1/*
   2 *  NSA Security-Enhanced Linux (SELinux) security module
   3 *
   4 *  This file contains the SELinux hook function implementations.
   5 *
   6 *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7 *	      Chris Vance, <cvance@nai.com>
   8 *	      Wayne Salamon, <wsalamon@nai.com>
   9 *	      James Morris <jmorris@redhat.com>
  10 *
  11 *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12 *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13 *					   Eric Paris <eparis@redhat.com>
  14 *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15 *			    <dgoeddel@trustedcs.com>
  16 *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17 *	Paul Moore <paul@paul-moore.com>
  18 *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19 *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
  20 *
  21 *	This program is free software; you can redistribute it and/or modify
  22 *	it under the terms of the GNU General Public License version 2,
  23 *	as published by the Free Software Foundation.
  24 */
  25
  26#include <linux/init.h>
  27#include <linux/kd.h>
  28#include <linux/kernel.h>
 
  29#include <linux/tracehook.h>
  30#include <linux/errno.h>
  31#include <linux/ext2_fs.h>
  32#include <linux/sched.h>
  33#include <linux/security.h>
  34#include <linux/xattr.h>
  35#include <linux/capability.h>
  36#include <linux/unistd.h>
  37#include <linux/mm.h>
  38#include <linux/mman.h>
  39#include <linux/slab.h>
  40#include <linux/pagemap.h>
  41#include <linux/proc_fs.h>
  42#include <linux/swap.h>
  43#include <linux/spinlock.h>
  44#include <linux/syscalls.h>
  45#include <linux/dcache.h>
  46#include <linux/file.h>
  47#include <linux/fdtable.h>
  48#include <linux/namei.h>
  49#include <linux/mount.h>
 
 
  50#include <linux/netfilter_ipv4.h>
  51#include <linux/netfilter_ipv6.h>
  52#include <linux/tty.h>
  53#include <net/icmp.h>
  54#include <net/ip.h>		/* for local_port_range[] */
  55#include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
 
  56#include <net/net_namespace.h>
  57#include <net/netlabel.h>
  58#include <linux/uaccess.h>
  59#include <asm/ioctls.h>
  60#include <linux/atomic.h>
  61#include <linux/bitops.h>
  62#include <linux/interrupt.h>
  63#include <linux/netdevice.h>	/* for network interface checks */
  64#include <linux/netlink.h>
  65#include <linux/tcp.h>
  66#include <linux/udp.h>
  67#include <linux/dccp.h>
 
 
  68#include <linux/quota.h>
  69#include <linux/un.h>		/* for Unix socket types */
  70#include <net/af_unix.h>	/* for Unix socket types */
  71#include <linux/parser.h>
  72#include <linux/nfs_mount.h>
  73#include <net/ipv6.h>
  74#include <linux/hugetlb.h>
  75#include <linux/personality.h>
  76#include <linux/audit.h>
  77#include <linux/string.h>
  78#include <linux/selinux.h>
  79#include <linux/mutex.h>
  80#include <linux/posix-timers.h>
  81#include <linux/syslog.h>
  82#include <linux/user_namespace.h>
 
 
 
 
 
 
 
 
 
  83
  84#include "avc.h"
  85#include "objsec.h"
  86#include "netif.h"
  87#include "netnode.h"
  88#include "netport.h"
 
  89#include "xfrm.h"
  90#include "netlabel.h"
  91#include "audit.h"
 
  92
  93#define NUM_SEL_MNT_OPTS 5
  94
  95extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  96extern struct security_operations *security_ops;
  97
  98/* SECMARK reference count */
  99atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102int selinux_enforcing;
 103
 104static int __init enforcing_setup(char *str)
 105{
 106	unsigned long enforcing;
 107	if (!strict_strtoul(str, 0, &enforcing))
 108		selinux_enforcing = enforcing ? 1 : 0;
 109	return 1;
 110}
 111__setup("enforcing=", enforcing_setup);
 
 
 112#endif
 113
 
 114#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117static int __init selinux_enabled_setup(char *str)
 118{
 119	unsigned long enabled;
 120	if (!strict_strtoul(str, 0, &enabled))
 121		selinux_enabled = enabled ? 1 : 0;
 122	return 1;
 123}
 124__setup("selinux=", selinux_enabled_setup);
 125#else
 126int selinux_enabled = 1;
 127#endif
 128
 129static struct kmem_cache *sel_inode_cache;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 130
 131/**
 132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133 *
 134 * Description:
 135 * This function checks the SECMARK reference counter to see if any SECMARK
 136 * targets are currently configured, if the reference counter is greater than
 137 * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138 * enabled, false (0) if SECMARK is disabled.
 
 139 *
 140 */
 141static int selinux_secmark_enabled(void)
 142{
 143	return (atomic_read(&selinux_secmark_refcount) > 0);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 144}
 145
 146/*
 147 * initialise the security for the init task
 148 */
 149static void cred_init_security(void)
 150{
 151	struct cred *cred = (struct cred *) current->real_cred;
 152	struct task_security_struct *tsec;
 153
 154	tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 155	if (!tsec)
 156		panic("SELinux:  Failed to initialize initial task.\n");
 157
 158	tsec->osid = tsec->sid = SECINITSID_KERNEL;
 159	cred->security = tsec;
 160}
 161
 162/*
 163 * get the security ID of a set of credentials
 164 */
 165static inline u32 cred_sid(const struct cred *cred)
 166{
 167	const struct task_security_struct *tsec;
 168
 169	tsec = cred->security;
 170	return tsec->sid;
 171}
 172
 173/*
 174 * get the objective security ID of a task
 175 */
 176static inline u32 task_sid(const struct task_struct *task)
 177{
 178	u32 sid;
 179
 180	rcu_read_lock();
 181	sid = cred_sid(__task_cred(task));
 182	rcu_read_unlock();
 183	return sid;
 184}
 185
 186/*
 187 * get the subjective security ID of the current task
 188 */
 189static inline u32 current_sid(void)
 190{
 191	const struct task_security_struct *tsec = current_security();
 192
 193	return tsec->sid;
 
 
 
 194}
 195
 196/* Allocate and free functions for each kind of security blob. */
 197
 198static int inode_alloc_security(struct inode *inode)
 
 199{
 200	struct inode_security_struct *isec;
 201	u32 sid = current_sid();
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 202
 203	isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 204	if (!isec)
 205		return -ENOMEM;
 206
 207	mutex_init(&isec->lock);
 208	INIT_LIST_HEAD(&isec->list);
 209	isec->inode = inode;
 210	isec->sid = SECINITSID_UNLABELED;
 211	isec->sclass = SECCLASS_FILE;
 212	isec->task_sid = sid;
 213	inode->i_security = isec;
 
 
 
 
 
 
 
 
 
 
 
 214
 
 
 
 
 
 
 
 215	return 0;
 216}
 217
 218static void inode_free_security(struct inode *inode)
 219{
 220	struct inode_security_struct *isec = inode->i_security;
 221	struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 222
 223	spin_lock(&sbsec->isec_lock);
 224	if (!list_empty(&isec->list))
 225		list_del_init(&isec->list);
 226	spin_unlock(&sbsec->isec_lock);
 227
 228	inode->i_security = NULL;
 229	kmem_cache_free(sel_inode_cache, isec);
 230}
 231
 232static int file_alloc_security(struct file *file)
 233{
 234	struct file_security_struct *fsec;
 235	u32 sid = current_sid();
 236
 237	fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 238	if (!fsec)
 239		return -ENOMEM;
 240
 241	fsec->sid = sid;
 242	fsec->fown_sid = sid;
 243	file->f_security = fsec;
 244
 245	return 0;
 
 
 
 246}
 247
 248static void file_free_security(struct file *file)
 
 
 
 249{
 250	struct file_security_struct *fsec = file->f_security;
 251	file->f_security = NULL;
 252	kfree(fsec);
 253}
 254
 255static int superblock_alloc_security(struct super_block *sb)
 256{
 257	struct superblock_security_struct *sbsec;
 258
 259	sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 260	if (!sbsec)
 261		return -ENOMEM;
 262
 263	mutex_init(&sbsec->lock);
 264	INIT_LIST_HEAD(&sbsec->isec_head);
 265	spin_lock_init(&sbsec->isec_lock);
 266	sbsec->sb = sb;
 267	sbsec->sid = SECINITSID_UNLABELED;
 268	sbsec->def_sid = SECINITSID_FILE;
 269	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 270	sb->s_security = sbsec;
 271
 272	return 0;
 
 273}
 274
 275static void superblock_free_security(struct super_block *sb)
 276{
 277	struct superblock_security_struct *sbsec = sb->s_security;
 278	sb->s_security = NULL;
 279	kfree(sbsec);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 280}
 281
 282/* The security server must be initialized before
 283   any labeling or access decisions can be provided. */
 284extern int ss_initialized;
 285
 286/* The file system's label must be initialized prior to use. */
 287
 288static const char *labeling_behaviors[6] = {
 289	"uses xattr",
 290	"uses transition SIDs",
 291	"uses task SIDs",
 292	"uses genfs_contexts",
 293	"not configured for labeling",
 294	"uses mountpoint labeling",
 295};
 296
 297static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 298
 299static inline int inode_doinit(struct inode *inode)
 300{
 301	return inode_doinit_with_dentry(inode, NULL);
 
 
 
 
 
 302}
 303
 304enum {
 305	Opt_error = -1,
 306	Opt_context = 1,
 
 307	Opt_fscontext = 2,
 308	Opt_defcontext = 3,
 309	Opt_rootcontext = 4,
 310	Opt_labelsupport = 5,
 311};
 312
 313static const match_table_t tokens = {
 314	{Opt_context, CONTEXT_STR "%s"},
 315	{Opt_fscontext, FSCONTEXT_STR "%s"},
 316	{Opt_defcontext, DEFCONTEXT_STR "%s"},
 317	{Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 318	{Opt_labelsupport, LABELSUPP_STR},
 319	{Opt_error, NULL},
 
 
 
 
 
 320};
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 321
 322#define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 323
 324static int may_context_mount_sb_relabel(u32 sid,
 325			struct superblock_security_struct *sbsec,
 326			const struct cred *cred)
 327{
 328	const struct task_security_struct *tsec = cred->security;
 329	int rc;
 330
 331	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 
 332			  FILESYSTEM__RELABELFROM, NULL);
 333	if (rc)
 334		return rc;
 335
 336	rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 
 337			  FILESYSTEM__RELABELTO, NULL);
 338	return rc;
 339}
 340
 341static int may_context_mount_inode_relabel(u32 sid,
 342			struct superblock_security_struct *sbsec,
 343			const struct cred *cred)
 344{
 345	const struct task_security_struct *tsec = cred->security;
 346	int rc;
 347	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 
 348			  FILESYSTEM__RELABELFROM, NULL);
 349	if (rc)
 350		return rc;
 351
 352	rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 
 353			  FILESYSTEM__ASSOCIATE, NULL);
 354	return rc;
 355}
 356
 357static int sb_finish_set_opts(struct super_block *sb)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 358{
 359	struct superblock_security_struct *sbsec = sb->s_security;
 360	struct dentry *root = sb->s_root;
 361	struct inode *root_inode = root->d_inode;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 362	int rc = 0;
 363
 364	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 365		/* Make sure that the xattr handler exists and that no
 366		   error other than -ENODATA is returned by getxattr on
 367		   the root directory.  -ENODATA is ok, as this may be
 368		   the first boot of the SELinux kernel before we have
 369		   assigned xattr values to the filesystem. */
 370		if (!root_inode->i_op->getxattr) {
 371			printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 372			       "xattr support\n", sb->s_id, sb->s_type->name);
 373			rc = -EOPNOTSUPP;
 374			goto out;
 375		}
 376		rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 377		if (rc < 0 && rc != -ENODATA) {
 378			if (rc == -EOPNOTSUPP)
 379				printk(KERN_WARNING "SELinux: (dev %s, type "
 380				       "%s) has no security xattr handler\n",
 381				       sb->s_id, sb->s_type->name);
 382			else
 383				printk(KERN_WARNING "SELinux: (dev %s, type "
 384				       "%s) getxattr errno %d\n", sb->s_id,
 385				       sb->s_type->name, -rc);
 386			goto out;
 387		}
 388	}
 389
 390	sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 391
 392	if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 393		printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 394		       sb->s_id, sb->s_type->name);
 
 
 
 
 395	else
 396		printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 397		       sb->s_id, sb->s_type->name,
 398		       labeling_behaviors[sbsec->behavior-1]);
 399
 400	if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 401	    sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 402	    sbsec->behavior == SECURITY_FS_USE_NONE ||
 403	    sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 404		sbsec->flags &= ~SE_SBLABELSUPP;
 405
 406	/* Special handling for sysfs. Is genfs but also has setxattr handler*/
 407	if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 408		sbsec->flags |= SE_SBLABELSUPP;
 409
 410	/* Initialize the root inode. */
 411	rc = inode_doinit_with_dentry(root_inode, root);
 412
 413	/* Initialize any other inodes associated with the superblock, e.g.
 414	   inodes created prior to initial policy load or inodes created
 415	   during get_sb by a pseudo filesystem that directly
 416	   populates itself. */
 417	spin_lock(&sbsec->isec_lock);
 418next_inode:
 419	if (!list_empty(&sbsec->isec_head)) {
 420		struct inode_security_struct *isec =
 421				list_entry(sbsec->isec_head.next,
 422					   struct inode_security_struct, list);
 423		struct inode *inode = isec->inode;
 
 424		spin_unlock(&sbsec->isec_lock);
 425		inode = igrab(inode);
 426		if (inode) {
 427			if (!IS_PRIVATE(inode))
 428				inode_doinit(inode);
 429			iput(inode);
 430		}
 431		spin_lock(&sbsec->isec_lock);
 432		list_del_init(&isec->list);
 433		goto next_inode;
 434	}
 435	spin_unlock(&sbsec->isec_lock);
 436out:
 437	return rc;
 438}
 439
 440/*
 441 * This function should allow an FS to ask what it's mount security
 442 * options were so it can use those later for submounts, displaying
 443 * mount options, or whatever.
 444 */
 445static int selinux_get_mnt_opts(const struct super_block *sb,
 446				struct security_mnt_opts *opts)
 447{
 448	int rc = 0, i;
 449	struct superblock_security_struct *sbsec = sb->s_security;
 450	char *context = NULL;
 451	u32 len;
 452	char tmp;
 453
 454	security_init_mnt_opts(opts);
 455
 456	if (!(sbsec->flags & SE_SBINITIALIZED))
 457		return -EINVAL;
 458
 459	if (!ss_initialized)
 460		return -EINVAL;
 461
 462	tmp = sbsec->flags & SE_MNTMASK;
 463	/* count the number of mount options for this sb */
 464	for (i = 0; i < 8; i++) {
 465		if (tmp & 0x01)
 466			opts->num_mnt_opts++;
 467		tmp >>= 1;
 468	}
 469	/* Check if the Label support flag is set */
 470	if (sbsec->flags & SE_SBLABELSUPP)
 471		opts->num_mnt_opts++;
 472
 473	opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 474	if (!opts->mnt_opts) {
 475		rc = -ENOMEM;
 476		goto out_free;
 477	}
 478
 479	opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 480	if (!opts->mnt_opts_flags) {
 481		rc = -ENOMEM;
 482		goto out_free;
 483	}
 484
 485	i = 0;
 486	if (sbsec->flags & FSCONTEXT_MNT) {
 487		rc = security_sid_to_context(sbsec->sid, &context, &len);
 488		if (rc)
 489			goto out_free;
 490		opts->mnt_opts[i] = context;
 491		opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 492	}
 493	if (sbsec->flags & CONTEXT_MNT) {
 494		rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 495		if (rc)
 496			goto out_free;
 497		opts->mnt_opts[i] = context;
 498		opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 499	}
 500	if (sbsec->flags & DEFCONTEXT_MNT) {
 501		rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 502		if (rc)
 503			goto out_free;
 504		opts->mnt_opts[i] = context;
 505		opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 506	}
 507	if (sbsec->flags & ROOTCONTEXT_MNT) {
 508		struct inode *root = sbsec->sb->s_root->d_inode;
 509		struct inode_security_struct *isec = root->i_security;
 510
 511		rc = security_sid_to_context(isec->sid, &context, &len);
 512		if (rc)
 513			goto out_free;
 514		opts->mnt_opts[i] = context;
 515		opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 516	}
 517	if (sbsec->flags & SE_SBLABELSUPP) {
 518		opts->mnt_opts[i] = NULL;
 519		opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 520	}
 521
 522	BUG_ON(i != opts->num_mnt_opts);
 523
 524	return 0;
 525
 526out_free:
 527	security_free_mnt_opts(opts);
 528	return rc;
 529}
 530
 531static int bad_option(struct superblock_security_struct *sbsec, char flag,
 532		      u32 old_sid, u32 new_sid)
 533{
 534	char mnt_flags = sbsec->flags & SE_MNTMASK;
 535
 536	/* check if the old mount command had the same options */
 537	if (sbsec->flags & SE_SBINITIALIZED)
 538		if (!(sbsec->flags & flag) ||
 539		    (old_sid != new_sid))
 540			return 1;
 541
 542	/* check if we were passed the same options twice,
 543	 * aka someone passed context=a,context=b
 544	 */
 545	if (!(sbsec->flags & SE_SBINITIALIZED))
 546		if (mnt_flags & flag)
 547			return 1;
 548	return 0;
 549}
 550
 
 
 
 
 
 
 
 
 
 
 
 551/*
 552 * Allow filesystems with binary mount data to explicitly set mount point
 553 * labeling information.
 554 */
 555static int selinux_set_mnt_opts(struct super_block *sb,
 556				struct security_mnt_opts *opts)
 
 
 557{
 558	const struct cred *cred = current_cred();
 559	int rc = 0, i;
 560	struct superblock_security_struct *sbsec = sb->s_security;
 561	const char *name = sb->s_type->name;
 562	struct inode *inode = sbsec->sb->s_root->d_inode;
 563	struct inode_security_struct *root_isec = inode->i_security;
 564	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 565	u32 defcontext_sid = 0;
 566	char **mount_options = opts->mnt_opts;
 567	int *flags = opts->mnt_opts_flags;
 568	int num_opts = opts->num_mnt_opts;
 569
 570	mutex_lock(&sbsec->lock);
 571
 572	if (!ss_initialized) {
 573		if (!num_opts) {
 574			/* Defer initialization until selinux_complete_init,
 575			   after the initial policy is loaded and the security
 576			   server is ready to handle calls. */
 577			goto out;
 578		}
 579		rc = -EINVAL;
 580		printk(KERN_WARNING "SELinux: Unable to set superblock options "
 581			"before the security server is initialized\n");
 582		goto out;
 583	}
 
 
 
 
 
 
 584
 585	/*
 586	 * Binary mount data FS will come through this function twice.  Once
 587	 * from an explicit call and once from the generic calls from the vfs.
 588	 * Since the generic VFS calls will not contain any security mount data
 589	 * we need to skip the double mount verification.
 590	 *
 591	 * This does open a hole in which we will not notice if the first
 592	 * mount using this sb set explict options and a second mount using
 593	 * this sb does not set any security options.  (The first options
 594	 * will be used for both mounts)
 595	 */
 596	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 597	    && (num_opts == 0))
 598		goto out;
 599
 
 
 600	/*
 601	 * parse the mount options, check if they are valid sids.
 602	 * also check if someone is trying to mount the same sb more
 603	 * than once with different security options.
 604	 */
 605	for (i = 0; i < num_opts; i++) {
 606		u32 sid;
 607
 608		if (flags[i] == SE_SBLABELSUPP)
 609			continue;
 610		rc = security_context_to_sid(mount_options[i],
 611					     strlen(mount_options[i]), &sid);
 612		if (rc) {
 613			printk(KERN_WARNING "SELinux: security_context_to_sid"
 614			       "(%s) failed for (dev %s, type %s) errno=%d\n",
 615			       mount_options[i], sb->s_id, name, rc);
 616			goto out;
 617		}
 618		switch (flags[i]) {
 619		case FSCONTEXT_MNT:
 620			fscontext_sid = sid;
 621
 622			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 623					fscontext_sid))
 624				goto out_double_mount;
 625
 626			sbsec->flags |= FSCONTEXT_MNT;
 627			break;
 628		case CONTEXT_MNT:
 629			context_sid = sid;
 630
 
 631			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 632					context_sid))
 633				goto out_double_mount;
 634
 635			sbsec->flags |= CONTEXT_MNT;
 636			break;
 637		case ROOTCONTEXT_MNT:
 638			rootcontext_sid = sid;
 639
 
 640			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 641					rootcontext_sid))
 642				goto out_double_mount;
 643
 644			sbsec->flags |= ROOTCONTEXT_MNT;
 645
 646			break;
 647		case DEFCONTEXT_MNT:
 648			defcontext_sid = sid;
 649
 650			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 651					defcontext_sid))
 652				goto out_double_mount;
 653
 654			sbsec->flags |= DEFCONTEXT_MNT;
 655
 656			break;
 657		default:
 658			rc = -EINVAL;
 659			goto out;
 660		}
 661	}
 662
 663	if (sbsec->flags & SE_SBINITIALIZED) {
 664		/* previously mounted with options, but not on this attempt? */
 665		if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 666			goto out_double_mount;
 667		rc = 0;
 668		goto out;
 669	}
 670
 671	if (strcmp(sb->s_type->name, "proc") == 0)
 672		sbsec->flags |= SE_SBPROC;
 673
 674	/* Determine the labeling behavior to use for this filesystem type. */
 675	rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 676	if (rc) {
 677		printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 678		       __func__, sb->s_type->name, rc);
 679		goto out;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 680	}
 681
 682	/* sets the context of the superblock for the fs being mounted. */
 683	if (fscontext_sid) {
 684		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 685		if (rc)
 686			goto out;
 687
 688		sbsec->sid = fscontext_sid;
 689	}
 690
 691	/*
 692	 * Switch to using mount point labeling behavior.
 693	 * sets the label used on all file below the mountpoint, and will set
 694	 * the superblock context if not already set.
 695	 */
 
 
 
 
 
 696	if (context_sid) {
 697		if (!fscontext_sid) {
 698			rc = may_context_mount_sb_relabel(context_sid, sbsec,
 699							  cred);
 700			if (rc)
 701				goto out;
 702			sbsec->sid = context_sid;
 703		} else {
 704			rc = may_context_mount_inode_relabel(context_sid, sbsec,
 705							     cred);
 706			if (rc)
 707				goto out;
 708		}
 709		if (!rootcontext_sid)
 710			rootcontext_sid = context_sid;
 711
 712		sbsec->mntpoint_sid = context_sid;
 713		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 714	}
 715
 716	if (rootcontext_sid) {
 717		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 718						     cred);
 719		if (rc)
 720			goto out;
 721
 722		root_isec->sid = rootcontext_sid;
 723		root_isec->initialized = 1;
 724	}
 725
 726	if (defcontext_sid) {
 727		if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 
 728			rc = -EINVAL;
 729			printk(KERN_WARNING "SELinux: defcontext option is "
 730			       "invalid for this filesystem type\n");
 731			goto out;
 732		}
 733
 734		if (defcontext_sid != sbsec->def_sid) {
 735			rc = may_context_mount_inode_relabel(defcontext_sid,
 736							     sbsec, cred);
 737			if (rc)
 738				goto out;
 739		}
 740
 741		sbsec->def_sid = defcontext_sid;
 742	}
 743
 
 744	rc = sb_finish_set_opts(sb);
 745out:
 746	mutex_unlock(&sbsec->lock);
 747	return rc;
 748out_double_mount:
 749	rc = -EINVAL;
 750	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 751	       "security settings for (dev %s, type %s)\n", sb->s_id, name);
 
 752	goto out;
 753}
 754
 755static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 756					struct super_block *newsb)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 757{
 758	const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 759	struct superblock_security_struct *newsbsec = newsb->s_security;
 
 
 760
 761	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
 762	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
 763	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
 764
 765	/*
 766	 * if the parent was able to be mounted it clearly had no special lsm
 767	 * mount options.  thus we can safely deal with this superblock later
 768	 */
 769	if (!ss_initialized)
 770		return;
 
 
 
 
 
 
 
 771
 772	/* how can we clone if the old one wasn't set up?? */
 773	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 774
 775	/* if fs is reusing a sb, just let its options stand... */
 776	if (newsbsec->flags & SE_SBINITIALIZED)
 777		return;
 
 
 
 778
 779	mutex_lock(&newsbsec->lock);
 780
 781	newsbsec->flags = oldsbsec->flags;
 782
 783	newsbsec->sid = oldsbsec->sid;
 784	newsbsec->def_sid = oldsbsec->def_sid;
 785	newsbsec->behavior = oldsbsec->behavior;
 786
 
 
 
 
 
 
 
 
 
 
 
 
 787	if (set_context) {
 788		u32 sid = oldsbsec->mntpoint_sid;
 789
 790		if (!set_fscontext)
 791			newsbsec->sid = sid;
 792		if (!set_rootcontext) {
 793			struct inode *newinode = newsb->s_root->d_inode;
 794			struct inode_security_struct *newisec = newinode->i_security;
 795			newisec->sid = sid;
 796		}
 797		newsbsec->mntpoint_sid = sid;
 798	}
 799	if (set_rootcontext) {
 800		const struct inode *oldinode = oldsb->s_root->d_inode;
 801		const struct inode_security_struct *oldisec = oldinode->i_security;
 802		struct inode *newinode = newsb->s_root->d_inode;
 803		struct inode_security_struct *newisec = newinode->i_security;
 804
 805		newisec->sid = oldisec->sid;
 806	}
 807
 808	sb_finish_set_opts(newsb);
 
 809	mutex_unlock(&newsbsec->lock);
 
 810}
 811
 812static int selinux_parse_opts_str(char *options,
 813				  struct security_mnt_opts *opts)
 814{
 815	char *p;
 816	char *context = NULL, *defcontext = NULL;
 817	char *fscontext = NULL, *rootcontext = NULL;
 818	int rc, num_mnt_opts = 0;
 819
 820	opts->num_mnt_opts = 0;
 821
 822	/* Standard string-based options. */
 823	while ((p = strsep(&options, "|")) != NULL) {
 824		int token;
 825		substring_t args[MAX_OPT_ARGS];
 826
 827		if (!*p)
 828			continue;
 829
 830		token = match_token(p, tokens, args);
 831
 832		switch (token) {
 833		case Opt_context:
 834			if (context || defcontext) {
 835				rc = -EINVAL;
 836				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 837				goto out_err;
 838			}
 839			context = match_strdup(&args[0]);
 840			if (!context) {
 841				rc = -ENOMEM;
 842				goto out_err;
 843			}
 844			break;
 845
 846		case Opt_fscontext:
 847			if (fscontext) {
 848				rc = -EINVAL;
 849				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 850				goto out_err;
 851			}
 852			fscontext = match_strdup(&args[0]);
 853			if (!fscontext) {
 854				rc = -ENOMEM;
 855				goto out_err;
 856			}
 857			break;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 858
 859		case Opt_rootcontext:
 860			if (rootcontext) {
 861				rc = -EINVAL;
 862				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 863				goto out_err;
 864			}
 865			rootcontext = match_strdup(&args[0]);
 866			if (!rootcontext) {
 867				rc = -ENOMEM;
 868				goto out_err;
 869			}
 870			break;
 871
 872		case Opt_defcontext:
 873			if (context || defcontext) {
 874				rc = -EINVAL;
 875				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 876				goto out_err;
 877			}
 878			defcontext = match_strdup(&args[0]);
 879			if (!defcontext) {
 880				rc = -ENOMEM;
 881				goto out_err;
 882			}
 883			break;
 884		case Opt_labelsupport:
 885			break;
 886		default:
 887			rc = -EINVAL;
 888			printk(KERN_WARNING "SELinux:  unknown mount option\n");
 889			goto out_err;
 890
 891		}
 892	}
 893
 894	rc = -ENOMEM;
 895	opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 896	if (!opts->mnt_opts)
 897		goto out_err;
 898
 899	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 900	if (!opts->mnt_opts_flags) {
 901		kfree(opts->mnt_opts);
 902		goto out_err;
 903	}
 904
 905	if (fscontext) {
 906		opts->mnt_opts[num_mnt_opts] = fscontext;
 907		opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 908	}
 909	if (context) {
 910		opts->mnt_opts[num_mnt_opts] = context;
 911		opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 912	}
 913	if (rootcontext) {
 914		opts->mnt_opts[num_mnt_opts] = rootcontext;
 915		opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 916	}
 917	if (defcontext) {
 918		opts->mnt_opts[num_mnt_opts] = defcontext;
 919		opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 
 920	}
 921
 922	opts->num_mnt_opts = num_mnt_opts;
 923	return 0;
 924
 925out_err:
 926	kfree(context);
 927	kfree(defcontext);
 928	kfree(fscontext);
 929	kfree(rootcontext);
 930	return rc;
 931}
 932/*
 933 * string mount options parsing and call set the sbsec
 934 */
 935static int superblock_doinit(struct super_block *sb, void *data)
 936{
 937	int rc = 0;
 938	char *options = data;
 939	struct security_mnt_opts opts;
 940
 941	security_init_mnt_opts(&opts);
 942
 943	if (!data)
 944		goto out;
 945
 946	BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 947
 948	rc = selinux_parse_opts_str(options, &opts);
 949	if (rc)
 950		goto out_err;
 951
 952out:
 953	rc = selinux_set_mnt_opts(sb, &opts);
 954
 955out_err:
 956	security_free_mnt_opts(&opts);
 957	return rc;
 958}
 959
 960static void selinux_write_opts(struct seq_file *m,
 961			       struct security_mnt_opts *opts)
 962{
 963	int i;
 964	char *prefix;
 
 965
 966	for (i = 0; i < opts->num_mnt_opts; i++) {
 967		char *has_comma;
 
 
 968
 969		if (opts->mnt_opts[i])
 970			has_comma = strchr(opts->mnt_opts[i], ',');
 971		else
 972			has_comma = NULL;
 973
 974		switch (opts->mnt_opts_flags[i]) {
 975		case CONTEXT_MNT:
 976			prefix = CONTEXT_STR;
 977			break;
 978		case FSCONTEXT_MNT:
 979			prefix = FSCONTEXT_STR;
 980			break;
 981		case ROOTCONTEXT_MNT:
 982			prefix = ROOTCONTEXT_STR;
 983			break;
 984		case DEFCONTEXT_MNT:
 985			prefix = DEFCONTEXT_STR;
 986			break;
 987		case SE_SBLABELSUPP:
 988			seq_putc(m, ',');
 989			seq_puts(m, LABELSUPP_STR);
 990			continue;
 991		default:
 992			BUG();
 993			return;
 994		};
 995		/* we need a comma before each option */
 996		seq_putc(m, ',');
 997		seq_puts(m, prefix);
 998		if (has_comma)
 999			seq_putc(m, '\"');
1000		seq_puts(m, opts->mnt_opts[i]);
1001		if (has_comma)
1002			seq_putc(m, '\"');
1003	}
 
 
1004}
1005
1006static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1007{
1008	struct security_mnt_opts opts;
1009	int rc;
1010
1011	rc = selinux_get_mnt_opts(sb, &opts);
1012	if (rc) {
1013		/* before policy load we may get EINVAL, don't show anything */
1014		if (rc == -EINVAL)
1015			rc = 0;
1016		return rc;
1017	}
1018
1019	selinux_write_opts(m, &opts);
1020
1021	security_free_mnt_opts(&opts);
 
1022
1023	return rc;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1024}
1025
1026static inline u16 inode_mode_to_security_class(umode_t mode)
1027{
1028	switch (mode & S_IFMT) {
1029	case S_IFSOCK:
1030		return SECCLASS_SOCK_FILE;
1031	case S_IFLNK:
1032		return SECCLASS_LNK_FILE;
1033	case S_IFREG:
1034		return SECCLASS_FILE;
1035	case S_IFBLK:
1036		return SECCLASS_BLK_FILE;
1037	case S_IFDIR:
1038		return SECCLASS_DIR;
1039	case S_IFCHR:
1040		return SECCLASS_CHR_FILE;
1041	case S_IFIFO:
1042		return SECCLASS_FIFO_FILE;
1043
1044	}
1045
1046	return SECCLASS_FILE;
1047}
1048
1049static inline int default_protocol_stream(int protocol)
1050{
1051	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 
1052}
1053
1054static inline int default_protocol_dgram(int protocol)
1055{
1056	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1057}
1058
1059static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1060{
 
 
1061	switch (family) {
1062	case PF_UNIX:
1063		switch (type) {
1064		case SOCK_STREAM:
1065		case SOCK_SEQPACKET:
1066			return SECCLASS_UNIX_STREAM_SOCKET;
1067		case SOCK_DGRAM:
 
1068			return SECCLASS_UNIX_DGRAM_SOCKET;
1069		}
1070		break;
1071	case PF_INET:
1072	case PF_INET6:
1073		switch (type) {
1074		case SOCK_STREAM:
 
1075			if (default_protocol_stream(protocol))
1076				return SECCLASS_TCP_SOCKET;
 
 
1077			else
1078				return SECCLASS_RAWIP_SOCKET;
1079		case SOCK_DGRAM:
1080			if (default_protocol_dgram(protocol))
1081				return SECCLASS_UDP_SOCKET;
 
 
 
1082			else
1083				return SECCLASS_RAWIP_SOCKET;
1084		case SOCK_DCCP:
1085			return SECCLASS_DCCP_SOCKET;
1086		default:
1087			return SECCLASS_RAWIP_SOCKET;
1088		}
1089		break;
1090	case PF_NETLINK:
1091		switch (protocol) {
1092		case NETLINK_ROUTE:
1093			return SECCLASS_NETLINK_ROUTE_SOCKET;
1094		case NETLINK_FIREWALL:
1095			return SECCLASS_NETLINK_FIREWALL_SOCKET;
1096		case NETLINK_INET_DIAG:
1097			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1098		case NETLINK_NFLOG:
1099			return SECCLASS_NETLINK_NFLOG_SOCKET;
1100		case NETLINK_XFRM:
1101			return SECCLASS_NETLINK_XFRM_SOCKET;
1102		case NETLINK_SELINUX:
1103			return SECCLASS_NETLINK_SELINUX_SOCKET;
 
 
1104		case NETLINK_AUDIT:
1105			return SECCLASS_NETLINK_AUDIT_SOCKET;
1106		case NETLINK_IP6_FW:
1107			return SECCLASS_NETLINK_IP6FW_SOCKET;
 
 
 
 
1108		case NETLINK_DNRTMSG:
1109			return SECCLASS_NETLINK_DNRT_SOCKET;
1110		case NETLINK_KOBJECT_UEVENT:
1111			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 
 
 
 
 
 
 
 
1112		default:
1113			return SECCLASS_NETLINK_SOCKET;
1114		}
1115	case PF_PACKET:
1116		return SECCLASS_PACKET_SOCKET;
1117	case PF_KEY:
1118		return SECCLASS_KEY_SOCKET;
1119	case PF_APPLETALK:
1120		return SECCLASS_APPLETALK_SOCKET;
1121	}
1122
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1123	return SECCLASS_SOCKET;
1124}
1125
1126#ifdef CONFIG_PROC_FS
1127static int selinux_proc_get_sid(struct dentry *dentry,
1128				u16 tclass,
1129				u32 *sid)
1130{
1131	int rc;
 
1132	char *buffer, *path;
1133
1134	buffer = (char *)__get_free_page(GFP_KERNEL);
1135	if (!buffer)
1136		return -ENOMEM;
1137
1138	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1139	if (IS_ERR(path))
1140		rc = PTR_ERR(path);
1141	else {
1142		/* each process gets a /proc/PID/ entry. Strip off the
1143		 * PID part to get a valid selinux labeling.
1144		 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1145		while (path[1] >= '0' && path[1] <= '9') {
1146			path[1] = '/';
1147			path++;
 
 
 
 
 
 
 
 
 
1148		}
1149		rc = security_genfs_sid("proc", path, tclass, sid);
1150	}
1151	free_page((unsigned long)buffer);
1152	return rc;
1153}
1154#else
1155static int selinux_proc_get_sid(struct dentry *dentry,
1156				u16 tclass,
1157				u32 *sid)
1158{
1159	return -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1160}
1161#endif
1162
1163/* The inode's security attributes must be initialized before first use. */
1164static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1165{
1166	struct superblock_security_struct *sbsec = NULL;
1167	struct inode_security_struct *isec = inode->i_security;
1168	u32 sid;
 
1169	struct dentry *dentry;
1170#define INITCONTEXTLEN 255
1171	char *context = NULL;
1172	unsigned len = 0;
1173	int rc = 0;
1174
1175	if (isec->initialized)
1176		goto out;
1177
1178	mutex_lock(&isec->lock);
1179	if (isec->initialized)
1180		goto out_unlock;
1181
1182	sbsec = inode->i_sb->s_security;
 
 
 
1183	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1184		/* Defer initialization until selinux_complete_init,
1185		   after the initial policy is loaded and the security
1186		   server is ready to handle calls. */
1187		spin_lock(&sbsec->isec_lock);
1188		if (list_empty(&isec->list))
1189			list_add(&isec->list, &sbsec->isec_head);
1190		spin_unlock(&sbsec->isec_lock);
1191		goto out_unlock;
1192	}
1193
 
 
 
 
 
 
1194	switch (sbsec->behavior) {
 
 
1195	case SECURITY_FS_USE_XATTR:
1196		if (!inode->i_op->getxattr) {
1197			isec->sid = sbsec->def_sid;
1198			break;
1199		}
1200
1201		/* Need a dentry, since the xattr API requires one.
1202		   Life would be simpler if we could just pass the inode. */
1203		if (opt_dentry) {
1204			/* Called from d_instantiate or d_splice_alias. */
1205			dentry = dget(opt_dentry);
1206		} else {
1207			/* Called from selinux_complete_init, try to find a dentry. */
 
 
 
 
 
1208			dentry = d_find_alias(inode);
 
 
1209		}
1210		if (!dentry) {
1211			/*
1212			 * this is can be hit on boot when a file is accessed
1213			 * before the policy is loaded.  When we load policy we
1214			 * may find inodes that have no dentry on the
1215			 * sbsec->isec_head list.  No reason to complain as these
1216			 * will get fixed up the next time we go through
1217			 * inode_doinit with a dentry, before these inodes could
1218			 * be used again by userspace.
1219			 */
1220			goto out_unlock;
1221		}
1222
1223		len = INITCONTEXTLEN;
1224		context = kmalloc(len+1, GFP_NOFS);
1225		if (!context) {
1226			rc = -ENOMEM;
1227			dput(dentry);
1228			goto out_unlock;
1229		}
1230		context[len] = '\0';
1231		rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1232					   context, len);
1233		if (rc == -ERANGE) {
1234			kfree(context);
1235
1236			/* Need a larger buffer.  Query for the right size. */
1237			rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1238						   NULL, 0);
1239			if (rc < 0) {
1240				dput(dentry);
1241				goto out_unlock;
1242			}
1243			len = rc;
1244			context = kmalloc(len+1, GFP_NOFS);
1245			if (!context) {
1246				rc = -ENOMEM;
1247				dput(dentry);
1248				goto out_unlock;
1249			}
1250			context[len] = '\0';
1251			rc = inode->i_op->getxattr(dentry,
1252						   XATTR_NAME_SELINUX,
1253						   context, len);
1254		}
1255		dput(dentry);
1256		if (rc < 0) {
1257			if (rc != -ENODATA) {
1258				printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1259				       "%d for dev=%s ino=%ld\n", __func__,
1260				       -rc, inode->i_sb->s_id, inode->i_ino);
1261				kfree(context);
1262				goto out_unlock;
1263			}
1264			/* Map ENODATA to the default file SID */
1265			sid = sbsec->def_sid;
1266			rc = 0;
1267		} else {
1268			rc = security_context_to_sid_default(context, rc, &sid,
1269							     sbsec->def_sid,
1270							     GFP_NOFS);
1271			if (rc) {
1272				char *dev = inode->i_sb->s_id;
1273				unsigned long ino = inode->i_ino;
1274
1275				if (rc == -EINVAL) {
1276					if (printk_ratelimit())
1277						printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1278							"context=%s.  This indicates you may need to relabel the inode or the "
1279							"filesystem in question.\n", ino, dev, context);
1280				} else {
1281					printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1282					       "returned %d for dev=%s ino=%ld\n",
1283					       __func__, context, -rc, dev, ino);
1284				}
1285				kfree(context);
1286				/* Leave with the unlabeled SID */
1287				rc = 0;
1288				break;
1289			}
1290		}
1291		kfree(context);
1292		isec->sid = sid;
1293		break;
1294	case SECURITY_FS_USE_TASK:
1295		isec->sid = isec->task_sid;
1296		break;
1297	case SECURITY_FS_USE_TRANS:
1298		/* Default to the fs SID. */
1299		isec->sid = sbsec->sid;
1300
1301		/* Try to obtain a transition SID. */
1302		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1303		rc = security_transition_sid(isec->task_sid, sbsec->sid,
1304					     isec->sclass, NULL, &sid);
1305		if (rc)
1306			goto out_unlock;
1307		isec->sid = sid;
1308		break;
1309	case SECURITY_FS_USE_MNTPOINT:
1310		isec->sid = sbsec->mntpoint_sid;
1311		break;
1312	default:
1313		/* Default to the fs superblock SID. */
1314		isec->sid = sbsec->sid;
1315
1316		if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
 
 
 
 
1317			if (opt_dentry) {
1318				isec->sclass = inode_mode_to_security_class(inode->i_mode);
1319				rc = selinux_proc_get_sid(opt_dentry,
1320							  isec->sclass,
1321							  &sid);
1322				if (rc)
1323					goto out_unlock;
1324				isec->sid = sid;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1325			}
 
1326		}
1327		break;
1328	}
1329
1330	isec->initialized = 1;
 
 
 
 
 
 
 
 
 
1331
1332out_unlock:
1333	mutex_unlock(&isec->lock);
1334out:
1335	if (isec->sclass == SECCLASS_FILE)
1336		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1337	return rc;
 
 
 
 
 
 
 
 
 
1338}
1339
1340/* Convert a Linux signal to an access vector. */
1341static inline u32 signal_to_av(int sig)
1342{
1343	u32 perm = 0;
1344
1345	switch (sig) {
1346	case SIGCHLD:
1347		/* Commonly granted from child to parent. */
1348		perm = PROCESS__SIGCHLD;
1349		break;
1350	case SIGKILL:
1351		/* Cannot be caught or ignored */
1352		perm = PROCESS__SIGKILL;
1353		break;
1354	case SIGSTOP:
1355		/* Cannot be caught or ignored */
1356		perm = PROCESS__SIGSTOP;
1357		break;
1358	default:
1359		/* All other signals. */
1360		perm = PROCESS__SIGNAL;
1361		break;
1362	}
1363
1364	return perm;
1365}
1366
1367/*
1368 * Check permission between a pair of credentials
1369 * fork check, ptrace check, etc.
1370 */
1371static int cred_has_perm(const struct cred *actor,
1372			 const struct cred *target,
1373			 u32 perms)
1374{
1375	u32 asid = cred_sid(actor), tsid = cred_sid(target);
1376
1377	return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1378}
1379
1380/*
1381 * Check permission between a pair of tasks, e.g. signal checks,
1382 * fork check, ptrace check, etc.
1383 * tsk1 is the actor and tsk2 is the target
1384 * - this uses the default subjective creds of tsk1
1385 */
1386static int task_has_perm(const struct task_struct *tsk1,
1387			 const struct task_struct *tsk2,
1388			 u32 perms)
1389{
1390	const struct task_security_struct *__tsec1, *__tsec2;
1391	u32 sid1, sid2;
1392
1393	rcu_read_lock();
1394	__tsec1 = __task_cred(tsk1)->security;	sid1 = __tsec1->sid;
1395	__tsec2 = __task_cred(tsk2)->security;	sid2 = __tsec2->sid;
1396	rcu_read_unlock();
1397	return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1398}
1399
1400/*
1401 * Check permission between current and another task, e.g. signal checks,
1402 * fork check, ptrace check, etc.
1403 * current is the actor and tsk2 is the target
1404 * - this uses current's subjective creds
1405 */
1406static int current_has_perm(const struct task_struct *tsk,
1407			    u32 perms)
1408{
1409	u32 sid, tsid;
1410
1411	sid = current_sid();
1412	tsid = task_sid(tsk);
1413	return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1414}
1415
1416#if CAP_LAST_CAP > 63
1417#error Fix SELinux to handle capabilities > 63.
1418#endif
1419
1420/* Check whether a task is allowed to use a capability. */
1421static int task_has_capability(struct task_struct *tsk,
1422			       const struct cred *cred,
1423			       int cap, int audit)
1424{
1425	struct common_audit_data ad;
1426	struct av_decision avd;
1427	u16 sclass;
1428	u32 sid = cred_sid(cred);
1429	u32 av = CAP_TO_MASK(cap);
1430	int rc;
1431
1432	COMMON_AUDIT_DATA_INIT(&ad, CAP);
1433	ad.tsk = tsk;
1434	ad.u.cap = cap;
1435
1436	switch (CAP_TO_INDEX(cap)) {
1437	case 0:
1438		sclass = SECCLASS_CAPABILITY;
1439		break;
1440	case 1:
1441		sclass = SECCLASS_CAPABILITY2;
1442		break;
1443	default:
1444		printk(KERN_ERR
1445		       "SELinux:  out of range capability %d\n", cap);
1446		BUG();
1447		return -EINVAL;
1448	}
1449
1450	rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1451	if (audit == SECURITY_CAP_AUDIT) {
1452		int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
 
 
1453		if (rc2)
1454			return rc2;
1455	}
1456	return rc;
1457}
1458
1459/* Check whether a task is allowed to use a system operation. */
1460static int task_has_system(struct task_struct *tsk,
1461			   u32 perms)
1462{
1463	u32 sid = task_sid(tsk);
1464
1465	return avc_has_perm(sid, SECINITSID_KERNEL,
1466			    SECCLASS_SYSTEM, perms, NULL);
1467}
1468
1469/* Check whether a task has a particular permission to an inode.
1470   The 'adp' parameter is optional and allows other audit
1471   data to be passed (e.g. the dentry). */
1472static int inode_has_perm(const struct cred *cred,
1473			  struct inode *inode,
1474			  u32 perms,
1475			  struct common_audit_data *adp,
1476			  unsigned flags)
1477{
1478	struct inode_security_struct *isec;
1479	u32 sid;
1480
1481	validate_creds(cred);
1482
1483	if (unlikely(IS_PRIVATE(inode)))
1484		return 0;
1485
1486	sid = cred_sid(cred);
1487	isec = inode->i_security;
1488
1489	return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1490}
1491
1492static int inode_has_perm_noadp(const struct cred *cred,
1493				struct inode *inode,
1494				u32 perms,
1495				unsigned flags)
1496{
1497	struct common_audit_data ad;
1498
1499	COMMON_AUDIT_DATA_INIT(&ad, INODE);
1500	ad.u.inode = inode;
1501	return inode_has_perm(cred, inode, perms, &ad, flags);
1502}
1503
1504/* Same as inode_has_perm, but pass explicit audit data containing
1505   the dentry to help the auditing code to more easily generate the
1506   pathname if needed. */
1507static inline int dentry_has_perm(const struct cred *cred,
1508				  struct dentry *dentry,
1509				  u32 av)
1510{
1511	struct inode *inode = dentry->d_inode;
1512	struct common_audit_data ad;
1513
1514	COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1515	ad.u.dentry = dentry;
1516	return inode_has_perm(cred, inode, av, &ad, 0);
 
1517}
1518
1519/* Same as inode_has_perm, but pass explicit audit data containing
1520   the path to help the auditing code to more easily generate the
1521   pathname if needed. */
1522static inline int path_has_perm(const struct cred *cred,
1523				struct path *path,
1524				u32 av)
1525{
1526	struct inode *inode = path->dentry->d_inode;
1527	struct common_audit_data ad;
1528
1529	COMMON_AUDIT_DATA_INIT(&ad, PATH);
1530	ad.u.path = *path;
1531	return inode_has_perm(cred, inode, av, &ad, 0);
 
 
 
 
 
 
 
 
 
 
 
 
 
1532}
1533
 
 
 
 
1534/* Check whether a task can use an open file descriptor to
1535   access an inode in a given way.  Check access to the
1536   descriptor itself, and then use dentry_has_perm to
1537   check a particular permission to the file.
1538   Access to the descriptor is implicitly granted if it
1539   has the same SID as the process.  If av is zero, then
1540   access to the file is not checked, e.g. for cases
1541   where only the descriptor is affected like seek. */
1542static int file_has_perm(const struct cred *cred,
1543			 struct file *file,
1544			 u32 av)
1545{
1546	struct file_security_struct *fsec = file->f_security;
1547	struct inode *inode = file->f_path.dentry->d_inode;
1548	struct common_audit_data ad;
1549	u32 sid = cred_sid(cred);
1550	int rc;
1551
1552	COMMON_AUDIT_DATA_INIT(&ad, PATH);
1553	ad.u.path = file->f_path;
1554
1555	if (sid != fsec->sid) {
1556		rc = avc_has_perm(sid, fsec->sid,
 
1557				  SECCLASS_FD,
1558				  FD__USE,
1559				  &ad);
1560		if (rc)
1561			goto out;
1562	}
1563
 
 
 
 
 
 
1564	/* av is zero if only checking access to the descriptor. */
1565	rc = 0;
1566	if (av)
1567		rc = inode_has_perm(cred, inode, av, &ad, 0);
1568
1569out:
1570	return rc;
1571}
1572
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1573/* Check whether a task can create a file. */
1574static int may_create(struct inode *dir,
1575		      struct dentry *dentry,
1576		      u16 tclass)
1577{
1578	const struct task_security_struct *tsec = current_security();
1579	struct inode_security_struct *dsec;
1580	struct superblock_security_struct *sbsec;
1581	u32 sid, newsid;
1582	struct common_audit_data ad;
1583	int rc;
1584
1585	dsec = dir->i_security;
1586	sbsec = dir->i_sb->s_security;
1587
1588	sid = tsec->sid;
1589	newsid = tsec->create_sid;
1590
1591	COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1592	ad.u.dentry = dentry;
1593
1594	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
 
1595			  DIR__ADD_NAME | DIR__SEARCH,
1596			  &ad);
1597	if (rc)
1598		return rc;
1599
1600	if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1601		rc = security_transition_sid(sid, dsec->sid, tclass,
1602					     &dentry->d_name, &newsid);
1603		if (rc)
1604			return rc;
1605	}
1606
1607	rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
 
1608	if (rc)
1609		return rc;
1610
1611	return avc_has_perm(newsid, sbsec->sid,
 
1612			    SECCLASS_FILESYSTEM,
1613			    FILESYSTEM__ASSOCIATE, &ad);
1614}
1615
1616/* Check whether a task can create a key. */
1617static int may_create_key(u32 ksid,
1618			  struct task_struct *ctx)
1619{
1620	u32 sid = task_sid(ctx);
1621
1622	return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1623}
1624
1625#define MAY_LINK	0
1626#define MAY_UNLINK	1
1627#define MAY_RMDIR	2
1628
1629/* Check whether a task can link, unlink, or rmdir a file/directory. */
1630static int may_link(struct inode *dir,
1631		    struct dentry *dentry,
1632		    int kind)
1633
1634{
1635	struct inode_security_struct *dsec, *isec;
1636	struct common_audit_data ad;
1637	u32 sid = current_sid();
1638	u32 av;
1639	int rc;
1640
1641	dsec = dir->i_security;
1642	isec = dentry->d_inode->i_security;
1643
1644	COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1645	ad.u.dentry = dentry;
1646
1647	av = DIR__SEARCH;
1648	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1649	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
 
1650	if (rc)
1651		return rc;
1652
1653	switch (kind) {
1654	case MAY_LINK:
1655		av = FILE__LINK;
1656		break;
1657	case MAY_UNLINK:
1658		av = FILE__UNLINK;
1659		break;
1660	case MAY_RMDIR:
1661		av = DIR__RMDIR;
1662		break;
1663	default:
1664		printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1665			__func__, kind);
1666		return 0;
1667	}
1668
1669	rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
 
1670	return rc;
1671}
1672
1673static inline int may_rename(struct inode *old_dir,
1674			     struct dentry *old_dentry,
1675			     struct inode *new_dir,
1676			     struct dentry *new_dentry)
1677{
1678	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1679	struct common_audit_data ad;
1680	u32 sid = current_sid();
1681	u32 av;
1682	int old_is_dir, new_is_dir;
1683	int rc;
1684
1685	old_dsec = old_dir->i_security;
1686	old_isec = old_dentry->d_inode->i_security;
1687	old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1688	new_dsec = new_dir->i_security;
1689
1690	COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1691
1692	ad.u.dentry = old_dentry;
1693	rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
 
1694			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1695	if (rc)
1696		return rc;
1697	rc = avc_has_perm(sid, old_isec->sid,
 
1698			  old_isec->sclass, FILE__RENAME, &ad);
1699	if (rc)
1700		return rc;
1701	if (old_is_dir && new_dir != old_dir) {
1702		rc = avc_has_perm(sid, old_isec->sid,
 
1703				  old_isec->sclass, DIR__REPARENT, &ad);
1704		if (rc)
1705			return rc;
1706	}
1707
1708	ad.u.dentry = new_dentry;
1709	av = DIR__ADD_NAME | DIR__SEARCH;
1710	if (new_dentry->d_inode)
1711		av |= DIR__REMOVE_NAME;
1712	rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
 
1713	if (rc)
1714		return rc;
1715	if (new_dentry->d_inode) {
1716		new_isec = new_dentry->d_inode->i_security;
1717		new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1718		rc = avc_has_perm(sid, new_isec->sid,
 
1719				  new_isec->sclass,
1720				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1721		if (rc)
1722			return rc;
1723	}
1724
1725	return 0;
1726}
1727
1728/* Check whether a task can perform a filesystem operation. */
1729static int superblock_has_perm(const struct cred *cred,
1730			       struct super_block *sb,
1731			       u32 perms,
1732			       struct common_audit_data *ad)
1733{
1734	struct superblock_security_struct *sbsec;
1735	u32 sid = cred_sid(cred);
1736
1737	sbsec = sb->s_security;
1738	return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
 
1739}
1740
1741/* Convert a Linux mode and permission mask to an access vector. */
1742static inline u32 file_mask_to_av(int mode, int mask)
1743{
1744	u32 av = 0;
1745
1746	if ((mode & S_IFMT) != S_IFDIR) {
1747		if (mask & MAY_EXEC)
1748			av |= FILE__EXECUTE;
1749		if (mask & MAY_READ)
1750			av |= FILE__READ;
1751
1752		if (mask & MAY_APPEND)
1753			av |= FILE__APPEND;
1754		else if (mask & MAY_WRITE)
1755			av |= FILE__WRITE;
1756
1757	} else {
1758		if (mask & MAY_EXEC)
1759			av |= DIR__SEARCH;
1760		if (mask & MAY_WRITE)
1761			av |= DIR__WRITE;
1762		if (mask & MAY_READ)
1763			av |= DIR__READ;
1764	}
1765
1766	return av;
1767}
1768
1769/* Convert a Linux file to an access vector. */
1770static inline u32 file_to_av(struct file *file)
1771{
1772	u32 av = 0;
1773
1774	if (file->f_mode & FMODE_READ)
1775		av |= FILE__READ;
1776	if (file->f_mode & FMODE_WRITE) {
1777		if (file->f_flags & O_APPEND)
1778			av |= FILE__APPEND;
1779		else
1780			av |= FILE__WRITE;
1781	}
1782	if (!av) {
1783		/*
1784		 * Special file opened with flags 3 for ioctl-only use.
1785		 */
1786		av = FILE__IOCTL;
1787	}
1788
1789	return av;
1790}
1791
1792/*
1793 * Convert a file to an access vector and include the correct open
1794 * open permission.
1795 */
1796static inline u32 open_file_to_av(struct file *file)
1797{
1798	u32 av = file_to_av(file);
 
1799
1800	if (selinux_policycap_openperm)
 
1801		av |= FILE__OPEN;
1802
1803	return av;
1804}
1805
1806/* Hook functions begin here. */
1807
1808static int selinux_ptrace_access_check(struct task_struct *child,
1809				     unsigned int mode)
1810{
1811	int rc;
 
 
 
1812
1813	rc = cap_ptrace_access_check(child, mode);
1814	if (rc)
1815		return rc;
 
 
 
1816
1817	if (mode == PTRACE_MODE_READ) {
1818		u32 sid = current_sid();
1819		u32 csid = task_sid(child);
1820		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
 
 
1821	}
1822
1823	return current_has_perm(child, PROCESS__PTRACE);
 
1824}
1825
1826static int selinux_ptrace_traceme(struct task_struct *parent)
 
1827{
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1828	int rc;
1829
1830	rc = cap_ptrace_traceme(parent);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1831	if (rc)
1832		return rc;
 
 
 
 
1833
1834	return task_has_perm(parent, current, PROCESS__PTRACE);
 
 
 
1835}
1836
1837static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1838			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
1839{
1840	int error;
 
1841
1842	error = current_has_perm(target, PROCESS__GETCAP);
1843	if (error)
1844		return error;
 
 
 
 
 
 
 
 
 
 
 
1845
1846	return cap_capget(target, effective, inheritable, permitted);
 
 
 
 
 
1847}
1848
1849static int selinux_capset(struct cred *new, const struct cred *old,
1850			  const kernel_cap_t *effective,
1851			  const kernel_cap_t *inheritable,
1852			  const kernel_cap_t *permitted)
1853{
1854	int error;
1855
1856	error = cap_capset(new, old,
1857				      effective, inheritable, permitted);
1858	if (error)
1859		return error;
1860
1861	return cred_has_perm(old, new, PROCESS__SETCAP);
1862}
1863
1864/*
1865 * (This comment used to live with the selinux_task_setuid hook,
1866 * which was removed).
1867 *
1868 * Since setuid only affects the current process, and since the SELinux
1869 * controls are not based on the Linux identity attributes, SELinux does not
1870 * need to control this operation.  However, SELinux does control the use of
1871 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1872 */
1873
1874static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1875			   struct user_namespace *ns, int cap, int audit)
1876{
1877	int rc;
1878
1879	rc = cap_capable(tsk, cred, ns, cap, audit);
1880	if (rc)
1881		return rc;
1882
1883	return task_has_capability(tsk, cred, cap, audit);
1884}
1885
1886static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1887{
1888	const struct cred *cred = current_cred();
1889	int rc = 0;
1890
1891	if (!sb)
1892		return 0;
1893
1894	switch (cmds) {
1895	case Q_SYNC:
1896	case Q_QUOTAON:
1897	case Q_QUOTAOFF:
1898	case Q_SETINFO:
1899	case Q_SETQUOTA:
 
 
 
1900		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1901		break;
1902	case Q_GETFMT:
1903	case Q_GETINFO:
1904	case Q_GETQUOTA:
 
 
 
 
1905		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1906		break;
1907	default:
1908		rc = 0;  /* let the kernel handle invalid cmds */
1909		break;
1910	}
1911	return rc;
1912}
1913
1914static int selinux_quota_on(struct dentry *dentry)
1915{
1916	const struct cred *cred = current_cred();
1917
1918	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1919}
1920
1921static int selinux_syslog(int type)
1922{
1923	int rc;
1924
1925	switch (type) {
1926	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
1927	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
1928		rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1929		break;
 
1930	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
1931	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
1932	/* Set level of messages printed to console */
1933	case SYSLOG_ACTION_CONSOLE_LEVEL:
1934		rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1935		break;
1936	case SYSLOG_ACTION_CLOSE:	/* Close log */
1937	case SYSLOG_ACTION_OPEN:	/* Open log */
1938	case SYSLOG_ACTION_READ:	/* Read from log */
1939	case SYSLOG_ACTION_READ_CLEAR:	/* Read/clear last kernel messages */
1940	case SYSLOG_ACTION_CLEAR:	/* Clear ring buffer */
1941	default:
1942		rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1943		break;
1944	}
1945	return rc;
1946}
1947
1948/*
1949 * Check that a process has enough memory to allocate a new virtual
1950 * mapping. 0 means there is enough memory for the allocation to
1951 * succeed and -ENOMEM implies there is not.
1952 *
1953 * Do not audit the selinux permission check, as this is applied to all
1954 * processes that allocate mappings.
1955 */
1956static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1957{
1958	int rc, cap_sys_admin = 0;
1959
1960	rc = selinux_capable(current, current_cred(),
1961			     &init_user_ns, CAP_SYS_ADMIN,
1962			     SECURITY_CAP_NOAUDIT);
1963	if (rc == 0)
1964		cap_sys_admin = 1;
1965
1966	return __vm_enough_memory(mm, pages, cap_sys_admin);
1967}
1968
1969/* binprm security operations */
1970
1971static int selinux_bprm_set_creds(struct linux_binprm *bprm)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1972{
1973	const struct task_security_struct *old_tsec;
1974	struct task_security_struct *new_tsec;
1975	struct inode_security_struct *isec;
1976	struct common_audit_data ad;
1977	struct inode *inode = bprm->file->f_path.dentry->d_inode;
1978	int rc;
1979
1980	rc = cap_bprm_set_creds(bprm);
1981	if (rc)
1982		return rc;
1983
1984	/* SELinux context only depends on initial program or script and not
1985	 * the script interpreter */
1986	if (bprm->cred_prepared)
1987		return 0;
1988
1989	old_tsec = current_security();
1990	new_tsec = bprm->cred->security;
1991	isec = inode->i_security;
1992
1993	/* Default to the current task SID. */
1994	new_tsec->sid = old_tsec->sid;
1995	new_tsec->osid = old_tsec->sid;
1996
1997	/* Reset fs, key, and sock SIDs on execve. */
1998	new_tsec->create_sid = 0;
1999	new_tsec->keycreate_sid = 0;
2000	new_tsec->sockcreate_sid = 0;
2001
2002	if (old_tsec->exec_sid) {
2003		new_tsec->sid = old_tsec->exec_sid;
2004		/* Reset exec SID on execve. */
2005		new_tsec->exec_sid = 0;
 
 
 
 
 
2006	} else {
2007		/* Check for a default transition on this program. */
2008		rc = security_transition_sid(old_tsec->sid, isec->sid,
2009					     SECCLASS_PROCESS, NULL,
2010					     &new_tsec->sid);
2011		if (rc)
2012			return rc;
2013	}
2014
2015	COMMON_AUDIT_DATA_INIT(&ad, PATH);
2016	ad.u.path = bprm->file->f_path;
 
 
 
 
 
 
2017
2018	if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2019		new_tsec->sid = old_tsec->sid;
2020
2021	if (new_tsec->sid == old_tsec->sid) {
2022		rc = avc_has_perm(old_tsec->sid, isec->sid,
 
2023				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2024		if (rc)
2025			return rc;
2026	} else {
2027		/* Check permissions for the transition. */
2028		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
 
2029				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2030		if (rc)
2031			return rc;
2032
2033		rc = avc_has_perm(new_tsec->sid, isec->sid,
 
2034				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2035		if (rc)
2036			return rc;
2037
2038		/* Check for shared state */
2039		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2040			rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
 
2041					  SECCLASS_PROCESS, PROCESS__SHARE,
2042					  NULL);
2043			if (rc)
2044				return -EPERM;
2045		}
2046
2047		/* Make sure that anyone attempting to ptrace over a task that
2048		 * changes its SID has the appropriate permit */
2049		if (bprm->unsafe &
2050		    (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2051			struct task_struct *tracer;
2052			struct task_security_struct *sec;
2053			u32 ptsid = 0;
2054
2055			rcu_read_lock();
2056			tracer = ptrace_parent(current);
2057			if (likely(tracer != NULL)) {
2058				sec = __task_cred(tracer)->security;
2059				ptsid = sec->sid;
2060			}
2061			rcu_read_unlock();
2062
2063			if (ptsid != 0) {
2064				rc = avc_has_perm(ptsid, new_tsec->sid,
 
2065						  SECCLASS_PROCESS,
2066						  PROCESS__PTRACE, NULL);
2067				if (rc)
2068					return -EPERM;
2069			}
2070		}
2071
2072		/* Clear any possibly unsafe personality bits on exec: */
2073		bprm->per_clear |= PER_CLEAR_ON_SETID;
2074	}
2075
2076	return 0;
2077}
2078
2079static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2080{
2081	const struct task_security_struct *tsec = current_security();
2082	u32 sid, osid;
2083	int atsecure = 0;
2084
2085	sid = tsec->sid;
2086	osid = tsec->osid;
2087
2088	if (osid != sid) {
2089		/* Enable secure mode for SIDs transitions unless
2090		   the noatsecure permission is granted between
2091		   the two SIDs, i.e. ahp returns 0. */
2092		atsecure = avc_has_perm(osid, sid,
2093					SECCLASS_PROCESS,
2094					PROCESS__NOATSECURE, NULL);
 
 
2095	}
2096
2097	return (atsecure || cap_bprm_secureexec(bprm));
2098}
2099
2100extern struct vfsmount *selinuxfs_mount;
2101extern struct dentry *selinux_null;
 
 
2102
2103/* Derived from fs/exec.c:flush_old_files. */
2104static inline void flush_unauthorized_files(const struct cred *cred,
2105					    struct files_struct *files)
2106{
2107	struct common_audit_data ad;
2108	struct file *file, *devnull = NULL;
2109	struct tty_struct *tty;
2110	struct fdtable *fdt;
2111	long j = -1;
2112	int drop_tty = 0;
 
2113
2114	tty = get_current_tty();
2115	if (tty) {
2116		spin_lock(&tty_files_lock);
2117		if (!list_empty(&tty->tty_files)) {
2118			struct tty_file_private *file_priv;
2119			struct inode *inode;
2120
2121			/* Revalidate access to controlling tty.
2122			   Use inode_has_perm on the tty inode directly rather
2123			   than using file_has_perm, as this particular open
2124			   file may belong to another process and we are only
2125			   interested in the inode-based check here. */
2126			file_priv = list_first_entry(&tty->tty_files,
2127						struct tty_file_private, list);
2128			file = file_priv->file;
2129			inode = file->f_path.dentry->d_inode;
2130			if (inode_has_perm_noadp(cred, inode,
2131					   FILE__READ | FILE__WRITE, 0)) {
2132				drop_tty = 1;
2133			}
2134		}
2135		spin_unlock(&tty_files_lock);
2136		tty_kref_put(tty);
2137	}
2138	/* Reset controlling tty. */
2139	if (drop_tty)
2140		no_tty();
2141
2142	/* Revalidate access to inherited open files. */
 
 
 
2143
2144	COMMON_AUDIT_DATA_INIT(&ad, INODE);
2145
2146	spin_lock(&files->file_lock);
2147	for (;;) {
2148		unsigned long set, i;
2149		int fd;
2150
2151		j++;
2152		i = j * __NFDBITS;
2153		fdt = files_fdtable(files);
2154		if (i >= fdt->max_fds)
2155			break;
2156		set = fdt->open_fds->fds_bits[j];
2157		if (!set)
2158			continue;
2159		spin_unlock(&files->file_lock);
2160		for ( ; set ; i++, set >>= 1) {
2161			if (set & 1) {
2162				file = fget(i);
2163				if (!file)
2164					continue;
2165				if (file_has_perm(cred,
2166						  file,
2167						  file_to_av(file))) {
2168					sys_close(i);
2169					fd = get_unused_fd();
2170					if (fd != i) {
2171						if (fd >= 0)
2172							put_unused_fd(fd);
2173						fput(file);
2174						continue;
2175					}
2176					if (devnull) {
2177						get_file(devnull);
2178					} else {
2179						devnull = dentry_open(
2180							dget(selinux_null),
2181							mntget(selinuxfs_mount),
2182							O_RDWR, cred);
2183						if (IS_ERR(devnull)) {
2184							devnull = NULL;
2185							put_unused_fd(fd);
2186							fput(file);
2187							continue;
2188						}
2189					}
2190					fd_install(fd, devnull);
2191				}
2192				fput(file);
2193			}
2194		}
2195		spin_lock(&files->file_lock);
2196
2197	}
2198	spin_unlock(&files->file_lock);
2199}
2200
2201/*
2202 * Prepare a process for imminent new credential changes due to exec
2203 */
2204static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2205{
2206	struct task_security_struct *new_tsec;
2207	struct rlimit *rlim, *initrlim;
2208	int rc, i;
2209
2210	new_tsec = bprm->cred->security;
2211	if (new_tsec->sid == new_tsec->osid)
2212		return;
2213
2214	/* Close files for which the new task SID is not authorized. */
2215	flush_unauthorized_files(bprm->cred, current->files);
2216
2217	/* Always clear parent death signal on SID transitions. */
2218	current->pdeath_signal = 0;
2219
2220	/* Check whether the new SID can inherit resource limits from the old
2221	 * SID.  If not, reset all soft limits to the lower of the current
2222	 * task's hard limit and the init task's soft limit.
2223	 *
2224	 * Note that the setting of hard limits (even to lower them) can be
2225	 * controlled by the setrlimit check.  The inclusion of the init task's
2226	 * soft limit into the computation is to avoid resetting soft limits
2227	 * higher than the default soft limit for cases where the default is
2228	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2229	 */
2230	rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
 
2231			  PROCESS__RLIMITINH, NULL);
2232	if (rc) {
2233		/* protect against do_prlimit() */
2234		task_lock(current);
2235		for (i = 0; i < RLIM_NLIMITS; i++) {
2236			rlim = current->signal->rlim + i;
2237			initrlim = init_task.signal->rlim + i;
2238			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2239		}
2240		task_unlock(current);
2241		update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
 
2242	}
2243}
2244
2245/*
2246 * Clean up the process immediately after the installation of new credentials
2247 * due to exec
2248 */
2249static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2250{
2251	const struct task_security_struct *tsec = current_security();
2252	struct itimerval itimer;
2253	u32 osid, sid;
2254	int rc, i;
2255
2256	osid = tsec->osid;
2257	sid = tsec->sid;
2258
2259	if (sid == osid)
2260		return;
2261
2262	/* Check whether the new SID can inherit signal state from the old SID.
2263	 * If not, clear itimers to avoid subsequent signal generation and
2264	 * flush and unblock signals.
2265	 *
2266	 * This must occur _after_ the task SID has been updated so that any
2267	 * kill done after the flush will be checked against the new SID.
2268	 */
2269	rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
 
2270	if (rc) {
2271		memset(&itimer, 0, sizeof itimer);
2272		for (i = 0; i < 3; i++)
2273			do_setitimer(i, &itimer, NULL);
2274		spin_lock_irq(&current->sighand->siglock);
2275		if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2276			__flush_signals(current);
 
2277			flush_signal_handlers(current, 1);
2278			sigemptyset(&current->blocked);
 
2279		}
2280		spin_unlock_irq(&current->sighand->siglock);
2281	}
2282
2283	/* Wake up the parent if it is waiting so that it can recheck
2284	 * wait permission to the new task SID. */
2285	read_lock(&tasklist_lock);
2286	__wake_up_parent(current, current->real_parent);
2287	read_unlock(&tasklist_lock);
2288}
2289
2290/* superblock security operations */
2291
2292static int selinux_sb_alloc_security(struct super_block *sb)
2293{
2294	return superblock_alloc_security(sb);
2295}
2296
2297static void selinux_sb_free_security(struct super_block *sb)
2298{
2299	superblock_free_security(sb);
2300}
2301
2302static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2303{
2304	if (plen > olen)
2305		return 0;
2306
2307	return !memcmp(prefix, option, plen);
2308}
2309
2310static inline int selinux_option(char *option, int len)
2311{
2312	return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2313		match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2314		match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2315		match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2316		match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2317}
2318
2319static inline void take_option(char **to, char *from, int *first, int len)
2320{
2321	if (!*first) {
2322		**to = ',';
2323		*to += 1;
2324	} else
2325		*first = 0;
2326	memcpy(*to, from, len);
2327	*to += len;
2328}
2329
2330static inline void take_selinux_option(char **to, char *from, int *first,
2331				       int len)
2332{
2333	int current_size = 0;
2334
2335	if (!*first) {
2336		**to = '|';
2337		*to += 1;
2338	} else
2339		*first = 0;
2340
2341	while (current_size < len) {
2342		if (*from != '"') {
2343			**to = *from;
2344			*to += 1;
2345		}
2346		from += 1;
2347		current_size += 1;
2348	}
 
2349}
2350
2351static int selinux_sb_copy_data(char *orig, char *copy)
2352{
2353	int fnosec, fsec, rc = 0;
2354	char *in_save, *in_curr, *in_end;
2355	char *sec_curr, *nosec_save, *nosec;
2356	int open_quote = 0;
2357
2358	in_curr = orig;
2359	sec_curr = copy;
2360
2361	nosec = (char *)get_zeroed_page(GFP_KERNEL);
2362	if (!nosec) {
2363		rc = -ENOMEM;
2364		goto out;
2365	}
2366
2367	nosec_save = nosec;
2368	fnosec = fsec = 1;
2369	in_save = in_end = orig;
 
2370
2371	do {
2372		if (*in_end == '"')
2373			open_quote = !open_quote;
2374		if ((*in_end == ',' && open_quote == 0) ||
2375				*in_end == '\0') {
2376			int len = in_end - in_curr;
2377
2378			if (selinux_option(in_curr, len))
2379				take_selinux_option(&sec_curr, in_curr, &fsec, len);
2380			else
2381				take_option(&nosec, in_curr, &fnosec, len);
2382
2383			in_curr = in_end + 1;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2384		}
2385	} while (*in_end++);
 
 
 
 
 
2386
2387	strcpy(in_save, nosec_save);
2388	free_page((unsigned long)nosec_save);
2389out:
 
 
2390	return rc;
2391}
2392
2393static int selinux_sb_remount(struct super_block *sb, void *data)
2394{
2395	int rc, i, *flags;
2396	struct security_mnt_opts opts;
2397	char *secdata, **mount_options;
2398	struct superblock_security_struct *sbsec = sb->s_security;
 
 
2399
 
 
 
 
2400	if (!(sbsec->flags & SE_SBINITIALIZED))
2401		return 0;
2402
2403	if (!data)
2404		return 0;
2405
2406	if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2407		return 0;
 
2408
2409	security_init_mnt_opts(&opts);
2410	secdata = alloc_secdata();
2411	if (!secdata)
2412		return -ENOMEM;
2413	rc = selinux_sb_copy_data(data, secdata);
2414	if (rc)
2415		goto out_free_secdata;
 
 
 
 
 
 
 
 
 
2416
2417	rc = selinux_parse_opts_str(secdata, &opts);
2418	if (rc)
2419		goto out_free_secdata;
 
 
 
 
 
 
 
 
 
 
 
 
 
2420
2421	mount_options = opts.mnt_opts;
2422	flags = opts.mnt_opts_flags;
 
 
 
 
2423
2424	for (i = 0; i < opts.num_mnt_opts; i++) {
2425		u32 sid;
2426		size_t len;
2427
2428		if (flags[i] == SE_SBLABELSUPP)
2429			continue;
2430		len = strlen(mount_options[i]);
2431		rc = security_context_to_sid(mount_options[i], len, &sid);
2432		if (rc) {
2433			printk(KERN_WARNING "SELinux: security_context_to_sid"
2434			       "(%s) failed for (dev %s, type %s) errno=%d\n",
2435			       mount_options[i], sb->s_id, sb->s_type->name, rc);
2436			goto out_free_opts;
2437		}
2438		rc = -EINVAL;
2439		switch (flags[i]) {
2440		case FSCONTEXT_MNT:
2441			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2442				goto out_bad_option;
2443			break;
2444		case CONTEXT_MNT:
2445			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2446				goto out_bad_option;
2447			break;
2448		case ROOTCONTEXT_MNT: {
2449			struct inode_security_struct *root_isec;
2450			root_isec = sb->s_root->d_inode->i_security;
2451
2452			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2453				goto out_bad_option;
2454			break;
2455		}
2456		case DEFCONTEXT_MNT:
2457			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2458				goto out_bad_option;
2459			break;
2460		default:
2461			goto out_free_opts;
2462		}
2463	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2464
2465	rc = 0;
2466out_free_opts:
2467	security_free_mnt_opts(&opts);
2468out_free_secdata:
2469	free_secdata(secdata);
2470	return rc;
2471out_bad_option:
2472	printk(KERN_WARNING "SELinux: unable to change security options "
2473	       "during remount (dev %s, type=%s)\n", sb->s_id,
2474	       sb->s_type->name);
2475	goto out_free_opts;
2476}
2477
2478static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2479{
2480	const struct cred *cred = current_cred();
2481	struct common_audit_data ad;
2482	int rc;
2483
2484	rc = superblock_doinit(sb, data);
2485	if (rc)
2486		return rc;
2487
2488	/* Allow all mounts performed by the kernel */
2489	if (flags & MS_KERNMOUNT)
2490		return 0;
2491
2492	COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2493	ad.u.dentry = sb->s_root;
2494	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2495}
2496
2497static int selinux_sb_statfs(struct dentry *dentry)
2498{
2499	const struct cred *cred = current_cred();
2500	struct common_audit_data ad;
2501
2502	COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2503	ad.u.dentry = dentry->d_sb->s_root;
2504	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2505}
2506
2507static int selinux_mount(char *dev_name,
2508			 struct path *path,
2509			 char *type,
2510			 unsigned long flags,
2511			 void *data)
2512{
2513	const struct cred *cred = current_cred();
2514
2515	if (flags & MS_REMOUNT)
2516		return superblock_has_perm(cred, path->mnt->mnt_sb,
2517					   FILESYSTEM__REMOUNT, NULL);
2518	else
2519		return path_has_perm(cred, path, FILE__MOUNTON);
2520}
2521
 
 
 
 
 
 
 
 
2522static int selinux_umount(struct vfsmount *mnt, int flags)
2523{
2524	const struct cred *cred = current_cred();
2525
2526	return superblock_has_perm(cred, mnt->mnt_sb,
2527				   FILESYSTEM__UNMOUNT, NULL);
2528}
2529
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2530/* inode security operations */
2531
2532static int selinux_inode_alloc_security(struct inode *inode)
2533{
2534	return inode_alloc_security(inode);
 
 
 
 
 
 
 
 
 
 
 
2535}
2536
2537static void selinux_inode_free_security(struct inode *inode)
2538{
2539	inode_free_security(inode);
2540}
2541
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2542static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2543				       const struct qstr *qstr, char **name,
 
2544				       void **value, size_t *len)
2545{
2546	const struct task_security_struct *tsec = current_security();
2547	struct inode_security_struct *dsec;
2548	struct superblock_security_struct *sbsec;
2549	u32 sid, newsid, clen;
2550	int rc;
2551	char *namep = NULL, *context;
2552
2553	dsec = dir->i_security;
2554	sbsec = dir->i_sb->s_security;
2555
2556	sid = tsec->sid;
2557	newsid = tsec->create_sid;
2558
2559	if ((sbsec->flags & SE_SBINITIALIZED) &&
2560	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2561		newsid = sbsec->mntpoint_sid;
2562	else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2563		rc = security_transition_sid(sid, dsec->sid,
2564					     inode_mode_to_security_class(inode->i_mode),
2565					     qstr, &newsid);
2566		if (rc) {
2567			printk(KERN_WARNING "%s:  "
2568			       "security_transition_sid failed, rc=%d (dev=%s "
2569			       "ino=%ld)\n",
2570			       __func__,
2571			       -rc, inode->i_sb->s_id, inode->i_ino);
2572			return rc;
2573		}
2574	}
2575
2576	/* Possibly defer initialization to selinux_complete_init. */
2577	if (sbsec->flags & SE_SBINITIALIZED) {
2578		struct inode_security_struct *isec = inode->i_security;
2579		isec->sclass = inode_mode_to_security_class(inode->i_mode);
2580		isec->sid = newsid;
2581		isec->initialized = 1;
2582	}
2583
2584	if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
 
2585		return -EOPNOTSUPP;
2586
2587	if (name) {
2588		namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2589		if (!namep)
2590			return -ENOMEM;
2591		*name = namep;
2592	}
2593
2594	if (value && len) {
2595		rc = security_sid_to_context_force(newsid, &context, &clen);
2596		if (rc) {
2597			kfree(namep);
2598			return rc;
2599		}
2600		*value = context;
2601		*len = clen;
2602	}
2603
2604	return 0;
2605}
2606
2607static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2608{
2609	return may_create(dir, dentry, SECCLASS_FILE);
2610}
2611
2612static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2613{
2614	return may_link(dir, old_dentry, MAY_LINK);
2615}
2616
2617static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2618{
2619	return may_link(dir, dentry, MAY_UNLINK);
2620}
2621
2622static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2623{
2624	return may_create(dir, dentry, SECCLASS_LNK_FILE);
2625}
2626
2627static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2628{
2629	return may_create(dir, dentry, SECCLASS_DIR);
2630}
2631
2632static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2633{
2634	return may_link(dir, dentry, MAY_RMDIR);
2635}
2636
2637static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2638{
2639	return may_create(dir, dentry, inode_mode_to_security_class(mode));
2640}
2641
2642static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2643				struct inode *new_inode, struct dentry *new_dentry)
2644{
2645	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2646}
2647
2648static int selinux_inode_readlink(struct dentry *dentry)
2649{
2650	const struct cred *cred = current_cred();
2651
2652	return dentry_has_perm(cred, dentry, FILE__READ);
2653}
2654
2655static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
 
2656{
2657	const struct cred *cred = current_cred();
 
 
 
2658
2659	return dentry_has_perm(cred, dentry, FILE__READ);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2660}
2661
2662static int selinux_inode_permission(struct inode *inode, int mask)
2663{
2664	const struct cred *cred = current_cred();
2665	struct common_audit_data ad;
2666	u32 perms;
2667	bool from_access;
2668	unsigned flags = mask & MAY_NOT_BLOCK;
 
 
 
 
 
2669
2670	from_access = mask & MAY_ACCESS;
2671	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2672
2673	/* No permission to check.  Existence test. */
2674	if (!mask)
2675		return 0;
2676
2677	COMMON_AUDIT_DATA_INIT(&ad, INODE);
2678	ad.u.inode = inode;
2679
2680	if (from_access)
2681		ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
2682
2683	perms = file_mask_to_av(inode->i_mode, mask);
2684
2685	return inode_has_perm(cred, inode, perms, &ad, flags);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2686}
2687
2688static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2689{
2690	const struct cred *cred = current_cred();
 
2691	unsigned int ia_valid = iattr->ia_valid;
 
2692
2693	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2694	if (ia_valid & ATTR_FORCE) {
2695		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2696			      ATTR_FORCE);
2697		if (!ia_valid)
2698			return 0;
2699	}
2700
2701	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2702			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2703		return dentry_has_perm(cred, dentry, FILE__SETATTR);
2704
2705	return dentry_has_perm(cred, dentry, FILE__WRITE);
 
 
 
 
 
 
2706}
2707
2708static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2709{
2710	const struct cred *cred = current_cred();
2711	struct path path;
2712
2713	path.dentry = dentry;
2714	path.mnt = mnt;
2715
2716	return path_has_perm(cred, &path, FILE__GETATTR);
2717}
2718
2719static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2720{
2721	const struct cred *cred = current_cred();
 
2722
2723	if (!strncmp(name, XATTR_SECURITY_PREFIX,
2724		     sizeof XATTR_SECURITY_PREFIX - 1)) {
2725		if (!strcmp(name, XATTR_NAME_CAPS)) {
2726			if (!capable(CAP_SETFCAP))
2727				return -EPERM;
2728		} else if (!capable(CAP_SYS_ADMIN)) {
2729			/* A different attribute in the security namespace.
2730			   Restrict to administrator. */
2731			return -EPERM;
2732		}
2733	}
2734
2735	/* Not an attribute we recognize, so just check the
2736	   ordinary setattr permission. */
2737	return dentry_has_perm(cred, dentry, FILE__SETATTR);
2738}
2739
2740static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
 
2741				  const void *value, size_t size, int flags)
2742{
2743	struct inode *inode = dentry->d_inode;
2744	struct inode_security_struct *isec = inode->i_security;
2745	struct superblock_security_struct *sbsec;
2746	struct common_audit_data ad;
2747	u32 newsid, sid = current_sid();
2748	int rc = 0;
2749
2750	if (strcmp(name, XATTR_NAME_SELINUX))
2751		return selinux_inode_setotherxattr(dentry, name);
 
 
 
 
 
 
 
 
 
 
2752
2753	sbsec = inode->i_sb->s_security;
2754	if (!(sbsec->flags & SE_SBLABELSUPP))
2755		return -EOPNOTSUPP;
2756
2757	if (!inode_owner_or_capable(inode))
2758		return -EPERM;
2759
2760	COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2761	ad.u.dentry = dentry;
2762
2763	rc = avc_has_perm(sid, isec->sid, isec->sclass,
 
 
2764			  FILE__RELABELFROM, &ad);
2765	if (rc)
2766		return rc;
2767
2768	rc = security_context_to_sid(value, size, &newsid);
 
2769	if (rc == -EINVAL) {
2770		if (!capable(CAP_MAC_ADMIN))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2771			return rc;
2772		rc = security_context_to_sid_force(value, size, &newsid);
 
 
2773	}
2774	if (rc)
2775		return rc;
2776
2777	rc = avc_has_perm(sid, newsid, isec->sclass,
 
2778			  FILE__RELABELTO, &ad);
2779	if (rc)
2780		return rc;
2781
2782	rc = security_validate_transition(isec->sid, newsid, sid,
2783					  isec->sclass);
2784	if (rc)
2785		return rc;
2786
2787	return avc_has_perm(newsid,
 
2788			    sbsec->sid,
2789			    SECCLASS_FILESYSTEM,
2790			    FILESYSTEM__ASSOCIATE,
2791			    &ad);
2792}
2793
2794static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2795					const void *value, size_t size,
2796					int flags)
2797{
2798	struct inode *inode = dentry->d_inode;
2799	struct inode_security_struct *isec = inode->i_security;
2800	u32 newsid;
2801	int rc;
2802
2803	if (strcmp(name, XATTR_NAME_SELINUX)) {
2804		/* Not an attribute we recognize, so nothing to do. */
2805		return;
2806	}
2807
2808	rc = security_context_to_sid_force(value, size, &newsid);
 
 
 
 
 
 
 
 
 
 
2809	if (rc) {
2810		printk(KERN_ERR "SELinux:  unable to map context to SID"
2811		       "for (%s, %lu), rc=%d\n",
2812		       inode->i_sb->s_id, inode->i_ino, -rc);
2813		return;
2814	}
2815
 
 
 
2816	isec->sid = newsid;
 
 
 
2817	return;
2818}
2819
2820static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2821{
2822	const struct cred *cred = current_cred();
2823
2824	return dentry_has_perm(cred, dentry, FILE__GETATTR);
2825}
2826
2827static int selinux_inode_listxattr(struct dentry *dentry)
2828{
2829	const struct cred *cred = current_cred();
2830
2831	return dentry_has_perm(cred, dentry, FILE__GETATTR);
2832}
2833
2834static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
 
2835{
2836	if (strcmp(name, XATTR_NAME_SELINUX))
2837		return selinux_inode_setotherxattr(dentry, name);
 
 
 
 
 
 
 
 
 
 
2838
2839	/* No one is allowed to remove a SELinux security label.
2840	   You can change the label, but all data must be labeled. */
2841	return -EACCES;
2842}
2843
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2844/*
2845 * Copy the inode security context value to the user.
2846 *
2847 * Permission check is handled by selinux_inode_getxattr hook.
2848 */
2849static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
 
 
2850{
2851	u32 size;
2852	int error;
2853	char *context = NULL;
2854	struct inode_security_struct *isec = inode->i_security;
2855
2856	if (strcmp(name, XATTR_SELINUX_SUFFIX))
 
 
 
 
 
2857		return -EOPNOTSUPP;
2858
2859	/*
2860	 * If the caller has CAP_MAC_ADMIN, then get the raw context
2861	 * value even if it is not defined by current policy; otherwise,
2862	 * use the in-core value under current policy.
2863	 * Use the non-auditing forms of the permission checks since
2864	 * getxattr may be called by unprivileged processes commonly
2865	 * and lack of permission just means that we fall back to the
2866	 * in-core context value, not a denial.
2867	 */
2868	error = selinux_capable(current, current_cred(),
2869				&init_user_ns, CAP_MAC_ADMIN,
2870				SECURITY_CAP_NOAUDIT);
2871	if (!error)
2872		error = security_sid_to_context_force(isec->sid, &context,
2873						      &size);
2874	else
2875		error = security_sid_to_context(isec->sid, &context, &size);
 
2876	if (error)
2877		return error;
2878	error = size;
2879	if (alloc) {
2880		*buffer = context;
2881		goto out_nofree;
2882	}
2883	kfree(context);
2884out_nofree:
2885	return error;
2886}
2887
2888static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2889				     const void *value, size_t size, int flags)
2890{
2891	struct inode_security_struct *isec = inode->i_security;
 
2892	u32 newsid;
2893	int rc;
2894
2895	if (strcmp(name, XATTR_SELINUX_SUFFIX))
2896		return -EOPNOTSUPP;
2897
 
 
 
 
2898	if (!value || !size)
2899		return -EACCES;
2900
2901	rc = security_context_to_sid((void *)value, size, &newsid);
 
2902	if (rc)
2903		return rc;
2904
 
 
2905	isec->sid = newsid;
2906	isec->initialized = 1;
 
2907	return 0;
2908}
2909
2910static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2911{
2912	const int len = sizeof(XATTR_NAME_SELINUX);
 
 
 
 
2913	if (buffer && len <= buffer_size)
2914		memcpy(buffer, XATTR_NAME_SELINUX, len);
2915	return len;
2916}
2917
2918static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2919{
2920	struct inode_security_struct *isec = inode->i_security;
2921	*secid = isec->sid;
2922}
2923
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2924/* file security operations */
2925
2926static int selinux_revalidate_file_permission(struct file *file, int mask)
2927{
2928	const struct cred *cred = current_cred();
2929	struct inode *inode = file->f_path.dentry->d_inode;
2930
2931	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2932	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2933		mask |= MAY_APPEND;
2934
2935	return file_has_perm(cred, file,
2936			     file_mask_to_av(inode->i_mode, mask));
2937}
2938
2939static int selinux_file_permission(struct file *file, int mask)
2940{
2941	struct inode *inode = file->f_path.dentry->d_inode;
2942	struct file_security_struct *fsec = file->f_security;
2943	struct inode_security_struct *isec = inode->i_security;
2944	u32 sid = current_sid();
2945
2946	if (!mask)
2947		/* No permission to check.  Existence test. */
2948		return 0;
2949
 
2950	if (sid == fsec->sid && fsec->isid == isec->sid &&
2951	    fsec->pseqno == avc_policy_seqno())
2952		/* No change since dentry_open check. */
2953		return 0;
2954
2955	return selinux_revalidate_file_permission(file, mask);
2956}
2957
2958static int selinux_file_alloc_security(struct file *file)
2959{
2960	return file_alloc_security(file);
 
 
 
 
 
 
2961}
2962
2963static void selinux_file_free_security(struct file *file)
 
 
 
 
 
2964{
2965	file_free_security(file);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2966}
2967
2968static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2969			      unsigned long arg)
2970{
2971	const struct cred *cred = current_cred();
2972	int error = 0;
2973
2974	switch (cmd) {
2975	case FIONREAD:
2976	/* fall through */
2977	case FIBMAP:
2978	/* fall through */
2979	case FIGETBSZ:
2980	/* fall through */
2981	case EXT2_IOC_GETFLAGS:
2982	/* fall through */
2983	case EXT2_IOC_GETVERSION:
2984		error = file_has_perm(cred, file, FILE__GETATTR);
2985		break;
2986
2987	case EXT2_IOC_SETFLAGS:
2988	/* fall through */
2989	case EXT2_IOC_SETVERSION:
2990		error = file_has_perm(cred, file, FILE__SETATTR);
2991		break;
2992
2993	/* sys_ioctl() checks */
2994	case FIONBIO:
2995	/* fall through */
2996	case FIOASYNC:
2997		error = file_has_perm(cred, file, 0);
2998		break;
2999
3000	case KDSKBENT:
3001	case KDSKBSENT:
3002		error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
3003					SECURITY_CAP_AUDIT);
3004		break;
3005
3006	/* default case assumes that the command will go
3007	 * to the file's ioctl() function.
3008	 */
3009	default:
3010		error = file_has_perm(cred, file, FILE__IOCTL);
3011	}
3012	return error;
3013}
3014
3015static int default_noexec;
3016
3017static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3018{
3019	const struct cred *cred = current_cred();
 
3020	int rc = 0;
3021
3022	if (default_noexec &&
3023	    (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
 
3024		/*
3025		 * We are making executable an anonymous mapping or a
3026		 * private file mapping that will also be writable.
3027		 * This has an additional check.
3028		 */
3029		rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
 
 
3030		if (rc)
3031			goto error;
3032	}
3033
3034	if (file) {
3035		/* read access is always possible with a mapping */
3036		u32 av = FILE__READ;
3037
3038		/* write access only matters if the mapping is shared */
3039		if (shared && (prot & PROT_WRITE))
3040			av |= FILE__WRITE;
3041
3042		if (prot & PROT_EXEC)
3043			av |= FILE__EXECUTE;
3044
3045		return file_has_perm(cred, file, av);
3046	}
3047
3048error:
3049	return rc;
3050}
3051
3052static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3053			     unsigned long prot, unsigned long flags,
3054			     unsigned long addr, unsigned long addr_only)
3055{
3056	int rc = 0;
3057	u32 sid = current_sid();
3058
3059	/*
3060	 * notice that we are intentionally putting the SELinux check before
3061	 * the secondary cap_file_mmap check.  This is such a likely attempt
3062	 * at bad behaviour/exploit that we always want to get the AVC, even
3063	 * if DAC would have also denied the operation.
3064	 */
3065	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3066		rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
 
 
3067				  MEMPROTECT__MMAP_ZERO, NULL);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3068		if (rc)
3069			return rc;
3070	}
3071
3072	/* do DAC check on address space usage */
3073	rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3074	if (rc || addr_only)
3075		return rc;
3076
3077	if (selinux_checkreqprot)
3078		prot = reqprot;
3079
3080	return file_map_prot_check(file, prot,
3081				   (flags & MAP_TYPE) == MAP_SHARED);
3082}
3083
3084static int selinux_file_mprotect(struct vm_area_struct *vma,
3085				 unsigned long reqprot,
3086				 unsigned long prot)
3087{
3088	const struct cred *cred = current_cred();
 
3089
3090	if (selinux_checkreqprot)
3091		prot = reqprot;
3092
3093	if (default_noexec &&
3094	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3095		int rc = 0;
3096		if (vma->vm_start >= vma->vm_mm->start_brk &&
3097		    vma->vm_end <= vma->vm_mm->brk) {
3098			rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
 
 
3099		} else if (!vma->vm_file &&
3100			   vma->vm_start <= vma->vm_mm->start_stack &&
3101			   vma->vm_end >= vma->vm_mm->start_stack) {
3102			rc = current_has_perm(current, PROCESS__EXECSTACK);
 
 
 
3103		} else if (vma->vm_file && vma->anon_vma) {
3104			/*
3105			 * We are making executable a file mapping that has
3106			 * had some COW done. Since pages might have been
3107			 * written, check ability to execute the possibly
3108			 * modified content.  This typically should only
3109			 * occur for text relocations.
3110			 */
3111			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3112		}
3113		if (rc)
3114			return rc;
3115	}
3116
3117	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3118}
3119
3120static int selinux_file_lock(struct file *file, unsigned int cmd)
3121{
3122	const struct cred *cred = current_cred();
3123
3124	return file_has_perm(cred, file, FILE__LOCK);
3125}
3126
3127static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3128			      unsigned long arg)
3129{
3130	const struct cred *cred = current_cred();
3131	int err = 0;
3132
3133	switch (cmd) {
3134	case F_SETFL:
3135		if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3136			err = -EINVAL;
3137			break;
3138		}
3139
3140		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3141			err = file_has_perm(cred, file, FILE__WRITE);
3142			break;
3143		}
3144		/* fall through */
3145	case F_SETOWN:
3146	case F_SETSIG:
3147	case F_GETFL:
3148	case F_GETOWN:
3149	case F_GETSIG:
 
3150		/* Just check FD__USE permission */
3151		err = file_has_perm(cred, file, 0);
3152		break;
3153	case F_GETLK:
3154	case F_SETLK:
3155	case F_SETLKW:
 
 
 
3156#if BITS_PER_LONG == 32
3157	case F_GETLK64:
3158	case F_SETLK64:
3159	case F_SETLKW64:
3160#endif
3161		if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3162			err = -EINVAL;
3163			break;
3164		}
3165		err = file_has_perm(cred, file, FILE__LOCK);
3166		break;
3167	}
3168
3169	return err;
3170}
3171
3172static int selinux_file_set_fowner(struct file *file)
3173{
3174	struct file_security_struct *fsec;
3175
3176	fsec = file->f_security;
3177	fsec->fown_sid = current_sid();
3178
3179	return 0;
3180}
3181
3182static int selinux_file_send_sigiotask(struct task_struct *tsk,
3183				       struct fown_struct *fown, int signum)
3184{
3185	struct file *file;
3186	u32 sid = task_sid(tsk);
3187	u32 perm;
3188	struct file_security_struct *fsec;
3189
3190	/* struct fown_struct is never outside the context of a struct file */
3191	file = container_of(fown, struct file, f_owner);
3192
3193	fsec = file->f_security;
3194
3195	if (!signum)
3196		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3197	else
3198		perm = signal_to_av(signum);
3199
3200	return avc_has_perm(fsec->fown_sid, sid,
 
3201			    SECCLASS_PROCESS, perm, NULL);
3202}
3203
3204static int selinux_file_receive(struct file *file)
3205{
3206	const struct cred *cred = current_cred();
3207
3208	return file_has_perm(cred, file, file_to_av(file));
3209}
3210
3211static int selinux_dentry_open(struct file *file, const struct cred *cred)
3212{
3213	struct file_security_struct *fsec;
3214	struct inode *inode;
3215	struct inode_security_struct *isec;
3216
3217	inode = file->f_path.dentry->d_inode;
3218	fsec = file->f_security;
3219	isec = inode->i_security;
3220	/*
3221	 * Save inode label and policy sequence number
3222	 * at open-time so that selinux_file_permission
3223	 * can determine whether revalidation is necessary.
3224	 * Task label is already saved in the file security
3225	 * struct as its SID.
3226	 */
3227	fsec->isid = isec->sid;
3228	fsec->pseqno = avc_policy_seqno();
3229	/*
3230	 * Since the inode label or policy seqno may have changed
3231	 * between the selinux_inode_permission check and the saving
3232	 * of state above, recheck that access is still permitted.
3233	 * Otherwise, access might never be revalidated against the
3234	 * new inode label or new policy.
3235	 * This check is not redundant - do not remove.
3236	 */
3237	return inode_has_perm_noadp(cred, inode, open_file_to_av(file), 0);
3238}
3239
3240/* task security operations */
3241
3242static int selinux_task_create(unsigned long clone_flags)
3243{
3244	return current_has_perm(current, PROCESS__FORK);
3245}
3246
3247/*
3248 * allocate the SELinux part of blank credentials
3249 */
3250static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3251{
3252	struct task_security_struct *tsec;
3253
3254	tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3255	if (!tsec)
3256		return -ENOMEM;
3257
3258	cred->security = tsec;
3259	return 0;
3260}
3261
3262/*
3263 * detach and free the LSM part of a set of credentials
3264 */
3265static void selinux_cred_free(struct cred *cred)
3266{
3267	struct task_security_struct *tsec = cred->security;
3268
3269	/*
3270	 * cred->security == NULL if security_cred_alloc_blank() or
3271	 * security_prepare_creds() returned an error.
3272	 */
3273	BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3274	cred->security = (void *) 0x7UL;
3275	kfree(tsec);
3276}
3277
3278/*
3279 * prepare a new set of credentials for modification
3280 */
3281static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3282				gfp_t gfp)
3283{
3284	const struct task_security_struct *old_tsec;
3285	struct task_security_struct *tsec;
3286
3287	old_tsec = old->security;
3288
3289	tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3290	if (!tsec)
3291		return -ENOMEM;
3292
3293	new->security = tsec;
3294	return 0;
3295}
3296
3297/*
3298 * transfer the SELinux data to a blank set of creds
3299 */
3300static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3301{
3302	const struct task_security_struct *old_tsec = old->security;
3303	struct task_security_struct *tsec = new->security;
3304
3305	*tsec = *old_tsec;
3306}
3307
 
 
 
 
 
3308/*
3309 * set the security data for a kernel service
3310 * - all the creation contexts are set to unlabelled
3311 */
3312static int selinux_kernel_act_as(struct cred *new, u32 secid)
3313{
3314	struct task_security_struct *tsec = new->security;
3315	u32 sid = current_sid();
3316	int ret;
3317
3318	ret = avc_has_perm(sid, secid,
 
3319			   SECCLASS_KERNEL_SERVICE,
3320			   KERNEL_SERVICE__USE_AS_OVERRIDE,
3321			   NULL);
3322	if (ret == 0) {
3323		tsec->sid = secid;
3324		tsec->create_sid = 0;
3325		tsec->keycreate_sid = 0;
3326		tsec->sockcreate_sid = 0;
3327	}
3328	return ret;
3329}
3330
3331/*
3332 * set the file creation context in a security record to the same as the
3333 * objective context of the specified inode
3334 */
3335static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3336{
3337	struct inode_security_struct *isec = inode->i_security;
3338	struct task_security_struct *tsec = new->security;
3339	u32 sid = current_sid();
3340	int ret;
3341
3342	ret = avc_has_perm(sid, isec->sid,
 
3343			   SECCLASS_KERNEL_SERVICE,
3344			   KERNEL_SERVICE__CREATE_FILES_AS,
3345			   NULL);
3346
3347	if (ret == 0)
3348		tsec->create_sid = isec->sid;
3349	return ret;
3350}
3351
3352static int selinux_kernel_module_request(char *kmod_name)
3353{
3354	u32 sid;
3355	struct common_audit_data ad;
3356
3357	sid = task_sid(current);
3358
3359	COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3360	ad.u.kmod_name = kmod_name;
3361
3362	return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
 
3363			    SYSTEM__MODULE_REQUEST, &ad);
3364}
3365
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3366static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3367{
3368	return current_has_perm(p, PROCESS__SETPGID);
 
 
3369}
3370
3371static int selinux_task_getpgid(struct task_struct *p)
3372{
3373	return current_has_perm(p, PROCESS__GETPGID);
 
 
3374}
3375
3376static int selinux_task_getsid(struct task_struct *p)
3377{
3378	return current_has_perm(p, PROCESS__GETSESSION);
 
 
3379}
3380
3381static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3382{
3383	*secid = task_sid(p);
3384}
3385
3386static int selinux_task_setnice(struct task_struct *p, int nice)
3387{
3388	int rc;
3389
3390	rc = cap_task_setnice(p, nice);
3391	if (rc)
3392		return rc;
3393
3394	return current_has_perm(p, PROCESS__SETSCHED);
 
 
 
 
3395}
3396
3397static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3398{
3399	int rc;
3400
3401	rc = cap_task_setioprio(p, ioprio);
3402	if (rc)
3403		return rc;
3404
3405	return current_has_perm(p, PROCESS__SETSCHED);
3406}
3407
3408static int selinux_task_getioprio(struct task_struct *p)
3409{
3410	return current_has_perm(p, PROCESS__GETSCHED);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3411}
3412
3413static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3414		struct rlimit *new_rlim)
3415{
3416	struct rlimit *old_rlim = p->signal->rlim + resource;
3417
3418	/* Control the ability to change the hard limit (whether
3419	   lowering or raising it), so that the hard limit can
3420	   later be used as a safe reset point for the soft limit
3421	   upon context transitions.  See selinux_bprm_committing_creds. */
3422	if (old_rlim->rlim_max != new_rlim->rlim_max)
3423		return current_has_perm(p, PROCESS__SETRLIMIT);
 
 
3424
3425	return 0;
3426}
3427
3428static int selinux_task_setscheduler(struct task_struct *p)
3429{
3430	int rc;
3431
3432	rc = cap_task_setscheduler(p);
3433	if (rc)
3434		return rc;
3435
3436	return current_has_perm(p, PROCESS__SETSCHED);
3437}
3438
3439static int selinux_task_getscheduler(struct task_struct *p)
3440{
3441	return current_has_perm(p, PROCESS__GETSCHED);
 
 
3442}
3443
3444static int selinux_task_movememory(struct task_struct *p)
3445{
3446	return current_has_perm(p, PROCESS__SETSCHED);
 
 
3447}
3448
3449static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3450				int sig, u32 secid)
3451{
 
3452	u32 perm;
3453	int rc;
3454
3455	if (!sig)
3456		perm = PROCESS__SIGNULL; /* null signal; existence test */
3457	else
3458		perm = signal_to_av(sig);
3459	if (secid)
3460		rc = avc_has_perm(secid, task_sid(p),
3461				  SECCLASS_PROCESS, perm, NULL);
3462	else
3463		rc = current_has_perm(p, perm);
3464	return rc;
3465}
3466
3467static int selinux_task_wait(struct task_struct *p)
3468{
3469	return task_has_perm(p, current, PROCESS__SIGCHLD);
3470}
3471
3472static void selinux_task_to_inode(struct task_struct *p,
3473				  struct inode *inode)
3474{
3475	struct inode_security_struct *isec = inode->i_security;
3476	u32 sid = task_sid(p);
3477
 
 
3478	isec->sid = sid;
3479	isec->initialized = 1;
 
3480}
3481
3482/* Returns error only if unable to parse addresses */
3483static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3484			struct common_audit_data *ad, u8 *proto)
3485{
3486	int offset, ihlen, ret = -EINVAL;
3487	struct iphdr _iph, *ih;
3488
3489	offset = skb_network_offset(skb);
3490	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3491	if (ih == NULL)
3492		goto out;
3493
3494	ihlen = ih->ihl * 4;
3495	if (ihlen < sizeof(_iph))
3496		goto out;
3497
3498	ad->u.net.v4info.saddr = ih->saddr;
3499	ad->u.net.v4info.daddr = ih->daddr;
3500	ret = 0;
3501
3502	if (proto)
3503		*proto = ih->protocol;
3504
3505	switch (ih->protocol) {
3506	case IPPROTO_TCP: {
3507		struct tcphdr _tcph, *th;
3508
3509		if (ntohs(ih->frag_off) & IP_OFFSET)
3510			break;
3511
3512		offset += ihlen;
3513		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3514		if (th == NULL)
3515			break;
3516
3517		ad->u.net.sport = th->source;
3518		ad->u.net.dport = th->dest;
3519		break;
3520	}
3521
3522	case IPPROTO_UDP: {
3523		struct udphdr _udph, *uh;
3524
3525		if (ntohs(ih->frag_off) & IP_OFFSET)
3526			break;
3527
3528		offset += ihlen;
3529		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3530		if (uh == NULL)
3531			break;
3532
3533		ad->u.net.sport = uh->source;
3534		ad->u.net.dport = uh->dest;
3535		break;
3536	}
3537
3538	case IPPROTO_DCCP: {
3539		struct dccp_hdr _dccph, *dh;
3540
3541		if (ntohs(ih->frag_off) & IP_OFFSET)
3542			break;
3543
3544		offset += ihlen;
3545		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3546		if (dh == NULL)
3547			break;
3548
3549		ad->u.net.sport = dh->dccph_sport;
3550		ad->u.net.dport = dh->dccph_dport;
3551		break;
3552	}
3553
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3554	default:
3555		break;
3556	}
3557out:
3558	return ret;
3559}
3560
3561#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3562
3563/* Returns error only if unable to parse addresses */
3564static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3565			struct common_audit_data *ad, u8 *proto)
3566{
3567	u8 nexthdr;
3568	int ret = -EINVAL, offset;
3569	struct ipv6hdr _ipv6h, *ip6;
 
3570
3571	offset = skb_network_offset(skb);
3572	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3573	if (ip6 == NULL)
3574		goto out;
3575
3576	ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3577	ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3578	ret = 0;
3579
3580	nexthdr = ip6->nexthdr;
3581	offset += sizeof(_ipv6h);
3582	offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3583	if (offset < 0)
3584		goto out;
3585
3586	if (proto)
3587		*proto = nexthdr;
3588
3589	switch (nexthdr) {
3590	case IPPROTO_TCP: {
3591		struct tcphdr _tcph, *th;
3592
3593		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3594		if (th == NULL)
3595			break;
3596
3597		ad->u.net.sport = th->source;
3598		ad->u.net.dport = th->dest;
3599		break;
3600	}
3601
3602	case IPPROTO_UDP: {
3603		struct udphdr _udph, *uh;
3604
3605		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3606		if (uh == NULL)
3607			break;
3608
3609		ad->u.net.sport = uh->source;
3610		ad->u.net.dport = uh->dest;
3611		break;
3612	}
3613
3614	case IPPROTO_DCCP: {
3615		struct dccp_hdr _dccph, *dh;
3616
3617		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3618		if (dh == NULL)
3619			break;
3620
3621		ad->u.net.sport = dh->dccph_sport;
3622		ad->u.net.dport = dh->dccph_dport;
3623		break;
3624	}
3625
 
 
 
 
 
 
 
 
 
 
 
 
 
3626	/* includes fragments */
3627	default:
3628		break;
3629	}
3630out:
3631	return ret;
3632}
3633
3634#endif /* IPV6 */
3635
3636static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3637			     char **_addrp, int src, u8 *proto)
3638{
3639	char *addrp;
3640	int ret;
3641
3642	switch (ad->u.net.family) {
3643	case PF_INET:
3644		ret = selinux_parse_skb_ipv4(skb, ad, proto);
3645		if (ret)
3646			goto parse_error;
3647		addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3648				       &ad->u.net.v4info.daddr);
3649		goto okay;
3650
3651#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3652	case PF_INET6:
3653		ret = selinux_parse_skb_ipv6(skb, ad, proto);
3654		if (ret)
3655			goto parse_error;
3656		addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3657				       &ad->u.net.v6info.daddr);
3658		goto okay;
3659#endif	/* IPV6 */
3660	default:
3661		addrp = NULL;
3662		goto okay;
3663	}
3664
3665parse_error:
3666	printk(KERN_WARNING
3667	       "SELinux: failure in selinux_parse_skb(),"
3668	       " unable to parse packet\n");
3669	return ret;
3670
3671okay:
3672	if (_addrp)
3673		*_addrp = addrp;
3674	return 0;
3675}
3676
3677/**
3678 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3679 * @skb: the packet
3680 * @family: protocol family
3681 * @sid: the packet's peer label SID
3682 *
3683 * Description:
3684 * Check the various different forms of network peer labeling and determine
3685 * the peer label/SID for the packet; most of the magic actually occurs in
3686 * the security server function security_net_peersid_cmp().  The function
3687 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3688 * or -EACCES if @sid is invalid due to inconsistencies with the different
3689 * peer labels.
3690 *
3691 */
3692static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3693{
3694	int err;
3695	u32 xfrm_sid;
3696	u32 nlbl_sid;
3697	u32 nlbl_type;
3698
3699	selinux_skb_xfrm_sid(skb, &xfrm_sid);
3700	selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
 
 
 
 
3701
3702	err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
 
3703	if (unlikely(err)) {
3704		printk(KERN_WARNING
3705		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
3706		       " unable to determine packet's peer label\n");
3707		return -EACCES;
3708	}
3709
3710	return 0;
3711}
3712
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3713/* socket security operations */
3714
3715static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3716				 u16 secclass, u32 *socksid)
3717{
3718	if (tsec->sockcreate_sid > SECSID_NULL) {
3719		*socksid = tsec->sockcreate_sid;
3720		return 0;
3721	}
3722
3723	return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3724				       socksid);
3725}
3726
3727static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3728{
3729	struct sk_security_struct *sksec = sk->sk_security;
3730	struct common_audit_data ad;
3731	u32 tsid = task_sid(task);
3732
3733	if (sksec->sid == SECINITSID_KERNEL)
3734		return 0;
3735
3736	COMMON_AUDIT_DATA_INIT(&ad, NET);
3737	ad.u.net.sk = sk;
 
3738
3739	return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
 
 
3740}
3741
3742static int selinux_socket_create(int family, int type,
3743				 int protocol, int kern)
3744{
3745	const struct task_security_struct *tsec = current_security();
3746	u32 newsid;
3747	u16 secclass;
3748	int rc;
3749
3750	if (kern)
3751		return 0;
3752
3753	secclass = socket_type_to_security_class(family, type, protocol);
3754	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3755	if (rc)
3756		return rc;
3757
3758	return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
 
3759}
3760
3761static int selinux_socket_post_create(struct socket *sock, int family,
3762				      int type, int protocol, int kern)
3763{
3764	const struct task_security_struct *tsec = current_security();
3765	struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3766	struct sk_security_struct *sksec;
 
 
3767	int err = 0;
3768
3769	isec->sclass = socket_type_to_security_class(family, type, protocol);
3770
3771	if (kern)
3772		isec->sid = SECINITSID_KERNEL;
3773	else {
3774		err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3775		if (err)
3776			return err;
3777	}
3778
3779	isec->initialized = 1;
 
 
3780
3781	if (sock->sk) {
3782		sksec = sock->sk->sk_security;
3783		sksec->sid = isec->sid;
3784		sksec->sclass = isec->sclass;
 
 
 
 
3785		err = selinux_netlbl_socket_post_create(sock->sk, family);
3786	}
3787
3788	return err;
3789}
3790
 
 
 
 
 
 
 
 
 
 
 
 
3791/* Range of port numbers used to automatically bind.
3792   Need to determine whether we should perform a name_bind
3793   permission check between the socket and the port number. */
3794
3795static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3796{
3797	struct sock *sk = sock->sk;
 
3798	u16 family;
3799	int err;
3800
3801	err = sock_has_perm(current, sk, SOCKET__BIND);
3802	if (err)
3803		goto out;
3804
3805	/*
3806	 * If PF_INET or PF_INET6, check name_bind permission for the port.
3807	 * Multiple address binding for SCTP is not supported yet: we just
3808	 * check the first address now.
3809	 */
3810	family = sk->sk_family;
3811	if (family == PF_INET || family == PF_INET6) {
3812		char *addrp;
3813		struct sk_security_struct *sksec = sk->sk_security;
3814		struct common_audit_data ad;
 
3815		struct sockaddr_in *addr4 = NULL;
3816		struct sockaddr_in6 *addr6 = NULL;
 
3817		unsigned short snum;
3818		u32 sid, node_perm;
3819
3820		if (family == PF_INET) {
 
 
 
 
 
 
 
 
 
 
 
 
 
3821			addr4 = (struct sockaddr_in *)address;
 
 
 
 
 
 
 
 
3822			snum = ntohs(addr4->sin_port);
3823			addrp = (char *)&addr4->sin_addr.s_addr;
3824		} else {
 
 
 
3825			addr6 = (struct sockaddr_in6 *)address;
3826			snum = ntohs(addr6->sin6_port);
3827			addrp = (char *)&addr6->sin6_addr.s6_addr;
 
 
 
3828		}
3829
 
 
 
 
 
3830		if (snum) {
3831			int low, high;
3832
3833			inet_get_local_port_range(&low, &high);
3834
3835			if (snum < max(PROT_SOCK, low) || snum > high) {
 
3836				err = sel_netport_sid(sk->sk_protocol,
3837						      snum, &sid);
3838				if (err)
3839					goto out;
3840				COMMON_AUDIT_DATA_INIT(&ad, NET);
3841				ad.u.net.sport = htons(snum);
3842				ad.u.net.family = family;
3843				err = avc_has_perm(sksec->sid, sid,
3844						   sksec->sclass,
3845						   SOCKET__NAME_BIND, &ad);
3846				if (err)
3847					goto out;
3848			}
3849		}
3850
3851		switch (sksec->sclass) {
3852		case SECCLASS_TCP_SOCKET:
3853			node_perm = TCP_SOCKET__NODE_BIND;
3854			break;
3855
3856		case SECCLASS_UDP_SOCKET:
3857			node_perm = UDP_SOCKET__NODE_BIND;
3858			break;
3859
3860		case SECCLASS_DCCP_SOCKET:
3861			node_perm = DCCP_SOCKET__NODE_BIND;
3862			break;
3863
 
 
 
 
3864		default:
3865			node_perm = RAWIP_SOCKET__NODE_BIND;
3866			break;
3867		}
3868
3869		err = sel_netnode_sid(addrp, family, &sid);
3870		if (err)
3871			goto out;
3872
3873		COMMON_AUDIT_DATA_INIT(&ad, NET);
3874		ad.u.net.sport = htons(snum);
3875		ad.u.net.family = family;
3876
3877		if (family == PF_INET)
3878			ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3879		else
3880			ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3881
3882		err = avc_has_perm(sksec->sid, sid,
 
3883				   sksec->sclass, node_perm, &ad);
3884		if (err)
3885			goto out;
3886	}
3887out:
3888	return err;
 
 
 
 
 
3889}
3890
3891static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
 
 
 
 
3892{
3893	struct sock *sk = sock->sk;
3894	struct sk_security_struct *sksec = sk->sk_security;
3895	int err;
3896
3897	err = sock_has_perm(current, sk, SOCKET__CONNECT);
3898	if (err)
3899		return err;
 
 
 
 
 
 
 
 
3900
3901	/*
3902	 * If a TCP or DCCP socket, check name_connect permission for the port.
 
3903	 */
3904	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3905	    sksec->sclass == SECCLASS_DCCP_SOCKET) {
 
3906		struct common_audit_data ad;
 
3907		struct sockaddr_in *addr4 = NULL;
3908		struct sockaddr_in6 *addr6 = NULL;
3909		unsigned short snum;
3910		u32 sid, perm;
3911
3912		if (sk->sk_family == PF_INET) {
 
 
 
 
 
 
3913			addr4 = (struct sockaddr_in *)address;
3914			if (addrlen < sizeof(struct sockaddr_in))
3915				return -EINVAL;
3916			snum = ntohs(addr4->sin_port);
3917		} else {
 
3918			addr6 = (struct sockaddr_in6 *)address;
3919			if (addrlen < SIN6_LEN_RFC2133)
3920				return -EINVAL;
3921			snum = ntohs(addr6->sin6_port);
 
 
 
 
 
 
 
 
 
3922		}
3923
3924		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3925		if (err)
3926			goto out;
3927
3928		perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3929		       TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
 
 
 
 
 
 
 
 
 
3930
3931		COMMON_AUDIT_DATA_INIT(&ad, NET);
3932		ad.u.net.dport = htons(snum);
3933		ad.u.net.family = sk->sk_family;
3934		err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
 
 
3935		if (err)
3936			goto out;
3937	}
3938
3939	err = selinux_netlbl_socket_connect(sk, address);
 
3940
3941out:
3942	return err;
 
 
 
 
 
 
 
 
 
 
3943}
3944
3945static int selinux_socket_listen(struct socket *sock, int backlog)
3946{
3947	return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3948}
3949
3950static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3951{
3952	int err;
3953	struct inode_security_struct *isec;
3954	struct inode_security_struct *newisec;
 
 
3955
3956	err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
3957	if (err)
3958		return err;
3959
3960	newisec = SOCK_INODE(newsock)->i_security;
3961
3962	isec = SOCK_INODE(sock)->i_security;
3963	newisec->sclass = isec->sclass;
3964	newisec->sid = isec->sid;
3965	newisec->initialized = 1;
 
 
 
 
3966
3967	return 0;
3968}
3969
3970static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3971				  int size)
3972{
3973	return sock_has_perm(current, sock->sk, SOCKET__WRITE);
3974}
3975
3976static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3977				  int size, int flags)
3978{
3979	return sock_has_perm(current, sock->sk, SOCKET__READ);
3980}
3981
3982static int selinux_socket_getsockname(struct socket *sock)
3983{
3984	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3985}
3986
3987static int selinux_socket_getpeername(struct socket *sock)
3988{
3989	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3990}
3991
3992static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3993{
3994	int err;
3995
3996	err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
3997	if (err)
3998		return err;
3999
4000	return selinux_netlbl_socket_setsockopt(sock, level, optname);
4001}
4002
4003static int selinux_socket_getsockopt(struct socket *sock, int level,
4004				     int optname)
4005{
4006	return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4007}
4008
4009static int selinux_socket_shutdown(struct socket *sock, int how)
4010{
4011	return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4012}
4013
4014static int selinux_socket_unix_stream_connect(struct sock *sock,
4015					      struct sock *other,
4016					      struct sock *newsk)
4017{
4018	struct sk_security_struct *sksec_sock = sock->sk_security;
4019	struct sk_security_struct *sksec_other = other->sk_security;
4020	struct sk_security_struct *sksec_new = newsk->sk_security;
4021	struct common_audit_data ad;
 
4022	int err;
4023
4024	COMMON_AUDIT_DATA_INIT(&ad, NET);
4025	ad.u.net.sk = other;
 
4026
4027	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
 
4028			   sksec_other->sclass,
4029			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4030	if (err)
4031		return err;
4032
4033	/* server child socket */
4034	sksec_new->peer_sid = sksec_sock->sid;
4035	err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4036				    &sksec_new->sid);
4037	if (err)
4038		return err;
4039
4040	/* connecting socket */
4041	sksec_sock->peer_sid = sksec_new->sid;
4042
4043	return 0;
4044}
4045
4046static int selinux_socket_unix_may_send(struct socket *sock,
4047					struct socket *other)
4048{
4049	struct sk_security_struct *ssec = sock->sk->sk_security;
4050	struct sk_security_struct *osec = other->sk->sk_security;
4051	struct common_audit_data ad;
 
4052
4053	COMMON_AUDIT_DATA_INIT(&ad, NET);
4054	ad.u.net.sk = other->sk;
 
4055
4056	return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
 
4057			    &ad);
4058}
4059
4060static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4061				    u32 peer_sid,
4062				    struct common_audit_data *ad)
4063{
4064	int err;
4065	u32 if_sid;
4066	u32 node_sid;
4067
4068	err = sel_netif_sid(ifindex, &if_sid);
4069	if (err)
4070		return err;
4071	err = avc_has_perm(peer_sid, if_sid,
 
4072			   SECCLASS_NETIF, NETIF__INGRESS, ad);
4073	if (err)
4074		return err;
4075
4076	err = sel_netnode_sid(addrp, family, &node_sid);
4077	if (err)
4078		return err;
4079	return avc_has_perm(peer_sid, node_sid,
 
4080			    SECCLASS_NODE, NODE__RECVFROM, ad);
4081}
4082
4083static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4084				       u16 family)
4085{
4086	int err = 0;
4087	struct sk_security_struct *sksec = sk->sk_security;
4088	u32 sk_sid = sksec->sid;
4089	struct common_audit_data ad;
 
4090	char *addrp;
4091
4092	COMMON_AUDIT_DATA_INIT(&ad, NET);
4093	ad.u.net.netif = skb->skb_iif;
4094	ad.u.net.family = family;
 
4095	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4096	if (err)
4097		return err;
4098
4099	if (selinux_secmark_enabled()) {
4100		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
 
4101				   PACKET__RECV, &ad);
4102		if (err)
4103			return err;
4104	}
4105
4106	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4107	if (err)
4108		return err;
4109	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4110
4111	return err;
4112}
4113
4114static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4115{
4116	int err;
4117	struct sk_security_struct *sksec = sk->sk_security;
4118	u16 family = sk->sk_family;
4119	u32 sk_sid = sksec->sid;
4120	struct common_audit_data ad;
 
4121	char *addrp;
4122	u8 secmark_active;
4123	u8 peerlbl_active;
4124
4125	if (family != PF_INET && family != PF_INET6)
4126		return 0;
4127
4128	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
4129	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4130		family = PF_INET;
4131
4132	/* If any sort of compatibility mode is enabled then handoff processing
4133	 * to the selinux_sock_rcv_skb_compat() function to deal with the
4134	 * special handling.  We do this in an attempt to keep this function
4135	 * as fast and as clean as possible. */
4136	if (!selinux_policycap_netpeer)
4137		return selinux_sock_rcv_skb_compat(sk, skb, family);
4138
4139	secmark_active = selinux_secmark_enabled();
4140	peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4141	if (!secmark_active && !peerlbl_active)
4142		return 0;
4143
4144	COMMON_AUDIT_DATA_INIT(&ad, NET);
4145	ad.u.net.netif = skb->skb_iif;
4146	ad.u.net.family = family;
 
4147	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4148	if (err)
4149		return err;
4150
4151	if (peerlbl_active) {
4152		u32 peer_sid;
4153
4154		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4155		if (err)
4156			return err;
4157		err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4158					       peer_sid, &ad);
4159		if (err) {
4160			selinux_netlbl_err(skb, err, 0);
4161			return err;
4162		}
4163		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
 
4164				   PEER__RECV, &ad);
4165		if (err)
4166			selinux_netlbl_err(skb, err, 0);
 
 
4167	}
4168
4169	if (secmark_active) {
4170		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
 
4171				   PACKET__RECV, &ad);
4172		if (err)
4173			return err;
4174	}
4175
4176	return err;
4177}
4178
4179static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4180					    int __user *optlen, unsigned len)
4181{
4182	int err = 0;
4183	char *scontext;
4184	u32 scontext_len;
4185	struct sk_security_struct *sksec = sock->sk->sk_security;
4186	u32 peer_sid = SECSID_NULL;
4187
4188	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4189	    sksec->sclass == SECCLASS_TCP_SOCKET)
 
4190		peer_sid = sksec->peer_sid;
4191	if (peer_sid == SECSID_NULL)
4192		return -ENOPROTOOPT;
4193
4194	err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
 
4195	if (err)
4196		return err;
4197
4198	if (scontext_len > len) {
4199		err = -ERANGE;
4200		goto out_len;
4201	}
4202
4203	if (copy_to_user(optval, scontext, scontext_len))
4204		err = -EFAULT;
4205
4206out_len:
4207	if (put_user(scontext_len, optlen))
4208		err = -EFAULT;
4209	kfree(scontext);
4210	return err;
4211}
4212
4213static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4214{
4215	u32 peer_secid = SECSID_NULL;
4216	u16 family;
 
4217
4218	if (skb && skb->protocol == htons(ETH_P_IP))
4219		family = PF_INET;
4220	else if (skb && skb->protocol == htons(ETH_P_IPV6))
4221		family = PF_INET6;
4222	else if (sock)
4223		family = sock->sk->sk_family;
4224	else
4225		goto out;
4226
4227	if (sock && family == PF_UNIX)
4228		selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4229	else if (skb)
 
4230		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4231
4232out:
4233	*secid = peer_secid;
4234	if (peer_secid == SECSID_NULL)
4235		return -EINVAL;
4236	return 0;
4237}
4238
4239static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4240{
4241	struct sk_security_struct *sksec;
4242
4243	sksec = kzalloc(sizeof(*sksec), priority);
4244	if (!sksec)
4245		return -ENOMEM;
4246
4247	sksec->peer_sid = SECINITSID_UNLABELED;
4248	sksec->sid = SECINITSID_UNLABELED;
 
4249	selinux_netlbl_sk_security_reset(sksec);
4250	sk->sk_security = sksec;
4251
4252	return 0;
4253}
4254
4255static void selinux_sk_free_security(struct sock *sk)
4256{
4257	struct sk_security_struct *sksec = sk->sk_security;
4258
4259	sk->sk_security = NULL;
4260	selinux_netlbl_sk_security_free(sksec);
4261	kfree(sksec);
4262}
4263
4264static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4265{
4266	struct sk_security_struct *sksec = sk->sk_security;
4267	struct sk_security_struct *newsksec = newsk->sk_security;
4268
4269	newsksec->sid = sksec->sid;
4270	newsksec->peer_sid = sksec->peer_sid;
4271	newsksec->sclass = sksec->sclass;
4272
4273	selinux_netlbl_sk_security_reset(newsksec);
4274}
4275
4276static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4277{
4278	if (!sk)
4279		*secid = SECINITSID_ANY_SOCKET;
4280	else {
4281		struct sk_security_struct *sksec = sk->sk_security;
4282
4283		*secid = sksec->sid;
4284	}
4285}
4286
4287static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4288{
4289	struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
 
4290	struct sk_security_struct *sksec = sk->sk_security;
4291
4292	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4293	    sk->sk_family == PF_UNIX)
4294		isec->sid = sksec->sid;
4295	sksec->sclass = isec->sclass;
4296}
4297
4298static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4299				     struct request_sock *req)
4300{
4301	struct sk_security_struct *sksec = sk->sk_security;
4302	int err;
4303	u16 family = sk->sk_family;
4304	u32 newsid;
4305	u32 peersid;
4306
4307	/* handle mapped IPv4 packets arriving via IPv6 sockets */
4308	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4309		family = PF_INET;
4310
4311	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4312	if (err)
4313		return err;
4314	if (peersid == SECSID_NULL) {
4315		req->secid = sksec->sid;
4316		req->peer_secid = SECSID_NULL;
4317	} else {
4318		err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4319		if (err)
4320			return err;
4321		req->secid = newsid;
4322		req->peer_secid = peersid;
4323	}
4324
4325	return selinux_netlbl_inet_conn_request(req, family);
4326}
4327
4328static void selinux_inet_csk_clone(struct sock *newsk,
4329				   const struct request_sock *req)
4330{
4331	struct sk_security_struct *newsksec = newsk->sk_security;
4332
4333	newsksec->sid = req->secid;
4334	newsksec->peer_sid = req->peer_secid;
4335	/* NOTE: Ideally, we should also get the isec->sid for the
4336	   new socket in sync, but we don't have the isec available yet.
4337	   So we will wait until sock_graft to do it, by which
4338	   time it will have been created and available. */
4339
4340	/* We don't need to take any sort of lock here as we are the only
4341	 * thread with access to newsksec */
4342	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4343}
4344
4345static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4346{
4347	u16 family = sk->sk_family;
4348	struct sk_security_struct *sksec = sk->sk_security;
4349
4350	/* handle mapped IPv4 packets arriving via IPv6 sockets */
4351	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4352		family = PF_INET;
4353
4354	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4355}
4356
4357static int selinux_secmark_relabel_packet(u32 sid)
4358{
4359	const struct task_security_struct *__tsec;
4360	u32 tsid;
4361
4362	__tsec = current_security();
4363	tsid = __tsec->sid;
4364
4365	return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
 
 
4366}
4367
4368static void selinux_secmark_refcount_inc(void)
4369{
4370	atomic_inc(&selinux_secmark_refcount);
4371}
4372
4373static void selinux_secmark_refcount_dec(void)
4374{
4375	atomic_dec(&selinux_secmark_refcount);
4376}
4377
4378static void selinux_req_classify_flow(const struct request_sock *req,
4379				      struct flowi *fl)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4380{
4381	fl->flowi_secid = req->secid;
4382}
4383
4384static int selinux_tun_dev_create(void)
4385{
4386	u32 sid = current_sid();
4387
4388	/* we aren't taking into account the "sockcreate" SID since the socket
4389	 * that is being created here is not a socket in the traditional sense,
4390	 * instead it is a private sock, accessible only to the kernel, and
4391	 * representing a wide range of network traffic spanning multiple
4392	 * connections unlike traditional sockets - check the TUN driver to
4393	 * get a better understanding of why this socket is special */
4394
4395	return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
 
4396			    NULL);
4397}
4398
4399static void selinux_tun_dev_post_create(struct sock *sk)
4400{
 
 
 
 
 
 
 
 
 
 
4401	struct sk_security_struct *sksec = sk->sk_security;
4402
4403	/* we don't currently perform any NetLabel based labeling here and it
4404	 * isn't clear that we would want to do so anyway; while we could apply
4405	 * labeling without the support of the TUN user the resulting labeled
4406	 * traffic from the other end of the connection would almost certainly
4407	 * cause confusion to the TUN user that had no idea network labeling
4408	 * protocols were being used */
4409
4410	/* see the comments in selinux_tun_dev_create() about why we don't use
4411	 * the sockcreate SID here */
4412
4413	sksec->sid = current_sid();
4414	sksec->sclass = SECCLASS_TUN_SOCKET;
 
 
4415}
4416
4417static int selinux_tun_dev_attach(struct sock *sk)
4418{
4419	struct sk_security_struct *sksec = sk->sk_security;
4420	u32 sid = current_sid();
4421	int err;
4422
4423	err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
 
4424			   TUN_SOCKET__RELABELFROM, NULL);
4425	if (err)
4426		return err;
4427	err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
 
4428			   TUN_SOCKET__RELABELTO, NULL);
4429	if (err)
4430		return err;
4431
4432	sksec->sid = sid;
4433
4434	return 0;
4435}
4436
4437static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4438{
4439	int err = 0;
4440	u32 perm;
4441	struct nlmsghdr *nlh;
4442	struct sk_security_struct *sksec = sk->sk_security;
4443
4444	if (skb->len < NLMSG_SPACE(0)) {
4445		err = -EINVAL;
4446		goto out;
4447	}
4448	nlh = nlmsg_hdr(skb);
4449
4450	err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4451	if (err) {
4452		if (err == -EINVAL) {
4453			audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4454				  "SELinux:  unrecognized netlink message"
4455				  " type=%hu for sclass=%hu\n",
4456				  nlh->nlmsg_type, sksec->sclass);
4457			if (!selinux_enforcing || security_get_allow_unknown())
4458				err = 0;
4459		}
4460
4461		/* Ignore */
4462		if (err == -ENOENT)
4463			err = 0;
4464		goto out;
4465	}
4466
4467	err = sock_has_perm(current, sk, perm);
4468out:
4469	return err;
4470}
4471
4472#ifdef CONFIG_NETFILTER
4473
4474static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
 
4475				       u16 family)
4476{
4477	int err;
4478	char *addrp;
4479	u32 peer_sid;
4480	struct common_audit_data ad;
 
4481	u8 secmark_active;
4482	u8 netlbl_active;
4483	u8 peerlbl_active;
4484
4485	if (!selinux_policycap_netpeer)
4486		return NF_ACCEPT;
4487
4488	secmark_active = selinux_secmark_enabled();
4489	netlbl_active = netlbl_enabled();
4490	peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4491	if (!secmark_active && !peerlbl_active)
4492		return NF_ACCEPT;
4493
4494	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4495		return NF_DROP;
4496
4497	COMMON_AUDIT_DATA_INIT(&ad, NET);
4498	ad.u.net.netif = ifindex;
4499	ad.u.net.family = family;
 
4500	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4501		return NF_DROP;
4502
4503	if (peerlbl_active) {
4504		err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4505					       peer_sid, &ad);
4506		if (err) {
4507			selinux_netlbl_err(skb, err, 1);
4508			return NF_DROP;
4509		}
4510	}
4511
4512	if (secmark_active)
4513		if (avc_has_perm(peer_sid, skb->secmark,
 
4514				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4515			return NF_DROP;
4516
4517	if (netlbl_active)
4518		/* we do this in the FORWARD path and not the POST_ROUTING
4519		 * path because we want to make sure we apply the necessary
4520		 * labeling before IPsec is applied so we can leverage AH
4521		 * protection */
4522		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4523			return NF_DROP;
4524
4525	return NF_ACCEPT;
4526}
4527
4528static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4529					 struct sk_buff *skb,
4530					 const struct net_device *in,
4531					 const struct net_device *out,
4532					 int (*okfn)(struct sk_buff *))
4533{
4534	return selinux_ip_forward(skb, in->ifindex, PF_INET);
4535}
4536
4537#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4538static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4539					 struct sk_buff *skb,
4540					 const struct net_device *in,
4541					 const struct net_device *out,
4542					 int (*okfn)(struct sk_buff *))
4543{
4544	return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4545}
4546#endif	/* IPV6 */
4547
4548static unsigned int selinux_ip_output(struct sk_buff *skb,
4549				      u16 family)
4550{
 
4551	u32 sid;
4552
4553	if (!netlbl_enabled())
4554		return NF_ACCEPT;
4555
4556	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4557	 * because we want to make sure we apply the necessary labeling
4558	 * before IPsec is applied so we can leverage AH protection */
4559	if (skb->sk) {
4560		struct sk_security_struct *sksec = skb->sk->sk_security;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4561		sid = sksec->sid;
4562	} else
4563		sid = SECINITSID_KERNEL;
4564	if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4565		return NF_DROP;
4566
4567	return NF_ACCEPT;
4568}
4569
4570static unsigned int selinux_ipv4_output(unsigned int hooknum,
4571					struct sk_buff *skb,
4572					const struct net_device *in,
4573					const struct net_device *out,
4574					int (*okfn)(struct sk_buff *))
4575{
4576	return selinux_ip_output(skb, PF_INET);
4577}
4578
 
 
 
 
 
 
 
 
 
4579static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4580						int ifindex,
4581						u16 family)
4582{
4583	struct sock *sk = skb->sk;
4584	struct sk_security_struct *sksec;
4585	struct common_audit_data ad;
 
4586	char *addrp;
4587	u8 proto;
4588
4589	if (sk == NULL)
4590		return NF_ACCEPT;
4591	sksec = sk->sk_security;
4592
4593	COMMON_AUDIT_DATA_INIT(&ad, NET);
4594	ad.u.net.netif = ifindex;
4595	ad.u.net.family = family;
 
4596	if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4597		return NF_DROP;
4598
4599	if (selinux_secmark_enabled())
4600		if (avc_has_perm(sksec->sid, skb->secmark,
 
4601				 SECCLASS_PACKET, PACKET__SEND, &ad))
4602			return NF_DROP_ERR(-ECONNREFUSED);
4603
4604	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4605		return NF_DROP_ERR(-ECONNREFUSED);
4606
4607	return NF_ACCEPT;
4608}
4609
4610static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
 
4611					 u16 family)
4612{
4613	u32 secmark_perm;
4614	u32 peer_sid;
 
4615	struct sock *sk;
4616	struct common_audit_data ad;
 
4617	char *addrp;
4618	u8 secmark_active;
4619	u8 peerlbl_active;
4620
4621	/* If any sort of compatibility mode is enabled then handoff processing
4622	 * to the selinux_ip_postroute_compat() function to deal with the
4623	 * special handling.  We do this in an attempt to keep this function
4624	 * as fast and as clean as possible. */
4625	if (!selinux_policycap_netpeer)
4626		return selinux_ip_postroute_compat(skb, ifindex, family);
 
 
 
 
 
 
 
 
4627#ifdef CONFIG_XFRM
4628	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4629	 * packet transformation so allow the packet to pass without any checks
4630	 * since we'll have another chance to perform access control checks
4631	 * when the packet is on it's final way out.
4632	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4633	 *       is NULL, in this case go ahead and apply access control. */
4634	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
 
 
 
 
 
 
4635		return NF_ACCEPT;
4636#endif
4637	secmark_active = selinux_secmark_enabled();
4638	peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4639	if (!secmark_active && !peerlbl_active)
4640		return NF_ACCEPT;
4641
4642	/* if the packet is being forwarded then get the peer label from the
4643	 * packet itself; otherwise check to see if it is from a local
4644	 * application or the kernel, if from an application get the peer label
4645	 * from the sending socket, otherwise use the kernel's sid */
4646	sk = skb->sk;
4647	if (sk == NULL) {
 
 
 
 
4648		if (skb->skb_iif) {
4649			secmark_perm = PACKET__FORWARD_OUT;
4650			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4651				return NF_DROP;
4652		} else {
4653			secmark_perm = PACKET__SEND;
4654			peer_sid = SECINITSID_KERNEL;
4655		}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4656	} else {
 
 
4657		struct sk_security_struct *sksec = sk->sk_security;
4658		peer_sid = sksec->sid;
4659		secmark_perm = PACKET__SEND;
4660	}
4661
4662	COMMON_AUDIT_DATA_INIT(&ad, NET);
4663	ad.u.net.netif = ifindex;
4664	ad.u.net.family = family;
 
4665	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4666		return NF_DROP;
4667
4668	if (secmark_active)
4669		if (avc_has_perm(peer_sid, skb->secmark,
 
4670				 SECCLASS_PACKET, secmark_perm, &ad))
4671			return NF_DROP_ERR(-ECONNREFUSED);
4672
4673	if (peerlbl_active) {
4674		u32 if_sid;
4675		u32 node_sid;
4676
4677		if (sel_netif_sid(ifindex, &if_sid))
4678			return NF_DROP;
4679		if (avc_has_perm(peer_sid, if_sid,
 
4680				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4681			return NF_DROP_ERR(-ECONNREFUSED);
4682
4683		if (sel_netnode_sid(addrp, family, &node_sid))
4684			return NF_DROP;
4685		if (avc_has_perm(peer_sid, node_sid,
 
4686				 SECCLASS_NODE, NODE__SENDTO, &ad))
4687			return NF_DROP_ERR(-ECONNREFUSED);
4688	}
4689
4690	return NF_ACCEPT;
4691}
4692
4693static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4694					   struct sk_buff *skb,
4695					   const struct net_device *in,
4696					   const struct net_device *out,
4697					   int (*okfn)(struct sk_buff *))
4698{
4699	return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4700}
4701
4702#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4703static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4704					   struct sk_buff *skb,
4705					   const struct net_device *in,
4706					   const struct net_device *out,
4707					   int (*okfn)(struct sk_buff *))
4708{
4709	return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4710}
4711#endif	/* IPV6 */
4712
4713#endif	/* CONFIG_NETFILTER */
4714
4715static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4716{
4717	int err;
4718
4719	err = cap_netlink_send(sk, skb);
4720	if (err)
4721		return err;
 
 
 
4722
4723	return selinux_nlmsg_perm(sk, skb);
4724}
4725
4726static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4727{
4728	int err;
4729	struct common_audit_data ad;
4730	u32 sid;
 
 
 
4731
4732	err = cap_netlink_recv(skb, capability);
4733	if (err)
4734		return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4735
4736	COMMON_AUDIT_DATA_INIT(&ad, CAP);
4737	ad.u.cap = capability;
 
 
 
 
 
4738
4739	security_task_getsecid(current, &sid);
4740	return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
4741			    CAP_TO_MASK(capability), &ad);
4742}
4743
4744static int ipc_alloc_security(struct task_struct *task,
4745			      struct kern_ipc_perm *perm,
4746			      u16 sclass)
4747{
4748	struct ipc_security_struct *isec;
4749	u32 sid;
4750
4751	isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4752	if (!isec)
4753		return -ENOMEM;
4754
4755	sid = task_sid(task);
4756	isec->sclass = sclass;
4757	isec->sid = sid;
4758	perm->security = isec;
4759
4760	return 0;
4761}
4762
4763static void ipc_free_security(struct kern_ipc_perm *perm)
4764{
4765	struct ipc_security_struct *isec = perm->security;
4766	perm->security = NULL;
4767	kfree(isec);
4768}
4769
4770static int msg_msg_alloc_security(struct msg_msg *msg)
4771{
4772	struct msg_security_struct *msec;
4773
4774	msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4775	if (!msec)
4776		return -ENOMEM;
4777
4778	msec->sid = SECINITSID_UNLABELED;
4779	msg->security = msec;
4780
4781	return 0;
4782}
4783
4784static void msg_msg_free_security(struct msg_msg *msg)
4785{
4786	struct msg_security_struct *msec = msg->security;
4787
4788	msg->security = NULL;
4789	kfree(msec);
4790}
4791
4792static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4793			u32 perms)
4794{
4795	struct ipc_security_struct *isec;
4796	struct common_audit_data ad;
4797	u32 sid = current_sid();
4798
4799	isec = ipc_perms->security;
4800
4801	COMMON_AUDIT_DATA_INIT(&ad, IPC);
4802	ad.u.ipc_id = ipc_perms->key;
4803
4804	return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
 
4805}
4806
4807static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4808{
4809	return msg_msg_alloc_security(msg);
4810}
4811
4812static void selinux_msg_msg_free_security(struct msg_msg *msg)
4813{
4814	msg_msg_free_security(msg);
 
4815}
4816
4817/* message queue security operations */
4818static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4819{
4820	struct ipc_security_struct *isec;
4821	struct common_audit_data ad;
4822	u32 sid = current_sid();
4823	int rc;
4824
4825	rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4826	if (rc)
4827		return rc;
4828
4829	isec = msq->q_perm.security;
4830
4831	COMMON_AUDIT_DATA_INIT(&ad, IPC);
4832	ad.u.ipc_id = msq->q_perm.key;
4833
4834	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
 
4835			  MSGQ__CREATE, &ad);
4836	if (rc) {
4837		ipc_free_security(&msq->q_perm);
4838		return rc;
4839	}
4840	return 0;
4841}
4842
4843static void selinux_msg_queue_free_security(struct msg_queue *msq)
4844{
4845	ipc_free_security(&msq->q_perm);
4846}
4847
4848static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4849{
4850	struct ipc_security_struct *isec;
4851	struct common_audit_data ad;
4852	u32 sid = current_sid();
4853
4854	isec = msq->q_perm.security;
4855
4856	COMMON_AUDIT_DATA_INIT(&ad, IPC);
4857	ad.u.ipc_id = msq->q_perm.key;
4858
4859	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
 
4860			    MSGQ__ASSOCIATE, &ad);
4861}
4862
4863static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4864{
4865	int err;
4866	int perms;
4867
4868	switch (cmd) {
4869	case IPC_INFO:
4870	case MSG_INFO:
4871		/* No specific object, just general system-wide information. */
4872		return task_has_system(current, SYSTEM__IPC_INFO);
 
 
4873	case IPC_STAT:
4874	case MSG_STAT:
 
4875		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4876		break;
4877	case IPC_SET:
4878		perms = MSGQ__SETATTR;
4879		break;
4880	case IPC_RMID:
4881		perms = MSGQ__DESTROY;
4882		break;
4883	default:
4884		return 0;
4885	}
4886
4887	err = ipc_has_perm(&msq->q_perm, perms);
4888	return err;
4889}
4890
4891static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4892{
4893	struct ipc_security_struct *isec;
4894	struct msg_security_struct *msec;
4895	struct common_audit_data ad;
4896	u32 sid = current_sid();
4897	int rc;
4898
4899	isec = msq->q_perm.security;
4900	msec = msg->security;
4901
4902	/*
4903	 * First time through, need to assign label to the message
4904	 */
4905	if (msec->sid == SECINITSID_UNLABELED) {
4906		/*
4907		 * Compute new sid based on current process and
4908		 * message queue this message will be stored in
4909		 */
4910		rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4911					     NULL, &msec->sid);
4912		if (rc)
4913			return rc;
4914	}
4915
4916	COMMON_AUDIT_DATA_INIT(&ad, IPC);
4917	ad.u.ipc_id = msq->q_perm.key;
4918
4919	/* Can this process write to the queue? */
4920	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
 
4921			  MSGQ__WRITE, &ad);
4922	if (!rc)
4923		/* Can this process send the message */
4924		rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
 
4925				  MSG__SEND, &ad);
4926	if (!rc)
4927		/* Can the message be put in the queue? */
4928		rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
 
4929				  MSGQ__ENQUEUE, &ad);
4930
4931	return rc;
4932}
4933
4934static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4935				    struct task_struct *target,
4936				    long type, int mode)
4937{
4938	struct ipc_security_struct *isec;
4939	struct msg_security_struct *msec;
4940	struct common_audit_data ad;
4941	u32 sid = task_sid(target);
4942	int rc;
4943
4944	isec = msq->q_perm.security;
4945	msec = msg->security;
4946
4947	COMMON_AUDIT_DATA_INIT(&ad, IPC);
4948	ad.u.ipc_id = msq->q_perm.key;
4949
4950	rc = avc_has_perm(sid, isec->sid,
 
4951			  SECCLASS_MSGQ, MSGQ__READ, &ad);
4952	if (!rc)
4953		rc = avc_has_perm(sid, msec->sid,
 
4954				  SECCLASS_MSG, MSG__RECEIVE, &ad);
4955	return rc;
4956}
4957
4958/* Shared Memory security operations */
4959static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4960{
4961	struct ipc_security_struct *isec;
4962	struct common_audit_data ad;
4963	u32 sid = current_sid();
4964	int rc;
4965
4966	rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4967	if (rc)
4968		return rc;
4969
4970	isec = shp->shm_perm.security;
4971
4972	COMMON_AUDIT_DATA_INIT(&ad, IPC);
4973	ad.u.ipc_id = shp->shm_perm.key;
4974
4975	rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
 
4976			  SHM__CREATE, &ad);
4977	if (rc) {
4978		ipc_free_security(&shp->shm_perm);
4979		return rc;
4980	}
4981	return 0;
4982}
4983
4984static void selinux_shm_free_security(struct shmid_kernel *shp)
4985{
4986	ipc_free_security(&shp->shm_perm);
4987}
4988
4989static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4990{
4991	struct ipc_security_struct *isec;
4992	struct common_audit_data ad;
4993	u32 sid = current_sid();
4994
4995	isec = shp->shm_perm.security;
4996
4997	COMMON_AUDIT_DATA_INIT(&ad, IPC);
4998	ad.u.ipc_id = shp->shm_perm.key;
4999
5000	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
 
5001			    SHM__ASSOCIATE, &ad);
5002}
5003
5004/* Note, at this point, shp is locked down */
5005static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5006{
5007	int perms;
5008	int err;
5009
5010	switch (cmd) {
5011	case IPC_INFO:
5012	case SHM_INFO:
5013		/* No specific object, just general system-wide information. */
5014		return task_has_system(current, SYSTEM__IPC_INFO);
 
 
5015	case IPC_STAT:
5016	case SHM_STAT:
 
5017		perms = SHM__GETATTR | SHM__ASSOCIATE;
5018		break;
5019	case IPC_SET:
5020		perms = SHM__SETATTR;
5021		break;
5022	case SHM_LOCK:
5023	case SHM_UNLOCK:
5024		perms = SHM__LOCK;
5025		break;
5026	case IPC_RMID:
5027		perms = SHM__DESTROY;
5028		break;
5029	default:
5030		return 0;
5031	}
5032
5033	err = ipc_has_perm(&shp->shm_perm, perms);
5034	return err;
5035}
5036
5037static int selinux_shm_shmat(struct shmid_kernel *shp,
5038			     char __user *shmaddr, int shmflg)
5039{
5040	u32 perms;
5041
5042	if (shmflg & SHM_RDONLY)
5043		perms = SHM__READ;
5044	else
5045		perms = SHM__READ | SHM__WRITE;
5046
5047	return ipc_has_perm(&shp->shm_perm, perms);
5048}
5049
5050/* Semaphore security operations */
5051static int selinux_sem_alloc_security(struct sem_array *sma)
5052{
5053	struct ipc_security_struct *isec;
5054	struct common_audit_data ad;
5055	u32 sid = current_sid();
5056	int rc;
5057
5058	rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5059	if (rc)
5060		return rc;
5061
5062	isec = sma->sem_perm.security;
 
5063
5064	COMMON_AUDIT_DATA_INIT(&ad, IPC);
5065	ad.u.ipc_id = sma->sem_perm.key;
5066
5067	rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5068			  SEM__CREATE, &ad);
5069	if (rc) {
5070		ipc_free_security(&sma->sem_perm);
5071		return rc;
5072	}
5073	return 0;
5074}
5075
5076static void selinux_sem_free_security(struct sem_array *sma)
5077{
5078	ipc_free_security(&sma->sem_perm);
5079}
5080
5081static int selinux_sem_associate(struct sem_array *sma, int semflg)
5082{
5083	struct ipc_security_struct *isec;
5084	struct common_audit_data ad;
5085	u32 sid = current_sid();
5086
5087	isec = sma->sem_perm.security;
5088
5089	COMMON_AUDIT_DATA_INIT(&ad, IPC);
5090	ad.u.ipc_id = sma->sem_perm.key;
5091
5092	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
 
5093			    SEM__ASSOCIATE, &ad);
5094}
5095
5096/* Note, at this point, sma is locked down */
5097static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5098{
5099	int err;
5100	u32 perms;
5101
5102	switch (cmd) {
5103	case IPC_INFO:
5104	case SEM_INFO:
5105		/* No specific object, just general system-wide information. */
5106		return task_has_system(current, SYSTEM__IPC_INFO);
 
 
5107	case GETPID:
5108	case GETNCNT:
5109	case GETZCNT:
5110		perms = SEM__GETATTR;
5111		break;
5112	case GETVAL:
5113	case GETALL:
5114		perms = SEM__READ;
5115		break;
5116	case SETVAL:
5117	case SETALL:
5118		perms = SEM__WRITE;
5119		break;
5120	case IPC_RMID:
5121		perms = SEM__DESTROY;
5122		break;
5123	case IPC_SET:
5124		perms = SEM__SETATTR;
5125		break;
5126	case IPC_STAT:
5127	case SEM_STAT:
 
5128		perms = SEM__GETATTR | SEM__ASSOCIATE;
5129		break;
5130	default:
5131		return 0;
5132	}
5133
5134	err = ipc_has_perm(&sma->sem_perm, perms);
5135	return err;
5136}
5137
5138static int selinux_sem_semop(struct sem_array *sma,
5139			     struct sembuf *sops, unsigned nsops, int alter)
5140{
5141	u32 perms;
5142
5143	if (alter)
5144		perms = SEM__READ | SEM__WRITE;
5145	else
5146		perms = SEM__READ;
5147
5148	return ipc_has_perm(&sma->sem_perm, perms);
5149}
5150
5151static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5152{
5153	u32 av = 0;
5154
5155	av = 0;
5156	if (flag & S_IRUGO)
5157		av |= IPC__UNIX_READ;
5158	if (flag & S_IWUGO)
5159		av |= IPC__UNIX_WRITE;
5160
5161	if (av == 0)
5162		return 0;
5163
5164	return ipc_has_perm(ipcp, av);
5165}
5166
5167static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5168{
5169	struct ipc_security_struct *isec = ipcp->security;
5170	*secid = isec->sid;
5171}
5172
5173static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5174{
5175	if (inode)
5176		inode_doinit_with_dentry(inode, dentry);
5177}
5178
5179static int selinux_getprocattr(struct task_struct *p,
5180			       char *name, char **value)
5181{
5182	const struct task_security_struct *__tsec;
5183	u32 sid;
5184	int error;
5185	unsigned len;
5186
 
 
 
5187	if (current != p) {
5188		error = current_has_perm(p, PROCESS__GETATTR);
 
 
5189		if (error)
5190			return error;
5191	}
5192
5193	rcu_read_lock();
5194	__tsec = __task_cred(p)->security;
5195
5196	if (!strcmp(name, "current"))
5197		sid = __tsec->sid;
5198	else if (!strcmp(name, "prev"))
5199		sid = __tsec->osid;
5200	else if (!strcmp(name, "exec"))
5201		sid = __tsec->exec_sid;
5202	else if (!strcmp(name, "fscreate"))
5203		sid = __tsec->create_sid;
5204	else if (!strcmp(name, "keycreate"))
5205		sid = __tsec->keycreate_sid;
5206	else if (!strcmp(name, "sockcreate"))
5207		sid = __tsec->sockcreate_sid;
5208	else
5209		goto invalid;
 
 
5210	rcu_read_unlock();
5211
5212	if (!sid)
5213		return 0;
5214
5215	error = security_sid_to_context(sid, value, &len);
5216	if (error)
5217		return error;
5218	return len;
5219
5220invalid:
5221	rcu_read_unlock();
5222	return -EINVAL;
5223}
5224
5225static int selinux_setprocattr(struct task_struct *p,
5226			       char *name, void *value, size_t size)
5227{
5228	struct task_security_struct *tsec;
5229	struct task_struct *tracer;
5230	struct cred *new;
5231	u32 sid = 0, ptsid;
5232	int error;
5233	char *str = value;
5234
5235	if (current != p) {
5236		/* SELinux only allows a process to change its own
5237		   security attributes. */
5238		return -EACCES;
5239	}
5240
5241	/*
5242	 * Basic control over ability to set these attributes at all.
5243	 * current == p, but we'll pass them separately in case the
5244	 * above restriction is ever removed.
5245	 */
5246	if (!strcmp(name, "exec"))
5247		error = current_has_perm(p, PROCESS__SETEXEC);
 
 
5248	else if (!strcmp(name, "fscreate"))
5249		error = current_has_perm(p, PROCESS__SETFSCREATE);
 
 
5250	else if (!strcmp(name, "keycreate"))
5251		error = current_has_perm(p, PROCESS__SETKEYCREATE);
 
 
5252	else if (!strcmp(name, "sockcreate"))
5253		error = current_has_perm(p, PROCESS__SETSOCKCREATE);
 
 
5254	else if (!strcmp(name, "current"))
5255		error = current_has_perm(p, PROCESS__SETCURRENT);
 
 
5256	else
5257		error = -EINVAL;
5258	if (error)
5259		return error;
5260
5261	/* Obtain a SID for the context, if one was specified. */
5262	if (size && str[1] && str[1] != '\n') {
5263		if (str[size-1] == '\n') {
5264			str[size-1] = 0;
5265			size--;
5266		}
5267		error = security_context_to_sid(value, size, &sid);
 
5268		if (error == -EINVAL && !strcmp(name, "fscreate")) {
5269			if (!capable(CAP_MAC_ADMIN))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5270				return error;
5271			error = security_context_to_sid_force(value, size,
5272							      &sid);
 
 
5273		}
5274		if (error)
5275			return error;
5276	}
5277
5278	new = prepare_creds();
5279	if (!new)
5280		return -ENOMEM;
5281
5282	/* Permission checking based on the specified context is
5283	   performed during the actual operation (execve,
5284	   open/mkdir/...), when we know the full context of the
5285	   operation.  See selinux_bprm_set_creds for the execve
5286	   checks and may_create for the file creation checks. The
5287	   operation will then fail if the context is not permitted. */
5288	tsec = new->security;
5289	if (!strcmp(name, "exec")) {
5290		tsec->exec_sid = sid;
5291	} else if (!strcmp(name, "fscreate")) {
5292		tsec->create_sid = sid;
5293	} else if (!strcmp(name, "keycreate")) {
5294		error = may_create_key(sid, p);
5295		if (error)
5296			goto abort_change;
 
 
 
5297		tsec->keycreate_sid = sid;
5298	} else if (!strcmp(name, "sockcreate")) {
5299		tsec->sockcreate_sid = sid;
5300	} else if (!strcmp(name, "current")) {
5301		error = -EINVAL;
5302		if (sid == 0)
5303			goto abort_change;
5304
5305		/* Only allow single threaded processes to change context */
5306		error = -EPERM;
5307		if (!current_is_single_threaded()) {
5308			error = security_bounded_transition(tsec->sid, sid);
 
5309			if (error)
5310				goto abort_change;
5311		}
5312
5313		/* Check permissions for the transition. */
5314		error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
 
5315				     PROCESS__DYNTRANSITION, NULL);
5316		if (error)
5317			goto abort_change;
5318
5319		/* Check for ptracing, and update the task SID if ok.
5320		   Otherwise, leave SID unchanged and fail. */
5321		ptsid = 0;
5322		task_lock(p);
5323		tracer = ptrace_parent(p);
5324		if (tracer)
5325			ptsid = task_sid(tracer);
5326		task_unlock(p);
5327
5328		if (tracer) {
5329			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5330					     PROCESS__PTRACE, NULL);
5331			if (error)
5332				goto abort_change;
5333		}
5334
5335		tsec->sid = sid;
5336	} else {
5337		error = -EINVAL;
5338		goto abort_change;
5339	}
5340
5341	commit_creds(new);
5342	return size;
5343
5344abort_change:
5345	abort_creds(new);
5346	return error;
5347}
5348
 
 
 
 
 
5349static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5350{
5351	return security_sid_to_context(secid, secdata, seclen);
 
5352}
5353
5354static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5355{
5356	return security_context_to_sid(secdata, seclen, secid);
 
5357}
5358
5359static void selinux_release_secctx(char *secdata, u32 seclen)
5360{
5361	kfree(secdata);
5362}
5363
 
 
 
 
 
 
 
 
 
5364/*
5365 *	called with inode->i_mutex locked
5366 */
5367static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5368{
5369	return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
 
 
 
5370}
5371
5372/*
5373 *	called with inode->i_mutex locked
5374 */
5375static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5376{
5377	return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
 
5378}
5379
5380static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5381{
5382	int len = 0;
5383	len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5384						ctx, true);
5385	if (len < 0)
5386		return len;
5387	*ctxlen = len;
5388	return 0;
5389}
5390#ifdef CONFIG_KEYS
5391
5392static int selinux_key_alloc(struct key *k, const struct cred *cred,
5393			     unsigned long flags)
5394{
5395	const struct task_security_struct *tsec;
5396	struct key_security_struct *ksec;
5397
5398	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5399	if (!ksec)
5400		return -ENOMEM;
5401
5402	tsec = cred->security;
5403	if (tsec->keycreate_sid)
5404		ksec->sid = tsec->keycreate_sid;
5405	else
5406		ksec->sid = tsec->sid;
5407
5408	k->security = ksec;
5409	return 0;
5410}
5411
5412static void selinux_key_free(struct key *k)
5413{
5414	struct key_security_struct *ksec = k->security;
5415
5416	k->security = NULL;
5417	kfree(ksec);
5418}
5419
5420static int selinux_key_permission(key_ref_t key_ref,
5421				  const struct cred *cred,
5422				  key_perm_t perm)
5423{
5424	struct key *key;
5425	struct key_security_struct *ksec;
5426	u32 sid;
5427
5428	/* if no specific permissions are requested, we skip the
5429	   permission check. No serious, additional covert channels
5430	   appear to be created. */
5431	if (perm == 0)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5432		return 0;
 
 
 
5433
5434	sid = cred_sid(cred);
5435
 
5436	key = key_ref_to_ptr(key_ref);
5437	ksec = key->security;
5438
5439	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
 
5440}
5441
5442static int selinux_key_getsecurity(struct key *key, char **_buffer)
5443{
5444	struct key_security_struct *ksec = key->security;
5445	char *context = NULL;
5446	unsigned len;
5447	int rc;
5448
5449	rc = security_sid_to_context(ksec->sid, &context, &len);
 
5450	if (!rc)
5451		rc = len;
5452	*_buffer = context;
5453	return rc;
5454}
5455
 
 
 
 
 
 
 
 
 
5456#endif
 
 
 
 
 
 
 
 
 
 
5457
5458static struct security_operations selinux_ops = {
5459	.name =				"selinux",
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5460
5461	.ptrace_access_check =		selinux_ptrace_access_check,
5462	.ptrace_traceme =		selinux_ptrace_traceme,
5463	.capget =			selinux_capget,
5464	.capset =			selinux_capset,
5465	.capable =			selinux_capable,
5466	.quotactl =			selinux_quotactl,
5467	.quota_on =			selinux_quota_on,
5468	.syslog =			selinux_syslog,
5469	.vm_enough_memory =		selinux_vm_enough_memory,
5470
5471	.netlink_send =			selinux_netlink_send,
5472	.netlink_recv =			selinux_netlink_recv,
5473
5474	.bprm_set_creds =		selinux_bprm_set_creds,
5475	.bprm_committing_creds =	selinux_bprm_committing_creds,
5476	.bprm_committed_creds =		selinux_bprm_committed_creds,
5477	.bprm_secureexec =		selinux_bprm_secureexec,
5478
5479	.sb_alloc_security =		selinux_sb_alloc_security,
5480	.sb_free_security =		selinux_sb_free_security,
5481	.sb_copy_data =			selinux_sb_copy_data,
5482	.sb_remount =			selinux_sb_remount,
5483	.sb_kern_mount =		selinux_sb_kern_mount,
5484	.sb_show_options =		selinux_sb_show_options,
5485	.sb_statfs =			selinux_sb_statfs,
5486	.sb_mount =			selinux_mount,
5487	.sb_umount =			selinux_umount,
5488	.sb_set_mnt_opts =		selinux_set_mnt_opts,
5489	.sb_clone_mnt_opts =		selinux_sb_clone_mnt_opts,
5490	.sb_parse_opts_str = 		selinux_parse_opts_str,
5491
5492
5493	.inode_alloc_security =		selinux_inode_alloc_security,
5494	.inode_free_security =		selinux_inode_free_security,
5495	.inode_init_security =		selinux_inode_init_security,
5496	.inode_create =			selinux_inode_create,
5497	.inode_link =			selinux_inode_link,
5498	.inode_unlink =			selinux_inode_unlink,
5499	.inode_symlink =		selinux_inode_symlink,
5500	.inode_mkdir =			selinux_inode_mkdir,
5501	.inode_rmdir =			selinux_inode_rmdir,
5502	.inode_mknod =			selinux_inode_mknod,
5503	.inode_rename =			selinux_inode_rename,
5504	.inode_readlink =		selinux_inode_readlink,
5505	.inode_follow_link =		selinux_inode_follow_link,
5506	.inode_permission =		selinux_inode_permission,
5507	.inode_setattr =		selinux_inode_setattr,
5508	.inode_getattr =		selinux_inode_getattr,
5509	.inode_setxattr =		selinux_inode_setxattr,
5510	.inode_post_setxattr =		selinux_inode_post_setxattr,
5511	.inode_getxattr =		selinux_inode_getxattr,
5512	.inode_listxattr =		selinux_inode_listxattr,
5513	.inode_removexattr =		selinux_inode_removexattr,
5514	.inode_getsecurity =		selinux_inode_getsecurity,
5515	.inode_setsecurity =		selinux_inode_setsecurity,
5516	.inode_listsecurity =		selinux_inode_listsecurity,
5517	.inode_getsecid =		selinux_inode_getsecid,
5518
5519	.file_permission =		selinux_file_permission,
5520	.file_alloc_security =		selinux_file_alloc_security,
5521	.file_free_security =		selinux_file_free_security,
5522	.file_ioctl =			selinux_file_ioctl,
5523	.file_mmap =			selinux_file_mmap,
5524	.file_mprotect =		selinux_file_mprotect,
5525	.file_lock =			selinux_file_lock,
5526	.file_fcntl =			selinux_file_fcntl,
5527	.file_set_fowner =		selinux_file_set_fowner,
5528	.file_send_sigiotask =		selinux_file_send_sigiotask,
5529	.file_receive =			selinux_file_receive,
5530
5531	.dentry_open =			selinux_dentry_open,
5532
5533	.task_create =			selinux_task_create,
5534	.cred_alloc_blank =		selinux_cred_alloc_blank,
5535	.cred_free =			selinux_cred_free,
5536	.cred_prepare =			selinux_cred_prepare,
5537	.cred_transfer =		selinux_cred_transfer,
5538	.kernel_act_as =		selinux_kernel_act_as,
5539	.kernel_create_files_as =	selinux_kernel_create_files_as,
5540	.kernel_module_request =	selinux_kernel_module_request,
5541	.task_setpgid =			selinux_task_setpgid,
5542	.task_getpgid =			selinux_task_getpgid,
5543	.task_getsid =			selinux_task_getsid,
5544	.task_getsecid =		selinux_task_getsecid,
5545	.task_setnice =			selinux_task_setnice,
5546	.task_setioprio =		selinux_task_setioprio,
5547	.task_getioprio =		selinux_task_getioprio,
5548	.task_setrlimit =		selinux_task_setrlimit,
5549	.task_setscheduler =		selinux_task_setscheduler,
5550	.task_getscheduler =		selinux_task_getscheduler,
5551	.task_movememory =		selinux_task_movememory,
5552	.task_kill =			selinux_task_kill,
5553	.task_wait =			selinux_task_wait,
5554	.task_to_inode =		selinux_task_to_inode,
5555
5556	.ipc_permission =		selinux_ipc_permission,
5557	.ipc_getsecid =			selinux_ipc_getsecid,
5558
5559	.msg_msg_alloc_security =	selinux_msg_msg_alloc_security,
5560	.msg_msg_free_security =	selinux_msg_msg_free_security,
5561
5562	.msg_queue_alloc_security =	selinux_msg_queue_alloc_security,
5563	.msg_queue_free_security =	selinux_msg_queue_free_security,
5564	.msg_queue_associate =		selinux_msg_queue_associate,
5565	.msg_queue_msgctl =		selinux_msg_queue_msgctl,
5566	.msg_queue_msgsnd =		selinux_msg_queue_msgsnd,
5567	.msg_queue_msgrcv =		selinux_msg_queue_msgrcv,
5568
5569	.shm_alloc_security =		selinux_shm_alloc_security,
5570	.shm_free_security =		selinux_shm_free_security,
5571	.shm_associate =		selinux_shm_associate,
5572	.shm_shmctl =			selinux_shm_shmctl,
5573	.shm_shmat =			selinux_shm_shmat,
5574
5575	.sem_alloc_security =		selinux_sem_alloc_security,
5576	.sem_free_security =		selinux_sem_free_security,
5577	.sem_associate =		selinux_sem_associate,
5578	.sem_semctl =			selinux_sem_semctl,
5579	.sem_semop =			selinux_sem_semop,
5580
5581	.d_instantiate =		selinux_d_instantiate,
5582
5583	.getprocattr =			selinux_getprocattr,
5584	.setprocattr =			selinux_setprocattr,
5585
5586	.secid_to_secctx =		selinux_secid_to_secctx,
5587	.secctx_to_secid =		selinux_secctx_to_secid,
5588	.release_secctx =		selinux_release_secctx,
5589	.inode_notifysecctx =		selinux_inode_notifysecctx,
5590	.inode_setsecctx =		selinux_inode_setsecctx,
5591	.inode_getsecctx =		selinux_inode_getsecctx,
5592
5593	.unix_stream_connect =		selinux_socket_unix_stream_connect,
5594	.unix_may_send =		selinux_socket_unix_may_send,
5595
5596	.socket_create =		selinux_socket_create,
5597	.socket_post_create =		selinux_socket_post_create,
5598	.socket_bind =			selinux_socket_bind,
5599	.socket_connect =		selinux_socket_connect,
5600	.socket_listen =		selinux_socket_listen,
5601	.socket_accept =		selinux_socket_accept,
5602	.socket_sendmsg =		selinux_socket_sendmsg,
5603	.socket_recvmsg =		selinux_socket_recvmsg,
5604	.socket_getsockname =		selinux_socket_getsockname,
5605	.socket_getpeername =		selinux_socket_getpeername,
5606	.socket_getsockopt =		selinux_socket_getsockopt,
5607	.socket_setsockopt =		selinux_socket_setsockopt,
5608	.socket_shutdown =		selinux_socket_shutdown,
5609	.socket_sock_rcv_skb =		selinux_socket_sock_rcv_skb,
5610	.socket_getpeersec_stream =	selinux_socket_getpeersec_stream,
5611	.socket_getpeersec_dgram =	selinux_socket_getpeersec_dgram,
5612	.sk_alloc_security =		selinux_sk_alloc_security,
5613	.sk_free_security =		selinux_sk_free_security,
5614	.sk_clone_security =		selinux_sk_clone_security,
5615	.sk_getsecid =			selinux_sk_getsecid,
5616	.sock_graft =			selinux_sock_graft,
5617	.inet_conn_request =		selinux_inet_conn_request,
5618	.inet_csk_clone =		selinux_inet_csk_clone,
5619	.inet_conn_established =	selinux_inet_conn_established,
5620	.secmark_relabel_packet =	selinux_secmark_relabel_packet,
5621	.secmark_refcount_inc =		selinux_secmark_refcount_inc,
5622	.secmark_refcount_dec =		selinux_secmark_refcount_dec,
5623	.req_classify_flow =		selinux_req_classify_flow,
5624	.tun_dev_create =		selinux_tun_dev_create,
5625	.tun_dev_post_create = 		selinux_tun_dev_post_create,
5626	.tun_dev_attach =		selinux_tun_dev_attach,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5627
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5628#ifdef CONFIG_SECURITY_NETWORK_XFRM
5629	.xfrm_policy_alloc_security =	selinux_xfrm_policy_alloc,
5630	.xfrm_policy_clone_security =	selinux_xfrm_policy_clone,
5631	.xfrm_policy_free_security =	selinux_xfrm_policy_free,
5632	.xfrm_policy_delete_security =	selinux_xfrm_policy_delete,
5633	.xfrm_state_alloc_security =	selinux_xfrm_state_alloc,
5634	.xfrm_state_free_security =	selinux_xfrm_state_free,
5635	.xfrm_state_delete_security =	selinux_xfrm_state_delete,
5636	.xfrm_policy_lookup =		selinux_xfrm_policy_lookup,
5637	.xfrm_state_pol_flow_match =	selinux_xfrm_state_pol_flow_match,
5638	.xfrm_decode_session =		selinux_xfrm_decode_session,
5639#endif
5640
5641#ifdef CONFIG_KEYS
5642	.key_alloc =			selinux_key_alloc,
5643	.key_free =			selinux_key_free,
5644	.key_permission =		selinux_key_permission,
5645	.key_getsecurity =		selinux_key_getsecurity,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5646#endif
5647
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5648#ifdef CONFIG_AUDIT
5649	.audit_rule_init =		selinux_audit_rule_init,
5650	.audit_rule_known =		selinux_audit_rule_known,
5651	.audit_rule_match =		selinux_audit_rule_match,
5652	.audit_rule_free =		selinux_audit_rule_free,
 
 
 
 
5653#endif
5654};
5655
5656static __init int selinux_init(void)
5657{
5658	if (!security_module_enable(&selinux_ops)) {
5659		selinux_enabled = 0;
5660		return 0;
5661	}
5662
5663	if (!selinux_enabled) {
5664		printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5665		return 0;
5666	}
5667
5668	printk(KERN_INFO "SELinux:  Initializing.\n");
 
 
 
 
 
5669
5670	/* Set the security state for the initial task. */
5671	cred_init_security();
5672
5673	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5674
5675	sel_inode_cache = kmem_cache_create("selinux_inode_security",
5676					    sizeof(struct inode_security_struct),
5677					    0, SLAB_PANIC, NULL);
5678	avc_init();
5679
5680	if (register_security(&selinux_ops))
5681		panic("SELinux: Unable to register with kernel.\n");
 
 
 
 
 
 
 
 
 
 
 
5682
5683	if (selinux_enforcing)
5684		printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5685	else
5686		printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
 
 
5687
5688	return 0;
5689}
5690
5691static void delayed_superblock_init(struct super_block *sb, void *unused)
5692{
5693	superblock_doinit(sb, NULL);
5694}
5695
5696void selinux_complete_init(void)
5697{
5698	printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5699
5700	/* Set up any superblocks initialized prior to the policy load. */
5701	printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5702	iterate_supers(delayed_superblock_init, NULL);
5703}
5704
5705/* SELinux requires early initialization in order to label
5706   all processes and objects when they are created. */
5707security_initcall(selinux_init);
 
 
 
 
 
 
5708
5709#if defined(CONFIG_NETFILTER)
5710
5711static struct nf_hook_ops selinux_ipv4_ops[] = {
5712	{
5713		.hook =		selinux_ipv4_postroute,
5714		.owner =	THIS_MODULE,
5715		.pf =		PF_INET,
5716		.hooknum =	NF_INET_POST_ROUTING,
5717		.priority =	NF_IP_PRI_SELINUX_LAST,
5718	},
5719	{
5720		.hook =		selinux_ipv4_forward,
5721		.owner =	THIS_MODULE,
5722		.pf =		PF_INET,
5723		.hooknum =	NF_INET_FORWARD,
5724		.priority =	NF_IP_PRI_SELINUX_FIRST,
5725	},
5726	{
5727		.hook =		selinux_ipv4_output,
5728		.owner =	THIS_MODULE,
5729		.pf =		PF_INET,
5730		.hooknum =	NF_INET_LOCAL_OUT,
5731		.priority =	NF_IP_PRI_SELINUX_FIRST,
5732	}
5733};
5734
5735#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5736
5737static struct nf_hook_ops selinux_ipv6_ops[] = {
5738	{
5739		.hook =		selinux_ipv6_postroute,
5740		.owner =	THIS_MODULE,
5741		.pf =		PF_INET6,
5742		.hooknum =	NF_INET_POST_ROUTING,
5743		.priority =	NF_IP6_PRI_SELINUX_LAST,
5744	},
5745	{
5746		.hook =		selinux_ipv6_forward,
5747		.owner =	THIS_MODULE,
5748		.pf =		PF_INET6,
5749		.hooknum =	NF_INET_FORWARD,
5750		.priority =	NF_IP6_PRI_SELINUX_FIRST,
5751	}
 
 
 
 
 
 
 
5752};
5753
5754#endif	/* IPV6 */
 
 
 
 
5755
5756static int __init selinux_nf_ip_init(void)
5757{
5758	int err = 0;
 
 
5759
5760	if (!selinux_enabled)
5761		goto out;
 
 
5762
5763	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
 
 
5764
5765	err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5766	if (err)
5767		panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
 
5768
5769#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5770	err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5771	if (err)
5772		panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5773#endif	/* IPV6 */
5774
5775out:
5776	return err;
5777}
5778
5779__initcall(selinux_nf_ip_init);
5780
5781#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5782static void selinux_nf_ip_exit(void)
5783{
5784	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5785
5786	nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5787#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5788	nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5789#endif	/* IPV6 */
5790}
5791#endif
5792
5793#else /* CONFIG_NETFILTER */
5794
5795#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5796#define selinux_nf_ip_exit()
5797#endif
5798
5799#endif /* CONFIG_NETFILTER */
5800
5801#ifdef CONFIG_SECURITY_SELINUX_DISABLE
5802static int selinux_disabled;
5803
5804int selinux_disable(void)
5805{
5806	extern void exit_sel_fs(void);
5807
5808	if (ss_initialized) {
5809		/* Not permitted after initial policy load. */
5810		return -EINVAL;
5811	}
5812
5813	if (selinux_disabled) {
5814		/* Only do this once. */
5815		return -EINVAL;
5816	}
5817
5818	printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5819
5820	selinux_disabled = 1;
5821	selinux_enabled = 0;
5822
5823	reset_security_ops();
 
 
 
 
 
 
 
5824
5825	/* Try to destroy the avc node cache */
5826	avc_disable();
5827
5828	/* Unregister netfilter hooks. */
5829	selinux_nf_ip_exit();
5830
5831	/* Unregister selinuxfs. */
5832	exit_sel_fs();
5833
5834	return 0;
5835}
5836#endif