2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <linux/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
97 #define NUM_SEL_MNT_OPTS 5
99 extern struct security_operations *security_ops;
101 /* SECMARK reference count */
102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
105 int selinux_enforcing;
107 static int __init enforcing_setup(char *str)
109 unsigned long enforcing;
110 if (!strict_strtoul(str, 0, &enforcing))
111 selinux_enforcing = enforcing ? 1 : 0;
114 __setup("enforcing=", enforcing_setup);
117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
120 static int __init selinux_enabled_setup(char *str)
122 unsigned long enabled;
123 if (!strict_strtoul(str, 0, &enabled))
124 selinux_enabled = enabled ? 1 : 0;
127 __setup("selinux=", selinux_enabled_setup);
129 int selinux_enabled = 1;
132 static struct kmem_cache *sel_inode_cache;
135 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
138 * This function checks the SECMARK reference counter to see if any SECMARK
139 * targets are currently configured, if the reference counter is greater than
140 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
141 * enabled, false (0) if SECMARK is disabled.
144 static int selinux_secmark_enabled(void)
146 return (atomic_read(&selinux_secmark_refcount) > 0);
150 * initialise the security for the init task
152 static void cred_init_security(void)
154 struct cred *cred = (struct cred *) current->real_cred;
155 struct task_security_struct *tsec;
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
159 panic("SELinux: Failed to initialize initial task.\n");
161 tsec->osid = tsec->sid = SECINITSID_KERNEL;
162 cred->security = tsec;
166 * get the security ID of a set of credentials
168 static inline u32 cred_sid(const struct cred *cred)
170 const struct task_security_struct *tsec;
172 tsec = cred->security;
177 * get the objective security ID of a task
179 static inline u32 task_sid(const struct task_struct *task)
184 sid = cred_sid(__task_cred(task));
190 * get the subjective security ID of the current task
192 static inline u32 current_sid(void)
194 const struct task_security_struct *tsec = current_security();
199 /* Allocate and free functions for each kind of security blob. */
201 static int inode_alloc_security(struct inode *inode)
203 struct inode_security_struct *isec;
204 u32 sid = current_sid();
206 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
210 mutex_init(&isec->lock);
211 INIT_LIST_HEAD(&isec->list);
213 isec->sid = SECINITSID_UNLABELED;
214 isec->sclass = SECCLASS_FILE;
215 isec->task_sid = sid;
216 inode->i_security = isec;
221 static void inode_free_security(struct inode *inode)
223 struct inode_security_struct *isec = inode->i_security;
224 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
226 spin_lock(&sbsec->isec_lock);
227 if (!list_empty(&isec->list))
228 list_del_init(&isec->list);
229 spin_unlock(&sbsec->isec_lock);
231 inode->i_security = NULL;
232 kmem_cache_free(sel_inode_cache, isec);
235 static int file_alloc_security(struct file *file)
237 struct file_security_struct *fsec;
238 u32 sid = current_sid();
240 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
245 fsec->fown_sid = sid;
246 file->f_security = fsec;
251 static void file_free_security(struct file *file)
253 struct file_security_struct *fsec = file->f_security;
254 file->f_security = NULL;
258 static int superblock_alloc_security(struct super_block *sb)
260 struct superblock_security_struct *sbsec;
262 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
266 mutex_init(&sbsec->lock);
267 INIT_LIST_HEAD(&sbsec->isec_head);
268 spin_lock_init(&sbsec->isec_lock);
270 sbsec->sid = SECINITSID_UNLABELED;
271 sbsec->def_sid = SECINITSID_FILE;
272 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
273 sb->s_security = sbsec;
278 static void superblock_free_security(struct super_block *sb)
280 struct superblock_security_struct *sbsec = sb->s_security;
281 sb->s_security = NULL;
285 /* The file system's label must be initialized prior to use. */
287 static const char *labeling_behaviors[6] = {
289 "uses transition SIDs",
291 "uses genfs_contexts",
292 "not configured for labeling",
293 "uses mountpoint labeling",
296 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
298 static inline int inode_doinit(struct inode *inode)
300 return inode_doinit_with_dentry(inode, NULL);
309 Opt_labelsupport = 5,
312 static const match_table_t tokens = {
313 {Opt_context, CONTEXT_STR "%s"},
314 {Opt_fscontext, FSCONTEXT_STR "%s"},
315 {Opt_defcontext, DEFCONTEXT_STR "%s"},
316 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
317 {Opt_labelsupport, LABELSUPP_STR},
321 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
323 static int may_context_mount_sb_relabel(u32 sid,
324 struct superblock_security_struct *sbsec,
325 const struct cred *cred)
327 const struct task_security_struct *tsec = cred->security;
330 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
331 FILESYSTEM__RELABELFROM, NULL);
335 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
336 FILESYSTEM__RELABELTO, NULL);
340 static int may_context_mount_inode_relabel(u32 sid,
341 struct superblock_security_struct *sbsec,
342 const struct cred *cred)
344 const struct task_security_struct *tsec = cred->security;
346 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELFROM, NULL);
351 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
352 FILESYSTEM__ASSOCIATE, NULL);
356 static int sb_finish_set_opts(struct super_block *sb)
358 struct superblock_security_struct *sbsec = sb->s_security;
359 struct dentry *root = sb->s_root;
360 struct inode *root_inode = root->d_inode;
363 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
364 /* Make sure that the xattr handler exists and that no
365 error other than -ENODATA is returned by getxattr on
366 the root directory. -ENODATA is ok, as this may be
367 the first boot of the SELinux kernel before we have
368 assigned xattr values to the filesystem. */
369 if (!root_inode->i_op->getxattr) {
370 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
371 "xattr support\n", sb->s_id, sb->s_type->name);
375 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
376 if (rc < 0 && rc != -ENODATA) {
377 if (rc == -EOPNOTSUPP)
378 printk(KERN_WARNING "SELinux: (dev %s, type "
379 "%s) has no security xattr handler\n",
380 sb->s_id, sb->s_type->name);
382 printk(KERN_WARNING "SELinux: (dev %s, type "
383 "%s) getxattr errno %d\n", sb->s_id,
384 sb->s_type->name, -rc);
389 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
391 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
392 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
393 sb->s_id, sb->s_type->name);
395 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
396 sb->s_id, sb->s_type->name,
397 labeling_behaviors[sbsec->behavior-1]);
399 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
400 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
401 sbsec->behavior == SECURITY_FS_USE_NONE ||
402 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
403 sbsec->flags &= ~SE_SBLABELSUPP;
405 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
406 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
407 sbsec->flags |= SE_SBLABELSUPP;
409 /* Initialize the root inode. */
410 rc = inode_doinit_with_dentry(root_inode, root);
412 /* Initialize any other inodes associated with the superblock, e.g.
413 inodes created prior to initial policy load or inodes created
414 during get_sb by a pseudo filesystem that directly
416 spin_lock(&sbsec->isec_lock);
418 if (!list_empty(&sbsec->isec_head)) {
419 struct inode_security_struct *isec =
420 list_entry(sbsec->isec_head.next,
421 struct inode_security_struct, list);
422 struct inode *inode = isec->inode;
423 spin_unlock(&sbsec->isec_lock);
424 inode = igrab(inode);
426 if (!IS_PRIVATE(inode))
430 spin_lock(&sbsec->isec_lock);
431 list_del_init(&isec->list);
434 spin_unlock(&sbsec->isec_lock);
440 * This function should allow an FS to ask what it's mount security
441 * options were so it can use those later for submounts, displaying
442 * mount options, or whatever.
444 static int selinux_get_mnt_opts(const struct super_block *sb,
445 struct security_mnt_opts *opts)
448 struct superblock_security_struct *sbsec = sb->s_security;
449 char *context = NULL;
453 security_init_mnt_opts(opts);
455 if (!(sbsec->flags & SE_SBINITIALIZED))
461 tmp = sbsec->flags & SE_MNTMASK;
462 /* count the number of mount options for this sb */
463 for (i = 0; i < 8; i++) {
465 opts->num_mnt_opts++;
468 /* Check if the Label support flag is set */
469 if (sbsec->flags & SE_SBLABELSUPP)
470 opts->num_mnt_opts++;
472 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
473 if (!opts->mnt_opts) {
478 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
479 if (!opts->mnt_opts_flags) {
485 if (sbsec->flags & FSCONTEXT_MNT) {
486 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 opts->mnt_opts[i] = context;
490 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
492 if (sbsec->flags & CONTEXT_MNT) {
493 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 opts->mnt_opts[i] = context;
497 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
499 if (sbsec->flags & DEFCONTEXT_MNT) {
500 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 opts->mnt_opts[i] = context;
504 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
506 if (sbsec->flags & ROOTCONTEXT_MNT) {
507 struct inode *root = sbsec->sb->s_root->d_inode;
508 struct inode_security_struct *isec = root->i_security;
510 rc = security_sid_to_context(isec->sid, &context, &len);
513 opts->mnt_opts[i] = context;
514 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
516 if (sbsec->flags & SE_SBLABELSUPP) {
517 opts->mnt_opts[i] = NULL;
518 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
521 BUG_ON(i != opts->num_mnt_opts);
526 security_free_mnt_opts(opts);
530 static int bad_option(struct superblock_security_struct *sbsec, char flag,
531 u32 old_sid, u32 new_sid)
533 char mnt_flags = sbsec->flags & SE_MNTMASK;
535 /* check if the old mount command had the same options */
536 if (sbsec->flags & SE_SBINITIALIZED)
537 if (!(sbsec->flags & flag) ||
538 (old_sid != new_sid))
541 /* check if we were passed the same options twice,
542 * aka someone passed context=a,context=b
544 if (!(sbsec->flags & SE_SBINITIALIZED))
545 if (mnt_flags & flag)
551 * Allow filesystems with binary mount data to explicitly set mount point
552 * labeling information.
554 static int selinux_set_mnt_opts(struct super_block *sb,
555 struct security_mnt_opts *opts)
557 const struct cred *cred = current_cred();
559 struct superblock_security_struct *sbsec = sb->s_security;
560 const char *name = sb->s_type->name;
561 struct inode *inode = sbsec->sb->s_root->d_inode;
562 struct inode_security_struct *root_isec = inode->i_security;
563 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
564 u32 defcontext_sid = 0;
565 char **mount_options = opts->mnt_opts;
566 int *flags = opts->mnt_opts_flags;
567 int num_opts = opts->num_mnt_opts;
569 mutex_lock(&sbsec->lock);
571 if (!ss_initialized) {
573 /* Defer initialization until selinux_complete_init,
574 after the initial policy is loaded and the security
575 server is ready to handle calls. */
579 printk(KERN_WARNING "SELinux: Unable to set superblock options "
580 "before the security server is initialized\n");
585 * Binary mount data FS will come through this function twice. Once
586 * from an explicit call and once from the generic calls from the vfs.
587 * Since the generic VFS calls will not contain any security mount data
588 * we need to skip the double mount verification.
590 * This does open a hole in which we will not notice if the first
591 * mount using this sb set explict options and a second mount using
592 * this sb does not set any security options. (The first options
593 * will be used for both mounts)
595 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
600 * parse the mount options, check if they are valid sids.
601 * also check if someone is trying to mount the same sb more
602 * than once with different security options.
604 for (i = 0; i < num_opts; i++) {
607 if (flags[i] == SE_SBLABELSUPP)
609 rc = security_context_to_sid(mount_options[i],
610 strlen(mount_options[i]), &sid);
612 printk(KERN_WARNING "SELinux: security_context_to_sid"
613 "(%s) failed for (dev %s, type %s) errno=%d\n",
614 mount_options[i], sb->s_id, name, rc);
621 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
623 goto out_double_mount;
625 sbsec->flags |= FSCONTEXT_MNT;
630 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
632 goto out_double_mount;
634 sbsec->flags |= CONTEXT_MNT;
636 case ROOTCONTEXT_MNT:
637 rootcontext_sid = sid;
639 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
641 goto out_double_mount;
643 sbsec->flags |= ROOTCONTEXT_MNT;
647 defcontext_sid = sid;
649 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
651 goto out_double_mount;
653 sbsec->flags |= DEFCONTEXT_MNT;
662 if (sbsec->flags & SE_SBINITIALIZED) {
663 /* previously mounted with options, but not on this attempt? */
664 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
665 goto out_double_mount;
670 if (strcmp(sb->s_type->name, "proc") == 0)
671 sbsec->flags |= SE_SBPROC;
673 /* Determine the labeling behavior to use for this filesystem type. */
674 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
676 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
677 __func__, sb->s_type->name, rc);
681 /* sets the context of the superblock for the fs being mounted. */
683 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
687 sbsec->sid = fscontext_sid;
691 * Switch to using mount point labeling behavior.
692 * sets the label used on all file below the mountpoint, and will set
693 * the superblock context if not already set.
696 if (!fscontext_sid) {
697 rc = may_context_mount_sb_relabel(context_sid, sbsec,
701 sbsec->sid = context_sid;
703 rc = may_context_mount_inode_relabel(context_sid, sbsec,
708 if (!rootcontext_sid)
709 rootcontext_sid = context_sid;
711 sbsec->mntpoint_sid = context_sid;
712 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
715 if (rootcontext_sid) {
716 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
721 root_isec->sid = rootcontext_sid;
722 root_isec->initialized = 1;
725 if (defcontext_sid) {
726 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
728 printk(KERN_WARNING "SELinux: defcontext option is "
729 "invalid for this filesystem type\n");
733 if (defcontext_sid != sbsec->def_sid) {
734 rc = may_context_mount_inode_relabel(defcontext_sid,
740 sbsec->def_sid = defcontext_sid;
743 rc = sb_finish_set_opts(sb);
745 mutex_unlock(&sbsec->lock);
749 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
750 "security settings for (dev %s, type %s)\n", sb->s_id, name);
754 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
755 struct super_block *newsb)
757 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
758 struct superblock_security_struct *newsbsec = newsb->s_security;
760 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
761 int set_context = (oldsbsec->flags & CONTEXT_MNT);
762 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
765 * if the parent was able to be mounted it clearly had no special lsm
766 * mount options. thus we can safely deal with this superblock later
771 /* how can we clone if the old one wasn't set up?? */
772 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
774 /* if fs is reusing a sb, just let its options stand... */
775 if (newsbsec->flags & SE_SBINITIALIZED)
778 mutex_lock(&newsbsec->lock);
780 newsbsec->flags = oldsbsec->flags;
782 newsbsec->sid = oldsbsec->sid;
783 newsbsec->def_sid = oldsbsec->def_sid;
784 newsbsec->behavior = oldsbsec->behavior;
787 u32 sid = oldsbsec->mntpoint_sid;
791 if (!set_rootcontext) {
792 struct inode *newinode = newsb->s_root->d_inode;
793 struct inode_security_struct *newisec = newinode->i_security;
796 newsbsec->mntpoint_sid = sid;
798 if (set_rootcontext) {
799 const struct inode *oldinode = oldsb->s_root->d_inode;
800 const struct inode_security_struct *oldisec = oldinode->i_security;
801 struct inode *newinode = newsb->s_root->d_inode;
802 struct inode_security_struct *newisec = newinode->i_security;
804 newisec->sid = oldisec->sid;
807 sb_finish_set_opts(newsb);
808 mutex_unlock(&newsbsec->lock);
811 static int selinux_parse_opts_str(char *options,
812 struct security_mnt_opts *opts)
815 char *context = NULL, *defcontext = NULL;
816 char *fscontext = NULL, *rootcontext = NULL;
817 int rc, num_mnt_opts = 0;
819 opts->num_mnt_opts = 0;
821 /* Standard string-based options. */
822 while ((p = strsep(&options, "|")) != NULL) {
824 substring_t args[MAX_OPT_ARGS];
829 token = match_token(p, tokens, args);
833 if (context || defcontext) {
835 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
838 context = match_strdup(&args[0]);
848 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
851 fscontext = match_strdup(&args[0]);
858 case Opt_rootcontext:
861 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
864 rootcontext = match_strdup(&args[0]);
872 if (context || defcontext) {
874 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
877 defcontext = match_strdup(&args[0]);
883 case Opt_labelsupport:
887 printk(KERN_WARNING "SELinux: unknown mount option\n");
894 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
898 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
899 if (!opts->mnt_opts_flags) {
900 kfree(opts->mnt_opts);
905 opts->mnt_opts[num_mnt_opts] = fscontext;
906 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
909 opts->mnt_opts[num_mnt_opts] = context;
910 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
913 opts->mnt_opts[num_mnt_opts] = rootcontext;
914 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
917 opts->mnt_opts[num_mnt_opts] = defcontext;
918 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
921 opts->num_mnt_opts = num_mnt_opts;
932 * string mount options parsing and call set the sbsec
934 static int superblock_doinit(struct super_block *sb, void *data)
937 char *options = data;
938 struct security_mnt_opts opts;
940 security_init_mnt_opts(&opts);
945 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
947 rc = selinux_parse_opts_str(options, &opts);
952 rc = selinux_set_mnt_opts(sb, &opts);
955 security_free_mnt_opts(&opts);
959 static void selinux_write_opts(struct seq_file *m,
960 struct security_mnt_opts *opts)
965 for (i = 0; i < opts->num_mnt_opts; i++) {
968 if (opts->mnt_opts[i])
969 has_comma = strchr(opts->mnt_opts[i], ',');
973 switch (opts->mnt_opts_flags[i]) {
975 prefix = CONTEXT_STR;
978 prefix = FSCONTEXT_STR;
980 case ROOTCONTEXT_MNT:
981 prefix = ROOTCONTEXT_STR;
984 prefix = DEFCONTEXT_STR;
988 seq_puts(m, LABELSUPP_STR);
994 /* we need a comma before each option */
999 seq_puts(m, opts->mnt_opts[i]);
1005 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1007 struct security_mnt_opts opts;
1010 rc = selinux_get_mnt_opts(sb, &opts);
1012 /* before policy load we may get EINVAL, don't show anything */
1018 selinux_write_opts(m, &opts);
1020 security_free_mnt_opts(&opts);
1025 static inline u16 inode_mode_to_security_class(umode_t mode)
1027 switch (mode & S_IFMT) {
1029 return SECCLASS_SOCK_FILE;
1031 return SECCLASS_LNK_FILE;
1033 return SECCLASS_FILE;
1035 return SECCLASS_BLK_FILE;
1037 return SECCLASS_DIR;
1039 return SECCLASS_CHR_FILE;
1041 return SECCLASS_FIFO_FILE;
1045 return SECCLASS_FILE;
1048 static inline int default_protocol_stream(int protocol)
1050 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1053 static inline int default_protocol_dgram(int protocol)
1055 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1058 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1064 case SOCK_SEQPACKET:
1065 return SECCLASS_UNIX_STREAM_SOCKET;
1067 return SECCLASS_UNIX_DGRAM_SOCKET;
1074 if (default_protocol_stream(protocol))
1075 return SECCLASS_TCP_SOCKET;
1077 return SECCLASS_RAWIP_SOCKET;
1079 if (default_protocol_dgram(protocol))
1080 return SECCLASS_UDP_SOCKET;
1082 return SECCLASS_RAWIP_SOCKET;
1084 return SECCLASS_DCCP_SOCKET;
1086 return SECCLASS_RAWIP_SOCKET;
1092 return SECCLASS_NETLINK_ROUTE_SOCKET;
1093 case NETLINK_FIREWALL:
1094 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1095 case NETLINK_SOCK_DIAG:
1096 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1098 return SECCLASS_NETLINK_NFLOG_SOCKET;
1100 return SECCLASS_NETLINK_XFRM_SOCKET;
1101 case NETLINK_SELINUX:
1102 return SECCLASS_NETLINK_SELINUX_SOCKET;
1104 return SECCLASS_NETLINK_AUDIT_SOCKET;
1105 case NETLINK_IP6_FW:
1106 return SECCLASS_NETLINK_IP6FW_SOCKET;
1107 case NETLINK_DNRTMSG:
1108 return SECCLASS_NETLINK_DNRT_SOCKET;
1109 case NETLINK_KOBJECT_UEVENT:
1110 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1112 return SECCLASS_NETLINK_SOCKET;
1115 return SECCLASS_PACKET_SOCKET;
1117 return SECCLASS_KEY_SOCKET;
1119 return SECCLASS_APPLETALK_SOCKET;
1122 return SECCLASS_SOCKET;
1125 #ifdef CONFIG_PROC_FS
1126 static int selinux_proc_get_sid(struct dentry *dentry,
1131 char *buffer, *path;
1133 buffer = (char *)__get_free_page(GFP_KERNEL);
1137 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1141 /* each process gets a /proc/PID/ entry. Strip off the
1142 * PID part to get a valid selinux labeling.
1143 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1144 while (path[1] >= '0' && path[1] <= '9') {
1148 rc = security_genfs_sid("proc", path, tclass, sid);
1150 free_page((unsigned long)buffer);
1154 static int selinux_proc_get_sid(struct dentry *dentry,
1162 /* The inode's security attributes must be initialized before first use. */
1163 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1165 struct superblock_security_struct *sbsec = NULL;
1166 struct inode_security_struct *isec = inode->i_security;
1168 struct dentry *dentry;
1169 #define INITCONTEXTLEN 255
1170 char *context = NULL;
1174 if (isec->initialized)
1177 mutex_lock(&isec->lock);
1178 if (isec->initialized)
1181 sbsec = inode->i_sb->s_security;
1182 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1183 /* Defer initialization until selinux_complete_init,
1184 after the initial policy is loaded and the security
1185 server is ready to handle calls. */
1186 spin_lock(&sbsec->isec_lock);
1187 if (list_empty(&isec->list))
1188 list_add(&isec->list, &sbsec->isec_head);
1189 spin_unlock(&sbsec->isec_lock);
1193 switch (sbsec->behavior) {
1194 case SECURITY_FS_USE_XATTR:
1195 if (!inode->i_op->getxattr) {
1196 isec->sid = sbsec->def_sid;
1200 /* Need a dentry, since the xattr API requires one.
1201 Life would be simpler if we could just pass the inode. */
1203 /* Called from d_instantiate or d_splice_alias. */
1204 dentry = dget(opt_dentry);
1206 /* Called from selinux_complete_init, try to find a dentry. */
1207 dentry = d_find_alias(inode);
1211 * this is can be hit on boot when a file is accessed
1212 * before the policy is loaded. When we load policy we
1213 * may find inodes that have no dentry on the
1214 * sbsec->isec_head list. No reason to complain as these
1215 * will get fixed up the next time we go through
1216 * inode_doinit with a dentry, before these inodes could
1217 * be used again by userspace.
1222 len = INITCONTEXTLEN;
1223 context = kmalloc(len+1, GFP_NOFS);
1229 context[len] = '\0';
1230 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1232 if (rc == -ERANGE) {
1235 /* Need a larger buffer. Query for the right size. */
1236 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1243 context = kmalloc(len+1, GFP_NOFS);
1249 context[len] = '\0';
1250 rc = inode->i_op->getxattr(dentry,
1256 if (rc != -ENODATA) {
1257 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1258 "%d for dev=%s ino=%ld\n", __func__,
1259 -rc, inode->i_sb->s_id, inode->i_ino);
1263 /* Map ENODATA to the default file SID */
1264 sid = sbsec->def_sid;
1267 rc = security_context_to_sid_default(context, rc, &sid,
1271 char *dev = inode->i_sb->s_id;
1272 unsigned long ino = inode->i_ino;
1274 if (rc == -EINVAL) {
1275 if (printk_ratelimit())
1276 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1277 "context=%s. This indicates you may need to relabel the inode or the "
1278 "filesystem in question.\n", ino, dev, context);
1280 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1281 "returned %d for dev=%s ino=%ld\n",
1282 __func__, context, -rc, dev, ino);
1285 /* Leave with the unlabeled SID */
1293 case SECURITY_FS_USE_TASK:
1294 isec->sid = isec->task_sid;
1296 case SECURITY_FS_USE_TRANS:
1297 /* Default to the fs SID. */
1298 isec->sid = sbsec->sid;
1300 /* Try to obtain a transition SID. */
1301 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1302 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1303 isec->sclass, NULL, &sid);
1308 case SECURITY_FS_USE_MNTPOINT:
1309 isec->sid = sbsec->mntpoint_sid;
1312 /* Default to the fs superblock SID. */
1313 isec->sid = sbsec->sid;
1315 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1317 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1318 rc = selinux_proc_get_sid(opt_dentry,
1329 isec->initialized = 1;
1332 mutex_unlock(&isec->lock);
1334 if (isec->sclass == SECCLASS_FILE)
1335 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1339 /* Convert a Linux signal to an access vector. */
1340 static inline u32 signal_to_av(int sig)
1346 /* Commonly granted from child to parent. */
1347 perm = PROCESS__SIGCHLD;
1350 /* Cannot be caught or ignored */
1351 perm = PROCESS__SIGKILL;
1354 /* Cannot be caught or ignored */
1355 perm = PROCESS__SIGSTOP;
1358 /* All other signals. */
1359 perm = PROCESS__SIGNAL;
1367 * Check permission between a pair of credentials
1368 * fork check, ptrace check, etc.
1370 static int cred_has_perm(const struct cred *actor,
1371 const struct cred *target,
1374 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1376 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1380 * Check permission between a pair of tasks, e.g. signal checks,
1381 * fork check, ptrace check, etc.
1382 * tsk1 is the actor and tsk2 is the target
1383 * - this uses the default subjective creds of tsk1
1385 static int task_has_perm(const struct task_struct *tsk1,
1386 const struct task_struct *tsk2,
1389 const struct task_security_struct *__tsec1, *__tsec2;
1393 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1394 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1396 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1400 * Check permission between current and another task, e.g. signal checks,
1401 * fork check, ptrace check, etc.
1402 * current is the actor and tsk2 is the target
1403 * - this uses current's subjective creds
1405 static int current_has_perm(const struct task_struct *tsk,
1410 sid = current_sid();
1411 tsid = task_sid(tsk);
1412 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1415 #if CAP_LAST_CAP > 63
1416 #error Fix SELinux to handle capabilities > 63.
1419 /* Check whether a task is allowed to use a capability. */
1420 static int cred_has_capability(const struct cred *cred,
1423 struct common_audit_data ad;
1424 struct av_decision avd;
1426 u32 sid = cred_sid(cred);
1427 u32 av = CAP_TO_MASK(cap);
1430 ad.type = LSM_AUDIT_DATA_CAP;
1433 switch (CAP_TO_INDEX(cap)) {
1435 sclass = SECCLASS_CAPABILITY;
1438 sclass = SECCLASS_CAPABILITY2;
1442 "SELinux: out of range capability %d\n", cap);
1447 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1448 if (audit == SECURITY_CAP_AUDIT) {
1449 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1456 /* Check whether a task is allowed to use a system operation. */
1457 static int task_has_system(struct task_struct *tsk,
1460 u32 sid = task_sid(tsk);
1462 return avc_has_perm(sid, SECINITSID_KERNEL,
1463 SECCLASS_SYSTEM, perms, NULL);
1466 /* Check whether a task has a particular permission to an inode.
1467 The 'adp' parameter is optional and allows other audit
1468 data to be passed (e.g. the dentry). */
1469 static int inode_has_perm(const struct cred *cred,
1470 struct inode *inode,
1472 struct common_audit_data *adp,
1475 struct inode_security_struct *isec;
1478 validate_creds(cred);
1480 if (unlikely(IS_PRIVATE(inode)))
1483 sid = cred_sid(cred);
1484 isec = inode->i_security;
1486 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1489 /* Same as inode_has_perm, but pass explicit audit data containing
1490 the dentry to help the auditing code to more easily generate the
1491 pathname if needed. */
1492 static inline int dentry_has_perm(const struct cred *cred,
1493 struct dentry *dentry,
1496 struct inode *inode = dentry->d_inode;
1497 struct common_audit_data ad;
1499 ad.type = LSM_AUDIT_DATA_DENTRY;
1500 ad.u.dentry = dentry;
1501 return inode_has_perm(cred, inode, av, &ad, 0);
1504 /* Same as inode_has_perm, but pass explicit audit data containing
1505 the path to help the auditing code to more easily generate the
1506 pathname if needed. */
1507 static inline int path_has_perm(const struct cred *cred,
1511 struct inode *inode = path->dentry->d_inode;
1512 struct common_audit_data ad;
1514 ad.type = LSM_AUDIT_DATA_PATH;
1516 return inode_has_perm(cred, inode, av, &ad, 0);
1519 /* Check whether a task can use an open file descriptor to
1520 access an inode in a given way. Check access to the
1521 descriptor itself, and then use dentry_has_perm to
1522 check a particular permission to the file.
1523 Access to the descriptor is implicitly granted if it
1524 has the same SID as the process. If av is zero, then
1525 access to the file is not checked, e.g. for cases
1526 where only the descriptor is affected like seek. */
1527 static int file_has_perm(const struct cred *cred,
1531 struct file_security_struct *fsec = file->f_security;
1532 struct inode *inode = file_inode(file);
1533 struct common_audit_data ad;
1534 u32 sid = cred_sid(cred);
1537 ad.type = LSM_AUDIT_DATA_PATH;
1538 ad.u.path = file->f_path;
1540 if (sid != fsec->sid) {
1541 rc = avc_has_perm(sid, fsec->sid,
1549 /* av is zero if only checking access to the descriptor. */
1552 rc = inode_has_perm(cred, inode, av, &ad, 0);
1558 /* Check whether a task can create a file. */
1559 static int may_create(struct inode *dir,
1560 struct dentry *dentry,
1563 const struct task_security_struct *tsec = current_security();
1564 struct inode_security_struct *dsec;
1565 struct superblock_security_struct *sbsec;
1567 struct common_audit_data ad;
1570 dsec = dir->i_security;
1571 sbsec = dir->i_sb->s_security;
1574 newsid = tsec->create_sid;
1576 ad.type = LSM_AUDIT_DATA_DENTRY;
1577 ad.u.dentry = dentry;
1579 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1580 DIR__ADD_NAME | DIR__SEARCH,
1585 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1586 rc = security_transition_sid(sid, dsec->sid, tclass,
1587 &dentry->d_name, &newsid);
1592 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1596 return avc_has_perm(newsid, sbsec->sid,
1597 SECCLASS_FILESYSTEM,
1598 FILESYSTEM__ASSOCIATE, &ad);
1601 /* Check whether a task can create a key. */
1602 static int may_create_key(u32 ksid,
1603 struct task_struct *ctx)
1605 u32 sid = task_sid(ctx);
1607 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1611 #define MAY_UNLINK 1
1614 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1615 static int may_link(struct inode *dir,
1616 struct dentry *dentry,
1620 struct inode_security_struct *dsec, *isec;
1621 struct common_audit_data ad;
1622 u32 sid = current_sid();
1626 dsec = dir->i_security;
1627 isec = dentry->d_inode->i_security;
1629 ad.type = LSM_AUDIT_DATA_DENTRY;
1630 ad.u.dentry = dentry;
1633 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1634 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1649 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1654 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1658 static inline int may_rename(struct inode *old_dir,
1659 struct dentry *old_dentry,
1660 struct inode *new_dir,
1661 struct dentry *new_dentry)
1663 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1664 struct common_audit_data ad;
1665 u32 sid = current_sid();
1667 int old_is_dir, new_is_dir;
1670 old_dsec = old_dir->i_security;
1671 old_isec = old_dentry->d_inode->i_security;
1672 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1673 new_dsec = new_dir->i_security;
1675 ad.type = LSM_AUDIT_DATA_DENTRY;
1677 ad.u.dentry = old_dentry;
1678 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1679 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1682 rc = avc_has_perm(sid, old_isec->sid,
1683 old_isec->sclass, FILE__RENAME, &ad);
1686 if (old_is_dir && new_dir != old_dir) {
1687 rc = avc_has_perm(sid, old_isec->sid,
1688 old_isec->sclass, DIR__REPARENT, &ad);
1693 ad.u.dentry = new_dentry;
1694 av = DIR__ADD_NAME | DIR__SEARCH;
1695 if (new_dentry->d_inode)
1696 av |= DIR__REMOVE_NAME;
1697 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1700 if (new_dentry->d_inode) {
1701 new_isec = new_dentry->d_inode->i_security;
1702 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1703 rc = avc_has_perm(sid, new_isec->sid,
1705 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1713 /* Check whether a task can perform a filesystem operation. */
1714 static int superblock_has_perm(const struct cred *cred,
1715 struct super_block *sb,
1717 struct common_audit_data *ad)
1719 struct superblock_security_struct *sbsec;
1720 u32 sid = cred_sid(cred);
1722 sbsec = sb->s_security;
1723 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1726 /* Convert a Linux mode and permission mask to an access vector. */
1727 static inline u32 file_mask_to_av(int mode, int mask)
1731 if (!S_ISDIR(mode)) {
1732 if (mask & MAY_EXEC)
1733 av |= FILE__EXECUTE;
1734 if (mask & MAY_READ)
1737 if (mask & MAY_APPEND)
1739 else if (mask & MAY_WRITE)
1743 if (mask & MAY_EXEC)
1745 if (mask & MAY_WRITE)
1747 if (mask & MAY_READ)
1754 /* Convert a Linux file to an access vector. */
1755 static inline u32 file_to_av(struct file *file)
1759 if (file->f_mode & FMODE_READ)
1761 if (file->f_mode & FMODE_WRITE) {
1762 if (file->f_flags & O_APPEND)
1769 * Special file opened with flags 3 for ioctl-only use.
1778 * Convert a file to an access vector and include the correct open
1781 static inline u32 open_file_to_av(struct file *file)
1783 u32 av = file_to_av(file);
1785 if (selinux_policycap_openperm)
1791 /* Hook functions begin here. */
1793 static int selinux_ptrace_access_check(struct task_struct *child,
1798 rc = cap_ptrace_access_check(child, mode);
1802 if (mode & PTRACE_MODE_READ) {
1803 u32 sid = current_sid();
1804 u32 csid = task_sid(child);
1805 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1808 return current_has_perm(child, PROCESS__PTRACE);
1811 static int selinux_ptrace_traceme(struct task_struct *parent)
1815 rc = cap_ptrace_traceme(parent);
1819 return task_has_perm(parent, current, PROCESS__PTRACE);
1822 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1823 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1827 error = current_has_perm(target, PROCESS__GETCAP);
1831 return cap_capget(target, effective, inheritable, permitted);
1834 static int selinux_capset(struct cred *new, const struct cred *old,
1835 const kernel_cap_t *effective,
1836 const kernel_cap_t *inheritable,
1837 const kernel_cap_t *permitted)
1841 error = cap_capset(new, old,
1842 effective, inheritable, permitted);
1846 return cred_has_perm(old, new, PROCESS__SETCAP);
1850 * (This comment used to live with the selinux_task_setuid hook,
1851 * which was removed).
1853 * Since setuid only affects the current process, and since the SELinux
1854 * controls are not based on the Linux identity attributes, SELinux does not
1855 * need to control this operation. However, SELinux does control the use of
1856 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1859 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1864 rc = cap_capable(cred, ns, cap, audit);
1868 return cred_has_capability(cred, cap, audit);
1871 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1873 const struct cred *cred = current_cred();
1885 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1890 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1893 rc = 0; /* let the kernel handle invalid cmds */
1899 static int selinux_quota_on(struct dentry *dentry)
1901 const struct cred *cred = current_cred();
1903 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1906 static int selinux_syslog(int type)
1911 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1912 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1913 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1915 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1916 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1917 /* Set level of messages printed to console */
1918 case SYSLOG_ACTION_CONSOLE_LEVEL:
1919 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1921 case SYSLOG_ACTION_CLOSE: /* Close log */
1922 case SYSLOG_ACTION_OPEN: /* Open log */
1923 case SYSLOG_ACTION_READ: /* Read from log */
1924 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1925 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1927 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1934 * Check that a process has enough memory to allocate a new virtual
1935 * mapping. 0 means there is enough memory for the allocation to
1936 * succeed and -ENOMEM implies there is not.
1938 * Do not audit the selinux permission check, as this is applied to all
1939 * processes that allocate mappings.
1941 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1943 int rc, cap_sys_admin = 0;
1945 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1946 SECURITY_CAP_NOAUDIT);
1950 return __vm_enough_memory(mm, pages, cap_sys_admin);
1953 /* binprm security operations */
1955 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1957 const struct task_security_struct *old_tsec;
1958 struct task_security_struct *new_tsec;
1959 struct inode_security_struct *isec;
1960 struct common_audit_data ad;
1961 struct inode *inode = file_inode(bprm->file);
1964 rc = cap_bprm_set_creds(bprm);
1968 /* SELinux context only depends on initial program or script and not
1969 * the script interpreter */
1970 if (bprm->cred_prepared)
1973 old_tsec = current_security();
1974 new_tsec = bprm->cred->security;
1975 isec = inode->i_security;
1977 /* Default to the current task SID. */
1978 new_tsec->sid = old_tsec->sid;
1979 new_tsec->osid = old_tsec->sid;
1981 /* Reset fs, key, and sock SIDs on execve. */
1982 new_tsec->create_sid = 0;
1983 new_tsec->keycreate_sid = 0;
1984 new_tsec->sockcreate_sid = 0;
1986 if (old_tsec->exec_sid) {
1987 new_tsec->sid = old_tsec->exec_sid;
1988 /* Reset exec SID on execve. */
1989 new_tsec->exec_sid = 0;
1992 * Minimize confusion: if no_new_privs and a transition is
1993 * explicitly requested, then fail the exec.
1995 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
1998 /* Check for a default transition on this program. */
1999 rc = security_transition_sid(old_tsec->sid, isec->sid,
2000 SECCLASS_PROCESS, NULL,
2006 ad.type = LSM_AUDIT_DATA_PATH;
2007 ad.u.path = bprm->file->f_path;
2009 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2010 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2011 new_tsec->sid = old_tsec->sid;
2013 if (new_tsec->sid == old_tsec->sid) {
2014 rc = avc_has_perm(old_tsec->sid, isec->sid,
2015 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2019 /* Check permissions for the transition. */
2020 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2021 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2025 rc = avc_has_perm(new_tsec->sid, isec->sid,
2026 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2030 /* Check for shared state */
2031 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2032 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2033 SECCLASS_PROCESS, PROCESS__SHARE,
2039 /* Make sure that anyone attempting to ptrace over a task that
2040 * changes its SID has the appropriate permit */
2042 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2043 struct task_struct *tracer;
2044 struct task_security_struct *sec;
2048 tracer = ptrace_parent(current);
2049 if (likely(tracer != NULL)) {
2050 sec = __task_cred(tracer)->security;
2056 rc = avc_has_perm(ptsid, new_tsec->sid,
2058 PROCESS__PTRACE, NULL);
2064 /* Clear any possibly unsafe personality bits on exec: */
2065 bprm->per_clear |= PER_CLEAR_ON_SETID;
2071 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2073 const struct task_security_struct *tsec = current_security();
2081 /* Enable secure mode for SIDs transitions unless
2082 the noatsecure permission is granted between
2083 the two SIDs, i.e. ahp returns 0. */
2084 atsecure = avc_has_perm(osid, sid,
2086 PROCESS__NOATSECURE, NULL);
2089 return (atsecure || cap_bprm_secureexec(bprm));
2092 static int match_file(const void *p, struct file *file, unsigned fd)
2094 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2097 /* Derived from fs/exec.c:flush_old_files. */
2098 static inline void flush_unauthorized_files(const struct cred *cred,
2099 struct files_struct *files)
2101 struct file *file, *devnull = NULL;
2102 struct tty_struct *tty;
2106 tty = get_current_tty();
2108 spin_lock(&tty_files_lock);
2109 if (!list_empty(&tty->tty_files)) {
2110 struct tty_file_private *file_priv;
2112 /* Revalidate access to controlling tty.
2113 Use path_has_perm on the tty path directly rather
2114 than using file_has_perm, as this particular open
2115 file may belong to another process and we are only
2116 interested in the inode-based check here. */
2117 file_priv = list_first_entry(&tty->tty_files,
2118 struct tty_file_private, list);
2119 file = file_priv->file;
2120 if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2123 spin_unlock(&tty_files_lock);
2126 /* Reset controlling tty. */
2130 /* Revalidate access to inherited open files. */
2131 n = iterate_fd(files, 0, match_file, cred);
2132 if (!n) /* none found? */
2135 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2136 if (IS_ERR(devnull))
2138 /* replace all the matching ones with this */
2140 replace_fd(n - 1, devnull, 0);
2141 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2147 * Prepare a process for imminent new credential changes due to exec
2149 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2151 struct task_security_struct *new_tsec;
2152 struct rlimit *rlim, *initrlim;
2155 new_tsec = bprm->cred->security;
2156 if (new_tsec->sid == new_tsec->osid)
2159 /* Close files for which the new task SID is not authorized. */
2160 flush_unauthorized_files(bprm->cred, current->files);
2162 /* Always clear parent death signal on SID transitions. */
2163 current->pdeath_signal = 0;
2165 /* Check whether the new SID can inherit resource limits from the old
2166 * SID. If not, reset all soft limits to the lower of the current
2167 * task's hard limit and the init task's soft limit.
2169 * Note that the setting of hard limits (even to lower them) can be
2170 * controlled by the setrlimit check. The inclusion of the init task's
2171 * soft limit into the computation is to avoid resetting soft limits
2172 * higher than the default soft limit for cases where the default is
2173 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2175 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2176 PROCESS__RLIMITINH, NULL);
2178 /* protect against do_prlimit() */
2180 for (i = 0; i < RLIM_NLIMITS; i++) {
2181 rlim = current->signal->rlim + i;
2182 initrlim = init_task.signal->rlim + i;
2183 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2185 task_unlock(current);
2186 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2191 * Clean up the process immediately after the installation of new credentials
2194 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2196 const struct task_security_struct *tsec = current_security();
2197 struct itimerval itimer;
2207 /* Check whether the new SID can inherit signal state from the old SID.
2208 * If not, clear itimers to avoid subsequent signal generation and
2209 * flush and unblock signals.
2211 * This must occur _after_ the task SID has been updated so that any
2212 * kill done after the flush will be checked against the new SID.
2214 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2216 memset(&itimer, 0, sizeof itimer);
2217 for (i = 0; i < 3; i++)
2218 do_setitimer(i, &itimer, NULL);
2219 spin_lock_irq(¤t->sighand->siglock);
2220 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2221 __flush_signals(current);
2222 flush_signal_handlers(current, 1);
2223 sigemptyset(¤t->blocked);
2225 spin_unlock_irq(¤t->sighand->siglock);
2228 /* Wake up the parent if it is waiting so that it can recheck
2229 * wait permission to the new task SID. */
2230 read_lock(&tasklist_lock);
2231 __wake_up_parent(current, current->real_parent);
2232 read_unlock(&tasklist_lock);
2235 /* superblock security operations */
2237 static int selinux_sb_alloc_security(struct super_block *sb)
2239 return superblock_alloc_security(sb);
2242 static void selinux_sb_free_security(struct super_block *sb)
2244 superblock_free_security(sb);
2247 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2252 return !memcmp(prefix, option, plen);
2255 static inline int selinux_option(char *option, int len)
2257 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2258 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2259 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2260 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2261 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2264 static inline void take_option(char **to, char *from, int *first, int len)
2271 memcpy(*to, from, len);
2275 static inline void take_selinux_option(char **to, char *from, int *first,
2278 int current_size = 0;
2286 while (current_size < len) {
2296 static int selinux_sb_copy_data(char *orig, char *copy)
2298 int fnosec, fsec, rc = 0;
2299 char *in_save, *in_curr, *in_end;
2300 char *sec_curr, *nosec_save, *nosec;
2306 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2314 in_save = in_end = orig;
2318 open_quote = !open_quote;
2319 if ((*in_end == ',' && open_quote == 0) ||
2321 int len = in_end - in_curr;
2323 if (selinux_option(in_curr, len))
2324 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2326 take_option(&nosec, in_curr, &fnosec, len);
2328 in_curr = in_end + 1;
2330 } while (*in_end++);
2332 strcpy(in_save, nosec_save);
2333 free_page((unsigned long)nosec_save);
2338 static int selinux_sb_remount(struct super_block *sb, void *data)
2341 struct security_mnt_opts opts;
2342 char *secdata, **mount_options;
2343 struct superblock_security_struct *sbsec = sb->s_security;
2345 if (!(sbsec->flags & SE_SBINITIALIZED))
2351 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2354 security_init_mnt_opts(&opts);
2355 secdata = alloc_secdata();
2358 rc = selinux_sb_copy_data(data, secdata);
2360 goto out_free_secdata;
2362 rc = selinux_parse_opts_str(secdata, &opts);
2364 goto out_free_secdata;
2366 mount_options = opts.mnt_opts;
2367 flags = opts.mnt_opts_flags;
2369 for (i = 0; i < opts.num_mnt_opts; i++) {
2373 if (flags[i] == SE_SBLABELSUPP)
2375 len = strlen(mount_options[i]);
2376 rc = security_context_to_sid(mount_options[i], len, &sid);
2378 printk(KERN_WARNING "SELinux: security_context_to_sid"
2379 "(%s) failed for (dev %s, type %s) errno=%d\n",
2380 mount_options[i], sb->s_id, sb->s_type->name, rc);
2386 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2387 goto out_bad_option;
2390 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2391 goto out_bad_option;
2393 case ROOTCONTEXT_MNT: {
2394 struct inode_security_struct *root_isec;
2395 root_isec = sb->s_root->d_inode->i_security;
2397 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2398 goto out_bad_option;
2401 case DEFCONTEXT_MNT:
2402 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2403 goto out_bad_option;
2412 security_free_mnt_opts(&opts);
2414 free_secdata(secdata);
2417 printk(KERN_WARNING "SELinux: unable to change security options "
2418 "during remount (dev %s, type=%s)\n", sb->s_id,
2423 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2425 const struct cred *cred = current_cred();
2426 struct common_audit_data ad;
2429 rc = superblock_doinit(sb, data);
2433 /* Allow all mounts performed by the kernel */
2434 if (flags & MS_KERNMOUNT)
2437 ad.type = LSM_AUDIT_DATA_DENTRY;
2438 ad.u.dentry = sb->s_root;
2439 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2442 static int selinux_sb_statfs(struct dentry *dentry)
2444 const struct cred *cred = current_cred();
2445 struct common_audit_data ad;
2447 ad.type = LSM_AUDIT_DATA_DENTRY;
2448 ad.u.dentry = dentry->d_sb->s_root;
2449 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2452 static int selinux_mount(const char *dev_name,
2455 unsigned long flags,
2458 const struct cred *cred = current_cred();
2460 if (flags & MS_REMOUNT)
2461 return superblock_has_perm(cred, path->dentry->d_sb,
2462 FILESYSTEM__REMOUNT, NULL);
2464 return path_has_perm(cred, path, FILE__MOUNTON);
2467 static int selinux_umount(struct vfsmount *mnt, int flags)
2469 const struct cred *cred = current_cred();
2471 return superblock_has_perm(cred, mnt->mnt_sb,
2472 FILESYSTEM__UNMOUNT, NULL);
2475 /* inode security operations */
2477 static int selinux_inode_alloc_security(struct inode *inode)
2479 return inode_alloc_security(inode);
2482 static void selinux_inode_free_security(struct inode *inode)
2484 inode_free_security(inode);
2487 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2488 const struct qstr *qstr, char **name,
2489 void **value, size_t *len)
2491 const struct task_security_struct *tsec = current_security();
2492 struct inode_security_struct *dsec;
2493 struct superblock_security_struct *sbsec;
2494 u32 sid, newsid, clen;
2496 char *namep = NULL, *context;
2498 dsec = dir->i_security;
2499 sbsec = dir->i_sb->s_security;
2502 newsid = tsec->create_sid;
2504 if ((sbsec->flags & SE_SBINITIALIZED) &&
2505 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2506 newsid = sbsec->mntpoint_sid;
2507 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2508 rc = security_transition_sid(sid, dsec->sid,
2509 inode_mode_to_security_class(inode->i_mode),
2512 printk(KERN_WARNING "%s: "
2513 "security_transition_sid failed, rc=%d (dev=%s "
2516 -rc, inode->i_sb->s_id, inode->i_ino);
2521 /* Possibly defer initialization to selinux_complete_init. */
2522 if (sbsec->flags & SE_SBINITIALIZED) {
2523 struct inode_security_struct *isec = inode->i_security;
2524 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2526 isec->initialized = 1;
2529 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2533 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2540 rc = security_sid_to_context_force(newsid, &context, &clen);
2552 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2554 return may_create(dir, dentry, SECCLASS_FILE);
2557 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2559 return may_link(dir, old_dentry, MAY_LINK);
2562 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2564 return may_link(dir, dentry, MAY_UNLINK);
2567 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2569 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2572 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2574 return may_create(dir, dentry, SECCLASS_DIR);
2577 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2579 return may_link(dir, dentry, MAY_RMDIR);
2582 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2584 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2587 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2588 struct inode *new_inode, struct dentry *new_dentry)
2590 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2593 static int selinux_inode_readlink(struct dentry *dentry)
2595 const struct cred *cred = current_cred();
2597 return dentry_has_perm(cred, dentry, FILE__READ);
2600 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2602 const struct cred *cred = current_cred();
2604 return dentry_has_perm(cred, dentry, FILE__READ);
2607 static noinline int audit_inode_permission(struct inode *inode,
2608 u32 perms, u32 audited, u32 denied,
2611 struct common_audit_data ad;
2612 struct inode_security_struct *isec = inode->i_security;
2615 ad.type = LSM_AUDIT_DATA_INODE;
2618 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2619 audited, denied, &ad, flags);
2625 static int selinux_inode_permission(struct inode *inode, int mask)
2627 const struct cred *cred = current_cred();
2630 unsigned flags = mask & MAY_NOT_BLOCK;
2631 struct inode_security_struct *isec;
2633 struct av_decision avd;
2635 u32 audited, denied;
2637 from_access = mask & MAY_ACCESS;
2638 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2640 /* No permission to check. Existence test. */
2644 validate_creds(cred);
2646 if (unlikely(IS_PRIVATE(inode)))
2649 perms = file_mask_to_av(inode->i_mode, mask);
2651 sid = cred_sid(cred);
2652 isec = inode->i_security;
2654 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2655 audited = avc_audit_required(perms, &avd, rc,
2656 from_access ? FILE__AUDIT_ACCESS : 0,
2658 if (likely(!audited))
2661 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2667 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2669 const struct cred *cred = current_cred();
2670 unsigned int ia_valid = iattr->ia_valid;
2671 __u32 av = FILE__WRITE;
2673 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2674 if (ia_valid & ATTR_FORCE) {
2675 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2681 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2682 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2683 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2685 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2688 return dentry_has_perm(cred, dentry, av);
2691 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2693 const struct cred *cred = current_cred();
2696 path.dentry = dentry;
2699 return path_has_perm(cred, &path, FILE__GETATTR);
2702 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2704 const struct cred *cred = current_cred();
2706 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2707 sizeof XATTR_SECURITY_PREFIX - 1)) {
2708 if (!strcmp(name, XATTR_NAME_CAPS)) {
2709 if (!capable(CAP_SETFCAP))
2711 } else if (!capable(CAP_SYS_ADMIN)) {
2712 /* A different attribute in the security namespace.
2713 Restrict to administrator. */
2718 /* Not an attribute we recognize, so just check the
2719 ordinary setattr permission. */
2720 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2723 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2724 const void *value, size_t size, int flags)
2726 struct inode *inode = dentry->d_inode;
2727 struct inode_security_struct *isec = inode->i_security;
2728 struct superblock_security_struct *sbsec;
2729 struct common_audit_data ad;
2730 u32 newsid, sid = current_sid();
2733 if (strcmp(name, XATTR_NAME_SELINUX))
2734 return selinux_inode_setotherxattr(dentry, name);
2736 sbsec = inode->i_sb->s_security;
2737 if (!(sbsec->flags & SE_SBLABELSUPP))
2740 if (!inode_owner_or_capable(inode))
2743 ad.type = LSM_AUDIT_DATA_DENTRY;
2744 ad.u.dentry = dentry;
2746 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2747 FILE__RELABELFROM, &ad);
2751 rc = security_context_to_sid(value, size, &newsid);
2752 if (rc == -EINVAL) {
2753 if (!capable(CAP_MAC_ADMIN)) {
2754 struct audit_buffer *ab;
2758 /* We strip a nul only if it is at the end, otherwise the
2759 * context contains a nul and we should audit that */
2762 if (str[size - 1] == '\0')
2763 audit_size = size - 1;
2770 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2771 audit_log_format(ab, "op=setxattr invalid_context=");
2772 audit_log_n_untrustedstring(ab, value, audit_size);
2777 rc = security_context_to_sid_force(value, size, &newsid);
2782 rc = avc_has_perm(sid, newsid, isec->sclass,
2783 FILE__RELABELTO, &ad);
2787 rc = security_validate_transition(isec->sid, newsid, sid,
2792 return avc_has_perm(newsid,
2794 SECCLASS_FILESYSTEM,
2795 FILESYSTEM__ASSOCIATE,
2799 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2800 const void *value, size_t size,
2803 struct inode *inode = dentry->d_inode;
2804 struct inode_security_struct *isec = inode->i_security;
2808 if (strcmp(name, XATTR_NAME_SELINUX)) {
2809 /* Not an attribute we recognize, so nothing to do. */
2813 rc = security_context_to_sid_force(value, size, &newsid);
2815 printk(KERN_ERR "SELinux: unable to map context to SID"
2816 "for (%s, %lu), rc=%d\n",
2817 inode->i_sb->s_id, inode->i_ino, -rc);
2825 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2827 const struct cred *cred = current_cred();
2829 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2832 static int selinux_inode_listxattr(struct dentry *dentry)
2834 const struct cred *cred = current_cred();
2836 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2839 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2841 if (strcmp(name, XATTR_NAME_SELINUX))
2842 return selinux_inode_setotherxattr(dentry, name);
2844 /* No one is allowed to remove a SELinux security label.
2845 You can change the label, but all data must be labeled. */
2850 * Copy the inode security context value to the user.
2852 * Permission check is handled by selinux_inode_getxattr hook.
2854 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2858 char *context = NULL;
2859 struct inode_security_struct *isec = inode->i_security;
2861 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2865 * If the caller has CAP_MAC_ADMIN, then get the raw context
2866 * value even if it is not defined by current policy; otherwise,
2867 * use the in-core value under current policy.
2868 * Use the non-auditing forms of the permission checks since
2869 * getxattr may be called by unprivileged processes commonly
2870 * and lack of permission just means that we fall back to the
2871 * in-core context value, not a denial.
2873 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2874 SECURITY_CAP_NOAUDIT);
2876 error = security_sid_to_context_force(isec->sid, &context,
2879 error = security_sid_to_context(isec->sid, &context, &size);
2892 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2893 const void *value, size_t size, int flags)
2895 struct inode_security_struct *isec = inode->i_security;
2899 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2902 if (!value || !size)
2905 rc = security_context_to_sid((void *)value, size, &newsid);
2910 isec->initialized = 1;
2914 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2916 const int len = sizeof(XATTR_NAME_SELINUX);
2917 if (buffer && len <= buffer_size)
2918 memcpy(buffer, XATTR_NAME_SELINUX, len);
2922 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2924 struct inode_security_struct *isec = inode->i_security;
2928 /* file security operations */
2930 static int selinux_revalidate_file_permission(struct file *file, int mask)
2932 const struct cred *cred = current_cred();
2933 struct inode *inode = file_inode(file);
2935 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2936 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2939 return file_has_perm(cred, file,
2940 file_mask_to_av(inode->i_mode, mask));
2943 static int selinux_file_permission(struct file *file, int mask)
2945 struct inode *inode = file_inode(file);
2946 struct file_security_struct *fsec = file->f_security;
2947 struct inode_security_struct *isec = inode->i_security;
2948 u32 sid = current_sid();
2951 /* No permission to check. Existence test. */
2954 if (sid == fsec->sid && fsec->isid == isec->sid &&
2955 fsec->pseqno == avc_policy_seqno())
2956 /* No change since file_open check. */
2959 return selinux_revalidate_file_permission(file, mask);
2962 static int selinux_file_alloc_security(struct file *file)
2964 return file_alloc_security(file);
2967 static void selinux_file_free_security(struct file *file)
2969 file_free_security(file);
2972 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2975 const struct cred *cred = current_cred();
2985 case FS_IOC_GETFLAGS:
2987 case FS_IOC_GETVERSION:
2988 error = file_has_perm(cred, file, FILE__GETATTR);
2991 case FS_IOC_SETFLAGS:
2993 case FS_IOC_SETVERSION:
2994 error = file_has_perm(cred, file, FILE__SETATTR);
2997 /* sys_ioctl() checks */
3001 error = file_has_perm(cred, file, 0);
3006 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3007 SECURITY_CAP_AUDIT);
3010 /* default case assumes that the command will go
3011 * to the file's ioctl() function.
3014 error = file_has_perm(cred, file, FILE__IOCTL);
3019 static int default_noexec;
3021 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3023 const struct cred *cred = current_cred();
3026 if (default_noexec &&
3027 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3029 * We are making executable an anonymous mapping or a
3030 * private file mapping that will also be writable.
3031 * This has an additional check.
3033 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3039 /* read access is always possible with a mapping */
3040 u32 av = FILE__READ;
3042 /* write access only matters if the mapping is shared */
3043 if (shared && (prot & PROT_WRITE))
3046 if (prot & PROT_EXEC)
3047 av |= FILE__EXECUTE;
3049 return file_has_perm(cred, file, av);
3056 static int selinux_mmap_addr(unsigned long addr)
3059 u32 sid = current_sid();
3062 * notice that we are intentionally putting the SELinux check before
3063 * the secondary cap_file_mmap check. This is such a likely attempt
3064 * at bad behaviour/exploit that we always want to get the AVC, even
3065 * if DAC would have also denied the operation.
3067 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3068 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3069 MEMPROTECT__MMAP_ZERO, NULL);
3074 /* do DAC check on address space usage */
3075 return cap_mmap_addr(addr);
3078 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3079 unsigned long prot, unsigned long flags)
3081 if (selinux_checkreqprot)
3084 return file_map_prot_check(file, prot,
3085 (flags & MAP_TYPE) == MAP_SHARED);
3088 static int selinux_file_mprotect(struct vm_area_struct *vma,
3089 unsigned long reqprot,
3092 const struct cred *cred = current_cred();
3094 if (selinux_checkreqprot)
3097 if (default_noexec &&
3098 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3100 if (vma->vm_start >= vma->vm_mm->start_brk &&
3101 vma->vm_end <= vma->vm_mm->brk) {
3102 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3103 } else if (!vma->vm_file &&
3104 vma->vm_start <= vma->vm_mm->start_stack &&
3105 vma->vm_end >= vma->vm_mm->start_stack) {
3106 rc = current_has_perm(current, PROCESS__EXECSTACK);
3107 } else if (vma->vm_file && vma->anon_vma) {
3109 * We are making executable a file mapping that has
3110 * had some COW done. Since pages might have been
3111 * written, check ability to execute the possibly
3112 * modified content. This typically should only
3113 * occur for text relocations.
3115 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3121 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3124 static int selinux_file_lock(struct file *file, unsigned int cmd)
3126 const struct cred *cred = current_cred();
3128 return file_has_perm(cred, file, FILE__LOCK);
3131 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3134 const struct cred *cred = current_cred();
3139 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3140 err = file_has_perm(cred, file, FILE__WRITE);
3149 case F_GETOWNER_UIDS:
3150 /* Just check FD__USE permission */
3151 err = file_has_perm(cred, file, 0);
3156 #if BITS_PER_LONG == 32
3161 err = file_has_perm(cred, file, FILE__LOCK);
3168 static int selinux_file_set_fowner(struct file *file)
3170 struct file_security_struct *fsec;
3172 fsec = file->f_security;
3173 fsec->fown_sid = current_sid();
3178 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3179 struct fown_struct *fown, int signum)
3182 u32 sid = task_sid(tsk);
3184 struct file_security_struct *fsec;
3186 /* struct fown_struct is never outside the context of a struct file */
3187 file = container_of(fown, struct file, f_owner);
3189 fsec = file->f_security;
3192 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3194 perm = signal_to_av(signum);
3196 return avc_has_perm(fsec->fown_sid, sid,
3197 SECCLASS_PROCESS, perm, NULL);
3200 static int selinux_file_receive(struct file *file)
3202 const struct cred *cred = current_cred();
3204 return file_has_perm(cred, file, file_to_av(file));
3207 static int selinux_file_open(struct file *file, const struct cred *cred)
3209 struct file_security_struct *fsec;
3210 struct inode_security_struct *isec;
3212 fsec = file->f_security;
3213 isec = file_inode(file)->i_security;
3215 * Save inode label and policy sequence number
3216 * at open-time so that selinux_file_permission
3217 * can determine whether revalidation is necessary.
3218 * Task label is already saved in the file security
3219 * struct as its SID.
3221 fsec->isid = isec->sid;
3222 fsec->pseqno = avc_policy_seqno();
3224 * Since the inode label or policy seqno may have changed
3225 * between the selinux_inode_permission check and the saving
3226 * of state above, recheck that access is still permitted.
3227 * Otherwise, access might never be revalidated against the
3228 * new inode label or new policy.
3229 * This check is not redundant - do not remove.
3231 return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3234 /* task security operations */
3236 static int selinux_task_create(unsigned long clone_flags)
3238 return current_has_perm(current, PROCESS__FORK);
3242 * allocate the SELinux part of blank credentials
3244 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3246 struct task_security_struct *tsec;
3248 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3252 cred->security = tsec;
3257 * detach and free the LSM part of a set of credentials
3259 static void selinux_cred_free(struct cred *cred)
3261 struct task_security_struct *tsec = cred->security;
3264 * cred->security == NULL if security_cred_alloc_blank() or
3265 * security_prepare_creds() returned an error.
3267 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3268 cred->security = (void *) 0x7UL;
3273 * prepare a new set of credentials for modification
3275 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3278 const struct task_security_struct *old_tsec;
3279 struct task_security_struct *tsec;
3281 old_tsec = old->security;
3283 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3287 new->security = tsec;
3292 * transfer the SELinux data to a blank set of creds
3294 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3296 const struct task_security_struct *old_tsec = old->security;
3297 struct task_security_struct *tsec = new->security;
3303 * set the security data for a kernel service
3304 * - all the creation contexts are set to unlabelled
3306 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3308 struct task_security_struct *tsec = new->security;
3309 u32 sid = current_sid();
3312 ret = avc_has_perm(sid, secid,
3313 SECCLASS_KERNEL_SERVICE,
3314 KERNEL_SERVICE__USE_AS_OVERRIDE,
3318 tsec->create_sid = 0;
3319 tsec->keycreate_sid = 0;
3320 tsec->sockcreate_sid = 0;
3326 * set the file creation context in a security record to the same as the
3327 * objective context of the specified inode
3329 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3331 struct inode_security_struct *isec = inode->i_security;
3332 struct task_security_struct *tsec = new->security;
3333 u32 sid = current_sid();
3336 ret = avc_has_perm(sid, isec->sid,
3337 SECCLASS_KERNEL_SERVICE,
3338 KERNEL_SERVICE__CREATE_FILES_AS,
3342 tsec->create_sid = isec->sid;
3346 static int selinux_kernel_module_request(char *kmod_name)
3349 struct common_audit_data ad;
3351 sid = task_sid(current);
3353 ad.type = LSM_AUDIT_DATA_KMOD;
3354 ad.u.kmod_name = kmod_name;
3356 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3357 SYSTEM__MODULE_REQUEST, &ad);
3360 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3362 return current_has_perm(p, PROCESS__SETPGID);
3365 static int selinux_task_getpgid(struct task_struct *p)
3367 return current_has_perm(p, PROCESS__GETPGID);
3370 static int selinux_task_getsid(struct task_struct *p)
3372 return current_has_perm(p, PROCESS__GETSESSION);
3375 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3377 *secid = task_sid(p);
3380 static int selinux_task_setnice(struct task_struct *p, int nice)
3384 rc = cap_task_setnice(p, nice);
3388 return current_has_perm(p, PROCESS__SETSCHED);
3391 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3395 rc = cap_task_setioprio(p, ioprio);
3399 return current_has_perm(p, PROCESS__SETSCHED);
3402 static int selinux_task_getioprio(struct task_struct *p)
3404 return current_has_perm(p, PROCESS__GETSCHED);
3407 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3408 struct rlimit *new_rlim)
3410 struct rlimit *old_rlim = p->signal->rlim + resource;
3412 /* Control the ability to change the hard limit (whether
3413 lowering or raising it), so that the hard limit can
3414 later be used as a safe reset point for the soft limit
3415 upon context transitions. See selinux_bprm_committing_creds. */
3416 if (old_rlim->rlim_max != new_rlim->rlim_max)
3417 return current_has_perm(p, PROCESS__SETRLIMIT);
3422 static int selinux_task_setscheduler(struct task_struct *p)
3426 rc = cap_task_setscheduler(p);
3430 return current_has_perm(p, PROCESS__SETSCHED);
3433 static int selinux_task_getscheduler(struct task_struct *p)
3435 return current_has_perm(p, PROCESS__GETSCHED);
3438 static int selinux_task_movememory(struct task_struct *p)
3440 return current_has_perm(p, PROCESS__SETSCHED);
3443 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3450 perm = PROCESS__SIGNULL; /* null signal; existence test */
3452 perm = signal_to_av(sig);
3454 rc = avc_has_perm(secid, task_sid(p),
3455 SECCLASS_PROCESS, perm, NULL);
3457 rc = current_has_perm(p, perm);
3461 static int selinux_task_wait(struct task_struct *p)
3463 return task_has_perm(p, current, PROCESS__SIGCHLD);
3466 static void selinux_task_to_inode(struct task_struct *p,
3467 struct inode *inode)
3469 struct inode_security_struct *isec = inode->i_security;
3470 u32 sid = task_sid(p);
3473 isec->initialized = 1;
3476 /* Returns error only if unable to parse addresses */
3477 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3478 struct common_audit_data *ad, u8 *proto)
3480 int offset, ihlen, ret = -EINVAL;
3481 struct iphdr _iph, *ih;
3483 offset = skb_network_offset(skb);
3484 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3488 ihlen = ih->ihl * 4;
3489 if (ihlen < sizeof(_iph))
3492 ad->u.net->v4info.saddr = ih->saddr;
3493 ad->u.net->v4info.daddr = ih->daddr;
3497 *proto = ih->protocol;
3499 switch (ih->protocol) {
3501 struct tcphdr _tcph, *th;
3503 if (ntohs(ih->frag_off) & IP_OFFSET)
3507 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3511 ad->u.net->sport = th->source;
3512 ad->u.net->dport = th->dest;
3517 struct udphdr _udph, *uh;
3519 if (ntohs(ih->frag_off) & IP_OFFSET)
3523 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3527 ad->u.net->sport = uh->source;
3528 ad->u.net->dport = uh->dest;
3532 case IPPROTO_DCCP: {
3533 struct dccp_hdr _dccph, *dh;
3535 if (ntohs(ih->frag_off) & IP_OFFSET)
3539 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3543 ad->u.net->sport = dh->dccph_sport;
3544 ad->u.net->dport = dh->dccph_dport;
3555 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3557 /* Returns error only if unable to parse addresses */
3558 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3559 struct common_audit_data *ad, u8 *proto)
3562 int ret = -EINVAL, offset;
3563 struct ipv6hdr _ipv6h, *ip6;
3566 offset = skb_network_offset(skb);
3567 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3571 ad->u.net->v6info.saddr = ip6->saddr;
3572 ad->u.net->v6info.daddr = ip6->daddr;
3575 nexthdr = ip6->nexthdr;
3576 offset += sizeof(_ipv6h);
3577 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3586 struct tcphdr _tcph, *th;
3588 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3592 ad->u.net->sport = th->source;
3593 ad->u.net->dport = th->dest;
3598 struct udphdr _udph, *uh;
3600 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3604 ad->u.net->sport = uh->source;
3605 ad->u.net->dport = uh->dest;
3609 case IPPROTO_DCCP: {
3610 struct dccp_hdr _dccph, *dh;
3612 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3616 ad->u.net->sport = dh->dccph_sport;
3617 ad->u.net->dport = dh->dccph_dport;
3621 /* includes fragments */
3631 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3632 char **_addrp, int src, u8 *proto)
3637 switch (ad->u.net->family) {
3639 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3642 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3643 &ad->u.net->v4info.daddr);
3646 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3648 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3651 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3652 &ad->u.net->v6info.daddr);
3662 "SELinux: failure in selinux_parse_skb(),"
3663 " unable to parse packet\n");
3673 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3675 * @family: protocol family
3676 * @sid: the packet's peer label SID
3679 * Check the various different forms of network peer labeling and determine
3680 * the peer label/SID for the packet; most of the magic actually occurs in
3681 * the security server function security_net_peersid_cmp(). The function
3682 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3683 * or -EACCES if @sid is invalid due to inconsistencies with the different
3687 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3694 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3695 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3697 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3698 if (unlikely(err)) {
3700 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3701 " unable to determine packet's peer label\n");
3708 /* socket security operations */
3710 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3711 u16 secclass, u32 *socksid)
3713 if (tsec->sockcreate_sid > SECSID_NULL) {
3714 *socksid = tsec->sockcreate_sid;
3718 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3722 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3724 struct sk_security_struct *sksec = sk->sk_security;
3725 struct common_audit_data ad;
3726 struct lsm_network_audit net = {0,};
3727 u32 tsid = task_sid(task);
3729 if (sksec->sid == SECINITSID_KERNEL)
3732 ad.type = LSM_AUDIT_DATA_NET;
3736 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3739 static int selinux_socket_create(int family, int type,
3740 int protocol, int kern)
3742 const struct task_security_struct *tsec = current_security();
3750 secclass = socket_type_to_security_class(family, type, protocol);
3751 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3755 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3758 static int selinux_socket_post_create(struct socket *sock, int family,
3759 int type, int protocol, int kern)
3761 const struct task_security_struct *tsec = current_security();
3762 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3763 struct sk_security_struct *sksec;
3766 isec->sclass = socket_type_to_security_class(family, type, protocol);
3769 isec->sid = SECINITSID_KERNEL;
3771 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3776 isec->initialized = 1;
3779 sksec = sock->sk->sk_security;
3780 sksec->sid = isec->sid;
3781 sksec->sclass = isec->sclass;
3782 err = selinux_netlbl_socket_post_create(sock->sk, family);
3788 /* Range of port numbers used to automatically bind.
3789 Need to determine whether we should perform a name_bind
3790 permission check between the socket and the port number. */
3792 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3794 struct sock *sk = sock->sk;
3798 err = sock_has_perm(current, sk, SOCKET__BIND);
3803 * If PF_INET or PF_INET6, check name_bind permission for the port.
3804 * Multiple address binding for SCTP is not supported yet: we just
3805 * check the first address now.
3807 family = sk->sk_family;
3808 if (family == PF_INET || family == PF_INET6) {
3810 struct sk_security_struct *sksec = sk->sk_security;
3811 struct common_audit_data ad;
3812 struct lsm_network_audit net = {0,};
3813 struct sockaddr_in *addr4 = NULL;
3814 struct sockaddr_in6 *addr6 = NULL;
3815 unsigned short snum;
3818 if (family == PF_INET) {
3819 addr4 = (struct sockaddr_in *)address;
3820 snum = ntohs(addr4->sin_port);
3821 addrp = (char *)&addr4->sin_addr.s_addr;
3823 addr6 = (struct sockaddr_in6 *)address;
3824 snum = ntohs(addr6->sin6_port);
3825 addrp = (char *)&addr6->sin6_addr.s6_addr;
3831 inet_get_local_port_range(&low, &high);
3833 if (snum < max(PROT_SOCK, low) || snum > high) {
3834 err = sel_netport_sid(sk->sk_protocol,
3838 ad.type = LSM_AUDIT_DATA_NET;
3840 ad.u.net->sport = htons(snum);
3841 ad.u.net->family = family;
3842 err = avc_has_perm(sksec->sid, sid,
3844 SOCKET__NAME_BIND, &ad);
3850 switch (sksec->sclass) {
3851 case SECCLASS_TCP_SOCKET:
3852 node_perm = TCP_SOCKET__NODE_BIND;
3855 case SECCLASS_UDP_SOCKET:
3856 node_perm = UDP_SOCKET__NODE_BIND;
3859 case SECCLASS_DCCP_SOCKET:
3860 node_perm = DCCP_SOCKET__NODE_BIND;
3864 node_perm = RAWIP_SOCKET__NODE_BIND;
3868 err = sel_netnode_sid(addrp, family, &sid);
3872 ad.type = LSM_AUDIT_DATA_NET;
3874 ad.u.net->sport = htons(snum);
3875 ad.u.net->family = family;
3877 if (family == PF_INET)
3878 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3880 ad.u.net->v6info.saddr = addr6->sin6_addr;
3882 err = avc_has_perm(sksec->sid, sid,
3883 sksec->sclass, node_perm, &ad);
3891 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3893 struct sock *sk = sock->sk;
3894 struct sk_security_struct *sksec = sk->sk_security;
3897 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3902 * If a TCP or DCCP socket, check name_connect permission for the port.
3904 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3905 sksec->sclass == SECCLASS_DCCP_SOCKET) {
3906 struct common_audit_data ad;
3907 struct lsm_network_audit net = {0,};
3908 struct sockaddr_in *addr4 = NULL;
3909 struct sockaddr_in6 *addr6 = NULL;
3910 unsigned short snum;
3913 if (sk->sk_family == PF_INET) {
3914 addr4 = (struct sockaddr_in *)address;
3915 if (addrlen < sizeof(struct sockaddr_in))
3917 snum = ntohs(addr4->sin_port);
3919 addr6 = (struct sockaddr_in6 *)address;
3920 if (addrlen < SIN6_LEN_RFC2133)
3922 snum = ntohs(addr6->sin6_port);
3925 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3929 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3930 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3932 ad.type = LSM_AUDIT_DATA_NET;
3934 ad.u.net->dport = htons(snum);
3935 ad.u.net->family = sk->sk_family;
3936 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3941 err = selinux_netlbl_socket_connect(sk, address);
3947 static int selinux_socket_listen(struct socket *sock, int backlog)
3949 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3952 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3955 struct inode_security_struct *isec;
3956 struct inode_security_struct *newisec;
3958 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
3962 newisec = SOCK_INODE(newsock)->i_security;
3964 isec = SOCK_INODE(sock)->i_security;
3965 newisec->sclass = isec->sclass;
3966 newisec->sid = isec->sid;
3967 newisec->initialized = 1;
3972 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3975 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
3978 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3979 int size, int flags)
3981 return sock_has_perm(current, sock->sk, SOCKET__READ);
3984 static int selinux_socket_getsockname(struct socket *sock)
3986 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3989 static int selinux_socket_getpeername(struct socket *sock)
3991 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3994 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3998 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4002 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4005 static int selinux_socket_getsockopt(struct socket *sock, int level,
4008 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4011 static int selinux_socket_shutdown(struct socket *sock, int how)
4013 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4016 static int selinux_socket_unix_stream_connect(struct sock *sock,
4020 struct sk_security_struct *sksec_sock = sock->sk_security;
4021 struct sk_security_struct *sksec_other = other->sk_security;
4022 struct sk_security_struct *sksec_new = newsk->sk_security;
4023 struct common_audit_data ad;
4024 struct lsm_network_audit net = {0,};
4027 ad.type = LSM_AUDIT_DATA_NET;
4029 ad.u.net->sk = other;
4031 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4032 sksec_other->sclass,
4033 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4037 /* server child socket */
4038 sksec_new->peer_sid = sksec_sock->sid;
4039 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4044 /* connecting socket */
4045 sksec_sock->peer_sid = sksec_new->sid;
4050 static int selinux_socket_unix_may_send(struct socket *sock,
4051 struct socket *other)
4053 struct sk_security_struct *ssec = sock->sk->sk_security;
4054 struct sk_security_struct *osec = other->sk->sk_security;
4055 struct common_audit_data ad;
4056 struct lsm_network_audit net = {0,};
4058 ad.type = LSM_AUDIT_DATA_NET;
4060 ad.u.net->sk = other->sk;
4062 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4066 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4068 struct common_audit_data *ad)
4074 err = sel_netif_sid(ifindex, &if_sid);
4077 err = avc_has_perm(peer_sid, if_sid,
4078 SECCLASS_NETIF, NETIF__INGRESS, ad);
4082 err = sel_netnode_sid(addrp, family, &node_sid);
4085 return avc_has_perm(peer_sid, node_sid,
4086 SECCLASS_NODE, NODE__RECVFROM, ad);
4089 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4093 struct sk_security_struct *sksec = sk->sk_security;
4094 u32 sk_sid = sksec->sid;
4095 struct common_audit_data ad;
4096 struct lsm_network_audit net = {0,};
4099 ad.type = LSM_AUDIT_DATA_NET;
4101 ad.u.net->netif = skb->skb_iif;
4102 ad.u.net->family = family;
4103 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4107 if (selinux_secmark_enabled()) {
4108 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4114 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4117 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4122 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4125 struct sk_security_struct *sksec = sk->sk_security;
4126 u16 family = sk->sk_family;
4127 u32 sk_sid = sksec->sid;
4128 struct common_audit_data ad;
4129 struct lsm_network_audit net = {0,};
4134 if (family != PF_INET && family != PF_INET6)
4137 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4138 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4141 /* If any sort of compatibility mode is enabled then handoff processing
4142 * to the selinux_sock_rcv_skb_compat() function to deal with the
4143 * special handling. We do this in an attempt to keep this function
4144 * as fast and as clean as possible. */
4145 if (!selinux_policycap_netpeer)
4146 return selinux_sock_rcv_skb_compat(sk, skb, family);
4148 secmark_active = selinux_secmark_enabled();
4149 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4150 if (!secmark_active && !peerlbl_active)
4153 ad.type = LSM_AUDIT_DATA_NET;
4155 ad.u.net->netif = skb->skb_iif;
4156 ad.u.net->family = family;
4157 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4161 if (peerlbl_active) {
4164 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4167 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4170 selinux_netlbl_err(skb, err, 0);
4173 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4176 selinux_netlbl_err(skb, err, 0);
4179 if (secmark_active) {
4180 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4189 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4190 int __user *optlen, unsigned len)
4195 struct sk_security_struct *sksec = sock->sk->sk_security;
4196 u32 peer_sid = SECSID_NULL;
4198 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4199 sksec->sclass == SECCLASS_TCP_SOCKET)
4200 peer_sid = sksec->peer_sid;
4201 if (peer_sid == SECSID_NULL)
4202 return -ENOPROTOOPT;
4204 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4208 if (scontext_len > len) {
4213 if (copy_to_user(optval, scontext, scontext_len))
4217 if (put_user(scontext_len, optlen))
4223 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4225 u32 peer_secid = SECSID_NULL;
4228 if (skb && skb->protocol == htons(ETH_P_IP))
4230 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4233 family = sock->sk->sk_family;
4237 if (sock && family == PF_UNIX)
4238 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4240 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4243 *secid = peer_secid;
4244 if (peer_secid == SECSID_NULL)
4249 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4251 struct sk_security_struct *sksec;
4253 sksec = kzalloc(sizeof(*sksec), priority);
4257 sksec->peer_sid = SECINITSID_UNLABELED;
4258 sksec->sid = SECINITSID_UNLABELED;
4259 selinux_netlbl_sk_security_reset(sksec);
4260 sk->sk_security = sksec;
4265 static void selinux_sk_free_security(struct sock *sk)
4267 struct sk_security_struct *sksec = sk->sk_security;
4269 sk->sk_security = NULL;
4270 selinux_netlbl_sk_security_free(sksec);
4274 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4276 struct sk_security_struct *sksec = sk->sk_security;
4277 struct sk_security_struct *newsksec = newsk->sk_security;
4279 newsksec->sid = sksec->sid;
4280 newsksec->peer_sid = sksec->peer_sid;
4281 newsksec->sclass = sksec->sclass;
4283 selinux_netlbl_sk_security_reset(newsksec);
4286 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4289 *secid = SECINITSID_ANY_SOCKET;
4291 struct sk_security_struct *sksec = sk->sk_security;
4293 *secid = sksec->sid;
4297 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4299 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4300 struct sk_security_struct *sksec = sk->sk_security;
4302 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4303 sk->sk_family == PF_UNIX)
4304 isec->sid = sksec->sid;
4305 sksec->sclass = isec->sclass;
4308 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4309 struct request_sock *req)
4311 struct sk_security_struct *sksec = sk->sk_security;
4313 u16 family = sk->sk_family;
4317 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4318 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4321 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4324 if (peersid == SECSID_NULL) {
4325 req->secid = sksec->sid;
4326 req->peer_secid = SECSID_NULL;
4328 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4331 req->secid = newsid;
4332 req->peer_secid = peersid;
4335 return selinux_netlbl_inet_conn_request(req, family);
4338 static void selinux_inet_csk_clone(struct sock *newsk,
4339 const struct request_sock *req)
4341 struct sk_security_struct *newsksec = newsk->sk_security;
4343 newsksec->sid = req->secid;
4344 newsksec->peer_sid = req->peer_secid;
4345 /* NOTE: Ideally, we should also get the isec->sid for the
4346 new socket in sync, but we don't have the isec available yet.
4347 So we will wait until sock_graft to do it, by which
4348 time it will have been created and available. */
4350 /* We don't need to take any sort of lock here as we are the only
4351 * thread with access to newsksec */
4352 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4355 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4357 u16 family = sk->sk_family;
4358 struct sk_security_struct *sksec = sk->sk_security;
4360 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4361 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4364 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4367 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4369 skb_set_owner_w(skb, sk);
4372 static int selinux_secmark_relabel_packet(u32 sid)
4374 const struct task_security_struct *__tsec;
4377 __tsec = current_security();
4380 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4383 static void selinux_secmark_refcount_inc(void)
4385 atomic_inc(&selinux_secmark_refcount);
4388 static void selinux_secmark_refcount_dec(void)
4390 atomic_dec(&selinux_secmark_refcount);
4393 static void selinux_req_classify_flow(const struct request_sock *req,
4396 fl->flowi_secid = req->secid;
4399 static int selinux_tun_dev_alloc_security(void **security)
4401 struct tun_security_struct *tunsec;
4403 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4406 tunsec->sid = current_sid();
4412 static void selinux_tun_dev_free_security(void *security)
4417 static int selinux_tun_dev_create(void)
4419 u32 sid = current_sid();
4421 /* we aren't taking into account the "sockcreate" SID since the socket
4422 * that is being created here is not a socket in the traditional sense,
4423 * instead it is a private sock, accessible only to the kernel, and
4424 * representing a wide range of network traffic spanning multiple
4425 * connections unlike traditional sockets - check the TUN driver to
4426 * get a better understanding of why this socket is special */
4428 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4432 static int selinux_tun_dev_attach_queue(void *security)
4434 struct tun_security_struct *tunsec = security;
4436 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4437 TUN_SOCKET__ATTACH_QUEUE, NULL);
4440 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4442 struct tun_security_struct *tunsec = security;
4443 struct sk_security_struct *sksec = sk->sk_security;
4445 /* we don't currently perform any NetLabel based labeling here and it
4446 * isn't clear that we would want to do so anyway; while we could apply
4447 * labeling without the support of the TUN user the resulting labeled
4448 * traffic from the other end of the connection would almost certainly
4449 * cause confusion to the TUN user that had no idea network labeling
4450 * protocols were being used */
4452 sksec->sid = tunsec->sid;
4453 sksec->sclass = SECCLASS_TUN_SOCKET;
4458 static int selinux_tun_dev_open(void *security)
4460 struct tun_security_struct *tunsec = security;
4461 u32 sid = current_sid();
4464 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4465 TUN_SOCKET__RELABELFROM, NULL);
4468 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4469 TUN_SOCKET__RELABELTO, NULL);
4477 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4481 struct nlmsghdr *nlh;
4482 struct sk_security_struct *sksec = sk->sk_security;
4484 if (skb->len < NLMSG_SPACE(0)) {
4488 nlh = nlmsg_hdr(skb);
4490 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4492 if (err == -EINVAL) {
4493 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4494 "SELinux: unrecognized netlink message"
4495 " type=%hu for sclass=%hu\n",
4496 nlh->nlmsg_type, sksec->sclass);
4497 if (!selinux_enforcing || security_get_allow_unknown())
4507 err = sock_has_perm(current, sk, perm);
4512 #ifdef CONFIG_NETFILTER
4514 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4520 struct common_audit_data ad;
4521 struct lsm_network_audit net = {0,};
4526 if (!selinux_policycap_netpeer)
4529 secmark_active = selinux_secmark_enabled();
4530 netlbl_active = netlbl_enabled();
4531 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4532 if (!secmark_active && !peerlbl_active)
4535 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4538 ad.type = LSM_AUDIT_DATA_NET;
4540 ad.u.net->netif = ifindex;
4541 ad.u.net->family = family;
4542 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4545 if (peerlbl_active) {
4546 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4549 selinux_netlbl_err(skb, err, 1);
4555 if (avc_has_perm(peer_sid, skb->secmark,
4556 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4560 /* we do this in the FORWARD path and not the POST_ROUTING
4561 * path because we want to make sure we apply the necessary
4562 * labeling before IPsec is applied so we can leverage AH
4564 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4570 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4571 struct sk_buff *skb,
4572 const struct net_device *in,
4573 const struct net_device *out,
4574 int (*okfn)(struct sk_buff *))
4576 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4579 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4580 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4581 struct sk_buff *skb,
4582 const struct net_device *in,
4583 const struct net_device *out,
4584 int (*okfn)(struct sk_buff *))
4586 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4590 static unsigned int selinux_ip_output(struct sk_buff *skb,
4595 if (!netlbl_enabled())
4598 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4599 * because we want to make sure we apply the necessary labeling
4600 * before IPsec is applied so we can leverage AH protection */
4602 struct sk_security_struct *sksec = skb->sk->sk_security;
4605 sid = SECINITSID_KERNEL;
4606 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4612 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4613 struct sk_buff *skb,
4614 const struct net_device *in,
4615 const struct net_device *out,
4616 int (*okfn)(struct sk_buff *))
4618 return selinux_ip_output(skb, PF_INET);
4621 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4625 struct sock *sk = skb->sk;
4626 struct sk_security_struct *sksec;
4627 struct common_audit_data ad;
4628 struct lsm_network_audit net = {0,};
4634 sksec = sk->sk_security;
4636 ad.type = LSM_AUDIT_DATA_NET;
4638 ad.u.net->netif = ifindex;
4639 ad.u.net->family = family;
4640 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4643 if (selinux_secmark_enabled())
4644 if (avc_has_perm(sksec->sid, skb->secmark,
4645 SECCLASS_PACKET, PACKET__SEND, &ad))
4646 return NF_DROP_ERR(-ECONNREFUSED);
4648 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4649 return NF_DROP_ERR(-ECONNREFUSED);
4654 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4660 struct common_audit_data ad;
4661 struct lsm_network_audit net = {0,};
4666 /* If any sort of compatibility mode is enabled then handoff processing
4667 * to the selinux_ip_postroute_compat() function to deal with the
4668 * special handling. We do this in an attempt to keep this function
4669 * as fast and as clean as possible. */
4670 if (!selinux_policycap_netpeer)
4671 return selinux_ip_postroute_compat(skb, ifindex, family);
4673 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4674 * packet transformation so allow the packet to pass without any checks
4675 * since we'll have another chance to perform access control checks
4676 * when the packet is on it's final way out.
4677 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4678 * is NULL, in this case go ahead and apply access control. */
4679 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4682 secmark_active = selinux_secmark_enabled();
4683 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4684 if (!secmark_active && !peerlbl_active)
4687 /* if the packet is being forwarded then get the peer label from the
4688 * packet itself; otherwise check to see if it is from a local
4689 * application or the kernel, if from an application get the peer label
4690 * from the sending socket, otherwise use the kernel's sid */
4694 secmark_perm = PACKET__FORWARD_OUT;
4695 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4698 secmark_perm = PACKET__SEND;
4699 peer_sid = SECINITSID_KERNEL;
4702 struct sk_security_struct *sksec = sk->sk_security;
4703 peer_sid = sksec->sid;
4704 secmark_perm = PACKET__SEND;
4707 ad.type = LSM_AUDIT_DATA_NET;
4709 ad.u.net->netif = ifindex;
4710 ad.u.net->family = family;
4711 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4715 if (avc_has_perm(peer_sid, skb->secmark,
4716 SECCLASS_PACKET, secmark_perm, &ad))
4717 return NF_DROP_ERR(-ECONNREFUSED);
4719 if (peerlbl_active) {
4723 if (sel_netif_sid(ifindex, &if_sid))
4725 if (avc_has_perm(peer_sid, if_sid,
4726 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4727 return NF_DROP_ERR(-ECONNREFUSED);
4729 if (sel_netnode_sid(addrp, family, &node_sid))
4731 if (avc_has_perm(peer_sid, node_sid,
4732 SECCLASS_NODE, NODE__SENDTO, &ad))
4733 return NF_DROP_ERR(-ECONNREFUSED);
4739 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4740 struct sk_buff *skb,
4741 const struct net_device *in,
4742 const struct net_device *out,
4743 int (*okfn)(struct sk_buff *))
4745 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4748 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4749 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4750 struct sk_buff *skb,
4751 const struct net_device *in,
4752 const struct net_device *out,
4753 int (*okfn)(struct sk_buff *))
4755 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4759 #endif /* CONFIG_NETFILTER */
4761 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4765 err = cap_netlink_send(sk, skb);
4769 return selinux_nlmsg_perm(sk, skb);
4772 static int ipc_alloc_security(struct task_struct *task,
4773 struct kern_ipc_perm *perm,
4776 struct ipc_security_struct *isec;
4779 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4783 sid = task_sid(task);
4784 isec->sclass = sclass;
4786 perm->security = isec;
4791 static void ipc_free_security(struct kern_ipc_perm *perm)
4793 struct ipc_security_struct *isec = perm->security;
4794 perm->security = NULL;
4798 static int msg_msg_alloc_security(struct msg_msg *msg)
4800 struct msg_security_struct *msec;
4802 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4806 msec->sid = SECINITSID_UNLABELED;
4807 msg->security = msec;
4812 static void msg_msg_free_security(struct msg_msg *msg)
4814 struct msg_security_struct *msec = msg->security;
4816 msg->security = NULL;
4820 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4823 struct ipc_security_struct *isec;
4824 struct common_audit_data ad;
4825 u32 sid = current_sid();
4827 isec = ipc_perms->security;
4829 ad.type = LSM_AUDIT_DATA_IPC;
4830 ad.u.ipc_id = ipc_perms->key;
4832 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4835 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4837 return msg_msg_alloc_security(msg);
4840 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4842 msg_msg_free_security(msg);
4845 /* message queue security operations */
4846 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4848 struct ipc_security_struct *isec;
4849 struct common_audit_data ad;
4850 u32 sid = current_sid();
4853 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4857 isec = msq->q_perm.security;
4859 ad.type = LSM_AUDIT_DATA_IPC;
4860 ad.u.ipc_id = msq->q_perm.key;
4862 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4865 ipc_free_security(&msq->q_perm);
4871 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4873 ipc_free_security(&msq->q_perm);
4876 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4878 struct ipc_security_struct *isec;
4879 struct common_audit_data ad;
4880 u32 sid = current_sid();
4882 isec = msq->q_perm.security;
4884 ad.type = LSM_AUDIT_DATA_IPC;
4885 ad.u.ipc_id = msq->q_perm.key;
4887 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4888 MSGQ__ASSOCIATE, &ad);
4891 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4899 /* No specific object, just general system-wide information. */
4900 return task_has_system(current, SYSTEM__IPC_INFO);
4903 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4906 perms = MSGQ__SETATTR;
4909 perms = MSGQ__DESTROY;
4915 err = ipc_has_perm(&msq->q_perm, perms);
4919 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4921 struct ipc_security_struct *isec;
4922 struct msg_security_struct *msec;
4923 struct common_audit_data ad;
4924 u32 sid = current_sid();
4927 isec = msq->q_perm.security;
4928 msec = msg->security;
4931 * First time through, need to assign label to the message
4933 if (msec->sid == SECINITSID_UNLABELED) {
4935 * Compute new sid based on current process and
4936 * message queue this message will be stored in
4938 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4944 ad.type = LSM_AUDIT_DATA_IPC;
4945 ad.u.ipc_id = msq->q_perm.key;
4947 /* Can this process write to the queue? */
4948 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4951 /* Can this process send the message */
4952 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4955 /* Can the message be put in the queue? */
4956 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4957 MSGQ__ENQUEUE, &ad);
4962 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4963 struct task_struct *target,
4964 long type, int mode)
4966 struct ipc_security_struct *isec;
4967 struct msg_security_struct *msec;
4968 struct common_audit_data ad;
4969 u32 sid = task_sid(target);
4972 isec = msq->q_perm.security;
4973 msec = msg->security;
4975 ad.type = LSM_AUDIT_DATA_IPC;
4976 ad.u.ipc_id = msq->q_perm.key;
4978 rc = avc_has_perm(sid, isec->sid,
4979 SECCLASS_MSGQ, MSGQ__READ, &ad);
4981 rc = avc_has_perm(sid, msec->sid,
4982 SECCLASS_MSG, MSG__RECEIVE, &ad);
4986 /* Shared Memory security operations */
4987 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4989 struct ipc_security_struct *isec;
4990 struct common_audit_data ad;
4991 u32 sid = current_sid();
4994 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4998 isec = shp->shm_perm.security;
5000 ad.type = LSM_AUDIT_DATA_IPC;
5001 ad.u.ipc_id = shp->shm_perm.key;
5003 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5006 ipc_free_security(&shp->shm_perm);
5012 static void selinux_shm_free_security(struct shmid_kernel *shp)
5014 ipc_free_security(&shp->shm_perm);
5017 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5019 struct ipc_security_struct *isec;
5020 struct common_audit_data ad;
5021 u32 sid = current_sid();
5023 isec = shp->shm_perm.security;
5025 ad.type = LSM_AUDIT_DATA_IPC;
5026 ad.u.ipc_id = shp->shm_perm.key;
5028 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5029 SHM__ASSOCIATE, &ad);
5032 /* Note, at this point, shp is locked down */
5033 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5041 /* No specific object, just general system-wide information. */
5042 return task_has_system(current, SYSTEM__IPC_INFO);
5045 perms = SHM__GETATTR | SHM__ASSOCIATE;
5048 perms = SHM__SETATTR;
5055 perms = SHM__DESTROY;
5061 err = ipc_has_perm(&shp->shm_perm, perms);
5065 static int selinux_shm_shmat(struct shmid_kernel *shp,
5066 char __user *shmaddr, int shmflg)
5070 if (shmflg & SHM_RDONLY)
5073 perms = SHM__READ | SHM__WRITE;
5075 return ipc_has_perm(&shp->shm_perm, perms);
5078 /* Semaphore security operations */
5079 static int selinux_sem_alloc_security(struct sem_array *sma)
5081 struct ipc_security_struct *isec;
5082 struct common_audit_data ad;
5083 u32 sid = current_sid();
5086 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5090 isec = sma->sem_perm.security;
5092 ad.type = LSM_AUDIT_DATA_IPC;
5093 ad.u.ipc_id = sma->sem_perm.key;
5095 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5098 ipc_free_security(&sma->sem_perm);
5104 static void selinux_sem_free_security(struct sem_array *sma)
5106 ipc_free_security(&sma->sem_perm);
5109 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5111 struct ipc_security_struct *isec;
5112 struct common_audit_data ad;
5113 u32 sid = current_sid();
5115 isec = sma->sem_perm.security;
5117 ad.type = LSM_AUDIT_DATA_IPC;
5118 ad.u.ipc_id = sma->sem_perm.key;
5120 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5121 SEM__ASSOCIATE, &ad);
5124 /* Note, at this point, sma is locked down */
5125 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5133 /* No specific object, just general system-wide information. */
5134 return task_has_system(current, SYSTEM__IPC_INFO);
5138 perms = SEM__GETATTR;
5149 perms = SEM__DESTROY;
5152 perms = SEM__SETATTR;
5156 perms = SEM__GETATTR | SEM__ASSOCIATE;
5162 err = ipc_has_perm(&sma->sem_perm, perms);
5166 static int selinux_sem_semop(struct sem_array *sma,
5167 struct sembuf *sops, unsigned nsops, int alter)
5172 perms = SEM__READ | SEM__WRITE;
5176 return ipc_has_perm(&sma->sem_perm, perms);
5179 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5185 av |= IPC__UNIX_READ;
5187 av |= IPC__UNIX_WRITE;
5192 return ipc_has_perm(ipcp, av);
5195 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5197 struct ipc_security_struct *isec = ipcp->security;
5201 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5204 inode_doinit_with_dentry(inode, dentry);
5207 static int selinux_getprocattr(struct task_struct *p,
5208 char *name, char **value)
5210 const struct task_security_struct *__tsec;
5216 error = current_has_perm(p, PROCESS__GETATTR);
5222 __tsec = __task_cred(p)->security;
5224 if (!strcmp(name, "current"))
5226 else if (!strcmp(name, "prev"))
5228 else if (!strcmp(name, "exec"))
5229 sid = __tsec->exec_sid;
5230 else if (!strcmp(name, "fscreate"))
5231 sid = __tsec->create_sid;
5232 else if (!strcmp(name, "keycreate"))
5233 sid = __tsec->keycreate_sid;
5234 else if (!strcmp(name, "sockcreate"))
5235 sid = __tsec->sockcreate_sid;
5243 error = security_sid_to_context(sid, value, &len);
5253 static int selinux_setprocattr(struct task_struct *p,
5254 char *name, void *value, size_t size)
5256 struct task_security_struct *tsec;
5257 struct task_struct *tracer;
5264 /* SELinux only allows a process to change its own
5265 security attributes. */
5270 * Basic control over ability to set these attributes at all.
5271 * current == p, but we'll pass them separately in case the
5272 * above restriction is ever removed.
5274 if (!strcmp(name, "exec"))
5275 error = current_has_perm(p, PROCESS__SETEXEC);
5276 else if (!strcmp(name, "fscreate"))
5277 error = current_has_perm(p, PROCESS__SETFSCREATE);
5278 else if (!strcmp(name, "keycreate"))
5279 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5280 else if (!strcmp(name, "sockcreate"))
5281 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5282 else if (!strcmp(name, "current"))
5283 error = current_has_perm(p, PROCESS__SETCURRENT);
5289 /* Obtain a SID for the context, if one was specified. */
5290 if (size && str[1] && str[1] != '\n') {
5291 if (str[size-1] == '\n') {
5295 error = security_context_to_sid(value, size, &sid);
5296 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5297 if (!capable(CAP_MAC_ADMIN)) {
5298 struct audit_buffer *ab;
5301 /* We strip a nul only if it is at the end, otherwise the
5302 * context contains a nul and we should audit that */
5303 if (str[size - 1] == '\0')
5304 audit_size = size - 1;
5307 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5308 audit_log_format(ab, "op=fscreate invalid_context=");
5309 audit_log_n_untrustedstring(ab, value, audit_size);
5314 error = security_context_to_sid_force(value, size,
5321 new = prepare_creds();
5325 /* Permission checking based on the specified context is
5326 performed during the actual operation (execve,
5327 open/mkdir/...), when we know the full context of the
5328 operation. See selinux_bprm_set_creds for the execve
5329 checks and may_create for the file creation checks. The
5330 operation will then fail if the context is not permitted. */
5331 tsec = new->security;
5332 if (!strcmp(name, "exec")) {
5333 tsec->exec_sid = sid;
5334 } else if (!strcmp(name, "fscreate")) {
5335 tsec->create_sid = sid;
5336 } else if (!strcmp(name, "keycreate")) {
5337 error = may_create_key(sid, p);
5340 tsec->keycreate_sid = sid;
5341 } else if (!strcmp(name, "sockcreate")) {
5342 tsec->sockcreate_sid = sid;
5343 } else if (!strcmp(name, "current")) {
5348 /* Only allow single threaded processes to change context */
5350 if (!current_is_single_threaded()) {
5351 error = security_bounded_transition(tsec->sid, sid);
5356 /* Check permissions for the transition. */
5357 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5358 PROCESS__DYNTRANSITION, NULL);
5362 /* Check for ptracing, and update the task SID if ok.
5363 Otherwise, leave SID unchanged and fail. */
5366 tracer = ptrace_parent(p);
5368 ptsid = task_sid(tracer);
5372 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5373 PROCESS__PTRACE, NULL);
5392 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5394 return security_sid_to_context(secid, secdata, seclen);
5397 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5399 return security_context_to_sid(secdata, seclen, secid);
5402 static void selinux_release_secctx(char *secdata, u32 seclen)
5408 * called with inode->i_mutex locked
5410 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5412 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5416 * called with inode->i_mutex locked
5418 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5420 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5423 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5426 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5435 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5436 unsigned long flags)
5438 const struct task_security_struct *tsec;
5439 struct key_security_struct *ksec;
5441 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5445 tsec = cred->security;
5446 if (tsec->keycreate_sid)
5447 ksec->sid = tsec->keycreate_sid;
5449 ksec->sid = tsec->sid;
5455 static void selinux_key_free(struct key *k)
5457 struct key_security_struct *ksec = k->security;
5463 static int selinux_key_permission(key_ref_t key_ref,
5464 const struct cred *cred,
5468 struct key_security_struct *ksec;
5471 /* if no specific permissions are requested, we skip the
5472 permission check. No serious, additional covert channels
5473 appear to be created. */
5477 sid = cred_sid(cred);
5479 key = key_ref_to_ptr(key_ref);
5480 ksec = key->security;
5482 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5485 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5487 struct key_security_struct *ksec = key->security;
5488 char *context = NULL;
5492 rc = security_sid_to_context(ksec->sid, &context, &len);
5501 static struct security_operations selinux_ops = {
5504 .ptrace_access_check = selinux_ptrace_access_check,
5505 .ptrace_traceme = selinux_ptrace_traceme,
5506 .capget = selinux_capget,
5507 .capset = selinux_capset,
5508 .capable = selinux_capable,
5509 .quotactl = selinux_quotactl,
5510 .quota_on = selinux_quota_on,
5511 .syslog = selinux_syslog,
5512 .vm_enough_memory = selinux_vm_enough_memory,
5514 .netlink_send = selinux_netlink_send,
5516 .bprm_set_creds = selinux_bprm_set_creds,
5517 .bprm_committing_creds = selinux_bprm_committing_creds,
5518 .bprm_committed_creds = selinux_bprm_committed_creds,
5519 .bprm_secureexec = selinux_bprm_secureexec,
5521 .sb_alloc_security = selinux_sb_alloc_security,
5522 .sb_free_security = selinux_sb_free_security,
5523 .sb_copy_data = selinux_sb_copy_data,
5524 .sb_remount = selinux_sb_remount,
5525 .sb_kern_mount = selinux_sb_kern_mount,
5526 .sb_show_options = selinux_sb_show_options,
5527 .sb_statfs = selinux_sb_statfs,
5528 .sb_mount = selinux_mount,
5529 .sb_umount = selinux_umount,
5530 .sb_set_mnt_opts = selinux_set_mnt_opts,
5531 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5532 .sb_parse_opts_str = selinux_parse_opts_str,
5535 .inode_alloc_security = selinux_inode_alloc_security,
5536 .inode_free_security = selinux_inode_free_security,
5537 .inode_init_security = selinux_inode_init_security,
5538 .inode_create = selinux_inode_create,
5539 .inode_link = selinux_inode_link,
5540 .inode_unlink = selinux_inode_unlink,
5541 .inode_symlink = selinux_inode_symlink,
5542 .inode_mkdir = selinux_inode_mkdir,
5543 .inode_rmdir = selinux_inode_rmdir,
5544 .inode_mknod = selinux_inode_mknod,
5545 .inode_rename = selinux_inode_rename,
5546 .inode_readlink = selinux_inode_readlink,
5547 .inode_follow_link = selinux_inode_follow_link,
5548 .inode_permission = selinux_inode_permission,
5549 .inode_setattr = selinux_inode_setattr,
5550 .inode_getattr = selinux_inode_getattr,
5551 .inode_setxattr = selinux_inode_setxattr,
5552 .inode_post_setxattr = selinux_inode_post_setxattr,
5553 .inode_getxattr = selinux_inode_getxattr,
5554 .inode_listxattr = selinux_inode_listxattr,
5555 .inode_removexattr = selinux_inode_removexattr,
5556 .inode_getsecurity = selinux_inode_getsecurity,
5557 .inode_setsecurity = selinux_inode_setsecurity,
5558 .inode_listsecurity = selinux_inode_listsecurity,
5559 .inode_getsecid = selinux_inode_getsecid,
5561 .file_permission = selinux_file_permission,
5562 .file_alloc_security = selinux_file_alloc_security,
5563 .file_free_security = selinux_file_free_security,
5564 .file_ioctl = selinux_file_ioctl,
5565 .mmap_file = selinux_mmap_file,
5566 .mmap_addr = selinux_mmap_addr,
5567 .file_mprotect = selinux_file_mprotect,
5568 .file_lock = selinux_file_lock,
5569 .file_fcntl = selinux_file_fcntl,
5570 .file_set_fowner = selinux_file_set_fowner,
5571 .file_send_sigiotask = selinux_file_send_sigiotask,
5572 .file_receive = selinux_file_receive,
5574 .file_open = selinux_file_open,
5576 .task_create = selinux_task_create,
5577 .cred_alloc_blank = selinux_cred_alloc_blank,
5578 .cred_free = selinux_cred_free,
5579 .cred_prepare = selinux_cred_prepare,
5580 .cred_transfer = selinux_cred_transfer,
5581 .kernel_act_as = selinux_kernel_act_as,
5582 .kernel_create_files_as = selinux_kernel_create_files_as,
5583 .kernel_module_request = selinux_kernel_module_request,
5584 .task_setpgid = selinux_task_setpgid,
5585 .task_getpgid = selinux_task_getpgid,
5586 .task_getsid = selinux_task_getsid,
5587 .task_getsecid = selinux_task_getsecid,
5588 .task_setnice = selinux_task_setnice,
5589 .task_setioprio = selinux_task_setioprio,
5590 .task_getioprio = selinux_task_getioprio,
5591 .task_setrlimit = selinux_task_setrlimit,
5592 .task_setscheduler = selinux_task_setscheduler,
5593 .task_getscheduler = selinux_task_getscheduler,
5594 .task_movememory = selinux_task_movememory,
5595 .task_kill = selinux_task_kill,
5596 .task_wait = selinux_task_wait,
5597 .task_to_inode = selinux_task_to_inode,
5599 .ipc_permission = selinux_ipc_permission,
5600 .ipc_getsecid = selinux_ipc_getsecid,
5602 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5603 .msg_msg_free_security = selinux_msg_msg_free_security,
5605 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5606 .msg_queue_free_security = selinux_msg_queue_free_security,
5607 .msg_queue_associate = selinux_msg_queue_associate,
5608 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5609 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5610 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5612 .shm_alloc_security = selinux_shm_alloc_security,
5613 .shm_free_security = selinux_shm_free_security,
5614 .shm_associate = selinux_shm_associate,
5615 .shm_shmctl = selinux_shm_shmctl,
5616 .shm_shmat = selinux_shm_shmat,
5618 .sem_alloc_security = selinux_sem_alloc_security,
5619 .sem_free_security = selinux_sem_free_security,
5620 .sem_associate = selinux_sem_associate,
5621 .sem_semctl = selinux_sem_semctl,
5622 .sem_semop = selinux_sem_semop,
5624 .d_instantiate = selinux_d_instantiate,
5626 .getprocattr = selinux_getprocattr,
5627 .setprocattr = selinux_setprocattr,
5629 .secid_to_secctx = selinux_secid_to_secctx,
5630 .secctx_to_secid = selinux_secctx_to_secid,
5631 .release_secctx = selinux_release_secctx,
5632 .inode_notifysecctx = selinux_inode_notifysecctx,
5633 .inode_setsecctx = selinux_inode_setsecctx,
5634 .inode_getsecctx = selinux_inode_getsecctx,
5636 .unix_stream_connect = selinux_socket_unix_stream_connect,
5637 .unix_may_send = selinux_socket_unix_may_send,
5639 .socket_create = selinux_socket_create,
5640 .socket_post_create = selinux_socket_post_create,
5641 .socket_bind = selinux_socket_bind,
5642 .socket_connect = selinux_socket_connect,
5643 .socket_listen = selinux_socket_listen,
5644 .socket_accept = selinux_socket_accept,
5645 .socket_sendmsg = selinux_socket_sendmsg,
5646 .socket_recvmsg = selinux_socket_recvmsg,
5647 .socket_getsockname = selinux_socket_getsockname,
5648 .socket_getpeername = selinux_socket_getpeername,
5649 .socket_getsockopt = selinux_socket_getsockopt,
5650 .socket_setsockopt = selinux_socket_setsockopt,
5651 .socket_shutdown = selinux_socket_shutdown,
5652 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5653 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5654 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5655 .sk_alloc_security = selinux_sk_alloc_security,
5656 .sk_free_security = selinux_sk_free_security,
5657 .sk_clone_security = selinux_sk_clone_security,
5658 .sk_getsecid = selinux_sk_getsecid,
5659 .sock_graft = selinux_sock_graft,
5660 .inet_conn_request = selinux_inet_conn_request,
5661 .inet_csk_clone = selinux_inet_csk_clone,
5662 .inet_conn_established = selinux_inet_conn_established,
5663 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5664 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5665 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5666 .req_classify_flow = selinux_req_classify_flow,
5667 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5668 .tun_dev_free_security = selinux_tun_dev_free_security,
5669 .tun_dev_create = selinux_tun_dev_create,
5670 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5671 .tun_dev_attach = selinux_tun_dev_attach,
5672 .tun_dev_open = selinux_tun_dev_open,
5673 .skb_owned_by = selinux_skb_owned_by,
5675 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5676 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5677 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5678 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5679 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5680 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5681 .xfrm_state_free_security = selinux_xfrm_state_free,
5682 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5683 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5684 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5685 .xfrm_decode_session = selinux_xfrm_decode_session,
5689 .key_alloc = selinux_key_alloc,
5690 .key_free = selinux_key_free,
5691 .key_permission = selinux_key_permission,
5692 .key_getsecurity = selinux_key_getsecurity,
5696 .audit_rule_init = selinux_audit_rule_init,
5697 .audit_rule_known = selinux_audit_rule_known,
5698 .audit_rule_match = selinux_audit_rule_match,
5699 .audit_rule_free = selinux_audit_rule_free,
5703 static __init int selinux_init(void)
5705 if (!security_module_enable(&selinux_ops)) {
5706 selinux_enabled = 0;
5710 if (!selinux_enabled) {
5711 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5715 printk(KERN_INFO "SELinux: Initializing.\n");
5717 /* Set the security state for the initial task. */
5718 cred_init_security();
5720 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5722 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5723 sizeof(struct inode_security_struct),
5724 0, SLAB_PANIC, NULL);
5727 if (register_security(&selinux_ops))
5728 panic("SELinux: Unable to register with kernel.\n");
5730 if (selinux_enforcing)
5731 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5733 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5738 static void delayed_superblock_init(struct super_block *sb, void *unused)
5740 superblock_doinit(sb, NULL);
5743 void selinux_complete_init(void)
5745 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5747 /* Set up any superblocks initialized prior to the policy load. */
5748 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5749 iterate_supers(delayed_superblock_init, NULL);
5752 /* SELinux requires early initialization in order to label
5753 all processes and objects when they are created. */
5754 security_initcall(selinux_init);
5756 #if defined(CONFIG_NETFILTER)
5758 static struct nf_hook_ops selinux_ipv4_ops[] = {
5760 .hook = selinux_ipv4_postroute,
5761 .owner = THIS_MODULE,
5763 .hooknum = NF_INET_POST_ROUTING,
5764 .priority = NF_IP_PRI_SELINUX_LAST,
5767 .hook = selinux_ipv4_forward,
5768 .owner = THIS_MODULE,
5770 .hooknum = NF_INET_FORWARD,
5771 .priority = NF_IP_PRI_SELINUX_FIRST,
5774 .hook = selinux_ipv4_output,
5775 .owner = THIS_MODULE,
5777 .hooknum = NF_INET_LOCAL_OUT,
5778 .priority = NF_IP_PRI_SELINUX_FIRST,
5782 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5784 static struct nf_hook_ops selinux_ipv6_ops[] = {
5786 .hook = selinux_ipv6_postroute,
5787 .owner = THIS_MODULE,
5789 .hooknum = NF_INET_POST_ROUTING,
5790 .priority = NF_IP6_PRI_SELINUX_LAST,
5793 .hook = selinux_ipv6_forward,
5794 .owner = THIS_MODULE,
5796 .hooknum = NF_INET_FORWARD,
5797 .priority = NF_IP6_PRI_SELINUX_FIRST,
5803 static int __init selinux_nf_ip_init(void)
5807 if (!selinux_enabled)
5810 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5812 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5814 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5816 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5817 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5819 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5826 __initcall(selinux_nf_ip_init);
5828 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5829 static void selinux_nf_ip_exit(void)
5831 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5833 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5834 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5835 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5840 #else /* CONFIG_NETFILTER */
5842 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5843 #define selinux_nf_ip_exit()
5846 #endif /* CONFIG_NETFILTER */
5848 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5849 static int selinux_disabled;
5851 int selinux_disable(void)
5853 if (ss_initialized) {
5854 /* Not permitted after initial policy load. */
5858 if (selinux_disabled) {
5859 /* Only do this once. */
5863 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5865 selinux_disabled = 1;
5866 selinux_enabled = 0;
5868 reset_security_ops();
5870 /* Try to destroy the avc node cache */
5873 /* Unregister netfilter hooks. */
5874 selinux_nf_ip_exit();
5876 /* Unregister selinuxfs. */