3708 ad->u.net->v6info.saddr = ip6->saddr;
3709 ad->u.net->v6info.daddr = ip6->daddr;
3712 nexthdr = ip6->nexthdr;
3713 offset += sizeof(_ipv6h);
3714 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3723 struct tcphdr _tcph, *th;
3725 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3729 ad->u.net->sport = th->source;
3730 ad->u.net->dport = th->dest;
3735 struct udphdr _udph, *uh;
3737 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3741 ad->u.net->sport = uh->source;
3742 ad->u.net->dport = uh->dest;
3746 case IPPROTO_DCCP: {
3747 struct dccp_hdr _dccph, *dh;
3749 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3753 ad->u.net->sport = dh->dccph_sport;
3754 ad->u.net->dport = dh->dccph_dport;
3758 /* includes fragments */
3768 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3769 char **_addrp, int src, u8 *proto)
3774 switch (ad->u.net->family) {
3776 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3779 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3780 &ad->u.net->v4info.daddr);
3783 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3785 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3788 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3789 &ad->u.net->v6info.daddr);
3799 "SELinux: failure in selinux_parse_skb(),"
3800 " unable to parse packet\n");
3810 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3812 * @family: protocol family
3813 * @sid: the packet's peer label SID
3816 * Check the various different forms of network peer labeling and determine
3817 * the peer label/SID for the packet; most of the magic actually occurs in
3818 * the security server function security_net_peersid_cmp(). The function
3819 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3820 * or -EACCES if @sid is invalid due to inconsistencies with the different
3824 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3831 err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3834 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3838 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3839 if (unlikely(err)) {
3841 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3842 " unable to determine packet's peer label\n");
3849 /* socket security operations */
3851 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3852 u16 secclass, u32 *socksid)
3854 if (tsec->sockcreate_sid > SECSID_NULL) {
3855 *socksid = tsec->sockcreate_sid;
3859 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3863 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3865 struct sk_security_struct *sksec = sk->sk_security;
3866 struct common_audit_data ad;
3867 struct lsm_network_audit net = {0,};
3868 u32 tsid = task_sid(task);
3870 if (sksec->sid == SECINITSID_KERNEL)
3873 ad.type = LSM_AUDIT_DATA_NET;
3877 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3880 static int selinux_socket_create(int family, int type,
3881 int protocol, int kern)
3883 const struct task_security_struct *tsec = current_security();
3891 secclass = socket_type_to_security_class(family, type, protocol);
3892 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3896 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3899 static int selinux_socket_post_create(struct socket *sock, int family,
3900 int type, int protocol, int kern)
3902 const struct task_security_struct *tsec = current_security();
3903 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3904 struct sk_security_struct *sksec;
3907 isec->sclass = socket_type_to_security_class(family, type, protocol);
3910 isec->sid = SECINITSID_KERNEL;
3912 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3917 isec->initialized = 1;
3920 sksec = sock->sk->sk_security;
3921 sksec->sid = isec->sid;
3922 sksec->sclass = isec->sclass;
3923 err = selinux_netlbl_socket_post_create(sock->sk, family);
3929 /* Range of port numbers used to automatically bind.
3930 Need to determine whether we should perform a name_bind
3931 permission check between the socket and the port number. */
3933 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3935 struct sock *sk = sock->sk;
3939 err = sock_has_perm(current, sk, SOCKET__BIND);
3944 * If PF_INET or PF_INET6, check name_bind permission for the port.
3945 * Multiple address binding for SCTP is not supported yet: we just
3946 * check the first address now.
3948 family = sk->sk_family;
3949 if (family == PF_INET || family == PF_INET6) {
3951 struct sk_security_struct *sksec = sk->sk_security;
3952 struct common_audit_data ad;
3953 struct lsm_network_audit net = {0,};
3954 struct sockaddr_in *addr4 = NULL;
3955 struct sockaddr_in6 *addr6 = NULL;
3956 unsigned short snum;
3959 if (family == PF_INET) {
3960 addr4 = (struct sockaddr_in *)address;
3961 snum = ntohs(addr4->sin_port);
3962 addrp = (char *)&addr4->sin_addr.s_addr;
3964 addr6 = (struct sockaddr_in6 *)address;
3965 snum = ntohs(addr6->sin6_port);
3966 addrp = (char *)&addr6->sin6_addr.s6_addr;
3972 inet_get_local_port_range(sock_net(sk), &low, &high);
3974 if (snum < max(PROT_SOCK, low) || snum > high) {
3975 err = sel_netport_sid(sk->sk_protocol,
3979 ad.type = LSM_AUDIT_DATA_NET;
3981 ad.u.net->sport = htons(snum);
3982 ad.u.net->family = family;
3983 err = avc_has_perm(sksec->sid, sid,
3985 SOCKET__NAME_BIND, &ad);
3991 switch (sksec->sclass) {
3992 case SECCLASS_TCP_SOCKET:
3993 node_perm = TCP_SOCKET__NODE_BIND;
3996 case SECCLASS_UDP_SOCKET:
3997 node_perm = UDP_SOCKET__NODE_BIND;
4000 case SECCLASS_DCCP_SOCKET:
4001 node_perm = DCCP_SOCKET__NODE_BIND;
4005 node_perm = RAWIP_SOCKET__NODE_BIND;
4009 err = sel_netnode_sid(addrp, family, &sid);
4013 ad.type = LSM_AUDIT_DATA_NET;
4015 ad.u.net->sport = htons(snum);
4016 ad.u.net->family = family;
4018 if (family == PF_INET)
4019 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4021 ad.u.net->v6info.saddr = addr6->sin6_addr;
4023 err = avc_has_perm(sksec->sid, sid,
4024 sksec->sclass, node_perm, &ad);
4032 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4034 struct sock *sk = sock->sk;
4035 struct sk_security_struct *sksec = sk->sk_security;
4038 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4043 * If a TCP or DCCP socket, check name_connect permission for the port.
4045 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4046 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4047 struct common_audit_data ad;
4048 struct lsm_network_audit net = {0,};
4049 struct sockaddr_in *addr4 = NULL;
4050 struct sockaddr_in6 *addr6 = NULL;
4051 unsigned short snum;
4054 if (sk->sk_family == PF_INET) {
4055 addr4 = (struct sockaddr_in *)address;
4056 if (addrlen < sizeof(struct sockaddr_in))
4058 snum = ntohs(addr4->sin_port);
4060 addr6 = (struct sockaddr_in6 *)address;
4061 if (addrlen < SIN6_LEN_RFC2133)
4063 snum = ntohs(addr6->sin6_port);
4066 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4070 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4071 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4073 ad.type = LSM_AUDIT_DATA_NET;
4075 ad.u.net->dport = htons(snum);
4076 ad.u.net->family = sk->sk_family;
4077 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4082 err = selinux_netlbl_socket_connect(sk, address);
4088 static int selinux_socket_listen(struct socket *sock, int backlog)
4090 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4093 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4096 struct inode_security_struct *isec;
4097 struct inode_security_struct *newisec;
4099 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4103 newisec = SOCK_INODE(newsock)->i_security;
4105 isec = SOCK_INODE(sock)->i_security;
4106 newisec->sclass = isec->sclass;
4107 newisec->sid = isec->sid;
4108 newisec->initialized = 1;
4113 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4116 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4119 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4120 int size, int flags)
4122 return sock_has_perm(current, sock->sk, SOCKET__READ);
4125 static int selinux_socket_getsockname(struct socket *sock)
4127 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4130 static int selinux_socket_getpeername(struct socket *sock)
4132 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4135 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4139 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4143 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4146 static int selinux_socket_getsockopt(struct socket *sock, int level,
4149 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4152 static int selinux_socket_shutdown(struct socket *sock, int how)
4154 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4157 static int selinux_socket_unix_stream_connect(struct sock *sock,
4161 struct sk_security_struct *sksec_sock = sock->sk_security;
4162 struct sk_security_struct *sksec_other = other->sk_security;
4163 struct sk_security_struct *sksec_new = newsk->sk_security;
4164 struct common_audit_data ad;
4165 struct lsm_network_audit net = {0,};
4168 ad.type = LSM_AUDIT_DATA_NET;
4170 ad.u.net->sk = other;
4172 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4173 sksec_other->sclass,
4174 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4178 /* server child socket */
4179 sksec_new->peer_sid = sksec_sock->sid;
4180 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4185 /* connecting socket */
4186 sksec_sock->peer_sid = sksec_new->sid;
4191 static int selinux_socket_unix_may_send(struct socket *sock,
4192 struct socket *other)
4194 struct sk_security_struct *ssec = sock->sk->sk_security;
4195 struct sk_security_struct *osec = other->sk->sk_security;
4196 struct common_audit_data ad;
4197 struct lsm_network_audit net = {0,};
4199 ad.type = LSM_AUDIT_DATA_NET;
4201 ad.u.net->sk = other->sk;
4203 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4207 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4209 struct common_audit_data *ad)
4215 err = sel_netif_sid(ifindex, &if_sid);
4218 err = avc_has_perm(peer_sid, if_sid,
4219 SECCLASS_NETIF, NETIF__INGRESS, ad);
4223 err = sel_netnode_sid(addrp, family, &node_sid);
4226 return avc_has_perm(peer_sid, node_sid,
4227 SECCLASS_NODE, NODE__RECVFROM, ad);
4230 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4234 struct sk_security_struct *sksec = sk->sk_security;
4235 u32 sk_sid = sksec->sid;
4236 struct common_audit_data ad;
4237 struct lsm_network_audit net = {0,};
4240 ad.type = LSM_AUDIT_DATA_NET;
4242 ad.u.net->netif = skb->skb_iif;
4243 ad.u.net->family = family;
4244 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4248 if (selinux_secmark_enabled()) {
4249 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4255 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4258 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4263 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4266 struct sk_security_struct *sksec = sk->sk_security;
4267 u16 family = sk->sk_family;
4268 u32 sk_sid = sksec->sid;
4269 struct common_audit_data ad;
4270 struct lsm_network_audit net = {0,};
4275 if (family != PF_INET && family != PF_INET6)
4278 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4279 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4282 /* If any sort of compatibility mode is enabled then handoff processing
4283 * to the selinux_sock_rcv_skb_compat() function to deal with the
4284 * special handling. We do this in an attempt to keep this function
4285 * as fast and as clean as possible. */
4286 if (!selinux_policycap_netpeer)
4287 return selinux_sock_rcv_skb_compat(sk, skb, family);
4289 secmark_active = selinux_secmark_enabled();
4290 peerlbl_active = selinux_peerlbl_enabled();
4291 if (!secmark_active && !peerlbl_active)
4294 ad.type = LSM_AUDIT_DATA_NET;
4296 ad.u.net->netif = skb->skb_iif;
4297 ad.u.net->family = family;
4298 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4302 if (peerlbl_active) {
4305 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4308 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4311 selinux_netlbl_err(skb, err, 0);
4314 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4317 selinux_netlbl_err(skb, err, 0);
4320 if (secmark_active) {
4321 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4330 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4331 int __user *optlen, unsigned len)
4336 struct sk_security_struct *sksec = sock->sk->sk_security;
4337 u32 peer_sid = SECSID_NULL;
4339 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4340 sksec->sclass == SECCLASS_TCP_SOCKET)
4341 peer_sid = sksec->peer_sid;
4342 if (peer_sid == SECSID_NULL)
4343 return -ENOPROTOOPT;
4345 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4349 if (scontext_len > len) {
4354 if (copy_to_user(optval, scontext, scontext_len))
4358 if (put_user(scontext_len, optlen))
4364 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4366 u32 peer_secid = SECSID_NULL;
4369 if (skb && skb->protocol == htons(ETH_P_IP))
4371 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4374 family = sock->sk->sk_family;
4378 if (sock && family == PF_UNIX)
4379 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4381 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4384 *secid = peer_secid;
4385 if (peer_secid == SECSID_NULL)
4390 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4392 struct sk_security_struct *sksec;
4394 sksec = kzalloc(sizeof(*sksec), priority);
4398 sksec->peer_sid = SECINITSID_UNLABELED;
4399 sksec->sid = SECINITSID_UNLABELED;
4400 selinux_netlbl_sk_security_reset(sksec);
4401 sk->sk_security = sksec;
4406 static void selinux_sk_free_security(struct sock *sk)
4408 struct sk_security_struct *sksec = sk->sk_security;
4410 sk->sk_security = NULL;
4411 selinux_netlbl_sk_security_free(sksec);
4415 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4417 struct sk_security_struct *sksec = sk->sk_security;
4418 struct sk_security_struct *newsksec = newsk->sk_security;
4420 newsksec->sid = sksec->sid;
4421 newsksec->peer_sid = sksec->peer_sid;
4422 newsksec->sclass = sksec->sclass;
4424 selinux_netlbl_sk_security_reset(newsksec);
4427 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4430 *secid = SECINITSID_ANY_SOCKET;
4432 struct sk_security_struct *sksec = sk->sk_security;
4434 *secid = sksec->sid;
4438 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4440 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4441 struct sk_security_struct *sksec = sk->sk_security;
4443 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4444 sk->sk_family == PF_UNIX)
4445 isec->sid = sksec->sid;
4446 sksec->sclass = isec->sclass;
4449 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4450 struct request_sock *req)
4452 struct sk_security_struct *sksec = sk->sk_security;
4454 u16 family = sk->sk_family;
4458 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4459 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4462 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4465 if (peersid == SECSID_NULL) {
4466 req->secid = sksec->sid;
4467 req->peer_secid = SECSID_NULL;
4469 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4472 req->secid = newsid;
4473 req->peer_secid = peersid;
4476 return selinux_netlbl_inet_conn_request(req, family);
4479 static void selinux_inet_csk_clone(struct sock *newsk,
4480 const struct request_sock *req)
4482 struct sk_security_struct *newsksec = newsk->sk_security;
4484 newsksec->sid = req->secid;
4485 newsksec->peer_sid = req->peer_secid;
4486 /* NOTE: Ideally, we should also get the isec->sid for the
4487 new socket in sync, but we don't have the isec available yet.
4488 So we will wait until sock_graft to do it, by which
4489 time it will have been created and available. */
4491 /* We don't need to take any sort of lock here as we are the only
4492 * thread with access to newsksec */
4493 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4496 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4498 u16 family = sk->sk_family;
4499 struct sk_security_struct *sksec = sk->sk_security;
4501 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4502 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4505 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4508 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4510 skb_set_owner_w(skb, sk);
4513 static int selinux_secmark_relabel_packet(u32 sid)
4515 const struct task_security_struct *__tsec;
4518 __tsec = current_security();
4521 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4524 static void selinux_secmark_refcount_inc(void)
4526 atomic_inc(&selinux_secmark_refcount);
4529 static void selinux_secmark_refcount_dec(void)
4531 atomic_dec(&selinux_secmark_refcount);
4534 static void selinux_req_classify_flow(const struct request_sock *req,
4537 fl->flowi_secid = req->secid;
4540 static int selinux_tun_dev_alloc_security(void **security)
4542 struct tun_security_struct *tunsec;
4544 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4547 tunsec->sid = current_sid();
4553 static void selinux_tun_dev_free_security(void *security)
4558 static int selinux_tun_dev_create(void)
4560 u32 sid = current_sid();
4562 /* we aren't taking into account the "sockcreate" SID since the socket
4563 * that is being created here is not a socket in the traditional sense,
4564 * instead it is a private sock, accessible only to the kernel, and
4565 * representing a wide range of network traffic spanning multiple
4566 * connections unlike traditional sockets - check the TUN driver to
4567 * get a better understanding of why this socket is special */
4569 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4573 static int selinux_tun_dev_attach_queue(void *security)
4575 struct tun_security_struct *tunsec = security;
4577 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4578 TUN_SOCKET__ATTACH_QUEUE, NULL);
4581 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4583 struct tun_security_struct *tunsec = security;
4584 struct sk_security_struct *sksec = sk->sk_security;
4586 /* we don't currently perform any NetLabel based labeling here and it
4587 * isn't clear that we would want to do so anyway; while we could apply
4588 * labeling without the support of the TUN user the resulting labeled
4589 * traffic from the other end of the connection would almost certainly
4590 * cause confusion to the TUN user that had no idea network labeling
4591 * protocols were being used */
4593 sksec->sid = tunsec->sid;
4594 sksec->sclass = SECCLASS_TUN_SOCKET;
4599 static int selinux_tun_dev_open(void *security)
4601 struct tun_security_struct *tunsec = security;
4602 u32 sid = current_sid();
4605 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4606 TUN_SOCKET__RELABELFROM, NULL);
4609 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4610 TUN_SOCKET__RELABELTO, NULL);
4618 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4622 struct nlmsghdr *nlh;
4623 struct sk_security_struct *sksec = sk->sk_security;
4625 if (skb->len < NLMSG_HDRLEN) {
4629 nlh = nlmsg_hdr(skb);
4631 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4633 if (err == -EINVAL) {
4634 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4635 "SELinux: unrecognized netlink message"
4636 " type=%hu for sclass=%hu\n",
4637 nlh->nlmsg_type, sksec->sclass);
4638 if (!selinux_enforcing || security_get_allow_unknown())
4648 err = sock_has_perm(current, sk, perm);
4653 #ifdef CONFIG_NETFILTER
4655 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4661 struct common_audit_data ad;
4662 struct lsm_network_audit net = {0,};
4667 if (!selinux_policycap_netpeer)
4670 secmark_active = selinux_secmark_enabled();
4671 netlbl_active = netlbl_enabled();
4672 peerlbl_active = selinux_peerlbl_enabled();
4673 if (!secmark_active && !peerlbl_active)
4676 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4679 ad.type = LSM_AUDIT_DATA_NET;
4681 ad.u.net->netif = ifindex;
4682 ad.u.net->family = family;
4683 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4686 if (peerlbl_active) {
4687 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4690 selinux_netlbl_err(skb, err, 1);
4696 if (avc_has_perm(peer_sid, skb->secmark,
4697 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4701 /* we do this in the FORWARD path and not the POST_ROUTING
4702 * path because we want to make sure we apply the necessary
4703 * labeling before IPsec is applied so we can leverage AH
4705 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4711 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4712 struct sk_buff *skb,
4713 const struct net_device *in,
4714 const struct net_device *out,
4715 int (*okfn)(struct sk_buff *))
4717 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4720 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4721 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4722 struct sk_buff *skb,
4723 const struct net_device *in,
4724 const struct net_device *out,
4725 int (*okfn)(struct sk_buff *))
4727 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4731 static unsigned int selinux_ip_output(struct sk_buff *skb,
4736 if (!netlbl_enabled())
4739 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4740 * because we want to make sure we apply the necessary labeling
4741 * before IPsec is applied so we can leverage AH protection */
4743 struct sk_security_struct *sksec = skb->sk->sk_security;
4746 sid = SECINITSID_KERNEL;
4747 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4753 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4754 struct sk_buff *skb,
4755 const struct net_device *in,
4756 const struct net_device *out,
4757 int (*okfn)(struct sk_buff *))
4759 return selinux_ip_output(skb, PF_INET);
4762 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4766 struct sock *sk = skb->sk;
4767 struct sk_security_struct *sksec;
4768 struct common_audit_data ad;
4769 struct lsm_network_audit net = {0,};
4775 sksec = sk->sk_security;
4777 ad.type = LSM_AUDIT_DATA_NET;
4779 ad.u.net->netif = ifindex;
4780 ad.u.net->family = family;
4781 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4784 if (selinux_secmark_enabled())
4785 if (avc_has_perm(sksec->sid, skb->secmark,
4786 SECCLASS_PACKET, PACKET__SEND, &ad))
4787 return NF_DROP_ERR(-ECONNREFUSED);
4789 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4790 return NF_DROP_ERR(-ECONNREFUSED);
4795 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4801 struct common_audit_data ad;
4802 struct lsm_network_audit net = {0,};
4807 /* If any sort of compatibility mode is enabled then handoff processing
4808 * to the selinux_ip_postroute_compat() function to deal with the
4809 * special handling. We do this in an attempt to keep this function
4810 * as fast and as clean as possible. */
4811 if (!selinux_policycap_netpeer)
4812 return selinux_ip_postroute_compat(skb, ifindex, family);
4814 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4815 * packet transformation so allow the packet to pass without any checks
4816 * since we'll have another chance to perform access control checks
4817 * when the packet is on it's final way out.
4818 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4819 * is NULL, in this case go ahead and apply access control. */
4820 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4823 secmark_active = selinux_secmark_enabled();
4824 peerlbl_active = selinux_peerlbl_enabled();
4825 if (!secmark_active && !peerlbl_active)
4828 /* if the packet is being forwarded then get the peer label from the
4829 * packet itself; otherwise check to see if it is from a local
4830 * application or the kernel, if from an application get the peer label
4831 * from the sending socket, otherwise use the kernel's sid */
4835 secmark_perm = PACKET__FORWARD_OUT;
4836 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4839 secmark_perm = PACKET__SEND;
4840 peer_sid = SECINITSID_KERNEL;
4843 struct sk_security_struct *sksec = sk->sk_security;
4844 peer_sid = sksec->sid;
4845 secmark_perm = PACKET__SEND;
4848 ad.type = LSM_AUDIT_DATA_NET;
4850 ad.u.net->netif = ifindex;
4851 ad.u.net->family = family;
4852 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4856 if (avc_has_perm(peer_sid, skb->secmark,
4857 SECCLASS_PACKET, secmark_perm, &ad))
4858 return NF_DROP_ERR(-ECONNREFUSED);
4860 if (peerlbl_active) {
4864 if (sel_netif_sid(ifindex, &if_sid))
4866 if (avc_has_perm(peer_sid, if_sid,
4867 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4868 return NF_DROP_ERR(-ECONNREFUSED);
4870 if (sel_netnode_sid(addrp, family, &node_sid))
4872 if (avc_has_perm(peer_sid, node_sid,
4873 SECCLASS_NODE, NODE__SENDTO, &ad))
4874 return NF_DROP_ERR(-ECONNREFUSED);
4880 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4881 struct sk_buff *skb,
4882 const struct net_device *in,
4883 const struct net_device *out,
4884 int (*okfn)(struct sk_buff *))
4886 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4889 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4890 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
4891 struct sk_buff *skb,
4892 const struct net_device *in,
4893 const struct net_device *out,
4894 int (*okfn)(struct sk_buff *))
4896 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4900 #endif /* CONFIG_NETFILTER */
4902 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4906 err = cap_netlink_send(sk, skb);
4910 return selinux_nlmsg_perm(sk, skb);
4913 static int ipc_alloc_security(struct task_struct *task,
4914 struct kern_ipc_perm *perm,
4917 struct ipc_security_struct *isec;
4920 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4924 sid = task_sid(task);
4925 isec->sclass = sclass;
4927 perm->security = isec;
4932 static void ipc_free_security(struct kern_ipc_perm *perm)
4934 struct ipc_security_struct *isec = perm->security;
4935 perm->security = NULL;
4939 static int msg_msg_alloc_security(struct msg_msg *msg)
4941 struct msg_security_struct *msec;
4943 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4947 msec->sid = SECINITSID_UNLABELED;
4948 msg->security = msec;
4953 static void msg_msg_free_security(struct msg_msg *msg)
4955 struct msg_security_struct *msec = msg->security;
4957 msg->security = NULL;
4961 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4964 struct ipc_security_struct *isec;
4965 struct common_audit_data ad;
4966 u32 sid = current_sid();
4968 isec = ipc_perms->security;
4970 ad.type = LSM_AUDIT_DATA_IPC;
4971 ad.u.ipc_id = ipc_perms->key;
4973 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4976 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4978 return msg_msg_alloc_security(msg);
4981 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4983 msg_msg_free_security(msg);
4986 /* message queue security operations */
4987 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4989 struct ipc_security_struct *isec;
4990 struct common_audit_data ad;
4991 u32 sid = current_sid();
4994 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4998 isec = msq->q_perm.security;
5000 ad.type = LSM_AUDIT_DATA_IPC;
5001 ad.u.ipc_id = msq->q_perm.key;
5003 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5006 ipc_free_security(&msq->q_perm);
5012 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5014 ipc_free_security(&msq->q_perm);
5017 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5019 struct ipc_security_struct *isec;
5020 struct common_audit_data ad;
5021 u32 sid = current_sid();
5023 isec = msq->q_perm.security;
5025 ad.type = LSM_AUDIT_DATA_IPC;
5026 ad.u.ipc_id = msq->q_perm.key;
5028 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5029 MSGQ__ASSOCIATE, &ad);
5032 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5040 /* No specific object, just general system-wide information. */
5041 return task_has_system(current, SYSTEM__IPC_INFO);
5044 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5047 perms = MSGQ__SETATTR;
5050 perms = MSGQ__DESTROY;
5056 err = ipc_has_perm(&msq->q_perm, perms);
5060 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5062 struct ipc_security_struct *isec;
5063 struct msg_security_struct *msec;
5064 struct common_audit_data ad;
5065 u32 sid = current_sid();
5068 isec = msq->q_perm.security;
5069 msec = msg->security;
5072 * First time through, need to assign label to the message
5074 if (msec->sid == SECINITSID_UNLABELED) {
5076 * Compute new sid based on current process and
5077 * message queue this message will be stored in
5079 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5085 ad.type = LSM_AUDIT_DATA_IPC;
5086 ad.u.ipc_id = msq->q_perm.key;
5088 /* Can this process write to the queue? */
5089 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5092 /* Can this process send the message */
5093 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5096 /* Can the message be put in the queue? */
5097 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5098 MSGQ__ENQUEUE, &ad);
5103 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5104 struct task_struct *target,
5105 long type, int mode)
5107 struct ipc_security_struct *isec;
5108 struct msg_security_struct *msec;
5109 struct common_audit_data ad;
5110 u32 sid = task_sid(target);
5113 isec = msq->q_perm.security;
5114 msec = msg->security;
5116 ad.type = LSM_AUDIT_DATA_IPC;
5117 ad.u.ipc_id = msq->q_perm.key;
5119 rc = avc_has_perm(sid, isec->sid,
5120 SECCLASS_MSGQ, MSGQ__READ, &ad);
5122 rc = avc_has_perm(sid, msec->sid,
5123 SECCLASS_MSG, MSG__RECEIVE, &ad);
5127 /* Shared Memory security operations */
5128 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5130 struct ipc_security_struct *isec;
5131 struct common_audit_data ad;
5132 u32 sid = current_sid();
5135 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5139 isec = shp->shm_perm.security;
5141 ad.type = LSM_AUDIT_DATA_IPC;
5142 ad.u.ipc_id = shp->shm_perm.key;
5144 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5147 ipc_free_security(&shp->shm_perm);
5153 static void selinux_shm_free_security(struct shmid_kernel *shp)
5155 ipc_free_security(&shp->shm_perm);
5158 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5160 struct ipc_security_struct *isec;
5161 struct common_audit_data ad;
5162 u32 sid = current_sid();
5164 isec = shp->shm_perm.security;
5166 ad.type = LSM_AUDIT_DATA_IPC;
5167 ad.u.ipc_id = shp->shm_perm.key;
5169 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5170 SHM__ASSOCIATE, &ad);
5173 /* Note, at this point, shp is locked down */
5174 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5182 /* No specific object, just general system-wide information. */
5183 return task_has_system(current, SYSTEM__IPC_INFO);
5186 perms = SHM__GETATTR | SHM__ASSOCIATE;
5189 perms = SHM__SETATTR;
5196 perms = SHM__DESTROY;
5202 err = ipc_has_perm(&shp->shm_perm, perms);
5206 static int selinux_shm_shmat(struct shmid_kernel *shp,
5207 char __user *shmaddr, int shmflg)
5211 if (shmflg & SHM_RDONLY)
5214 perms = SHM__READ | SHM__WRITE;
5216 return ipc_has_perm(&shp->shm_perm, perms);
5219 /* Semaphore security operations */
5220 static int selinux_sem_alloc_security(struct sem_array *sma)
5222 struct ipc_security_struct *isec;
5223 struct common_audit_data ad;
5224 u32 sid = current_sid();
5227 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5231 isec = sma->sem_perm.security;
5233 ad.type = LSM_AUDIT_DATA_IPC;
5234 ad.u.ipc_id = sma->sem_perm.key;
5236 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5239 ipc_free_security(&sma->sem_perm);
5245 static void selinux_sem_free_security(struct sem_array *sma)
5247 ipc_free_security(&sma->sem_perm);
5250 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5252 struct ipc_security_struct *isec;
5253 struct common_audit_data ad;
5254 u32 sid = current_sid();
5256 isec = sma->sem_perm.security;
5258 ad.type = LSM_AUDIT_DATA_IPC;
5259 ad.u.ipc_id = sma->sem_perm.key;
5261 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5262 SEM__ASSOCIATE, &ad);
5265 /* Note, at this point, sma is locked down */
5266 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5274 /* No specific object, just general system-wide information. */
5275 return task_has_system(current, SYSTEM__IPC_INFO);
5279 perms = SEM__GETATTR;
5290 perms = SEM__DESTROY;
5293 perms = SEM__SETATTR;
5297 perms = SEM__GETATTR | SEM__ASSOCIATE;
5303 err = ipc_has_perm(&sma->sem_perm, perms);
5307 static int selinux_sem_semop(struct sem_array *sma,
5308 struct sembuf *sops, unsigned nsops, int alter)
5313 perms = SEM__READ | SEM__WRITE;
5317 return ipc_has_perm(&sma->sem_perm, perms);
5320 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5326 av |= IPC__UNIX_READ;
5328 av |= IPC__UNIX_WRITE;
5333 return ipc_has_perm(ipcp, av);
5336 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5338 struct ipc_security_struct *isec = ipcp->security;
5342 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5345 inode_doinit_with_dentry(inode, dentry);
5348 static int selinux_getprocattr(struct task_struct *p,
5349 char *name, char **value)
5351 const struct task_security_struct *__tsec;
5357 error = current_has_perm(p, PROCESS__GETATTR);
5363 __tsec = __task_cred(p)->security;
5365 if (!strcmp(name, "current"))
5367 else if (!strcmp(name, "prev"))
5369 else if (!strcmp(name, "exec"))
5370 sid = __tsec->exec_sid;
5371 else if (!strcmp(name, "fscreate"))
5372 sid = __tsec->create_sid;
5373 else if (!strcmp(name, "keycreate"))
5374 sid = __tsec->keycreate_sid;
5375 else if (!strcmp(name, "sockcreate"))
5376 sid = __tsec->sockcreate_sid;
5384 error = security_sid_to_context(sid, value, &len);
5394 static int selinux_setprocattr(struct task_struct *p,
5395 char *name, void *value, size_t size)
5397 struct task_security_struct *tsec;
5398 struct task_struct *tracer;
5405 /* SELinux only allows a process to change its own
5406 security attributes. */
5411 * Basic control over ability to set these attributes at all.
5412 * current == p, but we'll pass them separately in case the
5413 * above restriction is ever removed.
5415 if (!strcmp(name, "exec"))
5416 error = current_has_perm(p, PROCESS__SETEXEC);
5417 else if (!strcmp(name, "fscreate"))
5418 error = current_has_perm(p, PROCESS__SETFSCREATE);
5419 else if (!strcmp(name, "keycreate"))
5420 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5421 else if (!strcmp(name, "sockcreate"))
5422 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5423 else if (!strcmp(name, "current"))
5424 error = current_has_perm(p, PROCESS__SETCURRENT);
5430 /* Obtain a SID for the context, if one was specified. */
5431 if (size && str[1] && str[1] != '\n') {
5432 if (str[size-1] == '\n') {
5436 error = security_context_to_sid(value, size, &sid);
5437 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5438 if (!capable(CAP_MAC_ADMIN)) {
5439 struct audit_buffer *ab;
5442 /* We strip a nul only if it is at the end, otherwise the
5443 * context contains a nul and we should audit that */
5444 if (str[size - 1] == '\0')
5445 audit_size = size - 1;
5448 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5449 audit_log_format(ab, "op=fscreate invalid_context=");
5450 audit_log_n_untrustedstring(ab, value, audit_size);
5455 error = security_context_to_sid_force(value, size,
5462 new = prepare_creds();
5466 /* Permission checking based on the specified context is
5467 performed during the actual operation (execve,
5468 open/mkdir/...), when we know the full context of the
5469 operation. See selinux_bprm_set_creds for the execve
5470 checks and may_create for the file creation checks. The
5471 operation will then fail if the context is not permitted. */
5472 tsec = new->security;
5473 if (!strcmp(name, "exec")) {
5474 tsec->exec_sid = sid;
5475 } else if (!strcmp(name, "fscreate")) {
5476 tsec->create_sid = sid;
5477 } else if (!strcmp(name, "keycreate")) {
5478 error = may_create_key(sid, p);
5481 tsec->keycreate_sid = sid;
5482 } else if (!strcmp(name, "sockcreate")) {
5483 tsec->sockcreate_sid = sid;
5484 } else if (!strcmp(name, "current")) {
5489 /* Only allow single threaded processes to change context */
5491 if (!current_is_single_threaded()) {
5492 error = security_bounded_transition(tsec->sid, sid);
5497 /* Check permissions for the transition. */
5498 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5499 PROCESS__DYNTRANSITION, NULL);
5503 /* Check for ptracing, and update the task SID if ok.
5504 Otherwise, leave SID unchanged and fail. */
5507 tracer = ptrace_parent(p);
5509 ptsid = task_sid(tracer);
5513 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5514 PROCESS__PTRACE, NULL);
5533 static int selinux_ismaclabel(const char *name)
5535 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5538 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5540 return security_sid_to_context(secid, secdata, seclen);
5543 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5545 return security_context_to_sid(secdata, seclen, secid);
5548 static void selinux_release_secctx(char *secdata, u32 seclen)
5554 * called with inode->i_mutex locked
5556 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5558 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5562 * called with inode->i_mutex locked
5564 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5566 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5569 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5572 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5581 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5582 unsigned long flags)
5584 const struct task_security_struct *tsec;
5585 struct key_security_struct *ksec;
5587 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5591 tsec = cred->security;
5592 if (tsec->keycreate_sid)
5593 ksec->sid = tsec->keycreate_sid;
5595 ksec->sid = tsec->sid;
5601 static void selinux_key_free(struct key *k)
5603 struct key_security_struct *ksec = k->security;
5609 static int selinux_key_permission(key_ref_t key_ref,
5610 const struct cred *cred,
5614 struct key_security_struct *ksec;
5617 /* if no specific permissions are requested, we skip the
5618 permission check. No serious, additional covert channels
5619 appear to be created. */
5623 sid = cred_sid(cred);
5625 key = key_ref_to_ptr(key_ref);
5626 ksec = key->security;
5628 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5631 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5633 struct key_security_struct *ksec = key->security;
5634 char *context = NULL;
5638 rc = security_sid_to_context(ksec->sid, &context, &len);
5647 static struct security_operations selinux_ops = {
5650 .ptrace_access_check = selinux_ptrace_access_check,
5651 .ptrace_traceme = selinux_ptrace_traceme,
5652 .capget = selinux_capget,
5653 .capset = selinux_capset,
5654 .capable = selinux_capable,
5655 .quotactl = selinux_quotactl,
5656 .quota_on = selinux_quota_on,
5657 .syslog = selinux_syslog,
5658 .vm_enough_memory = selinux_vm_enough_memory,
5660 .netlink_send = selinux_netlink_send,
5662 .bprm_set_creds = selinux_bprm_set_creds,
5663 .bprm_committing_creds = selinux_bprm_committing_creds,
5664 .bprm_committed_creds = selinux_bprm_committed_creds,
5665 .bprm_secureexec = selinux_bprm_secureexec,
5667 .sb_alloc_security = selinux_sb_alloc_security,
5668 .sb_free_security = selinux_sb_free_security,
5669 .sb_copy_data = selinux_sb_copy_data,
5670 .sb_remount = selinux_sb_remount,
5671 .sb_kern_mount = selinux_sb_kern_mount,
5672 .sb_show_options = selinux_sb_show_options,
5673 .sb_statfs = selinux_sb_statfs,
5674 .sb_mount = selinux_mount,
5675 .sb_umount = selinux_umount,
5676 .sb_set_mnt_opts = selinux_set_mnt_opts,
5677 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5678 .sb_parse_opts_str = selinux_parse_opts_str,
5680 .dentry_init_security = selinux_dentry_init_security,
5682 .inode_alloc_security = selinux_inode_alloc_security,
5683 .inode_free_security = selinux_inode_free_security,
5684 .inode_init_security = selinux_inode_init_security,
5685 .inode_create = selinux_inode_create,
5686 .inode_link = selinux_inode_link,
5687 .inode_unlink = selinux_inode_unlink,
5688 .inode_symlink = selinux_inode_symlink,
5689 .inode_mkdir = selinux_inode_mkdir,
5690 .inode_rmdir = selinux_inode_rmdir,
5691 .inode_mknod = selinux_inode_mknod,
5692 .inode_rename = selinux_inode_rename,
5693 .inode_readlink = selinux_inode_readlink,
5694 .inode_follow_link = selinux_inode_follow_link,
5695 .inode_permission = selinux_inode_permission,
5696 .inode_setattr = selinux_inode_setattr,
5697 .inode_getattr = selinux_inode_getattr,
5698 .inode_setxattr = selinux_inode_setxattr,
5699 .inode_post_setxattr = selinux_inode_post_setxattr,
5700 .inode_getxattr = selinux_inode_getxattr,
5701 .inode_listxattr = selinux_inode_listxattr,
5702 .inode_removexattr = selinux_inode_removexattr,
5703 .inode_getsecurity = selinux_inode_getsecurity,
5704 .inode_setsecurity = selinux_inode_setsecurity,
5705 .inode_listsecurity = selinux_inode_listsecurity,
5706 .inode_getsecid = selinux_inode_getsecid,
5708 .file_permission = selinux_file_permission,
5709 .file_alloc_security = selinux_file_alloc_security,
5710 .file_free_security = selinux_file_free_security,
5711 .file_ioctl = selinux_file_ioctl,
5712 .mmap_file = selinux_mmap_file,
5713 .mmap_addr = selinux_mmap_addr,
5714 .file_mprotect = selinux_file_mprotect,
5715 .file_lock = selinux_file_lock,
5716 .file_fcntl = selinux_file_fcntl,
5717 .file_set_fowner = selinux_file_set_fowner,
5718 .file_send_sigiotask = selinux_file_send_sigiotask,
5719 .file_receive = selinux_file_receive,
5721 .file_open = selinux_file_open,
5723 .task_create = selinux_task_create,
5724 .cred_alloc_blank = selinux_cred_alloc_blank,
5725 .cred_free = selinux_cred_free,
5726 .cred_prepare = selinux_cred_prepare,
5727 .cred_transfer = selinux_cred_transfer,
5728 .kernel_act_as = selinux_kernel_act_as,
5729 .kernel_create_files_as = selinux_kernel_create_files_as,
5730 .kernel_module_request = selinux_kernel_module_request,
5731 .task_setpgid = selinux_task_setpgid,
5732 .task_getpgid = selinux_task_getpgid,
5733 .task_getsid = selinux_task_getsid,
5734 .task_getsecid = selinux_task_getsecid,
5735 .task_setnice = selinux_task_setnice,
5736 .task_setioprio = selinux_task_setioprio,
5737 .task_getioprio = selinux_task_getioprio,
5738 .task_setrlimit = selinux_task_setrlimit,
5739 .task_setscheduler = selinux_task_setscheduler,
5740 .task_getscheduler = selinux_task_getscheduler,
5741 .task_movememory = selinux_task_movememory,
5742 .task_kill = selinux_task_kill,
5743 .task_wait = selinux_task_wait,
5744 .task_to_inode = selinux_task_to_inode,
5746 .ipc_permission = selinux_ipc_permission,
5747 .ipc_getsecid = selinux_ipc_getsecid,
5749 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5750 .msg_msg_free_security = selinux_msg_msg_free_security,
5752 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5753 .msg_queue_free_security = selinux_msg_queue_free_security,
5754 .msg_queue_associate = selinux_msg_queue_associate,
5755 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5756 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5757 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5759 .shm_alloc_security = selinux_shm_alloc_security,
5760 .shm_free_security = selinux_shm_free_security,
5761 .shm_associate = selinux_shm_associate,
5762 .shm_shmctl = selinux_shm_shmctl,
5763 .shm_shmat = selinux_shm_shmat,
5765 .sem_alloc_security = selinux_sem_alloc_security,
5766 .sem_free_security = selinux_sem_free_security,
5767 .sem_associate = selinux_sem_associate,
5768 .sem_semctl = selinux_sem_semctl,
5769 .sem_semop = selinux_sem_semop,
5771 .d_instantiate = selinux_d_instantiate,
5773 .getprocattr = selinux_getprocattr,
5774 .setprocattr = selinux_setprocattr,
5776 .ismaclabel = selinux_ismaclabel,
5777 .secid_to_secctx = selinux_secid_to_secctx,
5778 .secctx_to_secid = selinux_secctx_to_secid,
5779 .release_secctx = selinux_release_secctx,
5780 .inode_notifysecctx = selinux_inode_notifysecctx,
5781 .inode_setsecctx = selinux_inode_setsecctx,
5782 .inode_getsecctx = selinux_inode_getsecctx,
5784 .unix_stream_connect = selinux_socket_unix_stream_connect,
5785 .unix_may_send = selinux_socket_unix_may_send,
5787 .socket_create = selinux_socket_create,
5788 .socket_post_create = selinux_socket_post_create,
5789 .socket_bind = selinux_socket_bind,
5790 .socket_connect = selinux_socket_connect,
5791 .socket_listen = selinux_socket_listen,
5792 .socket_accept = selinux_socket_accept,
5793 .socket_sendmsg = selinux_socket_sendmsg,
5794 .socket_recvmsg = selinux_socket_recvmsg,
5795 .socket_getsockname = selinux_socket_getsockname,
5796 .socket_getpeername = selinux_socket_getpeername,
5797 .socket_getsockopt = selinux_socket_getsockopt,
5798 .socket_setsockopt = selinux_socket_setsockopt,
5799 .socket_shutdown = selinux_socket_shutdown,
5800 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5801 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5802 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5803 .sk_alloc_security = selinux_sk_alloc_security,
5804 .sk_free_security = selinux_sk_free_security,
5805 .sk_clone_security = selinux_sk_clone_security,
5806 .sk_getsecid = selinux_sk_getsecid,
5807 .sock_graft = selinux_sock_graft,
5808 .inet_conn_request = selinux_inet_conn_request,
5809 .inet_csk_clone = selinux_inet_csk_clone,
5810 .inet_conn_established = selinux_inet_conn_established,
5811 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5812 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5813 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5814 .req_classify_flow = selinux_req_classify_flow,
5815 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5816 .tun_dev_free_security = selinux_tun_dev_free_security,
5817 .tun_dev_create = selinux_tun_dev_create,
5818 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5819 .tun_dev_attach = selinux_tun_dev_attach,
5820 .tun_dev_open = selinux_tun_dev_open,
5821 .skb_owned_by = selinux_skb_owned_by,
5823 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5824 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5825 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5826 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5827 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5828 .xfrm_state_alloc = selinux_xfrm_state_alloc,
5829 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
5830 .xfrm_state_free_security = selinux_xfrm_state_free,
5831 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5832 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5833 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5834 .xfrm_decode_session = selinux_xfrm_decode_session,
5838 .key_alloc = selinux_key_alloc,
5839 .key_free = selinux_key_free,
5840 .key_permission = selinux_key_permission,
5841 .key_getsecurity = selinux_key_getsecurity,
5845 .audit_rule_init = selinux_audit_rule_init,
5846 .audit_rule_known = selinux_audit_rule_known,
5847 .audit_rule_match = selinux_audit_rule_match,
5848 .audit_rule_free = selinux_audit_rule_free,
5852 static __init int selinux_init(void)
5854 if (!security_module_enable(&selinux_ops)) {
5855 selinux_enabled = 0;
5859 if (!selinux_enabled) {
5860 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5864 printk(KERN_INFO "SELinux: Initializing.\n");
5866 /* Set the security state for the initial task. */
5867 cred_init_security();
5869 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5871 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5872 sizeof(struct inode_security_struct),
5873 0, SLAB_PANIC, NULL);
5876 if (register_security(&selinux_ops))
5877 panic("SELinux: Unable to register with kernel.\n");
5879 if (selinux_enforcing)
5880 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5882 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5887 static void delayed_superblock_init(struct super_block *sb, void *unused)
5889 superblock_doinit(sb, NULL);
5892 void selinux_complete_init(void)
5894 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5896 /* Set up any superblocks initialized prior to the policy load. */
5897 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5898 iterate_supers(delayed_superblock_init, NULL);
5901 /* SELinux requires early initialization in order to label
5902 all processes and objects when they are created. */
5903 security_initcall(selinux_init);
5905 #if defined(CONFIG_NETFILTER)
5907 static struct nf_hook_ops selinux_ipv4_ops[] = {
5909 .hook = selinux_ipv4_postroute,
5910 .owner = THIS_MODULE,
5912 .hooknum = NF_INET_POST_ROUTING,
5913 .priority = NF_IP_PRI_SELINUX_LAST,
5916 .hook = selinux_ipv4_forward,
5917 .owner = THIS_MODULE,
5919 .hooknum = NF_INET_FORWARD,
5920 .priority = NF_IP_PRI_SELINUX_FIRST,
5923 .hook = selinux_ipv4_output,
5924 .owner = THIS_MODULE,
5926 .hooknum = NF_INET_LOCAL_OUT,
5927 .priority = NF_IP_PRI_SELINUX_FIRST,
5931 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5933 static struct nf_hook_ops selinux_ipv6_ops[] = {
5935 .hook = selinux_ipv6_postroute,
5936 .owner = THIS_MODULE,
5938 .hooknum = NF_INET_POST_ROUTING,
5939 .priority = NF_IP6_PRI_SELINUX_LAST,
5942 .hook = selinux_ipv6_forward,
5943 .owner = THIS_MODULE,
5945 .hooknum = NF_INET_FORWARD,
5946 .priority = NF_IP6_PRI_SELINUX_FIRST,
5952 static int __init selinux_nf_ip_init(void)
5956 if (!selinux_enabled)
5959 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5961 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5963 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5965 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5966 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5968 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5975 __initcall(selinux_nf_ip_init);
5977 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5978 static void selinux_nf_ip_exit(void)
5980 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5982 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5983 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5984 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5989 #else /* CONFIG_NETFILTER */
5991 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5992 #define selinux_nf_ip_exit()
5995 #endif /* CONFIG_NETFILTER */
5997 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5998 static int selinux_disabled;
6000 int selinux_disable(void)
6002 if (ss_initialized) {
6003 /* Not permitted after initial policy load. */
6007 if (selinux_disabled) {
6008 /* Only do this once. */
6012 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6014 selinux_disabled = 1;
6015 selinux_enabled = 0;
6017 reset_security_ops();
6019 /* Try to destroy the avc node cache */
6022 /* Unregister netfilter hooks. */
6023 selinux_nf_ip_exit();
6025 /* Unregister selinuxfs. */