hooks.c 153.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6
/*
 *  NSA Security-Enhanced Linux (SELinux) security module
 *
 *  This file contains the SELinux hook function implementations.
 *
 *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
7 8 9
 *	      Chris Vance, <cvance@nai.com>
 *	      Wayne Salamon, <wsalamon@nai.com>
 *	      James Morris <jmorris@redhat.com>
L
Linus Torvalds 已提交
10 11
 *
 *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 13
 *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
 *					   Eric Paris <eparis@redhat.com>
L
Linus Torvalds 已提交
14
 *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15
 *			    <dgoeddel@trustedcs.com>
16
 *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17
 *	Paul Moore <paul@paul-moore.com>
18
 *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19
 *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
L
Linus Torvalds 已提交
20 21 22
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2,
23
 *	as published by the Free Software Foundation.
L
Linus Torvalds 已提交
24 25 26
 */

#include <linux/init.h>
27
#include <linux/kd.h>
L
Linus Torvalds 已提交
28
#include <linux/kernel.h>
29
#include <linux/tracehook.h>
L
Linus Torvalds 已提交
30 31 32 33 34 35 36 37 38 39
#include <linux/errno.h>
#include <linux/sched.h>
#include <linux/security.h>
#include <linux/xattr.h>
#include <linux/capability.h>
#include <linux/unistd.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/slab.h>
#include <linux/pagemap.h>
40
#include <linux/proc_fs.h>
L
Linus Torvalds 已提交
41 42 43
#include <linux/swap.h>
#include <linux/spinlock.h>
#include <linux/syscalls.h>
44
#include <linux/dcache.h>
L
Linus Torvalds 已提交
45
#include <linux/file.h>
A
Al Viro 已提交
46
#include <linux/fdtable.h>
L
Linus Torvalds 已提交
47 48 49 50 51 52
#include <linux/namei.h>
#include <linux/mount.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h>
#include <linux/tty.h>
#include <net/icmp.h>
53
#include <net/ip.h>		/* for local_port_range[] */
54
#include <net/sock.h>
L
Linus Torvalds 已提交
55
#include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
56
#include <net/inet_connection_sock.h>
57
#include <net/net_namespace.h>
58
#include <net/netlabel.h>
59
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
60
#include <asm/ioctls.h>
A
Arun Sharma 已提交
61
#include <linux/atomic.h>
L
Linus Torvalds 已提交
62 63 64
#include <linux/bitops.h>
#include <linux/interrupt.h>
#include <linux/netdevice.h>	/* for network interface checks */
65
#include <net/netlink.h>
L
Linus Torvalds 已提交
66 67
#include <linux/tcp.h>
#include <linux/udp.h>
J
James Morris 已提交
68
#include <linux/dccp.h>
L
Linus Torvalds 已提交
69 70 71 72 73 74 75 76 77
#include <linux/quota.h>
#include <linux/un.h>		/* for Unix socket types */
#include <net/af_unix.h>	/* for Unix socket types */
#include <linux/parser.h>
#include <linux/nfs_mount.h>
#include <net/ipv6.h>
#include <linux/hugetlb.h>
#include <linux/personality.h>
#include <linux/audit.h>
78
#include <linux/string.h>
C
Catherine Zhang 已提交
79
#include <linux/selinux.h>
80
#include <linux/mutex.h>
81
#include <linux/posix-timers.h>
82
#include <linux/syslog.h>
83
#include <linux/user_namespace.h>
84
#include <linux/export.h>
A
Al Viro 已提交
85 86
#include <linux/msg.h>
#include <linux/shm.h>
L
Linus Torvalds 已提交
87 88 89 90

#include "avc.h"
#include "objsec.h"
#include "netif.h"
91
#include "netnode.h"
P
Paul Moore 已提交
92
#include "netport.h"
93
#include "xfrm.h"
94
#include "netlabel.h"
95
#include "audit.h"
96
#include "avc_ss.h"
L
Linus Torvalds 已提交
97

98
/* SECMARK reference count */
99
static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100

L
Linus Torvalds 已提交
101
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102
int selinux_enforcing;
L
Linus Torvalds 已提交
103 104 105

static int __init enforcing_setup(char *str)
{
106
	unsigned long enforcing;
107
	if (!kstrtoul(str, 0, &enforcing))
108
		selinux_enforcing = enforcing ? 1 : 0;
L
Linus Torvalds 已提交
109 110 111 112 113 114 115 116 117 118
	return 1;
}
__setup("enforcing=", enforcing_setup);
#endif

#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;

static int __init selinux_enabled_setup(char *str)
{
119
	unsigned long enabled;
120
	if (!kstrtoul(str, 0, &enabled))
121
		selinux_enabled = enabled ? 1 : 0;
L
Linus Torvalds 已提交
122 123 124
	return 1;
}
__setup("selinux=", selinux_enabled_setup);
125 126
#else
int selinux_enabled = 1;
L
Linus Torvalds 已提交
127 128
#endif

129
static struct kmem_cache *sel_inode_cache;
130

131 132 133 134 135 136 137
/**
 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 *
 * Description:
 * This function checks the SECMARK reference counter to see if any SECMARK
 * targets are currently configured, if the reference counter is greater than
 * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
138 139
 * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 * policy capability is enabled, SECMARK is always considered enabled.
140 141 142 143
 *
 */
static int selinux_secmark_enabled(void)
{
144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159
	return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
}

/**
 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 *
 * Description:
 * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 * (1) if any are enabled or false (0) if neither are enabled.  If the
 * always_check_network policy capability is enabled, peer labeling
 * is always considered enabled.
 *
 */
static int selinux_peerlbl_enabled(void)
{
	return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
160 161
}

162 163 164 165 166 167 168 169 170 171 172
static int selinux_netcache_avc_callback(u32 event)
{
	if (event == AVC_CALLBACK_RESET) {
		sel_netif_flush();
		sel_netnode_flush();
		sel_netport_flush();
		synchronize_net();
	}
	return 0;
}

D
David Howells 已提交
173 174 175 176
/*
 * initialise the security for the init task
 */
static void cred_init_security(void)
L
Linus Torvalds 已提交
177
{
178
	struct cred *cred = (struct cred *) current->real_cred;
L
Linus Torvalds 已提交
179 180
	struct task_security_struct *tsec;

J
James Morris 已提交
181
	tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
L
Linus Torvalds 已提交
182
	if (!tsec)
D
David Howells 已提交
183
		panic("SELinux:  Failed to initialize initial task.\n");
L
Linus Torvalds 已提交
184

D
David Howells 已提交
185
	tsec->osid = tsec->sid = SECINITSID_KERNEL;
186
	cred->security = tsec;
L
Linus Torvalds 已提交
187 188
}

189 190 191 192 193 194 195 196 197 198 199
/*
 * get the security ID of a set of credentials
 */
static inline u32 cred_sid(const struct cred *cred)
{
	const struct task_security_struct *tsec;

	tsec = cred->security;
	return tsec->sid;
}

200
/*
201
 * get the objective security ID of a task
202 203 204 205 206 207
 */
static inline u32 task_sid(const struct task_struct *task)
{
	u32 sid;

	rcu_read_lock();
208
	sid = cred_sid(__task_cred(task));
209 210 211 212 213
	rcu_read_unlock();
	return sid;
}

/*
214
 * get the subjective security ID of the current task
215 216 217
 */
static inline u32 current_sid(void)
{
218
	const struct task_security_struct *tsec = current_security();
219 220 221 222

	return tsec->sid;
}

223 224
/* Allocate and free functions for each kind of security blob. */

L
Linus Torvalds 已提交
225 226 227
static int inode_alloc_security(struct inode *inode)
{
	struct inode_security_struct *isec;
228
	u32 sid = current_sid();
L
Linus Torvalds 已提交
229

230
	isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
L
Linus Torvalds 已提交
231 232 233
	if (!isec)
		return -ENOMEM;

234
	mutex_init(&isec->lock);
L
Linus Torvalds 已提交
235 236 237 238
	INIT_LIST_HEAD(&isec->list);
	isec->inode = inode;
	isec->sid = SECINITSID_UNLABELED;
	isec->sclass = SECCLASS_FILE;
239
	isec->task_sid = sid;
L
Linus Torvalds 已提交
240 241 242 243 244
	inode->i_security = isec;

	return 0;
}

245 246 247 248 249 250 251 252
static void inode_free_rcu(struct rcu_head *head)
{
	struct inode_security_struct *isec;

	isec = container_of(head, struct inode_security_struct, rcu);
	kmem_cache_free(sel_inode_cache, isec);
}

L
Linus Torvalds 已提交
253 254 255 256 257 258 259 260 261 262
static void inode_free_security(struct inode *inode)
{
	struct inode_security_struct *isec = inode->i_security;
	struct superblock_security_struct *sbsec = inode->i_sb->s_security;

	spin_lock(&sbsec->isec_lock);
	if (!list_empty(&isec->list))
		list_del_init(&isec->list);
	spin_unlock(&sbsec->isec_lock);

263 264 265 266 267 268 269 270 271 272
	/*
	 * The inode may still be referenced in a path walk and
	 * a call to selinux_inode_permission() can be made
	 * after inode_free_security() is called. Ideally, the VFS
	 * wouldn't do this, but fixing that is a much harder
	 * job. For now, simply free the i_security via RCU, and
	 * leave the current inode->i_security pointer intact.
	 * The inode will be freed after the RCU grace period too.
	 */
	call_rcu(&isec->rcu, inode_free_rcu);
L
Linus Torvalds 已提交
273 274 275 276 277
}

static int file_alloc_security(struct file *file)
{
	struct file_security_struct *fsec;
278
	u32 sid = current_sid();
L
Linus Torvalds 已提交
279

280
	fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
L
Linus Torvalds 已提交
281 282 283
	if (!fsec)
		return -ENOMEM;

284 285
	fsec->sid = sid;
	fsec->fown_sid = sid;
L
Linus Torvalds 已提交
286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301
	file->f_security = fsec;

	return 0;
}

static void file_free_security(struct file *file)
{
	struct file_security_struct *fsec = file->f_security;
	file->f_security = NULL;
	kfree(fsec);
}

static int superblock_alloc_security(struct super_block *sb)
{
	struct superblock_security_struct *sbsec;

J
James Morris 已提交
302
	sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
L
Linus Torvalds 已提交
303 304 305
	if (!sbsec)
		return -ENOMEM;

306
	mutex_init(&sbsec->lock);
L
Linus Torvalds 已提交
307 308 309 310 311
	INIT_LIST_HEAD(&sbsec->isec_head);
	spin_lock_init(&sbsec->isec_lock);
	sbsec->sb = sb;
	sbsec->sid = SECINITSID_UNLABELED;
	sbsec->def_sid = SECINITSID_FILE;
312
	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
L
Linus Torvalds 已提交
313 314 315 316 317 318 319 320 321 322 323 324 325 326
	sb->s_security = sbsec;

	return 0;
}

static void superblock_free_security(struct super_block *sb)
{
	struct superblock_security_struct *sbsec = sb->s_security;
	sb->s_security = NULL;
	kfree(sbsec);
}

/* The file system's label must be initialized prior to use. */

327
static const char *labeling_behaviors[7] = {
L
Linus Torvalds 已提交
328 329 330 331 332 333
	"uses xattr",
	"uses transition SIDs",
	"uses task SIDs",
	"uses genfs_contexts",
	"not configured for labeling",
	"uses mountpoint labeling",
334
	"uses native labeling",
L
Linus Torvalds 已提交
335 336 337 338 339 340 341 342 343 344
};

static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);

static inline int inode_doinit(struct inode *inode)
{
	return inode_doinit_with_dentry(inode, NULL);
}

enum {
345
	Opt_error = -1,
L
Linus Torvalds 已提交
346 347
	Opt_context = 1,
	Opt_fscontext = 2,
348 349
	Opt_defcontext = 3,
	Opt_rootcontext = 4,
350
	Opt_labelsupport = 5,
351
	Opt_nextmntopt = 6,
L
Linus Torvalds 已提交
352 353
};

354 355
#define NUM_SEL_MNT_OPTS	(Opt_nextmntopt - 1)

356
static const match_table_t tokens = {
357 358 359 360
	{Opt_context, CONTEXT_STR "%s"},
	{Opt_fscontext, FSCONTEXT_STR "%s"},
	{Opt_defcontext, DEFCONTEXT_STR "%s"},
	{Opt_rootcontext, ROOTCONTEXT_STR "%s"},
361
	{Opt_labelsupport, LABELSUPP_STR},
362
	{Opt_error, NULL},
L
Linus Torvalds 已提交
363 364 365 366
};

#define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"

367 368
static int may_context_mount_sb_relabel(u32 sid,
			struct superblock_security_struct *sbsec,
369
			const struct cred *cred)
370
{
371
	const struct task_security_struct *tsec = cred->security;
372 373 374 375 376 377 378 379 380 381 382 383
	int rc;

	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
			  FILESYSTEM__RELABELFROM, NULL);
	if (rc)
		return rc;

	rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
			  FILESYSTEM__RELABELTO, NULL);
	return rc;
}

384 385
static int may_context_mount_inode_relabel(u32 sid,
			struct superblock_security_struct *sbsec,
386
			const struct cred *cred)
387
{
388
	const struct task_security_struct *tsec = cred->security;
389 390 391 392 393 394 395 396 397 398 399
	int rc;
	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
			  FILESYSTEM__RELABELFROM, NULL);
	if (rc)
		return rc;

	rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
			  FILESYSTEM__ASSOCIATE, NULL);
	return rc;
}

400 401 402 403
static int selinux_is_sblabel_mnt(struct super_block *sb)
{
	struct superblock_security_struct *sbsec = sb->s_security;

404 405 406 407 408 409 410 411
	return sbsec->behavior == SECURITY_FS_USE_XATTR ||
		sbsec->behavior == SECURITY_FS_USE_TRANS ||
		sbsec->behavior == SECURITY_FS_USE_TASK ||
		/* Special handling. Genfs but also in-core setxattr handler */
		!strcmp(sb->s_type->name, "sysfs") ||
		!strcmp(sb->s_type->name, "pstore") ||
		!strcmp(sb->s_type->name, "debugfs") ||
		!strcmp(sb->s_type->name, "rootfs");
412 413
}

414
static int sb_finish_set_opts(struct super_block *sb)
L
Linus Torvalds 已提交
415 416
{
	struct superblock_security_struct *sbsec = sb->s_security;
417 418 419
	struct dentry *root = sb->s_root;
	struct inode *root_inode = root->d_inode;
	int rc = 0;
L
Linus Torvalds 已提交
420

421 422 423 424 425 426 427
	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
		/* Make sure that the xattr handler exists and that no
		   error other than -ENODATA is returned by getxattr on
		   the root directory.  -ENODATA is ok, as this may be
		   the first boot of the SELinux kernel before we have
		   assigned xattr values to the filesystem. */
		if (!root_inode->i_op->getxattr) {
428 429
			printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
			       "xattr support\n", sb->s_id, sb->s_type->name);
430 431 432 433 434 435 436
			rc = -EOPNOTSUPP;
			goto out;
		}
		rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
		if (rc < 0 && rc != -ENODATA) {
			if (rc == -EOPNOTSUPP)
				printk(KERN_WARNING "SELinux: (dev %s, type "
437 438
				       "%s) has no security xattr handler\n",
				       sb->s_id, sb->s_type->name);
439 440
			else
				printk(KERN_WARNING "SELinux: (dev %s, type "
441 442
				       "%s) getxattr errno %d\n", sb->s_id,
				       sb->s_type->name, -rc);
443 444 445
			goto out;
		}
	}
L
Linus Torvalds 已提交
446

447
	if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
448 449
		printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
		       sb->s_id, sb->s_type->name);
L
Linus Torvalds 已提交
450

451
	sbsec->flags |= SE_SBINITIALIZED;
452
	if (selinux_is_sblabel_mnt(sb))
453
		sbsec->flags |= SBLABEL_MNT;
454

455 456
	/* Initialize the root inode. */
	rc = inode_doinit_with_dentry(root_inode, root);
L
Linus Torvalds 已提交
457

458 459 460 461 462 463 464 465 466 467 468
	/* Initialize any other inodes associated with the superblock, e.g.
	   inodes created prior to initial policy load or inodes created
	   during get_sb by a pseudo filesystem that directly
	   populates itself. */
	spin_lock(&sbsec->isec_lock);
next_inode:
	if (!list_empty(&sbsec->isec_head)) {
		struct inode_security_struct *isec =
				list_entry(sbsec->isec_head.next,
					   struct inode_security_struct, list);
		struct inode *inode = isec->inode;
469
		list_del_init(&isec->list);
470 471 472 473 474 475 476 477 478 479 480 481 482 483
		spin_unlock(&sbsec->isec_lock);
		inode = igrab(inode);
		if (inode) {
			if (!IS_PRIVATE(inode))
				inode_doinit(inode);
			iput(inode);
		}
		spin_lock(&sbsec->isec_lock);
		goto next_inode;
	}
	spin_unlock(&sbsec->isec_lock);
out:
	return rc;
}
L
Linus Torvalds 已提交
484

485 486 487 488 489 490
/*
 * This function should allow an FS to ask what it's mount security
 * options were so it can use those later for submounts, displaying
 * mount options, or whatever.
 */
static int selinux_get_mnt_opts(const struct super_block *sb,
491
				struct security_mnt_opts *opts)
492 493 494 495 496 497
{
	int rc = 0, i;
	struct superblock_security_struct *sbsec = sb->s_security;
	char *context = NULL;
	u32 len;
	char tmp;
L
Linus Torvalds 已提交
498

499
	security_init_mnt_opts(opts);
L
Linus Torvalds 已提交
500

501
	if (!(sbsec->flags & SE_SBINITIALIZED))
502
		return -EINVAL;
L
Linus Torvalds 已提交
503

504 505
	if (!ss_initialized)
		return -EINVAL;
L
Linus Torvalds 已提交
506

507 508 509
	/* make sure we always check enough bits to cover the mask */
	BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));

510
	tmp = sbsec->flags & SE_MNTMASK;
511
	/* count the number of mount options for this sb */
512
	for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
513
		if (tmp & 0x01)
514
			opts->num_mnt_opts++;
515 516
		tmp >>= 1;
	}
517
	/* Check if the Label support flag is set */
518
	if (sbsec->flags & SBLABEL_MNT)
519
		opts->num_mnt_opts++;
L
Linus Torvalds 已提交
520

521 522
	opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
	if (!opts->mnt_opts) {
523 524 525
		rc = -ENOMEM;
		goto out_free;
	}
L
Linus Torvalds 已提交
526

527 528
	opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
	if (!opts->mnt_opts_flags) {
529 530 531
		rc = -ENOMEM;
		goto out_free;
	}
L
Linus Torvalds 已提交
532

533 534 535 536 537
	i = 0;
	if (sbsec->flags & FSCONTEXT_MNT) {
		rc = security_sid_to_context(sbsec->sid, &context, &len);
		if (rc)
			goto out_free;
538 539
		opts->mnt_opts[i] = context;
		opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
540 541 542 543 544
	}
	if (sbsec->flags & CONTEXT_MNT) {
		rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
		if (rc)
			goto out_free;
545 546
		opts->mnt_opts[i] = context;
		opts->mnt_opts_flags[i++] = CONTEXT_MNT;
547 548 549 550 551
	}
	if (sbsec->flags & DEFCONTEXT_MNT) {
		rc = security_sid_to_context(sbsec->def_sid, &context, &len);
		if (rc)
			goto out_free;
552 553
		opts->mnt_opts[i] = context;
		opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
554 555 556 557
	}
	if (sbsec->flags & ROOTCONTEXT_MNT) {
		struct inode *root = sbsec->sb->s_root->d_inode;
		struct inode_security_struct *isec = root->i_security;
558

559 560 561
		rc = security_sid_to_context(isec->sid, &context, &len);
		if (rc)
			goto out_free;
562 563
		opts->mnt_opts[i] = context;
		opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
564
	}
565
	if (sbsec->flags & SBLABEL_MNT) {
566
		opts->mnt_opts[i] = NULL;
567
		opts->mnt_opts_flags[i++] = SBLABEL_MNT;
568
	}
L
Linus Torvalds 已提交
569

570
	BUG_ON(i != opts->num_mnt_opts);
L
Linus Torvalds 已提交
571

572 573 574
	return 0;

out_free:
575
	security_free_mnt_opts(opts);
576 577
	return rc;
}
L
Linus Torvalds 已提交
578

579 580 581
static int bad_option(struct superblock_security_struct *sbsec, char flag,
		      u32 old_sid, u32 new_sid)
{
582 583
	char mnt_flags = sbsec->flags & SE_MNTMASK;

584
	/* check if the old mount command had the same options */
585
	if (sbsec->flags & SE_SBINITIALIZED)
586 587 588 589 590 591 592
		if (!(sbsec->flags & flag) ||
		    (old_sid != new_sid))
			return 1;

	/* check if we were passed the same options twice,
	 * aka someone passed context=a,context=b
	 */
593 594
	if (!(sbsec->flags & SE_SBINITIALIZED))
		if (mnt_flags & flag)
595 596 597
			return 1;
	return 0;
}
598

599 600 601 602
/*
 * Allow filesystems with binary mount data to explicitly set mount point
 * labeling information.
 */
603
static int selinux_set_mnt_opts(struct super_block *sb,
604 605 606
				struct security_mnt_opts *opts,
				unsigned long kern_flags,
				unsigned long *set_kern_flags)
607
{
608
	const struct cred *cred = current_cred();
609 610
	int rc = 0, i;
	struct superblock_security_struct *sbsec = sb->s_security;
611
	const char *name = sb->s_type->name;
612 613
	struct inode *inode = sbsec->sb->s_root->d_inode;
	struct inode_security_struct *root_isec = inode->i_security;
614 615
	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
	u32 defcontext_sid = 0;
616 617 618
	char **mount_options = opts->mnt_opts;
	int *flags = opts->mnt_opts_flags;
	int num_opts = opts->num_mnt_opts;
619 620 621 622 623 624 625 626 627 628 629

	mutex_lock(&sbsec->lock);

	if (!ss_initialized) {
		if (!num_opts) {
			/* Defer initialization until selinux_complete_init,
			   after the initial policy is loaded and the security
			   server is ready to handle calls. */
			goto out;
		}
		rc = -EINVAL;
E
Eric Paris 已提交
630 631
		printk(KERN_WARNING "SELinux: Unable to set superblock options "
			"before the security server is initialized\n");
L
Linus Torvalds 已提交
632
		goto out;
633
	}
634 635 636 637 638 639
	if (kern_flags && !set_kern_flags) {
		/* Specifying internal flags without providing a place to
		 * place the results is not allowed */
		rc = -EINVAL;
		goto out;
	}
L
Linus Torvalds 已提交
640

641 642 643 644 645 646 647 648 649 650 651
	/*
	 * Binary mount data FS will come through this function twice.  Once
	 * from an explicit call and once from the generic calls from the vfs.
	 * Since the generic VFS calls will not contain any security mount data
	 * we need to skip the double mount verification.
	 *
	 * This does open a hole in which we will not notice if the first
	 * mount using this sb set explict options and a second mount using
	 * this sb does not set any security options.  (The first options
	 * will be used for both mounts)
	 */
652
	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
653
	    && (num_opts == 0))
654
		goto out;
655

656 657 658 659 660 661 662
	/*
	 * parse the mount options, check if they are valid sids.
	 * also check if someone is trying to mount the same sb more
	 * than once with different security options.
	 */
	for (i = 0; i < num_opts; i++) {
		u32 sid;
663

664
		if (flags[i] == SBLABEL_MNT)
665
			continue;
666
		rc = security_context_to_sid(mount_options[i],
667
					     strlen(mount_options[i]), &sid, GFP_KERNEL);
L
Linus Torvalds 已提交
668 669
		if (rc) {
			printk(KERN_WARNING "SELinux: security_context_to_sid"
670 671
			       "(%s) failed for (dev %s, type %s) errno=%d\n",
			       mount_options[i], sb->s_id, name, rc);
672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715
			goto out;
		}
		switch (flags[i]) {
		case FSCONTEXT_MNT:
			fscontext_sid = sid;

			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
					fscontext_sid))
				goto out_double_mount;

			sbsec->flags |= FSCONTEXT_MNT;
			break;
		case CONTEXT_MNT:
			context_sid = sid;

			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
					context_sid))
				goto out_double_mount;

			sbsec->flags |= CONTEXT_MNT;
			break;
		case ROOTCONTEXT_MNT:
			rootcontext_sid = sid;

			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
					rootcontext_sid))
				goto out_double_mount;

			sbsec->flags |= ROOTCONTEXT_MNT;

			break;
		case DEFCONTEXT_MNT:
			defcontext_sid = sid;

			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
					defcontext_sid))
				goto out_double_mount;

			sbsec->flags |= DEFCONTEXT_MNT;

			break;
		default:
			rc = -EINVAL;
			goto out;
L
Linus Torvalds 已提交
716
		}
717 718
	}

719
	if (sbsec->flags & SE_SBINITIALIZED) {
720
		/* previously mounted with options, but not on this attempt? */
721
		if ((sbsec->flags & SE_MNTMASK) && !num_opts)
722 723 724 725 726
			goto out_double_mount;
		rc = 0;
		goto out;
	}

727
	if (strcmp(sb->s_type->name, "proc") == 0)
728
		sbsec->flags |= SE_SBPROC;
729

730 731 732 733 734
	if (!sbsec->behavior) {
		/*
		 * Determine the labeling behavior to use for this
		 * filesystem type.
		 */
735
		rc = security_fs_use(sb);
736 737 738 739 740 741
		if (rc) {
			printk(KERN_WARNING
				"%s: security_fs_use(%s) returned %d\n",
					__func__, sb->s_type->name, rc);
			goto out;
		}
742 743 744
	}
	/* sets the context of the superblock for the fs being mounted. */
	if (fscontext_sid) {
745
		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
L
Linus Torvalds 已提交
746
		if (rc)
747
			goto out;
L
Linus Torvalds 已提交
748

749
		sbsec->sid = fscontext_sid;
750 751 752 753 754 755 756
	}

	/*
	 * Switch to using mount point labeling behavior.
	 * sets the label used on all file below the mountpoint, and will set
	 * the superblock context if not already set.
	 */
757 758 759 760 761
	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
		sbsec->behavior = SECURITY_FS_USE_NATIVE;
		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
	}

762 763
	if (context_sid) {
		if (!fscontext_sid) {
764 765
			rc = may_context_mount_sb_relabel(context_sid, sbsec,
							  cred);
766
			if (rc)
767 768
				goto out;
			sbsec->sid = context_sid;
769
		} else {
770 771
			rc = may_context_mount_inode_relabel(context_sid, sbsec,
							     cred);
772
			if (rc)
773
				goto out;
774
		}
775 776
		if (!rootcontext_sid)
			rootcontext_sid = context_sid;
L
Linus Torvalds 已提交
777

778
		sbsec->mntpoint_sid = context_sid;
779
		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
L
Linus Torvalds 已提交
780 781
	}

782
	if (rootcontext_sid) {
783 784
		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
						     cred);
785
		if (rc)
786
			goto out;
787

788 789
		root_isec->sid = rootcontext_sid;
		root_isec->initialized = 1;
790 791
	}

792
	if (defcontext_sid) {
793 794
		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
795 796 797 798
			rc = -EINVAL;
			printk(KERN_WARNING "SELinux: defcontext option is "
			       "invalid for this filesystem type\n");
			goto out;
L
Linus Torvalds 已提交
799 800
		}

801 802
		if (defcontext_sid != sbsec->def_sid) {
			rc = may_context_mount_inode_relabel(defcontext_sid,
803
							     sbsec, cred);
804 805 806
			if (rc)
				goto out;
		}
L
Linus Torvalds 已提交
807

808
		sbsec->def_sid = defcontext_sid;
L
Linus Torvalds 已提交
809 810
	}

811
	rc = sb_finish_set_opts(sb);
L
Linus Torvalds 已提交
812
out:
813
	mutex_unlock(&sbsec->lock);
L
Linus Torvalds 已提交
814
	return rc;
815 816 817
out_double_mount:
	rc = -EINVAL;
	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
818
	       "security settings for (dev %s, type %s)\n", sb->s_id, name);
819
	goto out;
L
Linus Torvalds 已提交
820 821
}

822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852
static int selinux_cmp_sb_context(const struct super_block *oldsb,
				    const struct super_block *newsb)
{
	struct superblock_security_struct *old = oldsb->s_security;
	struct superblock_security_struct *new = newsb->s_security;
	char oldflags = old->flags & SE_MNTMASK;
	char newflags = new->flags & SE_MNTMASK;

	if (oldflags != newflags)
		goto mismatch;
	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
		goto mismatch;
	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
		goto mismatch;
	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
		goto mismatch;
	if (oldflags & ROOTCONTEXT_MNT) {
		struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
		struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
		if (oldroot->sid != newroot->sid)
			goto mismatch;
	}
	return 0;
mismatch:
	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
			    "different security settings for (dev %s, "
			    "type %s)\n", newsb->s_id, newsb->s_type->name);
	return -EBUSY;
}

static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
853
					struct super_block *newsb)
L
Linus Torvalds 已提交
854
{
855 856
	const struct superblock_security_struct *oldsbsec = oldsb->s_security;
	struct superblock_security_struct *newsbsec = newsb->s_security;
L
Linus Torvalds 已提交
857

858 859 860
	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
L
Linus Torvalds 已提交
861

862 863
	/*
	 * if the parent was able to be mounted it clearly had no special lsm
864
	 * mount options.  thus we can safely deal with this superblock later
865
	 */
866
	if (!ss_initialized)
867
		return 0;
868 869

	/* how can we clone if the old one wasn't set up?? */
870
	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
871

872
	/* if fs is reusing a sb, make sure that the contexts match */
873
	if (newsbsec->flags & SE_SBINITIALIZED)
874
		return selinux_cmp_sb_context(oldsb, newsb);
875

876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894
	mutex_lock(&newsbsec->lock);

	newsbsec->flags = oldsbsec->flags;

	newsbsec->sid = oldsbsec->sid;
	newsbsec->def_sid = oldsbsec->def_sid;
	newsbsec->behavior = oldsbsec->behavior;

	if (set_context) {
		u32 sid = oldsbsec->mntpoint_sid;

		if (!set_fscontext)
			newsbsec->sid = sid;
		if (!set_rootcontext) {
			struct inode *newinode = newsb->s_root->d_inode;
			struct inode_security_struct *newisec = newinode->i_security;
			newisec->sid = sid;
		}
		newsbsec->mntpoint_sid = sid;
L
Linus Torvalds 已提交
895
	}
896 897 898 899 900
	if (set_rootcontext) {
		const struct inode *oldinode = oldsb->s_root->d_inode;
		const struct inode_security_struct *oldisec = oldinode->i_security;
		struct inode *newinode = newsb->s_root->d_inode;
		struct inode_security_struct *newisec = newinode->i_security;
L
Linus Torvalds 已提交
901

902
		newisec->sid = oldisec->sid;
L
Linus Torvalds 已提交
903 904
	}

905 906
	sb_finish_set_opts(newsb);
	mutex_unlock(&newsbsec->lock);
907
	return 0;
908 909
}

910 911
static int selinux_parse_opts_str(char *options,
				  struct security_mnt_opts *opts)
912
{
913
	char *p;
914 915
	char *context = NULL, *defcontext = NULL;
	char *fscontext = NULL, *rootcontext = NULL;
916
	int rc, num_mnt_opts = 0;
L
Linus Torvalds 已提交
917

918
	opts->num_mnt_opts = 0;
L
Linus Torvalds 已提交
919

920 921 922 923
	/* Standard string-based options. */
	while ((p = strsep(&options, "|")) != NULL) {
		int token;
		substring_t args[MAX_OPT_ARGS];
L
Linus Torvalds 已提交
924

925 926
		if (!*p)
			continue;
L
Linus Torvalds 已提交
927

928
		token = match_token(p, tokens, args);
L
Linus Torvalds 已提交
929

930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981
		switch (token) {
		case Opt_context:
			if (context || defcontext) {
				rc = -EINVAL;
				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
				goto out_err;
			}
			context = match_strdup(&args[0]);
			if (!context) {
				rc = -ENOMEM;
				goto out_err;
			}
			break;

		case Opt_fscontext:
			if (fscontext) {
				rc = -EINVAL;
				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
				goto out_err;
			}
			fscontext = match_strdup(&args[0]);
			if (!fscontext) {
				rc = -ENOMEM;
				goto out_err;
			}
			break;

		case Opt_rootcontext:
			if (rootcontext) {
				rc = -EINVAL;
				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
				goto out_err;
			}
			rootcontext = match_strdup(&args[0]);
			if (!rootcontext) {
				rc = -ENOMEM;
				goto out_err;
			}
			break;

		case Opt_defcontext:
			if (context || defcontext) {
				rc = -EINVAL;
				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
				goto out_err;
			}
			defcontext = match_strdup(&args[0]);
			if (!defcontext) {
				rc = -ENOMEM;
				goto out_err;
			}
			break;
982 983
		case Opt_labelsupport:
			break;
984 985 986 987
		default:
			rc = -EINVAL;
			printk(KERN_WARNING "SELinux:  unknown mount option\n");
			goto out_err;
L
Linus Torvalds 已提交
988 989 990

		}
	}
991

992 993 994 995 996 997 998 999 1000 1001 1002
	rc = -ENOMEM;
	opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
	if (!opts->mnt_opts)
		goto out_err;

	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
	if (!opts->mnt_opts_flags) {
		kfree(opts->mnt_opts);
		goto out_err;
	}

1003
	if (fscontext) {
1004 1005
		opts->mnt_opts[num_mnt_opts] = fscontext;
		opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1006 1007
	}
	if (context) {
1008 1009
		opts->mnt_opts[num_mnt_opts] = context;
		opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1010 1011
	}
	if (rootcontext) {
1012 1013
		opts->mnt_opts[num_mnt_opts] = rootcontext;
		opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1014 1015
	}
	if (defcontext) {
1016 1017
		opts->mnt_opts[num_mnt_opts] = defcontext;
		opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1018 1019
	}

1020 1021 1022
	opts->num_mnt_opts = num_mnt_opts;
	return 0;

1023 1024 1025 1026 1027
out_err:
	kfree(context);
	kfree(defcontext);
	kfree(fscontext);
	kfree(rootcontext);
L
Linus Torvalds 已提交
1028 1029
	return rc;
}
1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050
/*
 * string mount options parsing and call set the sbsec
 */
static int superblock_doinit(struct super_block *sb, void *data)
{
	int rc = 0;
	char *options = data;
	struct security_mnt_opts opts;

	security_init_mnt_opts(&opts);

	if (!data)
		goto out;

	BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);

	rc = selinux_parse_opts_str(options, &opts);
	if (rc)
		goto out_err;

out:
1051
	rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1052 1053 1054 1055 1056

out_err:
	security_free_mnt_opts(&opts);
	return rc;
}
L
Linus Torvalds 已提交
1057

A
Adrian Bunk 已提交
1058 1059
static void selinux_write_opts(struct seq_file *m,
			       struct security_mnt_opts *opts)
1060 1061 1062 1063 1064
{
	int i;
	char *prefix;

	for (i = 0; i < opts->num_mnt_opts; i++) {
1065 1066 1067 1068 1069 1070
		char *has_comma;

		if (opts->mnt_opts[i])
			has_comma = strchr(opts->mnt_opts[i], ',');
		else
			has_comma = NULL;
1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084

		switch (opts->mnt_opts_flags[i]) {
		case CONTEXT_MNT:
			prefix = CONTEXT_STR;
			break;
		case FSCONTEXT_MNT:
			prefix = FSCONTEXT_STR;
			break;
		case ROOTCONTEXT_MNT:
			prefix = ROOTCONTEXT_STR;
			break;
		case DEFCONTEXT_MNT:
			prefix = DEFCONTEXT_STR;
			break;
1085
		case SBLABEL_MNT:
1086 1087 1088
			seq_putc(m, ',');
			seq_puts(m, LABELSUPP_STR);
			continue;
1089 1090
		default:
			BUG();
1091
			return;
1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109
		};
		/* we need a comma before each option */
		seq_putc(m, ',');
		seq_puts(m, prefix);
		if (has_comma)
			seq_putc(m, '\"');
		seq_puts(m, opts->mnt_opts[i]);
		if (has_comma)
			seq_putc(m, '\"');
	}
}

static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
{
	struct security_mnt_opts opts;
	int rc;

	rc = selinux_get_mnt_opts(sb, &opts);
1110 1111 1112 1113
	if (rc) {
		/* before policy load we may get EINVAL, don't show anything */
		if (rc == -EINVAL)
			rc = 0;
1114
		return rc;
1115
	}
1116 1117 1118 1119 1120 1121 1122 1123

	selinux_write_opts(m, &opts);

	security_free_mnt_opts(&opts);

	return rc;
}

L
Linus Torvalds 已提交
1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146
static inline u16 inode_mode_to_security_class(umode_t mode)
{
	switch (mode & S_IFMT) {
	case S_IFSOCK:
		return SECCLASS_SOCK_FILE;
	case S_IFLNK:
		return SECCLASS_LNK_FILE;
	case S_IFREG:
		return SECCLASS_FILE;
	case S_IFBLK:
		return SECCLASS_BLK_FILE;
	case S_IFDIR:
		return SECCLASS_DIR;
	case S_IFCHR:
		return SECCLASS_CHR_FILE;
	case S_IFIFO:
		return SECCLASS_FIFO_FILE;

	}

	return SECCLASS_FILE;
}

1147 1148 1149 1150 1151 1152 1153 1154 1155 1156
static inline int default_protocol_stream(int protocol)
{
	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
}

static inline int default_protocol_dgram(int protocol)
{
	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
}

L
Linus Torvalds 已提交
1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172
static inline u16 socket_type_to_security_class(int family, int type, int protocol)
{
	switch (family) {
	case PF_UNIX:
		switch (type) {
		case SOCK_STREAM:
		case SOCK_SEQPACKET:
			return SECCLASS_UNIX_STREAM_SOCKET;
		case SOCK_DGRAM:
			return SECCLASS_UNIX_DGRAM_SOCKET;
		}
		break;
	case PF_INET:
	case PF_INET6:
		switch (type) {
		case SOCK_STREAM:
1173 1174 1175 1176
			if (default_protocol_stream(protocol))
				return SECCLASS_TCP_SOCKET;
			else
				return SECCLASS_RAWIP_SOCKET;
L
Linus Torvalds 已提交
1177
		case SOCK_DGRAM:
1178 1179 1180 1181
			if (default_protocol_dgram(protocol))
				return SECCLASS_UDP_SOCKET;
			else
				return SECCLASS_RAWIP_SOCKET;
J
James Morris 已提交
1182 1183
		case SOCK_DCCP:
			return SECCLASS_DCCP_SOCKET;
1184
		default:
L
Linus Torvalds 已提交
1185 1186 1187 1188 1189 1190 1191 1192 1193
			return SECCLASS_RAWIP_SOCKET;
		}
		break;
	case PF_NETLINK:
		switch (protocol) {
		case NETLINK_ROUTE:
			return SECCLASS_NETLINK_ROUTE_SOCKET;
		case NETLINK_FIREWALL:
			return SECCLASS_NETLINK_FIREWALL_SOCKET;
1194
		case NETLINK_SOCK_DIAG:
L
Linus Torvalds 已提交
1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207
			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
		case NETLINK_NFLOG:
			return SECCLASS_NETLINK_NFLOG_SOCKET;
		case NETLINK_XFRM:
			return SECCLASS_NETLINK_XFRM_SOCKET;
		case NETLINK_SELINUX:
			return SECCLASS_NETLINK_SELINUX_SOCKET;
		case NETLINK_AUDIT:
			return SECCLASS_NETLINK_AUDIT_SOCKET;
		case NETLINK_IP6_FW:
			return SECCLASS_NETLINK_IP6FW_SOCKET;
		case NETLINK_DNRTMSG:
			return SECCLASS_NETLINK_DNRT_SOCKET;
1208 1209
		case NETLINK_KOBJECT_UEVENT:
			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
L
Linus Torvalds 已提交
1210 1211 1212 1213 1214 1215 1216
		default:
			return SECCLASS_NETLINK_SOCKET;
		}
	case PF_PACKET:
		return SECCLASS_PACKET_SOCKET;
	case PF_KEY:
		return SECCLASS_KEY_SOCKET;
1217 1218
	case PF_APPLETALK:
		return SECCLASS_APPLETALK_SOCKET;
L
Linus Torvalds 已提交
1219 1220 1221 1222 1223 1224
	}

	return SECCLASS_SOCKET;
}

#ifdef CONFIG_PROC_FS
1225
static int selinux_proc_get_sid(struct dentry *dentry,
L
Linus Torvalds 已提交
1226 1227 1228
				u16 tclass,
				u32 *sid)
{
1229 1230
	int rc;
	char *buffer, *path;
L
Linus Torvalds 已提交
1231

1232
	buffer = (char *)__get_free_page(GFP_KERNEL);
L
Linus Torvalds 已提交
1233 1234 1235
	if (!buffer)
		return -ENOMEM;

1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247
	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
	if (IS_ERR(path))
		rc = PTR_ERR(path);
	else {
		/* each process gets a /proc/PID/ entry. Strip off the
		 * PID part to get a valid selinux labeling.
		 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
		while (path[1] >= '0' && path[1] <= '9') {
			path[1] = '/';
			path++;
		}
		rc = security_genfs_sid("proc", path, tclass, sid);
L
Linus Torvalds 已提交
1248 1249 1250 1251 1252
	}
	free_page((unsigned long)buffer);
	return rc;
}
#else
1253
static int selinux_proc_get_sid(struct dentry *dentry,
L
Linus Torvalds 已提交
1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275
				u16 tclass,
				u32 *sid)
{
	return -EINVAL;
}
#endif

/* The inode's security attributes must be initialized before first use. */
static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
{
	struct superblock_security_struct *sbsec = NULL;
	struct inode_security_struct *isec = inode->i_security;
	u32 sid;
	struct dentry *dentry;
#define INITCONTEXTLEN 255
	char *context = NULL;
	unsigned len = 0;
	int rc = 0;

	if (isec->initialized)
		goto out;

1276
	mutex_lock(&isec->lock);
L
Linus Torvalds 已提交
1277
	if (isec->initialized)
1278
		goto out_unlock;
L
Linus Torvalds 已提交
1279 1280

	sbsec = inode->i_sb->s_security;
1281
	if (!(sbsec->flags & SE_SBINITIALIZED)) {
L
Linus Torvalds 已提交
1282 1283 1284 1285 1286 1287 1288
		/* Defer initialization until selinux_complete_init,
		   after the initial policy is loaded and the security
		   server is ready to handle calls. */
		spin_lock(&sbsec->isec_lock);
		if (list_empty(&isec->list))
			list_add(&isec->list, &sbsec->isec_head);
		spin_unlock(&sbsec->isec_lock);
1289
		goto out_unlock;
L
Linus Torvalds 已提交
1290 1291 1292
	}

	switch (sbsec->behavior) {
1293 1294
	case SECURITY_FS_USE_NATIVE:
		break;
L
Linus Torvalds 已提交
1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310
	case SECURITY_FS_USE_XATTR:
		if (!inode->i_op->getxattr) {
			isec->sid = sbsec->def_sid;
			break;
		}

		/* Need a dentry, since the xattr API requires one.
		   Life would be simpler if we could just pass the inode. */
		if (opt_dentry) {
			/* Called from d_instantiate or d_splice_alias. */
			dentry = dget(opt_dentry);
		} else {
			/* Called from selinux_complete_init, try to find a dentry. */
			dentry = d_find_alias(inode);
		}
		if (!dentry) {
1311 1312 1313 1314 1315 1316 1317 1318 1319
			/*
			 * this is can be hit on boot when a file is accessed
			 * before the policy is loaded.  When we load policy we
			 * may find inodes that have no dentry on the
			 * sbsec->isec_head list.  No reason to complain as these
			 * will get fixed up the next time we go through
			 * inode_doinit with a dentry, before these inodes could
			 * be used again by userspace.
			 */
1320
			goto out_unlock;
L
Linus Torvalds 已提交
1321 1322 1323
		}

		len = INITCONTEXTLEN;
1324
		context = kmalloc(len+1, GFP_NOFS);
L
Linus Torvalds 已提交
1325 1326 1327
		if (!context) {
			rc = -ENOMEM;
			dput(dentry);
1328
			goto out_unlock;
L
Linus Torvalds 已提交
1329
		}
1330
		context[len] = '\0';
L
Linus Torvalds 已提交
1331 1332 1333
		rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
					   context, len);
		if (rc == -ERANGE) {
1334 1335
			kfree(context);

L
Linus Torvalds 已提交
1336 1337 1338 1339 1340
			/* Need a larger buffer.  Query for the right size. */
			rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
						   NULL, 0);
			if (rc < 0) {
				dput(dentry);
1341
				goto out_unlock;
L
Linus Torvalds 已提交
1342 1343
			}
			len = rc;
1344
			context = kmalloc(len+1, GFP_NOFS);
L
Linus Torvalds 已提交
1345 1346 1347
			if (!context) {
				rc = -ENOMEM;
				dput(dentry);
1348
				goto out_unlock;
L
Linus Torvalds 已提交
1349
			}
1350
			context[len] = '\0';
L
Linus Torvalds 已提交
1351 1352 1353 1354 1355 1356 1357
			rc = inode->i_op->getxattr(dentry,
						   XATTR_NAME_SELINUX,
						   context, len);
		}
		dput(dentry);
		if (rc < 0) {
			if (rc != -ENODATA) {
E
Eric Paris 已提交
1358
				printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1359
				       "%d for dev=%s ino=%ld\n", __func__,
L
Linus Torvalds 已提交
1360 1361
				       -rc, inode->i_sb->s_id, inode->i_ino);
				kfree(context);
1362
				goto out_unlock;
L
Linus Torvalds 已提交
1363 1364 1365 1366 1367
			}
			/* Map ENODATA to the default file SID */
			sid = sbsec->def_sid;
			rc = 0;
		} else {
1368
			rc = security_context_to_sid_default(context, rc, &sid,
1369 1370
							     sbsec->def_sid,
							     GFP_NOFS);
L
Linus Torvalds 已提交
1371
			if (rc) {
1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384
				char *dev = inode->i_sb->s_id;
				unsigned long ino = inode->i_ino;

				if (rc == -EINVAL) {
					if (printk_ratelimit())
						printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
							"context=%s.  This indicates you may need to relabel the inode or the "
							"filesystem in question.\n", ino, dev, context);
				} else {
					printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
					       "returned %d for dev=%s ino=%ld\n",
					       __func__, context, -rc, dev, ino);
				}
L
Linus Torvalds 已提交
1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402
				kfree(context);
				/* Leave with the unlabeled SID */
				rc = 0;
				break;
			}
		}
		kfree(context);
		isec->sid = sid;
		break;
	case SECURITY_FS_USE_TASK:
		isec->sid = isec->task_sid;
		break;
	case SECURITY_FS_USE_TRANS:
		/* Default to the fs SID. */
		isec->sid = sbsec->sid;

		/* Try to obtain a transition SID. */
		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1403 1404
		rc = security_transition_sid(isec->task_sid, sbsec->sid,
					     isec->sclass, NULL, &sid);
L
Linus Torvalds 已提交
1405
		if (rc)
1406
			goto out_unlock;
L
Linus Torvalds 已提交
1407 1408
		isec->sid = sid;
		break;
1409 1410 1411
	case SECURITY_FS_USE_MNTPOINT:
		isec->sid = sbsec->mntpoint_sid;
		break;
L
Linus Torvalds 已提交
1412
	default:
1413
		/* Default to the fs superblock SID. */
L
Linus Torvalds 已提交
1414 1415
		isec->sid = sbsec->sid;

1416
		if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443
			/* We must have a dentry to determine the label on
			 * procfs inodes */
			if (opt_dentry)
				/* Called from d_instantiate or
				 * d_splice_alias. */
				dentry = dget(opt_dentry);
			else
				/* Called from selinux_complete_init, try to
				 * find a dentry. */
				dentry = d_find_alias(inode);
			/*
			 * This can be hit on boot when a file is accessed
			 * before the policy is loaded.  When we load policy we
			 * may find inodes that have no dentry on the
			 * sbsec->isec_head list.  No reason to complain as
			 * these will get fixed up the next time we go through
			 * inode_doinit() with a dentry, before these inodes
			 * could be used again by userspace.
			 */
			if (!dentry)
				goto out_unlock;
			isec->sclass = inode_mode_to_security_class(inode->i_mode);
			rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
			dput(dentry);
			if (rc)
				goto out_unlock;
			isec->sid = sid;
L
Linus Torvalds 已提交
1444 1445 1446 1447 1448 1449
		}
		break;
	}

	isec->initialized = 1;

1450 1451
out_unlock:
	mutex_unlock(&isec->lock);
L
Linus Torvalds 已提交
1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484
out:
	if (isec->sclass == SECCLASS_FILE)
		isec->sclass = inode_mode_to_security_class(inode->i_mode);
	return rc;
}

/* Convert a Linux signal to an access vector. */
static inline u32 signal_to_av(int sig)
{
	u32 perm = 0;

	switch (sig) {
	case SIGCHLD:
		/* Commonly granted from child to parent. */
		perm = PROCESS__SIGCHLD;
		break;
	case SIGKILL:
		/* Cannot be caught or ignored */
		perm = PROCESS__SIGKILL;
		break;
	case SIGSTOP:
		/* Cannot be caught or ignored */
		perm = PROCESS__SIGSTOP;
		break;
	default:
		/* All other signals. */
		perm = PROCESS__SIGNAL;
		break;
	}

	return perm;
}

D
David Howells 已提交
1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497
/*
 * Check permission between a pair of credentials
 * fork check, ptrace check, etc.
 */
static int cred_has_perm(const struct cred *actor,
			 const struct cred *target,
			 u32 perms)
{
	u32 asid = cred_sid(actor), tsid = cred_sid(target);

	return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
}

1498
/*
1499
 * Check permission between a pair of tasks, e.g. signal checks,
1500 1501
 * fork check, ptrace check, etc.
 * tsk1 is the actor and tsk2 is the target
1502
 * - this uses the default subjective creds of tsk1
1503 1504 1505
 */
static int task_has_perm(const struct task_struct *tsk1,
			 const struct task_struct *tsk2,
L
Linus Torvalds 已提交
1506 1507
			 u32 perms)
{
1508 1509
	const struct task_security_struct *__tsec1, *__tsec2;
	u32 sid1, sid2;
L
Linus Torvalds 已提交
1510

1511 1512 1513 1514 1515
	rcu_read_lock();
	__tsec1 = __task_cred(tsk1)->security;	sid1 = __tsec1->sid;
	__tsec2 = __task_cred(tsk2)->security;	sid2 = __tsec2->sid;
	rcu_read_unlock();
	return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
L
Linus Torvalds 已提交
1516 1517
}

1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533
/*
 * Check permission between current and another task, e.g. signal checks,
 * fork check, ptrace check, etc.
 * current is the actor and tsk2 is the target
 * - this uses current's subjective creds
 */
static int current_has_perm(const struct task_struct *tsk,
			    u32 perms)
{
	u32 sid, tsid;

	sid = current_sid();
	tsid = task_sid(tsk);
	return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
}

1534 1535 1536 1537
#if CAP_LAST_CAP > 63
#error Fix SELinux to handle capabilities > 63.
#endif

L
Linus Torvalds 已提交
1538
/* Check whether a task is allowed to use a capability. */
1539
static int cred_has_capability(const struct cred *cred,
1540
			       int cap, int audit)
L
Linus Torvalds 已提交
1541
{
1542
	struct common_audit_data ad;
1543
	struct av_decision avd;
1544
	u16 sclass;
1545
	u32 sid = cred_sid(cred);
1546
	u32 av = CAP_TO_MASK(cap);
1547
	int rc;
L
Linus Torvalds 已提交
1548

1549
	ad.type = LSM_AUDIT_DATA_CAP;
L
Linus Torvalds 已提交
1550 1551
	ad.u.cap = cap;

1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562
	switch (CAP_TO_INDEX(cap)) {
	case 0:
		sclass = SECCLASS_CAPABILITY;
		break;
	case 1:
		sclass = SECCLASS_CAPABILITY2;
		break;
	default:
		printk(KERN_ERR
		       "SELinux:  out of range capability %d\n", cap);
		BUG();
1563
		return -EINVAL;
1564
	}
1565

1566
	rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1567
	if (audit == SECURITY_CAP_AUDIT) {
1568
		int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1569 1570 1571
		if (rc2)
			return rc2;
	}
1572
	return rc;
L
Linus Torvalds 已提交
1573 1574 1575 1576 1577 1578
}

/* Check whether a task is allowed to use a system operation. */
static int task_has_system(struct task_struct *tsk,
			   u32 perms)
{
1579
	u32 sid = task_sid(tsk);
L
Linus Torvalds 已提交
1580

1581
	return avc_has_perm(sid, SECINITSID_KERNEL,
L
Linus Torvalds 已提交
1582 1583 1584 1585 1586 1587
			    SECCLASS_SYSTEM, perms, NULL);
}

/* Check whether a task has a particular permission to an inode.
   The 'adp' parameter is optional and allows other audit
   data to be passed (e.g. the dentry). */
1588
static int inode_has_perm(const struct cred *cred,
L
Linus Torvalds 已提交
1589 1590
			  struct inode *inode,
			  u32 perms,
1591
			  struct common_audit_data *adp)
L
Linus Torvalds 已提交
1592 1593
{
	struct inode_security_struct *isec;
1594
	u32 sid;
L
Linus Torvalds 已提交
1595

1596 1597
	validate_creds(cred);

1598
	if (unlikely(IS_PRIVATE(inode)))
1599 1600
		return 0;

1601
	sid = cred_sid(cred);
L
Linus Torvalds 已提交
1602 1603
	isec = inode->i_security;

1604
	return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
L
Linus Torvalds 已提交
1605 1606 1607 1608 1609
}

/* Same as inode_has_perm, but pass explicit audit data containing
   the dentry to help the auditing code to more easily generate the
   pathname if needed. */
1610
static inline int dentry_has_perm(const struct cred *cred,
L
Linus Torvalds 已提交
1611 1612 1613 1614
				  struct dentry *dentry,
				  u32 av)
{
	struct inode *inode = dentry->d_inode;
1615
	struct common_audit_data ad;
1616

1617
	ad.type = LSM_AUDIT_DATA_DENTRY;
E
Eric Paris 已提交
1618
	ad.u.dentry = dentry;
1619
	return inode_has_perm(cred, inode, av, &ad);
E
Eric Paris 已提交
1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631
}

/* Same as inode_has_perm, but pass explicit audit data containing
   the path to help the auditing code to more easily generate the
   pathname if needed. */
static inline int path_has_perm(const struct cred *cred,
				struct path *path,
				u32 av)
{
	struct inode *inode = path->dentry->d_inode;
	struct common_audit_data ad;

1632
	ad.type = LSM_AUDIT_DATA_PATH;
E
Eric Paris 已提交
1633
	ad.u.path = *path;
1634
	return inode_has_perm(cred, inode, av, &ad);
L
Linus Torvalds 已提交
1635 1636
}

1637 1638 1639 1640 1641 1642 1643 1644 1645
/* Same as path_has_perm, but uses the inode from the file struct. */
static inline int file_path_has_perm(const struct cred *cred,
				     struct file *file,
				     u32 av)
{
	struct common_audit_data ad;

	ad.type = LSM_AUDIT_DATA_PATH;
	ad.u.path = file->f_path;
1646
	return inode_has_perm(cred, file_inode(file), av, &ad);
1647 1648
}

L
Linus Torvalds 已提交
1649 1650 1651 1652 1653 1654 1655 1656
/* Check whether a task can use an open file descriptor to
   access an inode in a given way.  Check access to the
   descriptor itself, and then use dentry_has_perm to
   check a particular permission to the file.
   Access to the descriptor is implicitly granted if it
   has the same SID as the process.  If av is zero, then
   access to the file is not checked, e.g. for cases
   where only the descriptor is affected like seek. */
1657 1658 1659
static int file_has_perm(const struct cred *cred,
			 struct file *file,
			 u32 av)
L
Linus Torvalds 已提交
1660 1661
{
	struct file_security_struct *fsec = file->f_security;
A
Al Viro 已提交
1662
	struct inode *inode = file_inode(file);
1663
	struct common_audit_data ad;
1664
	u32 sid = cred_sid(cred);
L
Linus Torvalds 已提交
1665 1666
	int rc;

1667
	ad.type = LSM_AUDIT_DATA_PATH;
1668
	ad.u.path = file->f_path;
L
Linus Torvalds 已提交
1669

1670 1671
	if (sid != fsec->sid) {
		rc = avc_has_perm(sid, fsec->sid,
L
Linus Torvalds 已提交
1672 1673 1674 1675
				  SECCLASS_FD,
				  FD__USE,
				  &ad);
		if (rc)
1676
			goto out;
L
Linus Torvalds 已提交
1677 1678 1679
	}

	/* av is zero if only checking access to the descriptor. */
1680
	rc = 0;
L
Linus Torvalds 已提交
1681
	if (av)
1682
		rc = inode_has_perm(cred, inode, av, &ad);
L
Linus Torvalds 已提交
1683

1684 1685
out:
	return rc;
L
Linus Torvalds 已提交
1686 1687 1688 1689 1690 1691 1692
}

/* Check whether a task can create a file. */
static int may_create(struct inode *dir,
		      struct dentry *dentry,
		      u16 tclass)
{
1693
	const struct task_security_struct *tsec = current_security();
L
Linus Torvalds 已提交
1694 1695
	struct inode_security_struct *dsec;
	struct superblock_security_struct *sbsec;
1696
	u32 sid, newsid;
1697
	struct common_audit_data ad;
L
Linus Torvalds 已提交
1698 1699 1700 1701 1702
	int rc;

	dsec = dir->i_security;
	sbsec = dir->i_sb->s_security;

1703 1704 1705
	sid = tsec->sid;
	newsid = tsec->create_sid;

1706
	ad.type = LSM_AUDIT_DATA_DENTRY;
1707
	ad.u.dentry = dentry;
L
Linus Torvalds 已提交
1708

1709
	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
L
Linus Torvalds 已提交
1710 1711 1712 1713 1714
			  DIR__ADD_NAME | DIR__SEARCH,
			  &ad);
	if (rc)
		return rc;

1715
	if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1716 1717
		rc = security_transition_sid(sid, dsec->sid, tclass,
					     &dentry->d_name, &newsid);
L
Linus Torvalds 已提交
1718 1719 1720 1721
		if (rc)
			return rc;
	}

1722
	rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
L
Linus Torvalds 已提交
1723 1724 1725 1726 1727 1728 1729 1730
	if (rc)
		return rc;

	return avc_has_perm(newsid, sbsec->sid,
			    SECCLASS_FILESYSTEM,
			    FILESYSTEM__ASSOCIATE, &ad);
}

1731 1732 1733 1734
/* Check whether a task can create a key. */
static int may_create_key(u32 ksid,
			  struct task_struct *ctx)
{
1735
	u32 sid = task_sid(ctx);
1736

1737
	return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1738 1739
}

1740 1741 1742
#define MAY_LINK	0
#define MAY_UNLINK	1
#define MAY_RMDIR	2
L
Linus Torvalds 已提交
1743 1744 1745 1746 1747 1748 1749 1750

/* Check whether a task can link, unlink, or rmdir a file/directory. */
static int may_link(struct inode *dir,
		    struct dentry *dentry,
		    int kind)

{
	struct inode_security_struct *dsec, *isec;
1751
	struct common_audit_data ad;
1752
	u32 sid = current_sid();
L
Linus Torvalds 已提交
1753 1754 1755 1756 1757 1758
	u32 av;
	int rc;

	dsec = dir->i_security;
	isec = dentry->d_inode->i_security;

1759
	ad.type = LSM_AUDIT_DATA_DENTRY;
1760
	ad.u.dentry = dentry;
L
Linus Torvalds 已提交
1761 1762 1763

	av = DIR__SEARCH;
	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1764
	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
L
Linus Torvalds 已提交
1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778
	if (rc)
		return rc;

	switch (kind) {
	case MAY_LINK:
		av = FILE__LINK;
		break;
	case MAY_UNLINK:
		av = FILE__UNLINK;
		break;
	case MAY_RMDIR:
		av = DIR__RMDIR;
		break;
	default:
E
Eric Paris 已提交
1779 1780
		printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
			__func__, kind);
L
Linus Torvalds 已提交
1781 1782 1783
		return 0;
	}

1784
	rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
L
Linus Torvalds 已提交
1785 1786 1787 1788 1789 1790 1791 1792 1793
	return rc;
}

static inline int may_rename(struct inode *old_dir,
			     struct dentry *old_dentry,
			     struct inode *new_dir,
			     struct dentry *new_dentry)
{
	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1794
	struct common_audit_data ad;
1795
	u32 sid = current_sid();
L
Linus Torvalds 已提交
1796 1797 1798 1799 1800 1801
	u32 av;
	int old_is_dir, new_is_dir;
	int rc;

	old_dsec = old_dir->i_security;
	old_isec = old_dentry->d_inode->i_security;
1802
	old_is_dir = d_is_dir(old_dentry);
L
Linus Torvalds 已提交
1803 1804
	new_dsec = new_dir->i_security;

1805
	ad.type = LSM_AUDIT_DATA_DENTRY;
L
Linus Torvalds 已提交
1806

1807
	ad.u.dentry = old_dentry;
1808
	rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
L
Linus Torvalds 已提交
1809 1810 1811
			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
	if (rc)
		return rc;
1812
	rc = avc_has_perm(sid, old_isec->sid,
L
Linus Torvalds 已提交
1813 1814 1815 1816
			  old_isec->sclass, FILE__RENAME, &ad);
	if (rc)
		return rc;
	if (old_is_dir && new_dir != old_dir) {
1817
		rc = avc_has_perm(sid, old_isec->sid,
L
Linus Torvalds 已提交
1818 1819 1820 1821 1822
				  old_isec->sclass, DIR__REPARENT, &ad);
		if (rc)
			return rc;
	}

1823
	ad.u.dentry = new_dentry;
L
Linus Torvalds 已提交
1824
	av = DIR__ADD_NAME | DIR__SEARCH;
1825
	if (d_is_positive(new_dentry))
L
Linus Torvalds 已提交
1826
		av |= DIR__REMOVE_NAME;
1827
	rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
L
Linus Torvalds 已提交
1828 1829
	if (rc)
		return rc;
1830
	if (d_is_positive(new_dentry)) {
L
Linus Torvalds 已提交
1831
		new_isec = new_dentry->d_inode->i_security;
1832
		new_is_dir = d_is_dir(new_dentry);
1833
		rc = avc_has_perm(sid, new_isec->sid,
L
Linus Torvalds 已提交
1834 1835 1836 1837 1838 1839 1840 1841 1842 1843
				  new_isec->sclass,
				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
		if (rc)
			return rc;
	}

	return 0;
}

/* Check whether a task can perform a filesystem operation. */
1844
static int superblock_has_perm(const struct cred *cred,
L
Linus Torvalds 已提交
1845 1846
			       struct super_block *sb,
			       u32 perms,
1847
			       struct common_audit_data *ad)
L
Linus Torvalds 已提交
1848 1849
{
	struct superblock_security_struct *sbsec;
1850
	u32 sid = cred_sid(cred);
L
Linus Torvalds 已提交
1851 1852

	sbsec = sb->s_security;
1853
	return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
L
Linus Torvalds 已提交
1854 1855 1856 1857 1858 1859 1860
}

/* Convert a Linux mode and permission mask to an access vector. */
static inline u32 file_mask_to_av(int mode, int mask)
{
	u32 av = 0;

A
Al Viro 已提交
1861
	if (!S_ISDIR(mode)) {
L
Linus Torvalds 已提交
1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883
		if (mask & MAY_EXEC)
			av |= FILE__EXECUTE;
		if (mask & MAY_READ)
			av |= FILE__READ;

		if (mask & MAY_APPEND)
			av |= FILE__APPEND;
		else if (mask & MAY_WRITE)
			av |= FILE__WRITE;

	} else {
		if (mask & MAY_EXEC)
			av |= DIR__SEARCH;
		if (mask & MAY_WRITE)
			av |= DIR__WRITE;
		if (mask & MAY_READ)
			av |= DIR__READ;
	}

	return av;
}

1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906
/* Convert a Linux file to an access vector. */
static inline u32 file_to_av(struct file *file)
{
	u32 av = 0;

	if (file->f_mode & FMODE_READ)
		av |= FILE__READ;
	if (file->f_mode & FMODE_WRITE) {
		if (file->f_flags & O_APPEND)
			av |= FILE__APPEND;
		else
			av |= FILE__WRITE;
	}
	if (!av) {
		/*
		 * Special file opened with flags 3 for ioctl-only use.
		 */
		av = FILE__IOCTL;
	}

	return av;
}

E
Eric Paris 已提交
1907
/*
1908
 * Convert a file to an access vector and include the correct open
E
Eric Paris 已提交
1909 1910
 * open permission.
 */
1911
static inline u32 open_file_to_av(struct file *file)
E
Eric Paris 已提交
1912
{
1913
	u32 av = file_to_av(file);
E
Eric Paris 已提交
1914

1915 1916 1917
	if (selinux_policycap_openperm)
		av |= FILE__OPEN;

E
Eric Paris 已提交
1918 1919 1920
	return av;
}

L
Linus Torvalds 已提交
1921 1922
/* Hook functions begin here. */

1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990
static int selinux_binder_set_context_mgr(struct task_struct *mgr)
{
	u32 mysid = current_sid();
	u32 mgrsid = task_sid(mgr);

	return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
			    BINDER__SET_CONTEXT_MGR, NULL);
}

static int selinux_binder_transaction(struct task_struct *from,
				      struct task_struct *to)
{
	u32 mysid = current_sid();
	u32 fromsid = task_sid(from);
	u32 tosid = task_sid(to);
	int rc;

	if (mysid != fromsid) {
		rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
				  BINDER__IMPERSONATE, NULL);
		if (rc)
			return rc;
	}

	return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
			    NULL);
}

static int selinux_binder_transfer_binder(struct task_struct *from,
					  struct task_struct *to)
{
	u32 fromsid = task_sid(from);
	u32 tosid = task_sid(to);

	return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
			    NULL);
}

static int selinux_binder_transfer_file(struct task_struct *from,
					struct task_struct *to,
					struct file *file)
{
	u32 sid = task_sid(to);
	struct file_security_struct *fsec = file->f_security;
	struct inode *inode = file->f_path.dentry->d_inode;
	struct inode_security_struct *isec = inode->i_security;
	struct common_audit_data ad;
	int rc;

	ad.type = LSM_AUDIT_DATA_PATH;
	ad.u.path = file->f_path;

	if (sid != fsec->sid) {
		rc = avc_has_perm(sid, fsec->sid,
				  SECCLASS_FD,
				  FD__USE,
				  &ad);
		if (rc)
			return rc;
	}

	if (unlikely(IS_PRIVATE(inode)))
		return 0;

	return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
			    &ad);
}

1991
static int selinux_ptrace_access_check(struct task_struct *child,
1992
				     unsigned int mode)
L
Linus Torvalds 已提交
1993 1994 1995
{
	int rc;

1996
	rc = cap_ptrace_access_check(child, mode);
L
Linus Torvalds 已提交
1997 1998 1999
	if (rc)
		return rc;

2000
	if (mode & PTRACE_MODE_READ) {
2001 2002 2003
		u32 sid = current_sid();
		u32 csid = task_sid(child);
		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2004 2005
	}

2006
	return current_has_perm(child, PROCESS__PTRACE);
2007 2008 2009 2010 2011 2012
}

static int selinux_ptrace_traceme(struct task_struct *parent)
{
	int rc;

2013
	rc = cap_ptrace_traceme(parent);
2014 2015 2016 2017
	if (rc)
		return rc;

	return task_has_perm(parent, current, PROCESS__PTRACE);
L
Linus Torvalds 已提交
2018 2019 2020
}

static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2021
			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
L
Linus Torvalds 已提交
2022 2023 2024
{
	int error;

2025
	error = current_has_perm(target, PROCESS__GETCAP);
L
Linus Torvalds 已提交
2026 2027 2028
	if (error)
		return error;

2029
	return cap_capget(target, effective, inheritable, permitted);
L
Linus Torvalds 已提交
2030 2031
}

D
David Howells 已提交
2032 2033 2034 2035
static int selinux_capset(struct cred *new, const struct cred *old,
			  const kernel_cap_t *effective,
			  const kernel_cap_t *inheritable,
			  const kernel_cap_t *permitted)
L
Linus Torvalds 已提交
2036 2037 2038
{
	int error;

2039
	error = cap_capset(new, old,
D
David Howells 已提交
2040
				      effective, inheritable, permitted);
L
Linus Torvalds 已提交
2041 2042 2043
	if (error)
		return error;

D
David Howells 已提交
2044
	return cred_has_perm(old, new, PROCESS__SETCAP);
L
Linus Torvalds 已提交
2045 2046
}

2047 2048 2049 2050 2051 2052 2053 2054 2055 2056
/*
 * (This comment used to live with the selinux_task_setuid hook,
 * which was removed).
 *
 * Since setuid only affects the current process, and since the SELinux
 * controls are not based on the Linux identity attributes, SELinux does not
 * need to control this operation.  However, SELinux does control the use of
 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
 */

2057 2058
static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
			   int cap, int audit)
L
Linus Torvalds 已提交
2059 2060 2061
{
	int rc;

2062
	rc = cap_capable(cred, ns, cap, audit);
L
Linus Torvalds 已提交
2063 2064 2065
	if (rc)
		return rc;

2066
	return cred_has_capability(cred, cap, audit);
L
Linus Torvalds 已提交
2067 2068 2069 2070
}

static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
{
2071
	const struct cred *cred = current_cred();
L
Linus Torvalds 已提交
2072 2073 2074 2075 2076 2077
	int rc = 0;

	if (!sb)
		return 0;

	switch (cmds) {
2078 2079 2080 2081 2082
	case Q_SYNC:
	case Q_QUOTAON:
	case Q_QUOTAOFF:
	case Q_SETINFO:
	case Q_SETQUOTA:
2083
		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2084 2085 2086 2087
		break;
	case Q_GETFMT:
	case Q_GETINFO:
	case Q_GETQUOTA:
2088
		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2089 2090 2091 2092
		break;
	default:
		rc = 0;  /* let the kernel handle invalid cmds */
		break;
L
Linus Torvalds 已提交
2093 2094 2095 2096 2097 2098
	}
	return rc;
}

static int selinux_quota_on(struct dentry *dentry)
{
2099 2100
	const struct cred *cred = current_cred();

E
Eric Paris 已提交
2101
	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
L
Linus Torvalds 已提交
2102 2103
}

2104
static int selinux_syslog(int type)
L
Linus Torvalds 已提交
2105 2106 2107 2108
{
	int rc;

	switch (type) {
2109 2110
	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2111 2112
		rc = task_has_system(current, SYSTEM__SYSLOG_READ);
		break;
2113 2114 2115 2116
	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
	/* Set level of messages printed to console */
	case SYSLOG_ACTION_CONSOLE_LEVEL:
2117 2118
		rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
		break;
2119 2120 2121 2122 2123
	case SYSLOG_ACTION_CLOSE:	/* Close log */
	case SYSLOG_ACTION_OPEN:	/* Open log */
	case SYSLOG_ACTION_READ:	/* Read from log */
	case SYSLOG_ACTION_READ_CLEAR:	/* Read/clear last kernel messages */
	case SYSLOG_ACTION_CLEAR:	/* Clear ring buffer */
2124 2125 2126
	default:
		rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
		break;
L
Linus Torvalds 已提交
2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138
	}
	return rc;
}

/*
 * Check that a process has enough memory to allocate a new virtual
 * mapping. 0 means there is enough memory for the allocation to
 * succeed and -ENOMEM implies there is not.
 *
 * Do not audit the selinux permission check, as this is applied to all
 * processes that allocate mappings.
 */
2139
static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
L
Linus Torvalds 已提交
2140 2141 2142
{
	int rc, cap_sys_admin = 0;

2143
	rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2144
			     SECURITY_CAP_NOAUDIT);
L
Linus Torvalds 已提交
2145 2146 2147
	if (rc == 0)
		cap_sys_admin = 1;

2148
	return __vm_enough_memory(mm, pages, cap_sys_admin);
L
Linus Torvalds 已提交
2149 2150 2151 2152
}

/* binprm security operations */

2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187
static int check_nnp_nosuid(const struct linux_binprm *bprm,
			    const struct task_security_struct *old_tsec,
			    const struct task_security_struct *new_tsec)
{
	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
	int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
	int rc;

	if (!nnp && !nosuid)
		return 0; /* neither NNP nor nosuid */

	if (new_tsec->sid == old_tsec->sid)
		return 0; /* No change in credentials */

	/*
	 * The only transitions we permit under NNP or nosuid
	 * are transitions to bounded SIDs, i.e. SIDs that are
	 * guaranteed to only be allowed a subset of the permissions
	 * of the current SID.
	 */
	rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
	if (rc) {
		/*
		 * On failure, preserve the errno values for NNP vs nosuid.
		 * NNP:  Operation not permitted for caller.
		 * nosuid:  Permission denied to file.
		 */
		if (nnp)
			return -EPERM;
		else
			return -EACCES;
	}
	return 0;
}

2188
static int selinux_bprm_set_creds(struct linux_binprm *bprm)
L
Linus Torvalds 已提交
2189
{
2190 2191
	const struct task_security_struct *old_tsec;
	struct task_security_struct *new_tsec;
L
Linus Torvalds 已提交
2192
	struct inode_security_struct *isec;
2193
	struct common_audit_data ad;
A
Al Viro 已提交
2194
	struct inode *inode = file_inode(bprm->file);
L
Linus Torvalds 已提交
2195 2196
	int rc;

2197
	rc = cap_bprm_set_creds(bprm);
L
Linus Torvalds 已提交
2198 2199 2200
	if (rc)
		return rc;

2201 2202 2203
	/* SELinux context only depends on initial program or script and not
	 * the script interpreter */
	if (bprm->cred_prepared)
L
Linus Torvalds 已提交
2204 2205
		return 0;

2206 2207
	old_tsec = current_security();
	new_tsec = bprm->cred->security;
L
Linus Torvalds 已提交
2208 2209 2210
	isec = inode->i_security;

	/* Default to the current task SID. */
2211 2212
	new_tsec->sid = old_tsec->sid;
	new_tsec->osid = old_tsec->sid;
L
Linus Torvalds 已提交
2213

2214
	/* Reset fs, key, and sock SIDs on execve. */
2215 2216 2217
	new_tsec->create_sid = 0;
	new_tsec->keycreate_sid = 0;
	new_tsec->sockcreate_sid = 0;
L
Linus Torvalds 已提交
2218

2219 2220
	if (old_tsec->exec_sid) {
		new_tsec->sid = old_tsec->exec_sid;
L
Linus Torvalds 已提交
2221
		/* Reset exec SID on execve. */
2222
		new_tsec->exec_sid = 0;
2223

2224 2225 2226 2227
		/* Fail on NNP or nosuid if not an allowed transition. */
		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
		if (rc)
			return rc;
L
Linus Torvalds 已提交
2228 2229
	} else {
		/* Check for a default transition on this program. */
2230
		rc = security_transition_sid(old_tsec->sid, isec->sid,
2231 2232
					     SECCLASS_PROCESS, NULL,
					     &new_tsec->sid);
L
Linus Torvalds 已提交
2233 2234
		if (rc)
			return rc;
2235 2236 2237 2238 2239 2240 2241 2242

		/*
		 * Fallback to old SID on NNP or nosuid if not an allowed
		 * transition.
		 */
		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
		if (rc)
			new_tsec->sid = old_tsec->sid;
L
Linus Torvalds 已提交
2243 2244
	}

2245
	ad.type = LSM_AUDIT_DATA_PATH;
2246
	ad.u.path = bprm->file->f_path;
L
Linus Torvalds 已提交
2247

2248 2249
	if (new_tsec->sid == old_tsec->sid) {
		rc = avc_has_perm(old_tsec->sid, isec->sid,
L
Linus Torvalds 已提交
2250 2251 2252 2253 2254
				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
		if (rc)
			return rc;
	} else {
		/* Check permissions for the transition. */
2255
		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
L
Linus Torvalds 已提交
2256 2257 2258 2259
				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
		if (rc)
			return rc;

2260
		rc = avc_has_perm(new_tsec->sid, isec->sid,
L
Linus Torvalds 已提交
2261 2262 2263 2264
				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
		if (rc)
			return rc;

2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282
		/* Check for shared state */
		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
			rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
					  SECCLASS_PROCESS, PROCESS__SHARE,
					  NULL);
			if (rc)
				return -EPERM;
		}

		/* Make sure that anyone attempting to ptrace over a task that
		 * changes its SID has the appropriate permit */
		if (bprm->unsafe &
		    (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
			struct task_struct *tracer;
			struct task_security_struct *sec;
			u32 ptsid = 0;

			rcu_read_lock();
2283
			tracer = ptrace_parent(current);
2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297
			if (likely(tracer != NULL)) {
				sec = __task_cred(tracer)->security;
				ptsid = sec->sid;
			}
			rcu_read_unlock();

			if (ptsid != 0) {
				rc = avc_has_perm(ptsid, new_tsec->sid,
						  SECCLASS_PROCESS,
						  PROCESS__PTRACE, NULL);
				if (rc)
					return -EPERM;
			}
		}
L
Linus Torvalds 已提交
2298

2299 2300
		/* Clear any possibly unsafe personality bits on exec: */
		bprm->per_clear |= PER_CLEAR_ON_SETID;
L
Linus Torvalds 已提交
2301 2302 2303 2304 2305
	}

	return 0;
}

2306
static int selinux_bprm_secureexec(struct linux_binprm *bprm)
L
Linus Torvalds 已提交
2307
{
2308
	const struct task_security_struct *tsec = current_security();
2309
	u32 sid, osid;
L
Linus Torvalds 已提交
2310 2311
	int atsecure = 0;

2312 2313 2314 2315
	sid = tsec->sid;
	osid = tsec->osid;

	if (osid != sid) {
L
Linus Torvalds 已提交
2316 2317 2318
		/* Enable secure mode for SIDs transitions unless
		   the noatsecure permission is granted between
		   the two SIDs, i.e. ahp returns 0. */
2319
		atsecure = avc_has_perm(osid, sid,
2320 2321
					SECCLASS_PROCESS,
					PROCESS__NOATSECURE, NULL);
L
Linus Torvalds 已提交
2322 2323
	}

2324
	return (atsecure || cap_bprm_secureexec(bprm));
L
Linus Torvalds 已提交
2325 2326
}

A
Al Viro 已提交
2327 2328 2329 2330 2331
static int match_file(const void *p, struct file *file, unsigned fd)
{
	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
}

L
Linus Torvalds 已提交
2332
/* Derived from fs/exec.c:flush_old_files. */
2333 2334
static inline void flush_unauthorized_files(const struct cred *cred,
					    struct files_struct *files)
L
Linus Torvalds 已提交
2335 2336
{
	struct file *file, *devnull = NULL;
2337
	struct tty_struct *tty;
2338
	int drop_tty = 0;
A
Al Viro 已提交
2339
	unsigned n;
L
Linus Torvalds 已提交
2340

2341
	tty = get_current_tty();
L
Linus Torvalds 已提交
2342
	if (tty) {
N
Nick Piggin 已提交
2343
		spin_lock(&tty_files_lock);
2344
		if (!list_empty(&tty->tty_files)) {
N
Nick Piggin 已提交
2345
			struct tty_file_private *file_priv;
2346

L
Linus Torvalds 已提交
2347
			/* Revalidate access to controlling tty.
2348 2349 2350 2351
			   Use file_path_has_perm on the tty path directly
			   rather than using file_has_perm, as this particular
			   open file may belong to another process and we are
			   only interested in the inode-based check here. */
N
Nick Piggin 已提交
2352 2353 2354
			file_priv = list_first_entry(&tty->tty_files,
						struct tty_file_private, list);
			file = file_priv->file;
2355
			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2356
				drop_tty = 1;
L
Linus Torvalds 已提交
2357
		}
N
Nick Piggin 已提交
2358
		spin_unlock(&tty_files_lock);
A
Alan Cox 已提交
2359
		tty_kref_put(tty);
L
Linus Torvalds 已提交
2360
	}
2361 2362 2363
	/* Reset controlling tty. */
	if (drop_tty)
		no_tty();
L
Linus Torvalds 已提交
2364 2365

	/* Revalidate access to inherited open files. */
A
Al Viro 已提交
2366 2367 2368
	n = iterate_fd(files, 0, match_file, cred);
	if (!n) /* none found? */
		return;
L
Linus Torvalds 已提交
2369

A
Al Viro 已提交
2370
	devnull = dentry_open(&selinux_null, O_RDWR, cred);
A
Al Viro 已提交
2371 2372 2373 2374 2375 2376 2377
	if (IS_ERR(devnull))
		devnull = NULL;
	/* replace all the matching ones with this */
	do {
		replace_fd(n - 1, devnull, 0);
	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
	if (devnull)
A
Al Viro 已提交
2378
		fput(devnull);
L
Linus Torvalds 已提交
2379 2380
}

2381 2382 2383 2384
/*
 * Prepare a process for imminent new credential changes due to exec
 */
static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
L
Linus Torvalds 已提交
2385
{
2386 2387 2388
	struct task_security_struct *new_tsec;
	struct rlimit *rlim, *initrlim;
	int rc, i;
D
David Howells 已提交
2389

2390 2391 2392
	new_tsec = bprm->cred->security;
	if (new_tsec->sid == new_tsec->osid)
		return;
L
Linus Torvalds 已提交
2393

2394 2395
	/* Close files for which the new task SID is not authorized. */
	flush_unauthorized_files(bprm->cred, current->files);
R
Roland McGrath 已提交
2396

2397 2398
	/* Always clear parent death signal on SID transitions. */
	current->pdeath_signal = 0;
R
Roland McGrath 已提交
2399

2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412
	/* Check whether the new SID can inherit resource limits from the old
	 * SID.  If not, reset all soft limits to the lower of the current
	 * task's hard limit and the init task's soft limit.
	 *
	 * Note that the setting of hard limits (even to lower them) can be
	 * controlled by the setrlimit check.  The inclusion of the init task's
	 * soft limit into the computation is to avoid resetting soft limits
	 * higher than the default soft limit for cases where the default is
	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
	 */
	rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
			  PROCESS__RLIMITINH, NULL);
	if (rc) {
2413 2414
		/* protect against do_prlimit() */
		task_lock(current);
2415 2416 2417 2418
		for (i = 0; i < RLIM_NLIMITS; i++) {
			rlim = current->signal->rlim + i;
			initrlim = init_task.signal->rlim + i;
			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
L
Linus Torvalds 已提交
2419
		}
2420 2421
		task_unlock(current);
		update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
L
Linus Torvalds 已提交
2422 2423 2424 2425
	}
}

/*
2426 2427
 * Clean up the process immediately after the installation of new credentials
 * due to exec
L
Linus Torvalds 已提交
2428
 */
2429
static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
L
Linus Torvalds 已提交
2430
{
2431
	const struct task_security_struct *tsec = current_security();
L
Linus Torvalds 已提交
2432
	struct itimerval itimer;
2433
	u32 osid, sid;
L
Linus Torvalds 已提交
2434 2435
	int rc, i;

2436 2437 2438 2439
	osid = tsec->osid;
	sid = tsec->sid;

	if (sid == osid)
L
Linus Torvalds 已提交
2440 2441
		return;

2442 2443 2444 2445 2446 2447 2448 2449
	/* Check whether the new SID can inherit signal state from the old SID.
	 * If not, clear itimers to avoid subsequent signal generation and
	 * flush and unblock signals.
	 *
	 * This must occur _after_ the task SID has been updated so that any
	 * kill done after the flush will be checked against the new SID.
	 */
	rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
L
Linus Torvalds 已提交
2450 2451 2452 2453 2454
	if (rc) {
		memset(&itimer, 0, sizeof itimer);
		for (i = 0; i < 3; i++)
			do_setitimer(i, &itimer, NULL);
		spin_lock_irq(&current->sighand->siglock);
2455 2456 2457 2458 2459
		if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
			__flush_signals(current);
			flush_signal_handlers(current, 1);
			sigemptyset(&current->blocked);
		}
L
Linus Torvalds 已提交
2460 2461 2462
		spin_unlock_irq(&current->sighand->siglock);
	}

2463 2464
	/* Wake up the parent if it is waiting so that it can recheck
	 * wait permission to the new task SID. */
2465
	read_lock(&tasklist_lock);
2466
	__wake_up_parent(current, current->real_parent);
2467
	read_unlock(&tasklist_lock);
L
Linus Torvalds 已提交
2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491
}

/* superblock security operations */

static int selinux_sb_alloc_security(struct super_block *sb)
{
	return superblock_alloc_security(sb);
}

static void selinux_sb_free_security(struct super_block *sb)
{
	superblock_free_security(sb);
}

static inline int match_prefix(char *prefix, int plen, char *option, int olen)
{
	if (plen > olen)
		return 0;

	return !memcmp(prefix, option, plen);
}

static inline int selinux_option(char *option, int len)
{
2492 2493 2494
	return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
		match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
		match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2495 2496
		match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
		match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
L
Linus Torvalds 已提交
2497 2498 2499 2500 2501 2502 2503
}

static inline void take_option(char **to, char *from, int *first, int len)
{
	if (!*first) {
		**to = ',';
		*to += 1;
2504
	} else
L
Linus Torvalds 已提交
2505 2506 2507 2508 2509
		*first = 0;
	memcpy(*to, from, len);
	*to += len;
}

2510 2511
static inline void take_selinux_option(char **to, char *from, int *first,
				       int len)
2512 2513 2514 2515 2516 2517
{
	int current_size = 0;

	if (!*first) {
		**to = '|';
		*to += 1;
2518
	} else
2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530
		*first = 0;

	while (current_size < len) {
		if (*from != '"') {
			**to = *from;
			*to += 1;
		}
		from += 1;
		current_size += 1;
	}
}

2531
static int selinux_sb_copy_data(char *orig, char *copy)
L
Linus Torvalds 已提交
2532 2533 2534 2535
{
	int fnosec, fsec, rc = 0;
	char *in_save, *in_curr, *in_end;
	char *sec_curr, *nosec_save, *nosec;
2536
	int open_quote = 0;
L
Linus Torvalds 已提交
2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551

	in_curr = orig;
	sec_curr = copy;

	nosec = (char *)get_zeroed_page(GFP_KERNEL);
	if (!nosec) {
		rc = -ENOMEM;
		goto out;
	}

	nosec_save = nosec;
	fnosec = fsec = 1;
	in_save = in_end = orig;

	do {
2552 2553 2554 2555
		if (*in_end == '"')
			open_quote = !open_quote;
		if ((*in_end == ',' && open_quote == 0) ||
				*in_end == '\0') {
L
Linus Torvalds 已提交
2556 2557 2558
			int len = in_end - in_curr;

			if (selinux_option(in_curr, len))
2559
				take_selinux_option(&sec_curr, in_curr, &fsec, len);
L
Linus Torvalds 已提交
2560 2561 2562 2563 2564 2565 2566
			else
				take_option(&nosec, in_curr, &fnosec, len);

			in_curr = in_end + 1;
		}
	} while (*in_end++);

2567
	strcpy(in_save, nosec_save);
2568
	free_page((unsigned long)nosec_save);
L
Linus Torvalds 已提交
2569 2570 2571 2572
out:
	return rc;
}

2573 2574 2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607
static int selinux_sb_remount(struct super_block *sb, void *data)
{
	int rc, i, *flags;
	struct security_mnt_opts opts;
	char *secdata, **mount_options;
	struct superblock_security_struct *sbsec = sb->s_security;

	if (!(sbsec->flags & SE_SBINITIALIZED))
		return 0;

	if (!data)
		return 0;

	if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
		return 0;

	security_init_mnt_opts(&opts);
	secdata = alloc_secdata();
	if (!secdata)
		return -ENOMEM;
	rc = selinux_sb_copy_data(data, secdata);
	if (rc)
		goto out_free_secdata;

	rc = selinux_parse_opts_str(secdata, &opts);
	if (rc)
		goto out_free_secdata;

	mount_options = opts.mnt_opts;
	flags = opts.mnt_opts_flags;

	for (i = 0; i < opts.num_mnt_opts; i++) {
		u32 sid;
		size_t len;

2608
		if (flags[i] == SBLABEL_MNT)
2609 2610
			continue;
		len = strlen(mount_options[i]);
2611 2612
		rc = security_context_to_sid(mount_options[i], len, &sid,
					     GFP_KERNEL);
2613 2614
		if (rc) {
			printk(KERN_WARNING "SELinux: security_context_to_sid"
2615 2616
			       "(%s) failed for (dev %s, type %s) errno=%d\n",
			       mount_options[i], sb->s_id, sb->s_type->name, rc);
2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653
			goto out_free_opts;
		}
		rc = -EINVAL;
		switch (flags[i]) {
		case FSCONTEXT_MNT:
			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
				goto out_bad_option;
			break;
		case CONTEXT_MNT:
			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
				goto out_bad_option;
			break;
		case ROOTCONTEXT_MNT: {
			struct inode_security_struct *root_isec;
			root_isec = sb->s_root->d_inode->i_security;

			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
				goto out_bad_option;
			break;
		}
		case DEFCONTEXT_MNT:
			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
				goto out_bad_option;
			break;
		default:
			goto out_free_opts;
		}
	}

	rc = 0;
out_free_opts:
	security_free_mnt_opts(&opts);
out_free_secdata:
	free_secdata(secdata);
	return rc;
out_bad_option:
	printk(KERN_WARNING "SELinux: unable to change security options "
2654 2655
	       "during remount (dev %s, type=%s)\n", sb->s_id,
	       sb->s_type->name);
2656 2657 2658
	goto out_free_opts;
}

2659
static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
L
Linus Torvalds 已提交
2660
{
2661
	const struct cred *cred = current_cred();
2662
	struct common_audit_data ad;
L
Linus Torvalds 已提交
2663 2664 2665 2666 2667 2668
	int rc;

	rc = superblock_doinit(sb, data);
	if (rc)
		return rc;

2669 2670 2671 2672
	/* Allow all mounts performed by the kernel */
	if (flags & MS_KERNMOUNT)
		return 0;

2673
	ad.type = LSM_AUDIT_DATA_DENTRY;
2674
	ad.u.dentry = sb->s_root;
2675
	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
L
Linus Torvalds 已提交
2676 2677
}

2678
static int selinux_sb_statfs(struct dentry *dentry)
L
Linus Torvalds 已提交
2679
{
2680
	const struct cred *cred = current_cred();
2681
	struct common_audit_data ad;
L
Linus Torvalds 已提交
2682

2683
	ad.type = LSM_AUDIT_DATA_DENTRY;
2684
	ad.u.dentry = dentry->d_sb->s_root;
2685
	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
L
Linus Torvalds 已提交
2686 2687
}

A
Al Viro 已提交
2688
static int selinux_mount(const char *dev_name,
2689
			 struct path *path,
A
Al Viro 已提交
2690
			 const char *type,
2691 2692
			 unsigned long flags,
			 void *data)
L
Linus Torvalds 已提交
2693
{
2694
	const struct cred *cred = current_cred();
L
Linus Torvalds 已提交
2695 2696

	if (flags & MS_REMOUNT)
2697
		return superblock_has_perm(cred, path->dentry->d_sb,
2698
					   FILESYSTEM__REMOUNT, NULL);
L
Linus Torvalds 已提交
2699
	else
E
Eric Paris 已提交
2700
		return path_has_perm(cred, path, FILE__MOUNTON);
L
Linus Torvalds 已提交
2701 2702 2703 2704
}

static int selinux_umount(struct vfsmount *mnt, int flags)
{
2705
	const struct cred *cred = current_cred();
L
Linus Torvalds 已提交
2706

2707
	return superblock_has_perm(cred, mnt->mnt_sb,
2708
				   FILESYSTEM__UNMOUNT, NULL);
L
Linus Torvalds 已提交
2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722
}

/* inode security operations */

static int selinux_inode_alloc_security(struct inode *inode)
{
	return inode_alloc_security(inode);
}

static void selinux_inode_free_security(struct inode *inode)
{
	inode_free_security(inode);
}

2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756
static int selinux_dentry_init_security(struct dentry *dentry, int mode,
					struct qstr *name, void **ctx,
					u32 *ctxlen)
{
	const struct cred *cred = current_cred();
	struct task_security_struct *tsec;
	struct inode_security_struct *dsec;
	struct superblock_security_struct *sbsec;
	struct inode *dir = dentry->d_parent->d_inode;
	u32 newsid;
	int rc;

	tsec = cred->security;
	dsec = dir->i_security;
	sbsec = dir->i_sb->s_security;

	if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
		newsid = tsec->create_sid;
	} else {
		rc = security_transition_sid(tsec->sid, dsec->sid,
					     inode_mode_to_security_class(mode),
					     name,
					     &newsid);
		if (rc) {
			printk(KERN_WARNING
				"%s: security_transition_sid failed, rc=%d\n",
			       __func__, -rc);
			return rc;
		}
	}

	return security_sid_to_context(newsid, (char **)ctx, ctxlen);
}

2757
static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2758 2759
				       const struct qstr *qstr,
				       const char **name,
2760
				       void **value, size_t *len)
2761
{
2762
	const struct task_security_struct *tsec = current_security();
2763 2764
	struct inode_security_struct *dsec;
	struct superblock_security_struct *sbsec;
2765
	u32 sid, newsid, clen;
2766
	int rc;
2767
	char *context;
2768 2769 2770 2771

	dsec = dir->i_security;
	sbsec = dir->i_sb->s_security;

2772 2773 2774
	sid = tsec->sid;
	newsid = tsec->create_sid;

2775 2776 2777
	if ((sbsec->flags & SE_SBINITIALIZED) &&
	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
		newsid = sbsec->mntpoint_sid;
2778
	else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2779
		rc = security_transition_sid(sid, dsec->sid,
2780
					     inode_mode_to_security_class(inode->i_mode),
2781
					     qstr, &newsid);
2782 2783 2784 2785
		if (rc) {
			printk(KERN_WARNING "%s:  "
			       "security_transition_sid failed, rc=%d (dev=%s "
			       "ino=%ld)\n",
2786
			       __func__,
2787 2788 2789 2790 2791
			       -rc, inode->i_sb->s_id, inode->i_ino);
			return rc;
		}
	}

2792
	/* Possibly defer initialization to selinux_complete_init. */
2793
	if (sbsec->flags & SE_SBINITIALIZED) {
2794 2795 2796 2797 2798
		struct inode_security_struct *isec = inode->i_security;
		isec->sclass = inode_mode_to_security_class(inode->i_mode);
		isec->sid = newsid;
		isec->initialized = 1;
	}
2799

2800
	if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2801 2802
		return -EOPNOTSUPP;

2803 2804
	if (name)
		*name = XATTR_SELINUX_SUFFIX;
2805

2806
	if (value && len) {
2807
		rc = security_sid_to_context_force(newsid, &context, &clen);
2808
		if (rc)
2809 2810 2811
			return rc;
		*value = context;
		*len = clen;
2812 2813 2814 2815 2816
	}

	return 0;
}

A
Al Viro 已提交
2817
static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
L
Linus Torvalds 已提交
2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836
{
	return may_create(dir, dentry, SECCLASS_FILE);
}

static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
{
	return may_link(dir, old_dentry, MAY_LINK);
}

static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
{
	return may_link(dir, dentry, MAY_UNLINK);
}

static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
{
	return may_create(dir, dentry, SECCLASS_LNK_FILE);
}

2837
static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
L
Linus Torvalds 已提交
2838 2839 2840 2841 2842 2843 2844 2845 2846
{
	return may_create(dir, dentry, SECCLASS_DIR);
}

static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
{
	return may_link(dir, dentry, MAY_RMDIR);
}

A
Al Viro 已提交
2847
static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
L
Linus Torvalds 已提交
2848 2849 2850 2851 2852
{
	return may_create(dir, dentry, inode_mode_to_security_class(mode));
}

static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2853
				struct inode *new_inode, struct dentry *new_dentry)
L
Linus Torvalds 已提交
2854 2855 2856 2857 2858 2859
{
	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
}

static int selinux_inode_readlink(struct dentry *dentry)
{
2860 2861
	const struct cred *cred = current_cred();

E
Eric Paris 已提交
2862
	return dentry_has_perm(cred, dentry, FILE__READ);
L
Linus Torvalds 已提交
2863 2864 2865 2866
}

static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
{
2867
	const struct cred *cred = current_cred();
L
Linus Torvalds 已提交
2868

E
Eric Paris 已提交
2869
	return dentry_has_perm(cred, dentry, FILE__READ);
L
Linus Torvalds 已提交
2870 2871
}

2872 2873
static noinline int audit_inode_permission(struct inode *inode,
					   u32 perms, u32 audited, u32 denied,
2874
					   int result,
2875
					   unsigned flags)
L
Linus Torvalds 已提交
2876
{
2877
	struct common_audit_data ad;
2878 2879 2880
	struct inode_security_struct *isec = inode->i_security;
	int rc;

2881
	ad.type = LSM_AUDIT_DATA_INODE;
2882 2883 2884
	ad.u.inode = inode;

	rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2885
			    audited, denied, result, &ad, flags);
2886 2887 2888 2889 2890
	if (rc)
		return rc;
	return 0;
}

2891
static int selinux_inode_permission(struct inode *inode, int mask)
L
Linus Torvalds 已提交
2892
{
2893
	const struct cred *cred = current_cred();
2894 2895
	u32 perms;
	bool from_access;
2896
	unsigned flags = mask & MAY_NOT_BLOCK;
2897 2898 2899 2900 2901
	struct inode_security_struct *isec;
	u32 sid;
	struct av_decision avd;
	int rc, rc2;
	u32 audited, denied;
L
Linus Torvalds 已提交
2902

2903
	from_access = mask & MAY_ACCESS;
2904 2905
	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);

2906 2907
	/* No permission to check.  Existence test. */
	if (!mask)
L
Linus Torvalds 已提交
2908 2909
		return 0;

2910
	validate_creds(cred);
2911

2912 2913
	if (unlikely(IS_PRIVATE(inode)))
		return 0;
2914 2915 2916

	perms = file_mask_to_av(inode->i_mode, mask);

2917 2918 2919 2920 2921 2922 2923 2924 2925 2926
	sid = cred_sid(cred);
	isec = inode->i_security;

	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
	audited = avc_audit_required(perms, &avd, rc,
				     from_access ? FILE__AUDIT_ACCESS : 0,
				     &denied);
	if (likely(!audited))
		return rc;

2927
	rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2928 2929 2930
	if (rc2)
		return rc2;
	return rc;
L
Linus Torvalds 已提交
2931 2932 2933 2934
}

static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
{
2935
	const struct cred *cred = current_cred();
2936
	unsigned int ia_valid = iattr->ia_valid;
2937
	__u32 av = FILE__WRITE;
L
Linus Torvalds 已提交
2938

2939 2940 2941 2942 2943 2944 2945
	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
	if (ia_valid & ATTR_FORCE) {
		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
			      ATTR_FORCE);
		if (!ia_valid)
			return 0;
	}
L
Linus Torvalds 已提交
2946

2947 2948
	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
E
Eric Paris 已提交
2949
		return dentry_has_perm(cred, dentry, FILE__SETATTR);
L
Linus Torvalds 已提交
2950

2951
	if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2952 2953 2954
		av |= FILE__OPEN;

	return dentry_has_perm(cred, dentry, av);
L
Linus Torvalds 已提交
2955 2956 2957 2958
}

static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
{
2959
	const struct cred *cred = current_cred();
E
Eric Paris 已提交
2960 2961 2962 2963
	struct path path;

	path.dentry = dentry;
	path.mnt = mnt;
2964

E
Eric Paris 已提交
2965
	return path_has_perm(cred, &path, FILE__GETATTR);
L
Linus Torvalds 已提交
2966 2967
}

2968
static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2969
{
2970 2971
	const struct cred *cred = current_cred();

2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985
	if (!strncmp(name, XATTR_SECURITY_PREFIX,
		     sizeof XATTR_SECURITY_PREFIX - 1)) {
		if (!strcmp(name, XATTR_NAME_CAPS)) {
			if (!capable(CAP_SETFCAP))
				return -EPERM;
		} else if (!capable(CAP_SYS_ADMIN)) {
			/* A different attribute in the security namespace.
			   Restrict to administrator. */
			return -EPERM;
		}
	}

	/* Not an attribute we recognize, so just check the
	   ordinary setattr permission. */
E
Eric Paris 已提交
2986
	return dentry_has_perm(cred, dentry, FILE__SETATTR);
2987 2988
}

2989 2990
static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
				  const void *value, size_t size, int flags)
L
Linus Torvalds 已提交
2991 2992 2993 2994
{
	struct inode *inode = dentry->d_inode;
	struct inode_security_struct *isec = inode->i_security;
	struct superblock_security_struct *sbsec;
2995
	struct common_audit_data ad;
2996
	u32 newsid, sid = current_sid();
L
Linus Torvalds 已提交
2997 2998
	int rc = 0;

2999 3000
	if (strcmp(name, XATTR_NAME_SELINUX))
		return selinux_inode_setotherxattr(dentry, name);
L
Linus Torvalds 已提交
3001 3002

	sbsec = inode->i_sb->s_security;
3003
	if (!(sbsec->flags & SBLABEL_MNT))
L
Linus Torvalds 已提交
3004 3005
		return -EOPNOTSUPP;

3006
	if (!inode_owner_or_capable(inode))
L
Linus Torvalds 已提交
3007 3008
		return -EPERM;

3009
	ad.type = LSM_AUDIT_DATA_DENTRY;
3010
	ad.u.dentry = dentry;
L
Linus Torvalds 已提交
3011

3012
	rc = avc_has_perm(sid, isec->sid, isec->sclass,
L
Linus Torvalds 已提交
3013 3014 3015 3016
			  FILE__RELABELFROM, &ad);
	if (rc)
		return rc;

3017
	rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3018
	if (rc == -EINVAL) {
3019 3020 3021 3022 3023 3024 3025
		if (!capable(CAP_MAC_ADMIN)) {
			struct audit_buffer *ab;
			size_t audit_size;
			const char *str;

			/* We strip a nul only if it is at the end, otherwise the
			 * context contains a nul and we should audit that */
3026 3027 3028 3029 3030 3031 3032 3033 3034 3035
			if (value) {
				str = value;
				if (str[size - 1] == '\0')
					audit_size = size - 1;
				else
					audit_size = size;
			} else {
				str = "";
				audit_size = 0;
			}
3036 3037 3038 3039 3040
			ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
			audit_log_format(ab, "op=setxattr invalid_context=");
			audit_log_n_untrustedstring(ab, value, audit_size);
			audit_log_end(ab);

3041
			return rc;
3042
		}
3043 3044
		rc = security_context_to_sid_force(value, size, &newsid);
	}
L
Linus Torvalds 已提交
3045 3046 3047
	if (rc)
		return rc;

3048
	rc = avc_has_perm(sid, newsid, isec->sclass,
L
Linus Torvalds 已提交
3049 3050 3051 3052
			  FILE__RELABELTO, &ad);
	if (rc)
		return rc;

3053
	rc = security_validate_transition(isec->sid, newsid, sid,
3054
					  isec->sclass);
L
Linus Torvalds 已提交
3055 3056 3057 3058 3059 3060 3061 3062 3063 3064
	if (rc)
		return rc;

	return avc_has_perm(newsid,
			    sbsec->sid,
			    SECCLASS_FILESYSTEM,
			    FILESYSTEM__ASSOCIATE,
			    &ad);
}

3065
static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3066
					const void *value, size_t size,
3067
					int flags)
L
Linus Torvalds 已提交
3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078
{
	struct inode *inode = dentry->d_inode;
	struct inode_security_struct *isec = inode->i_security;
	u32 newsid;
	int rc;

	if (strcmp(name, XATTR_NAME_SELINUX)) {
		/* Not an attribute we recognize, so nothing to do. */
		return;
	}

3079
	rc = security_context_to_sid_force(value, size, &newsid);
L
Linus Torvalds 已提交
3080
	if (rc) {
3081 3082 3083
		printk(KERN_ERR "SELinux:  unable to map context to SID"
		       "for (%s, %lu), rc=%d\n",
		       inode->i_sb->s_id, inode->i_ino, -rc);
L
Linus Torvalds 已提交
3084 3085 3086
		return;
	}

3087
	isec->sclass = inode_mode_to_security_class(inode->i_mode);
L
Linus Torvalds 已提交
3088
	isec->sid = newsid;
3089 3090
	isec->initialized = 1;

L
Linus Torvalds 已提交
3091 3092 3093
	return;
}

3094
static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
L
Linus Torvalds 已提交
3095
{
3096 3097
	const struct cred *cred = current_cred();

E
Eric Paris 已提交
3098
	return dentry_has_perm(cred, dentry, FILE__GETATTR);
L
Linus Torvalds 已提交
3099 3100
}

3101
static int selinux_inode_listxattr(struct dentry *dentry)
L
Linus Torvalds 已提交
3102
{
3103 3104
	const struct cred *cred = current_cred();

E
Eric Paris 已提交
3105
	return dentry_has_perm(cred, dentry, FILE__GETATTR);
L
Linus Torvalds 已提交
3106 3107
}

3108
static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
L
Linus Torvalds 已提交
3109
{
3110 3111
	if (strcmp(name, XATTR_NAME_SELINUX))
		return selinux_inode_setotherxattr(dentry, name);
L
Linus Torvalds 已提交
3112 3113 3114 3115 3116 3117

	/* No one is allowed to remove a SELinux security label.
	   You can change the label, but all data must be labeled. */
	return -EACCES;
}

3118
/*
3119
 * Copy the inode security context value to the user.
3120 3121 3122
 *
 * Permission check is handled by selinux_inode_getxattr hook.
 */
3123
static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
L
Linus Torvalds 已提交
3124
{
3125 3126 3127
	u32 size;
	int error;
	char *context = NULL;
L
Linus Torvalds 已提交
3128
	struct inode_security_struct *isec = inode->i_security;
3129

3130 3131
	if (strcmp(name, XATTR_SELINUX_SUFFIX))
		return -EOPNOTSUPP;
3132

3133 3134 3135 3136 3137 3138 3139 3140 3141
	/*
	 * If the caller has CAP_MAC_ADMIN, then get the raw context
	 * value even if it is not defined by current policy; otherwise,
	 * use the in-core value under current policy.
	 * Use the non-auditing forms of the permission checks since
	 * getxattr may be called by unprivileged processes commonly
	 * and lack of permission just means that we fall back to the
	 * in-core context value, not a denial.
	 */
3142
	error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3143
				SECURITY_CAP_NOAUDIT);
3144 3145 3146 3147 3148
	if (!error)
		error = security_sid_to_context_force(isec->sid, &context,
						      &size);
	else
		error = security_sid_to_context(isec->sid, &context, &size);
3149 3150 3151 3152 3153 3154 3155 3156 3157 3158
	if (error)
		return error;
	error = size;
	if (alloc) {
		*buffer = context;
		goto out_nofree;
	}
	kfree(context);
out_nofree:
	return error;
L
Linus Torvalds 已提交
3159 3160 3161
}

static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3162
				     const void *value, size_t size, int flags)
L
Linus Torvalds 已提交
3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173
{
	struct inode_security_struct *isec = inode->i_security;
	u32 newsid;
	int rc;

	if (strcmp(name, XATTR_SELINUX_SUFFIX))
		return -EOPNOTSUPP;

	if (!value || !size)
		return -EACCES;

3174
	rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
L
Linus Torvalds 已提交
3175 3176 3177
	if (rc)
		return rc;

3178
	isec->sclass = inode_mode_to_security_class(inode->i_mode);
L
Linus Torvalds 已提交
3179
	isec->sid = newsid;
3180
	isec->initialized = 1;
L
Linus Torvalds 已提交
3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191
	return 0;
}

static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
{
	const int len = sizeof(XATTR_NAME_SELINUX);
	if (buffer && len <= buffer_size)
		memcpy(buffer, XATTR_NAME_SELINUX, len);
	return len;
}

3192 3193 3194 3195 3196 3197
static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
{
	struct inode_security_struct *isec = inode->i_security;
	*secid = isec->sid;
}

L
Linus Torvalds 已提交
3198 3199
/* file security operations */

3200
static int selinux_revalidate_file_permission(struct file *file, int mask)
L
Linus Torvalds 已提交
3201
{
3202
	const struct cred *cred = current_cred();
A
Al Viro 已提交
3203
	struct inode *inode = file_inode(file);
L
Linus Torvalds 已提交
3204 3205 3206 3207 3208

	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
		mask |= MAY_APPEND;

3209 3210
	return file_has_perm(cred, file,
			     file_mask_to_av(inode->i_mode, mask));
L
Linus Torvalds 已提交
3211 3212
}

3213 3214
static int selinux_file_permission(struct file *file, int mask)
{
A
Al Viro 已提交
3215
	struct inode *inode = file_inode(file);
3216 3217 3218 3219
	struct file_security_struct *fsec = file->f_security;
	struct inode_security_struct *isec = inode->i_security;
	u32 sid = current_sid();

3220
	if (!mask)
3221 3222 3223
		/* No permission to check.  Existence test. */
		return 0;

3224 3225
	if (sid == fsec->sid && fsec->isid == isec->sid &&
	    fsec->pseqno == avc_policy_seqno())
3226
		/* No change since file_open check. */
3227 3228
		return 0;

3229 3230 3231
	return selinux_revalidate_file_permission(file, mask);
}

L
Linus Torvalds 已提交
3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242 3243 3244
static int selinux_file_alloc_security(struct file *file)
{
	return file_alloc_security(file);
}

static void selinux_file_free_security(struct file *file)
{
	file_free_security(file);
}

static int selinux_file_ioctl(struct file *file, unsigned int cmd,
			      unsigned long arg)
{
3245
	const struct cred *cred = current_cred();
3246
	int error = 0;
L
Linus Torvalds 已提交
3247

3248 3249 3250 3251 3252 3253 3254
	switch (cmd) {
	case FIONREAD:
	/* fall through */
	case FIBMAP:
	/* fall through */
	case FIGETBSZ:
	/* fall through */
3255
	case FS_IOC_GETFLAGS:
3256
	/* fall through */
3257
	case FS_IOC_GETVERSION:
3258 3259
		error = file_has_perm(cred, file, FILE__GETATTR);
		break;
L
Linus Torvalds 已提交
3260

3261
	case FS_IOC_SETFLAGS:
3262
	/* fall through */
3263
	case FS_IOC_SETVERSION:
3264 3265 3266 3267 3268 3269 3270 3271 3272
		error = file_has_perm(cred, file, FILE__SETATTR);
		break;

	/* sys_ioctl() checks */
	case FIONBIO:
	/* fall through */
	case FIOASYNC:
		error = file_has_perm(cred, file, 0);
		break;
L
Linus Torvalds 已提交
3273

3274 3275
	case KDSKBENT:
	case KDSKBSENT:
3276 3277
		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
					    SECURITY_CAP_AUDIT);
3278 3279 3280 3281 3282 3283 3284 3285 3286
		break;

	/* default case assumes that the command will go
	 * to the file's ioctl() function.
	 */
	default:
		error = file_has_perm(cred, file, FILE__IOCTL);
	}
	return error;
L
Linus Torvalds 已提交
3287 3288
}

3289 3290
static int default_noexec;

L
Linus Torvalds 已提交
3291 3292
static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
{
3293
	const struct cred *cred = current_cred();
D
David Howells 已提交
3294
	int rc = 0;
3295

3296 3297
	if (default_noexec &&
	    (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
L
Linus Torvalds 已提交
3298 3299 3300 3301 3302
		/*
		 * We are making executable an anonymous mapping or a
		 * private file mapping that will also be writable.
		 * This has an additional check.
		 */
D
David Howells 已提交
3303
		rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
L
Linus Torvalds 已提交
3304
		if (rc)
D
David Howells 已提交
3305
			goto error;
L
Linus Torvalds 已提交
3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318
	}

	if (file) {
		/* read access is always possible with a mapping */
		u32 av = FILE__READ;

		/* write access only matters if the mapping is shared */
		if (shared && (prot & PROT_WRITE))
			av |= FILE__WRITE;

		if (prot & PROT_EXEC)
			av |= FILE__EXECUTE;

3319
		return file_has_perm(cred, file, av);
L
Linus Torvalds 已提交
3320
	}
D
David Howells 已提交
3321 3322 3323

error:
	return rc;
L
Linus Torvalds 已提交
3324 3325
}

3326
static int selinux_mmap_addr(unsigned long addr)
L
Linus Torvalds 已提交
3327
{
3328 3329 3330 3331 3332 3333
	int rc;

	/* do DAC check on address space usage */
	rc = cap_mmap_addr(addr);
	if (rc)
		return rc;
L
Linus Torvalds 已提交
3334

3335
	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3336
		u32 sid = current_sid();
3337 3338
		rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
				  MEMPROTECT__MMAP_ZERO, NULL);
3339 3340
	}

3341
	return rc;
3342
}
L
Linus Torvalds 已提交
3343

3344 3345 3346
static int selinux_mmap_file(struct file *file, unsigned long reqprot,
			     unsigned long prot, unsigned long flags)
{
L
Linus Torvalds 已提交
3347 3348 3349 3350 3351 3352 3353 3354 3355 3356 3357
	if (selinux_checkreqprot)
		prot = reqprot;

	return file_map_prot_check(file, prot,
				   (flags & MAP_TYPE) == MAP_SHARED);
}

static int selinux_file_mprotect(struct vm_area_struct *vma,
				 unsigned long reqprot,
				 unsigned long prot)
{
3358
	const struct cred *cred = current_cred();
L
Linus Torvalds 已提交
3359 3360 3361 3362

	if (selinux_checkreqprot)
		prot = reqprot;

3363 3364
	if (default_noexec &&
	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3365
		int rc = 0;
3366 3367
		if (vma->vm_start >= vma->vm_mm->start_brk &&
		    vma->vm_end <= vma->vm_mm->brk) {
D
David Howells 已提交
3368
			rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3369 3370 3371
		} else if (!vma->vm_file &&
			   vma->vm_start <= vma->vm_mm->start_stack &&
			   vma->vm_end >= vma->vm_mm->start_stack) {
3372
			rc = current_has_perm(current, PROCESS__EXECSTACK);
3373 3374 3375 3376 3377 3378 3379 3380
		} else if (vma->vm_file && vma->anon_vma) {
			/*
			 * We are making executable a file mapping that has
			 * had some COW done. Since pages might have been
			 * written, check ability to execute the possibly
			 * modified content.  This typically should only
			 * occur for text relocations.
			 */
D
David Howells 已提交
3381
			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3382
		}
3383 3384 3385
		if (rc)
			return rc;
	}
L
Linus Torvalds 已提交
3386 3387 3388 3389 3390 3391

	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
}

static int selinux_file_lock(struct file *file, unsigned int cmd)
{
3392 3393 3394
	const struct cred *cred = current_cred();

	return file_has_perm(cred, file, FILE__LOCK);
L
Linus Torvalds 已提交
3395 3396 3397 3398 3399
}

static int selinux_file_fcntl(struct file *file, unsigned int cmd,
			      unsigned long arg)
{
3400
	const struct cred *cred = current_cred();
L
Linus Torvalds 已提交
3401 3402 3403
	int err = 0;

	switch (cmd) {
3404 3405
	case F_SETFL:
		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3406
			err = file_has_perm(cred, file, FILE__WRITE);
L
Linus Torvalds 已提交
3407
			break;
3408 3409 3410 3411 3412 3413 3414
		}
		/* fall through */
	case F_SETOWN:
	case F_SETSIG:
	case F_GETFL:
	case F_GETOWN:
	case F_GETSIG:
3415
	case F_GETOWNER_UIDS:
3416
		/* Just check FD__USE permission */
3417
		err = file_has_perm(cred, file, 0);
3418 3419 3420 3421
		break;
	case F_GETLK:
	case F_SETLK:
	case F_SETLKW:
3422 3423 3424
	case F_OFD_GETLK:
	case F_OFD_SETLK:
	case F_OFD_SETLKW:
L
Linus Torvalds 已提交
3425
#if BITS_PER_LONG == 32
3426 3427 3428
	case F_GETLK64:
	case F_SETLK64:
	case F_SETLKW64:
L
Linus Torvalds 已提交
3429
#endif
3430
		err = file_has_perm(cred, file, FILE__LOCK);
3431
		break;
L
Linus Torvalds 已提交
3432 3433 3434 3435 3436
	}

	return err;
}

3437
static void selinux_file_set_fowner(struct file *file)
L
Linus Torvalds 已提交
3438 3439 3440 3441
{
	struct file_security_struct *fsec;

	fsec = file->f_security;
3442
	fsec->fown_sid = current_sid();
L
Linus Torvalds 已提交
3443 3444 3445 3446 3447
}

static int selinux_file_send_sigiotask(struct task_struct *tsk,
				       struct fown_struct *fown, int signum)
{
3448
	struct file *file;
3449
	u32 sid = task_sid(tsk);
L
Linus Torvalds 已提交
3450 3451 3452 3453
	u32 perm;
	struct file_security_struct *fsec;

	/* struct fown_struct is never outside the context of a struct file */
3454
	file = container_of(fown, struct file, f_owner);
L
Linus Torvalds 已提交
3455 3456 3457 3458 3459 3460 3461 3462

	fsec = file->f_security;

	if (!signum)
		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
	else
		perm = signal_to_av(signum);

3463
	return avc_has_perm(fsec->fown_sid, sid,
L
Linus Torvalds 已提交
3464 3465 3466 3467 3468
			    SECCLASS_PROCESS, perm, NULL);
}

static int selinux_file_receive(struct file *file)
{
3469 3470 3471
	const struct cred *cred = current_cred();

	return file_has_perm(cred, file, file_to_av(file));
L
Linus Torvalds 已提交
3472 3473
}

3474
static int selinux_file_open(struct file *file, const struct cred *cred)
3475 3476 3477
{
	struct file_security_struct *fsec;
	struct inode_security_struct *isec;
D
David Howells 已提交
3478

3479
	fsec = file->f_security;
A
Al Viro 已提交
3480
	isec = file_inode(file)->i_security;
3481 3482 3483 3484 3485 3486 3487 3488 3489 3490 3491 3492 3493 3494 3495 3496 3497
	/*
	 * Save inode label and policy sequence number
	 * at open-time so that selinux_file_permission
	 * can determine whether revalidation is necessary.
	 * Task label is already saved in the file security
	 * struct as its SID.
	 */
	fsec->isid = isec->sid;
	fsec->pseqno = avc_policy_seqno();
	/*
	 * Since the inode label or policy seqno may have changed
	 * between the selinux_inode_permission check and the saving
	 * of state above, recheck that access is still permitted.
	 * Otherwise, access might never be revalidated against the
	 * new inode label or new policy.
	 * This check is not redundant - do not remove.
	 */
3498
	return file_path_has_perm(cred, file, open_file_to_av(file));
3499 3500
}

L
Linus Torvalds 已提交
3501 3502 3503 3504
/* task security operations */

static int selinux_task_create(unsigned long clone_flags)
{
3505
	return current_has_perm(current, PROCESS__FORK);
L
Linus Torvalds 已提交
3506 3507
}

3508 3509 3510 3511 3512 3513 3514 3515 3516 3517 3518 3519 3520 3521 3522
/*
 * allocate the SELinux part of blank credentials
 */
static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
{
	struct task_security_struct *tsec;

	tsec = kzalloc(sizeof(struct task_security_struct), gfp);
	if (!tsec)
		return -ENOMEM;

	cred->security = tsec;
	return 0;
}

D
David Howells 已提交
3523 3524 3525 3526
/*
 * detach and free the LSM part of a set of credentials
 */
static void selinux_cred_free(struct cred *cred)
L
Linus Torvalds 已提交
3527
{
D
David Howells 已提交
3528
	struct task_security_struct *tsec = cred->security;
3529

3530 3531 3532 3533 3534
	/*
	 * cred->security == NULL if security_cred_alloc_blank() or
	 * security_prepare_creds() returned an error.
	 */
	BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3535
	cred->security = (void *) 0x7UL;
D
David Howells 已提交
3536 3537
	kfree(tsec);
}
L
Linus Torvalds 已提交
3538

D
David Howells 已提交
3539 3540 3541 3542 3543 3544 3545 3546
/*
 * prepare a new set of credentials for modification
 */
static int selinux_cred_prepare(struct cred *new, const struct cred *old,
				gfp_t gfp)
{
	const struct task_security_struct *old_tsec;
	struct task_security_struct *tsec;
L
Linus Torvalds 已提交
3547

D
David Howells 已提交
3548
	old_tsec = old->security;
L
Linus Torvalds 已提交
3549

D
David Howells 已提交
3550 3551 3552
	tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
	if (!tsec)
		return -ENOMEM;
L
Linus Torvalds 已提交
3553

D
David Howells 已提交
3554
	new->security = tsec;
L
Linus Torvalds 已提交
3555 3556 3557
	return 0;
}

3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568
/*
 * transfer the SELinux data to a blank set of creds
 */
static void selinux_cred_transfer(struct cred *new, const struct cred *old)
{
	const struct task_security_struct *old_tsec = old->security;
	struct task_security_struct *tsec = new->security;

	*tsec = *old_tsec;
}

3569 3570 3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581 3582 3583 3584 3585 3586 3587 3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602 3603 3604 3605 3606 3607 3608 3609
/*
 * set the security data for a kernel service
 * - all the creation contexts are set to unlabelled
 */
static int selinux_kernel_act_as(struct cred *new, u32 secid)
{
	struct task_security_struct *tsec = new->security;
	u32 sid = current_sid();
	int ret;

	ret = avc_has_perm(sid, secid,
			   SECCLASS_KERNEL_SERVICE,
			   KERNEL_SERVICE__USE_AS_OVERRIDE,
			   NULL);
	if (ret == 0) {
		tsec->sid = secid;
		tsec->create_sid = 0;
		tsec->keycreate_sid = 0;
		tsec->sockcreate_sid = 0;
	}
	return ret;
}

/*
 * set the file creation context in a security record to the same as the
 * objective context of the specified inode
 */
static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
{
	struct inode_security_struct *isec = inode->i_security;
	struct task_security_struct *tsec = new->security;
	u32 sid = current_sid();
	int ret;

	ret = avc_has_perm(sid, isec->sid,
			   SECCLASS_KERNEL_SERVICE,
			   KERNEL_SERVICE__CREATE_FILES_AS,
			   NULL);

	if (ret == 0)
		tsec->create_sid = isec->sid;
3610
	return ret;
3611 3612
}

3613
static int selinux_kernel_module_request(char *kmod_name)
3614
{
3615 3616 3617 3618 3619
	u32 sid;
	struct common_audit_data ad;

	sid = task_sid(current);

3620
	ad.type = LSM_AUDIT_DATA_KMOD;
3621 3622 3623 3624
	ad.u.kmod_name = kmod_name;

	return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
			    SYSTEM__MODULE_REQUEST, &ad);
3625 3626
}

L
Linus Torvalds 已提交
3627 3628
static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
{
3629
	return current_has_perm(p, PROCESS__SETPGID);
L
Linus Torvalds 已提交
3630 3631 3632 3633
}

static int selinux_task_getpgid(struct task_struct *p)
{
3634
	return current_has_perm(p, PROCESS__GETPGID);
L
Linus Torvalds 已提交
3635 3636 3637 3638
}

static int selinux_task_getsid(struct task_struct *p)
{
3639
	return current_has_perm(p, PROCESS__GETSESSION);
L
Linus Torvalds 已提交
3640 3641
}

3642 3643
static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
{
3644
	*secid = task_sid(p);
3645 3646
}

L
Linus Torvalds 已提交
3647 3648 3649 3650
static int selinux_task_setnice(struct task_struct *p, int nice)
{
	int rc;

3651
	rc = cap_task_setnice(p, nice);
L
Linus Torvalds 已提交
3652 3653 3654
	if (rc)
		return rc;

3655
	return current_has_perm(p, PROCESS__SETSCHED);
L
Linus Torvalds 已提交
3656 3657
}

3658 3659
static int selinux_task_setioprio(struct task_struct *p, int ioprio)
{
3660 3661
	int rc;

3662
	rc = cap_task_setioprio(p, ioprio);
3663 3664 3665
	if (rc)
		return rc;

3666
	return current_has_perm(p, PROCESS__SETSCHED);
3667 3668
}

3669 3670
static int selinux_task_getioprio(struct task_struct *p)
{
3671
	return current_has_perm(p, PROCESS__GETSCHED);
3672 3673
}

3674 3675
static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
		struct rlimit *new_rlim)
L
Linus Torvalds 已提交
3676
{
3677
	struct rlimit *old_rlim = p->signal->rlim + resource;
L
Linus Torvalds 已提交
3678 3679 3680 3681

	/* Control the ability to change the hard limit (whether
	   lowering or raising it), so that the hard limit can
	   later be used as a safe reset point for the soft limit
D
David Howells 已提交
3682
	   upon context transitions.  See selinux_bprm_committing_creds. */
L
Linus Torvalds 已提交
3683
	if (old_rlim->rlim_max != new_rlim->rlim_max)
3684
		return current_has_perm(p, PROCESS__SETRLIMIT);
L
Linus Torvalds 已提交
3685 3686 3687 3688

	return 0;
}

3689
static int selinux_task_setscheduler(struct task_struct *p)
L
Linus Torvalds 已提交
3690
{
3691 3692
	int rc;

3693
	rc = cap_task_setscheduler(p);
3694 3695 3696
	if (rc)
		return rc;

3697
	return current_has_perm(p, PROCESS__SETSCHED);
L
Linus Torvalds 已提交
3698 3699 3700 3701
}

static int selinux_task_getscheduler(struct task_struct *p)
{
3702
	return current_has_perm(p, PROCESS__GETSCHED);
L
Linus Torvalds 已提交
3703 3704
}

3705 3706
static int selinux_task_movememory(struct task_struct *p)
{
3707
	return current_has_perm(p, PROCESS__SETSCHED);
3708 3709
}

3710 3711
static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
				int sig, u32 secid)
L
Linus Torvalds 已提交
3712 3713 3714 3715 3716 3717 3718 3719
{
	u32 perm;
	int rc;

	if (!sig)
		perm = PROCESS__SIGNULL; /* null signal; existence test */
	else
		perm = signal_to_av(sig);
3720
	if (secid)
3721 3722
		rc = avc_has_perm(secid, task_sid(p),
				  SECCLASS_PROCESS, perm, NULL);
3723
	else
3724
		rc = current_has_perm(p, perm);
3725
	return rc;
L
Linus Torvalds 已提交
3726 3727 3728 3729
}

static int selinux_task_wait(struct task_struct *p)
{
3730
	return task_has_perm(p, current, PROCESS__SIGCHLD);
L
Linus Torvalds 已提交
3731 3732 3733 3734 3735 3736
}

static void selinux_task_to_inode(struct task_struct *p,
				  struct inode *inode)
{
	struct inode_security_struct *isec = inode->i_security;
3737
	u32 sid = task_sid(p);
L
Linus Torvalds 已提交
3738

3739
	isec->sid = sid;
L
Linus Torvalds 已提交
3740 3741 3742 3743
	isec->initialized = 1;
}

/* Returns error only if unable to parse addresses */
3744
static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3745
			struct common_audit_data *ad, u8 *proto)
L
Linus Torvalds 已提交
3746 3747 3748 3749
{
	int offset, ihlen, ret = -EINVAL;
	struct iphdr _iph, *ih;

3750
	offset = skb_network_offset(skb);
L
Linus Torvalds 已提交
3751 3752 3753 3754 3755 3756 3757 3758
	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	if (ih == NULL)
		goto out;

	ihlen = ih->ihl * 4;
	if (ihlen < sizeof(_iph))
		goto out;

3759 3760
	ad->u.net->v4info.saddr = ih->saddr;
	ad->u.net->v4info.daddr = ih->daddr;
L
Linus Torvalds 已提交
3761 3762
	ret = 0;

3763 3764 3765
	if (proto)
		*proto = ih->protocol;

L
Linus Torvalds 已提交
3766
	switch (ih->protocol) {
3767 3768
	case IPPROTO_TCP: {
		struct tcphdr _tcph, *th;
L
Linus Torvalds 已提交
3769

3770 3771
		if (ntohs(ih->frag_off) & IP_OFFSET)
			break;
L
Linus Torvalds 已提交
3772 3773 3774 3775 3776 3777

		offset += ihlen;
		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
		if (th == NULL)
			break;

3778 3779
		ad->u.net->sport = th->source;
		ad->u.net->dport = th->dest;
L
Linus Torvalds 已提交
3780
		break;
3781 3782 3783 3784 3785 3786 3787 3788
	}

	case IPPROTO_UDP: {
		struct udphdr _udph, *uh;

		if (ntohs(ih->frag_off) & IP_OFFSET)
			break;

L
Linus Torvalds 已提交
3789
		offset += ihlen;
3790
		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
L
Linus Torvalds 已提交
3791
		if (uh == NULL)
3792
			break;
L
Linus Torvalds 已提交
3793

3794 3795
		ad->u.net->sport = uh->source;
		ad->u.net->dport = uh->dest;
3796 3797
		break;
	}
L
Linus Torvalds 已提交
3798

J
James Morris 已提交
3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809
	case IPPROTO_DCCP: {
		struct dccp_hdr _dccph, *dh;

		if (ntohs(ih->frag_off) & IP_OFFSET)
			break;

		offset += ihlen;
		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
		if (dh == NULL)
			break;

3810 3811
		ad->u.net->sport = dh->dccph_sport;
		ad->u.net->dport = dh->dccph_dport;
J
James Morris 已提交
3812
		break;
3813
	}
J
James Morris 已提交
3814

3815 3816 3817
	default:
		break;
	}
L
Linus Torvalds 已提交
3818 3819 3820 3821 3822 3823 3824
out:
	return ret;
}

#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

/* Returns error only if unable to parse addresses */
3825
static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3826
			struct common_audit_data *ad, u8 *proto)
L
Linus Torvalds 已提交
3827 3828 3829 3830
{
	u8 nexthdr;
	int ret = -EINVAL, offset;
	struct ipv6hdr _ipv6h, *ip6;
3831
	__be16 frag_off;
L
Linus Torvalds 已提交
3832

3833
	offset = skb_network_offset(skb);
L
Linus Torvalds 已提交
3834 3835 3836 3837
	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
	if (ip6 == NULL)
		goto out;

3838 3839
	ad->u.net->v6info.saddr = ip6->saddr;
	ad->u.net->v6info.daddr = ip6->daddr;
L
Linus Torvalds 已提交
3840 3841 3842 3843
	ret = 0;

	nexthdr = ip6->nexthdr;
	offset += sizeof(_ipv6h);
3844
	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
L
Linus Torvalds 已提交
3845 3846 3847
	if (offset < 0)
		goto out;

3848 3849 3850
	if (proto)
		*proto = nexthdr;

L
Linus Torvalds 已提交
3851 3852
	switch (nexthdr) {
	case IPPROTO_TCP: {
3853
		struct tcphdr _tcph, *th;
L
Linus Torvalds 已提交
3854 3855 3856 3857 3858

		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
		if (th == NULL)
			break;

3859 3860
		ad->u.net->sport = th->source;
		ad->u.net->dport = th->dest;
L
Linus Torvalds 已提交
3861 3862 3863 3864 3865 3866 3867 3868 3869 3870
		break;
	}

	case IPPROTO_UDP: {
		struct udphdr _udph, *uh;

		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
		if (uh == NULL)
			break;

3871 3872
		ad->u.net->sport = uh->source;
		ad->u.net->dport = uh->dest;
L
Linus Torvalds 已提交
3873 3874 3875
		break;
	}

J
James Morris 已提交
3876 3877 3878 3879 3880 3881 3882
	case IPPROTO_DCCP: {
		struct dccp_hdr _dccph, *dh;

		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
		if (dh == NULL)
			break;

3883 3884
		ad->u.net->sport = dh->dccph_sport;
		ad->u.net->dport = dh->dccph_dport;
J
James Morris 已提交
3885
		break;
3886
	}
J
James Morris 已提交
3887

L
Linus Torvalds 已提交
3888 3889 3890 3891 3892 3893 3894 3895 3896 3897
	/* includes fragments */
	default:
		break;
	}
out:
	return ret;
}

#endif /* IPV6 */

3898
static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3899
			     char **_addrp, int src, u8 *proto)
L
Linus Torvalds 已提交
3900
{
3901 3902
	char *addrp;
	int ret;
L
Linus Torvalds 已提交
3903

3904
	switch (ad->u.net->family) {
L
Linus Torvalds 已提交
3905
	case PF_INET:
3906
		ret = selinux_parse_skb_ipv4(skb, ad, proto);
3907 3908
		if (ret)
			goto parse_error;
3909 3910
		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
				       &ad->u.net->v4info.daddr);
3911
		goto okay;
L
Linus Torvalds 已提交
3912 3913 3914

#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
	case PF_INET6:
3915
		ret = selinux_parse_skb_ipv6(skb, ad, proto);
3916 3917
		if (ret)
			goto parse_error;
3918 3919
		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
				       &ad->u.net->v6info.daddr);
3920
		goto okay;
L
Linus Torvalds 已提交
3921 3922
#endif	/* IPV6 */
	default:
3923 3924
		addrp = NULL;
		goto okay;
L
Linus Torvalds 已提交
3925 3926
	}

3927 3928 3929 3930
parse_error:
	printk(KERN_WARNING
	       "SELinux: failure in selinux_parse_skb(),"
	       " unable to parse packet\n");
L
Linus Torvalds 已提交
3931
	return ret;
3932 3933 3934 3935 3936

okay:
	if (_addrp)
		*_addrp = addrp;
	return 0;
L
Linus Torvalds 已提交
3937 3938
}

3939
/**
3940
 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3941
 * @skb: the packet
3942
 * @family: protocol family
3943
 * @sid: the packet's peer label SID
3944 3945
 *
 * Description:
3946 3947 3948 3949 3950 3951
 * Check the various different forms of network peer labeling and determine
 * the peer label/SID for the packet; most of the magic actually occurs in
 * the security server function security_net_peersid_cmp().  The function
 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
 * or -EACCES if @sid is invalid due to inconsistencies with the different
 * peer labels.
3952 3953
 *
 */
3954
static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3955
{
3956
	int err;
3957 3958
	u32 xfrm_sid;
	u32 nlbl_sid;
3959
	u32 nlbl_type;
3960

3961
	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3962 3963 3964 3965 3966
	if (unlikely(err))
		return -EACCES;
	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
	if (unlikely(err))
		return -EACCES;
3967

3968 3969 3970 3971 3972
	err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
	if (unlikely(err)) {
		printk(KERN_WARNING
		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
		       " unable to determine packet's peer label\n");
3973
		return -EACCES;
3974
	}
3975 3976

	return 0;
3977 3978
}

3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996 3997 3998 3999 4000 4001 4002
/**
 * selinux_conn_sid - Determine the child socket label for a connection
 * @sk_sid: the parent socket's SID
 * @skb_sid: the packet's SID
 * @conn_sid: the resulting connection SID
 *
 * If @skb_sid is valid then the user:role:type information from @sk_sid is
 * combined with the MLS information from @skb_sid in order to create
 * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
 * of @sk_sid.  Returns zero on success, negative values on failure.
 *
 */
static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
{
	int err = 0;

	if (skb_sid != SECSID_NULL)
		err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
	else
		*conn_sid = sk_sid;

	return err;
}

L
Linus Torvalds 已提交
4003
/* socket security operations */
4004

4005 4006
static int socket_sockcreate_sid(const struct task_security_struct *tsec,
				 u16 secclass, u32 *socksid)
4007
{
4008 4009 4010 4011 4012 4013 4014
	if (tsec->sockcreate_sid > SECSID_NULL) {
		*socksid = tsec->sockcreate_sid;
		return 0;
	}

	return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
				       socksid);
4015 4016
}

4017
static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
L
Linus Torvalds 已提交
4018
{
4019
	struct sk_security_struct *sksec = sk->sk_security;
4020
	struct common_audit_data ad;
4021
	struct lsm_network_audit net = {0,};
4022
	u32 tsid = task_sid(task);
L
Linus Torvalds 已提交
4023

4024 4025
	if (sksec->sid == SECINITSID_KERNEL)
		return 0;
L
Linus Torvalds 已提交
4026

4027
	ad.type = LSM_AUDIT_DATA_NET;
4028 4029
	ad.u.net = &net;
	ad.u.net->sk = sk;
L
Linus Torvalds 已提交
4030

4031
	return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
L
Linus Torvalds 已提交
4032 4033 4034 4035 4036
}

static int selinux_socket_create(int family, int type,
				 int protocol, int kern)
{
4037
	const struct task_security_struct *tsec = current_security();
4038
	u32 newsid;
4039
	u16 secclass;
4040
	int rc;
L
Linus Torvalds 已提交
4041 4042

	if (kern)
4043
		return 0;
4044 4045

	secclass = socket_type_to_security_class(family, type, protocol);
4046 4047 4048 4049
	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
	if (rc)
		return rc;

4050
	return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
L
Linus Torvalds 已提交
4051 4052
}

V
Venkat Yekkirala 已提交
4053 4054
static int selinux_socket_post_create(struct socket *sock, int family,
				      int type, int protocol, int kern)
L
Linus Torvalds 已提交
4055
{
4056
	const struct task_security_struct *tsec = current_security();
4057
	struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4058
	struct sk_security_struct *sksec;
4059 4060
	int err = 0;

4061 4062
	isec->sclass = socket_type_to_security_class(family, type, protocol);

4063 4064
	if (kern)
		isec->sid = SECINITSID_KERNEL;
4065 4066 4067 4068 4069
	else {
		err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
		if (err)
			return err;
	}
4070

L
Linus Torvalds 已提交
4071 4072
	isec->initialized = 1;

4073 4074 4075
	if (sock->sk) {
		sksec = sock->sk->sk_security;
		sksec->sid = isec->sid;
4076
		sksec->sclass = isec->sclass;
4077
		err = selinux_netlbl_socket_post_create(sock->sk, family);
4078 4079
	}

V
Venkat Yekkirala 已提交
4080
	return err;
L
Linus Torvalds 已提交
4081 4082 4083 4084 4085 4086 4087 4088
}

/* Range of port numbers used to automatically bind.
   Need to determine whether we should perform a name_bind
   permission check between the socket and the port number. */

static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
{
4089
	struct sock *sk = sock->sk;
L
Linus Torvalds 已提交
4090 4091 4092
	u16 family;
	int err;

4093
	err = sock_has_perm(current, sk, SOCKET__BIND);
L
Linus Torvalds 已提交
4094 4095 4096 4097 4098
	if (err)
		goto out;

	/*
	 * If PF_INET or PF_INET6, check name_bind permission for the port.
4099 4100
	 * Multiple address binding for SCTP is not supported yet: we just
	 * check the first address now.
L
Linus Torvalds 已提交
4101
	 */
4102
	family = sk->sk_family;
L
Linus Torvalds 已提交
4103 4104
	if (family == PF_INET || family == PF_INET6) {
		char *addrp;
4105
		struct sk_security_struct *sksec = sk->sk_security;
4106
		struct common_audit_data ad;
4107
		struct lsm_network_audit net = {0,};
L
Linus Torvalds 已提交
4108 4109 4110
		struct sockaddr_in *addr4 = NULL;
		struct sockaddr_in6 *addr6 = NULL;
		unsigned short snum;
4111
		u32 sid, node_perm;
L
Linus Torvalds 已提交
4112 4113 4114 4115 4116 4117 4118 4119 4120 4121 4122

		if (family == PF_INET) {
			addr4 = (struct sockaddr_in *)address;
			snum = ntohs(addr4->sin_port);
			addrp = (char *)&addr4->sin_addr.s_addr;
		} else {
			addr6 = (struct sockaddr_in6 *)address;
			snum = ntohs(addr6->sin6_port);
			addrp = (char *)&addr6->sin6_addr.s6_addr;
		}

4123 4124 4125
		if (snum) {
			int low, high;

4126
			inet_get_local_port_range(sock_net(sk), &low, &high);
4127 4128

			if (snum < max(PROT_SOCK, low) || snum > high) {
P
Paul Moore 已提交
4129 4130
				err = sel_netport_sid(sk->sk_protocol,
						      snum, &sid);
4131 4132
				if (err)
					goto out;
4133
				ad.type = LSM_AUDIT_DATA_NET;
4134 4135 4136
				ad.u.net = &net;
				ad.u.net->sport = htons(snum);
				ad.u.net->family = family;
4137 4138
				err = avc_has_perm(sksec->sid, sid,
						   sksec->sclass,
4139 4140 4141 4142
						   SOCKET__NAME_BIND, &ad);
				if (err)
					goto out;
			}
L
Linus Torvalds 已提交
4143
		}
4144

4145
		switch (sksec->sclass) {
4146
		case SECCLASS_TCP_SOCKET:
L
Linus Torvalds 已提交
4147 4148
			node_perm = TCP_SOCKET__NODE_BIND;
			break;
4149

4150
		case SECCLASS_UDP_SOCKET:
L
Linus Torvalds 已提交
4151 4152
			node_perm = UDP_SOCKET__NODE_BIND;
			break;
J
James Morris 已提交
4153 4154 4155 4156 4157

		case SECCLASS_DCCP_SOCKET:
			node_perm = DCCP_SOCKET__NODE_BIND;
			break;

L
Linus Torvalds 已提交
4158 4159 4160 4161
		default:
			node_perm = RAWIP_SOCKET__NODE_BIND;
			break;
		}
4162

4163
		err = sel_netnode_sid(addrp, family, &sid);
L
Linus Torvalds 已提交
4164 4165
		if (err)
			goto out;
4166

4167
		ad.type = LSM_AUDIT_DATA_NET;
4168 4169 4170
		ad.u.net = &net;
		ad.u.net->sport = htons(snum);
		ad.u.net->family = family;
L
Linus Torvalds 已提交
4171 4172

		if (family == PF_INET)
4173
			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
L
Linus Torvalds 已提交
4174
		else
4175
			ad.u.net->v6info.saddr = addr6->sin6_addr;
L
Linus Torvalds 已提交
4176

4177 4178
		err = avc_has_perm(sksec->sid, sid,
				   sksec->sclass, node_perm, &ad);
L
Linus Torvalds 已提交
4179 4180 4181 4182 4183 4184 4185 4186 4187
		if (err)
			goto out;
	}
out:
	return err;
}

static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
{
4188
	struct sock *sk = sock->sk;
4189
	struct sk_security_struct *sksec = sk->sk_security;
L
Linus Torvalds 已提交
4190 4191
	int err;

4192
	err = sock_has_perm(current, sk, SOCKET__CONNECT);
L
Linus Torvalds 已提交
4193 4194 4195 4196
	if (err)
		return err;

	/*
J
James Morris 已提交
4197
	 * If a TCP or DCCP socket, check name_connect permission for the port.
L
Linus Torvalds 已提交
4198
	 */
4199 4200
	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
	    sksec->sclass == SECCLASS_DCCP_SOCKET) {
4201
		struct common_audit_data ad;
4202
		struct lsm_network_audit net = {0,};
L
Linus Torvalds 已提交
4203 4204 4205
		struct sockaddr_in *addr4 = NULL;
		struct sockaddr_in6 *addr6 = NULL;
		unsigned short snum;
J
James Morris 已提交
4206
		u32 sid, perm;
L
Linus Torvalds 已提交
4207 4208 4209

		if (sk->sk_family == PF_INET) {
			addr4 = (struct sockaddr_in *)address;
4210
			if (addrlen < sizeof(struct sockaddr_in))
L
Linus Torvalds 已提交
4211 4212 4213 4214
				return -EINVAL;
			snum = ntohs(addr4->sin_port);
		} else {
			addr6 = (struct sockaddr_in6 *)address;
4215
			if (addrlen < SIN6_LEN_RFC2133)
L
Linus Torvalds 已提交
4216 4217 4218 4219
				return -EINVAL;
			snum = ntohs(addr6->sin6_port);
		}

P
Paul Moore 已提交
4220
		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
L
Linus Torvalds 已提交
4221 4222 4223
		if (err)
			goto out;

4224
		perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
J
James Morris 已提交
4225 4226
		       TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;

4227
		ad.type = LSM_AUDIT_DATA_NET;
4228 4229 4230
		ad.u.net = &net;
		ad.u.net->dport = htons(snum);
		ad.u.net->family = sk->sk_family;
4231
		err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
L
Linus Torvalds 已提交
4232 4233 4234 4235
		if (err)
			goto out;
	}

4236 4237
	err = selinux_netlbl_socket_connect(sk, address);

L
Linus Torvalds 已提交
4238 4239 4240 4241 4242 4243
out:
	return err;
}

static int selinux_socket_listen(struct socket *sock, int backlog)
{
4244
	return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
L
Linus Torvalds 已提交
4245 4246 4247 4248 4249 4250 4251 4252
}

static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
{
	int err;
	struct inode_security_struct *isec;
	struct inode_security_struct *newisec;

4253
	err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
L
Linus Torvalds 已提交
4254 4255 4256 4257 4258 4259 4260 4261 4262 4263 4264 4265 4266 4267
	if (err)
		return err;

	newisec = SOCK_INODE(newsock)->i_security;

	isec = SOCK_INODE(sock)->i_security;
	newisec->sclass = isec->sclass;
	newisec->sid = isec->sid;
	newisec->initialized = 1;

	return 0;
}

static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4268
				  int size)
L
Linus Torvalds 已提交
4269
{
4270
	return sock_has_perm(current, sock->sk, SOCKET__WRITE);
L
Linus Torvalds 已提交
4271 4272 4273 4274 4275
}

static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
				  int size, int flags)
{
4276
	return sock_has_perm(current, sock->sk, SOCKET__READ);
L
Linus Torvalds 已提交
4277 4278 4279 4280
}

static int selinux_socket_getsockname(struct socket *sock)
{
4281
	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
L
Linus Torvalds 已提交
4282 4283 4284 4285
}

static int selinux_socket_getpeername(struct socket *sock)
{
4286
	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
L
Linus Torvalds 已提交
4287 4288
}

4289
static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
L
Linus Torvalds 已提交
4290
{
4291 4292
	int err;

4293
	err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4294 4295 4296 4297
	if (err)
		return err;

	return selinux_netlbl_socket_setsockopt(sock, level, optname);
L
Linus Torvalds 已提交
4298 4299 4300 4301 4302
}

static int selinux_socket_getsockopt(struct socket *sock, int level,
				     int optname)
{
4303
	return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
L
Linus Torvalds 已提交
4304 4305 4306 4307
}

static int selinux_socket_shutdown(struct socket *sock, int how)
{
4308
	return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
L
Linus Torvalds 已提交
4309 4310
}

4311 4312
static int selinux_socket_unix_stream_connect(struct sock *sock,
					      struct sock *other,
L
Linus Torvalds 已提交
4313 4314
					      struct sock *newsk)
{
4315 4316
	struct sk_security_struct *sksec_sock = sock->sk_security;
	struct sk_security_struct *sksec_other = other->sk_security;
4317
	struct sk_security_struct *sksec_new = newsk->sk_security;
4318
	struct common_audit_data ad;
4319
	struct lsm_network_audit net = {0,};
L
Linus Torvalds 已提交
4320 4321
	int err;

4322
	ad.type = LSM_AUDIT_DATA_NET;
4323 4324
	ad.u.net = &net;
	ad.u.net->sk = other;
L
Linus Torvalds 已提交
4325

4326 4327
	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
			   sksec_other->sclass,
L
Linus Torvalds 已提交
4328 4329 4330 4331 4332
			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
	if (err)
		return err;

	/* server child socket */
4333 4334 4335 4336 4337
	sksec_new->peer_sid = sksec_sock->sid;
	err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
				    &sksec_new->sid);
	if (err)
		return err;
4338

4339 4340 4341 4342
	/* connecting socket */
	sksec_sock->peer_sid = sksec_new->sid;

	return 0;
L
Linus Torvalds 已提交
4343 4344 4345 4346 4347
}

static int selinux_socket_unix_may_send(struct socket *sock,
					struct socket *other)
{
4348 4349
	struct sk_security_struct *ssec = sock->sk->sk_security;
	struct sk_security_struct *osec = other->sk->sk_security;
4350
	struct common_audit_data ad;
4351
	struct lsm_network_audit net = {0,};
L
Linus Torvalds 已提交
4352

4353
	ad.type = LSM_AUDIT_DATA_NET;
4354 4355
	ad.u.net = &net;
	ad.u.net->sk = other->sk;
L
Linus Torvalds 已提交
4356

4357 4358
	return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
			    &ad);
L
Linus Torvalds 已提交
4359 4360
}

4361 4362
static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
				    char *addrp, u16 family, u32 peer_sid,
4363
				    struct common_audit_data *ad)
4364 4365 4366 4367 4368
{
	int err;
	u32 if_sid;
	u32 node_sid;

4369
	err = sel_netif_sid(ns, ifindex, &if_sid);
4370 4371 4372 4373 4374 4375 4376 4377 4378 4379 4380 4381 4382 4383
	if (err)
		return err;
	err = avc_has_perm(peer_sid, if_sid,
			   SECCLASS_NETIF, NETIF__INGRESS, ad);
	if (err)
		return err;

	err = sel_netnode_sid(addrp, family, &node_sid);
	if (err)
		return err;
	return avc_has_perm(peer_sid, node_sid,
			    SECCLASS_NODE, NODE__RECVFROM, ad);
}

4384
static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4385
				       u16 family)
4386
{
4387
	int err = 0;
4388 4389
	struct sk_security_struct *sksec = sk->sk_security;
	u32 sk_sid = sksec->sid;
4390
	struct common_audit_data ad;
4391
	struct lsm_network_audit net = {0,};
4392 4393
	char *addrp;

4394
	ad.type = LSM_AUDIT_DATA_NET;
4395 4396 4397
	ad.u.net = &net;
	ad.u.net->netif = skb->skb_iif;
	ad.u.net->family = family;
4398 4399 4400
	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
	if (err)
		return err;
L
Linus Torvalds 已提交
4401

4402
	if (selinux_secmark_enabled()) {
4403
		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4404
				   PACKET__RECV, &ad);
4405 4406 4407
		if (err)
			return err;
	}
4408

4409 4410 4411 4412
	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
	if (err)
		return err;
	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4413

4414 4415 4416 4417 4418
	return err;
}

static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
4419
	int err;
4420
	struct sk_security_struct *sksec = sk->sk_security;
4421 4422
	u16 family = sk->sk_family;
	u32 sk_sid = sksec->sid;
4423
	struct common_audit_data ad;
4424
	struct lsm_network_audit net = {0,};
4425
	char *addrp;
4426 4427
	u8 secmark_active;
	u8 peerlbl_active;
4428 4429

	if (family != PF_INET && family != PF_INET6)
4430
		return 0;
4431 4432

	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
A
Al Viro 已提交
4433
	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4434 4435
		family = PF_INET;

4436 4437 4438 4439
	/* If any sort of compatibility mode is enabled then handoff processing
	 * to the selinux_sock_rcv_skb_compat() function to deal with the
	 * special handling.  We do this in an attempt to keep this function
	 * as fast and as clean as possible. */
4440
	if (!selinux_policycap_netpeer)
4441 4442 4443
		return selinux_sock_rcv_skb_compat(sk, skb, family);

	secmark_active = selinux_secmark_enabled();
4444
	peerlbl_active = selinux_peerlbl_enabled();
4445 4446 4447
	if (!secmark_active && !peerlbl_active)
		return 0;

4448
	ad.type = LSM_AUDIT_DATA_NET;
4449 4450 4451
	ad.u.net = &net;
	ad.u.net->netif = skb->skb_iif;
	ad.u.net->family = family;
4452
	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4453
	if (err)
4454
		return err;
4455

4456
	if (peerlbl_active) {
4457 4458 4459
		u32 peer_sid;

		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4460 4461
		if (err)
			return err;
4462 4463
		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
					       addrp, family, peer_sid, &ad);
4464 4465
		if (err) {
			selinux_netlbl_err(skb, err, 0);
4466
			return err;
4467
		}
4468 4469
		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
				   PEER__RECV, &ad);
C
Chad Hanson 已提交
4470
		if (err) {
4471
			selinux_netlbl_err(skb, err, 0);
C
Chad Hanson 已提交
4472 4473
			return err;
		}
4474 4475
	}

4476
	if (secmark_active) {
4477 4478 4479 4480 4481 4482
		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
				   PACKET__RECV, &ad);
		if (err)
			return err;
	}

4483
	return err;
L
Linus Torvalds 已提交
4484 4485
}

C
Catherine Zhang 已提交
4486 4487
static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
					    int __user *optlen, unsigned len)
L
Linus Torvalds 已提交
4488 4489 4490 4491
{
	int err = 0;
	char *scontext;
	u32 scontext_len;
4492
	struct sk_security_struct *sksec = sock->sk->sk_security;
4493
	u32 peer_sid = SECSID_NULL;
L
Linus Torvalds 已提交
4494

4495 4496
	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
	    sksec->sclass == SECCLASS_TCP_SOCKET)
4497
		peer_sid = sksec->peer_sid;
4498 4499
	if (peer_sid == SECSID_NULL)
		return -ENOPROTOOPT;
L
Linus Torvalds 已提交
4500

C
Catherine Zhang 已提交
4501
	err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
L
Linus Torvalds 已提交
4502
	if (err)
4503
		return err;
L
Linus Torvalds 已提交
4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517 4518 4519

	if (scontext_len > len) {
		err = -ERANGE;
		goto out_len;
	}

	if (copy_to_user(optval, scontext, scontext_len))
		err = -EFAULT;

out_len:
	if (put_user(scontext_len, optlen))
		err = -EFAULT;
	kfree(scontext);
	return err;
}

4520
static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
C
Catherine Zhang 已提交
4521
{
4522
	u32 peer_secid = SECSID_NULL;
4523
	u16 family;
C
Catherine Zhang 已提交
4524

4525 4526 4527 4528 4529
	if (skb && skb->protocol == htons(ETH_P_IP))
		family = PF_INET;
	else if (skb && skb->protocol == htons(ETH_P_IPV6))
		family = PF_INET6;
	else if (sock)
4530 4531 4532 4533 4534
		family = sock->sk->sk_family;
	else
		goto out;

	if (sock && family == PF_UNIX)
4535
		selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4536
	else if (skb)
4537
		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
C
Catherine Zhang 已提交
4538

4539
out:
4540
	*secid = peer_secid;
4541 4542 4543
	if (peer_secid == SECSID_NULL)
		return -EINVAL;
	return 0;
C
Catherine Zhang 已提交
4544 4545
}

A
Al Viro 已提交
4546
static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
L
Linus Torvalds 已提交
4547
{
4548 4549 4550 4551 4552 4553 4554 4555 4556 4557 4558 4559
	struct sk_security_struct *sksec;

	sksec = kzalloc(sizeof(*sksec), priority);
	if (!sksec)
		return -ENOMEM;

	sksec->peer_sid = SECINITSID_UNLABELED;
	sksec->sid = SECINITSID_UNLABELED;
	selinux_netlbl_sk_security_reset(sksec);
	sk->sk_security = sksec;

	return 0;
L
Linus Torvalds 已提交
4560 4561 4562 4563
}

static void selinux_sk_free_security(struct sock *sk)
{
4564 4565 4566 4567 4568
	struct sk_security_struct *sksec = sk->sk_security;

	sk->sk_security = NULL;
	selinux_netlbl_sk_security_free(sksec);
	kfree(sksec);
L
Linus Torvalds 已提交
4569 4570
}

4571
static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4572
{
4573 4574
	struct sk_security_struct *sksec = sk->sk_security;
	struct sk_security_struct *newsksec = newsk->sk_security;
4575

4576 4577 4578
	newsksec->sid = sksec->sid;
	newsksec->peer_sid = sksec->peer_sid;
	newsksec->sclass = sksec->sclass;
4579

4580
	selinux_netlbl_sk_security_reset(newsksec);
4581 4582
}

V
Venkat Yekkirala 已提交
4583
static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4584
{
4585
	if (!sk)
V
Venkat Yekkirala 已提交
4586
		*secid = SECINITSID_ANY_SOCKET;
4587 4588
	else {
		struct sk_security_struct *sksec = sk->sk_security;
4589

V
Venkat Yekkirala 已提交
4590
		*secid = sksec->sid;
4591
	}
4592 4593
}

4594
static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4595 4596 4597 4598
{
	struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
	struct sk_security_struct *sksec = sk->sk_security;

4599 4600
	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
	    sk->sk_family == PF_UNIX)
4601
		isec->sid = sksec->sid;
4602
	sksec->sclass = isec->sclass;
4603 4604
}

4605 4606
static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
				     struct request_sock *req)
4607 4608 4609
{
	struct sk_security_struct *sksec = sk->sk_security;
	int err;
4610
	u16 family = req->rsk_ops->family;
4611
	u32 connsid;
4612 4613
	u32 peersid;

4614
	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4615 4616
	if (err)
		return err;
4617 4618 4619 4620 4621
	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
	if (err)
		return err;
	req->secid = connsid;
	req->peer_secid = peersid;
4622

4623
	return selinux_netlbl_inet_conn_request(req, family);
4624 4625
}

4626 4627
static void selinux_inet_csk_clone(struct sock *newsk,
				   const struct request_sock *req)
4628 4629 4630 4631
{
	struct sk_security_struct *newsksec = newsk->sk_security;

	newsksec->sid = req->secid;
4632
	newsksec->peer_sid = req->peer_secid;
4633 4634 4635 4636
	/* NOTE: Ideally, we should also get the isec->sid for the
	   new socket in sync, but we don't have the isec available yet.
	   So we will wait until sock_graft to do it, by which
	   time it will have been created and available. */
4637

P
Paul Moore 已提交
4638 4639
	/* We don't need to take any sort of lock here as we are the only
	 * thread with access to newsksec */
4640
	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4641 4642
}

4643
static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4644
{
4645
	u16 family = sk->sk_family;
4646 4647
	struct sk_security_struct *sksec = sk->sk_security;

4648 4649 4650 4651 4652
	/* handle mapped IPv4 packets arriving via IPv6 sockets */
	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
		family = PF_INET;

	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4653 4654
}

4655 4656 4657 4658 4659
static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
{
	skb_set_owner_w(skb, sk);
}

4660 4661 4662 4663 4664 4665 4666 4667 4668 4669 4670 4671 4672 4673 4674 4675 4676 4677 4678 4679 4680
static int selinux_secmark_relabel_packet(u32 sid)
{
	const struct task_security_struct *__tsec;
	u32 tsid;

	__tsec = current_security();
	tsid = __tsec->sid;

	return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
}

static void selinux_secmark_refcount_inc(void)
{
	atomic_inc(&selinux_secmark_refcount);
}

static void selinux_secmark_refcount_dec(void)
{
	atomic_dec(&selinux_secmark_refcount);
}

4681 4682
static void selinux_req_classify_flow(const struct request_sock *req,
				      struct flowi *fl)
4683
{
4684
	fl->flowi_secid = req->secid;
4685 4686
}

4687 4688 4689 4690 4691 4692 4693 4694 4695 4696 4697 4698 4699 4700 4701 4702 4703 4704
static int selinux_tun_dev_alloc_security(void **security)
{
	struct tun_security_struct *tunsec;

	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
	if (!tunsec)
		return -ENOMEM;
	tunsec->sid = current_sid();

	*security = tunsec;
	return 0;
}

static void selinux_tun_dev_free_security(void *security)
{
	kfree(security);
}

4705 4706 4707 4708 4709 4710 4711 4712 4713 4714 4715 4716 4717 4718 4719
static int selinux_tun_dev_create(void)
{
	u32 sid = current_sid();

	/* we aren't taking into account the "sockcreate" SID since the socket
	 * that is being created here is not a socket in the traditional sense,
	 * instead it is a private sock, accessible only to the kernel, and
	 * representing a wide range of network traffic spanning multiple
	 * connections unlike traditional sockets - check the TUN driver to
	 * get a better understanding of why this socket is special */

	return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
			    NULL);
}

4720
static int selinux_tun_dev_attach_queue(void *security)
4721
{
4722 4723 4724 4725 4726 4727 4728 4729 4730
	struct tun_security_struct *tunsec = security;

	return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
			    TUN_SOCKET__ATTACH_QUEUE, NULL);
}

static int selinux_tun_dev_attach(struct sock *sk, void *security)
{
	struct tun_security_struct *tunsec = security;
4731 4732 4733 4734 4735 4736 4737 4738 4739
	struct sk_security_struct *sksec = sk->sk_security;

	/* we don't currently perform any NetLabel based labeling here and it
	 * isn't clear that we would want to do so anyway; while we could apply
	 * labeling without the support of the TUN user the resulting labeled
	 * traffic from the other end of the connection would almost certainly
	 * cause confusion to the TUN user that had no idea network labeling
	 * protocols were being used */

4740
	sksec->sid = tunsec->sid;
4741
	sksec->sclass = SECCLASS_TUN_SOCKET;
4742 4743

	return 0;
4744 4745
}

4746
static int selinux_tun_dev_open(void *security)
4747
{
4748
	struct tun_security_struct *tunsec = security;
4749 4750 4751
	u32 sid = current_sid();
	int err;

4752
	err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4753 4754 4755 4756 4757 4758 4759
			   TUN_SOCKET__RELABELFROM, NULL);
	if (err)
		return err;
	err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
			   TUN_SOCKET__RELABELTO, NULL);
	if (err)
		return err;
4760
	tunsec->sid = sid;
4761 4762 4763 4764

	return 0;
}

L
Linus Torvalds 已提交
4765 4766 4767 4768 4769
static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
{
	int err = 0;
	u32 perm;
	struct nlmsghdr *nlh;
4770
	struct sk_security_struct *sksec = sk->sk_security;
4771

4772
	if (skb->len < NLMSG_HDRLEN) {
L
Linus Torvalds 已提交
4773 4774 4775
		err = -EINVAL;
		goto out;
	}
4776
	nlh = nlmsg_hdr(skb);
4777

4778
	err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
L
Linus Torvalds 已提交
4779 4780
	if (err) {
		if (err == -EINVAL) {
4781 4782 4783 4784
			printk(KERN_WARNING
			       "SELinux: unrecognized netlink message:"
			       " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
			       sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4785
			if (!selinux_enforcing || security_get_allow_unknown())
L
Linus Torvalds 已提交
4786 4787 4788 4789 4790 4791 4792 4793 4794
				err = 0;
		}

		/* Ignore */
		if (err == -ENOENT)
			err = 0;
		goto out;
	}

4795
	err = sock_has_perm(current, sk, perm);
L
Linus Torvalds 已提交
4796 4797 4798 4799 4800 4801
out:
	return err;
}

#ifdef CONFIG_NETFILTER

4802 4803
static unsigned int selinux_ip_forward(struct sk_buff *skb,
				       const struct net_device *indev,
4804
				       u16 family)
L
Linus Torvalds 已提交
4805
{
4806
	int err;
4807 4808
	char *addrp;
	u32 peer_sid;
4809
	struct common_audit_data ad;
4810
	struct lsm_network_audit net = {0,};
4811
	u8 secmark_active;
4812
	u8 netlbl_active;
4813
	u8 peerlbl_active;
4814

4815 4816
	if (!selinux_policycap_netpeer)
		return NF_ACCEPT;
4817

4818
	secmark_active = selinux_secmark_enabled();
4819
	netlbl_active = netlbl_enabled();
4820
	peerlbl_active = selinux_peerlbl_enabled();
4821 4822
	if (!secmark_active && !peerlbl_active)
		return NF_ACCEPT;
4823

4824 4825 4826
	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
		return NF_DROP;

4827
	ad.type = LSM_AUDIT_DATA_NET;
4828
	ad.u.net = &net;
4829
	ad.u.net->netif = indev->ifindex;
4830
	ad.u.net->family = family;
4831 4832 4833
	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
		return NF_DROP;

4834
	if (peerlbl_active) {
4835 4836
		err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
					       addrp, family, peer_sid, &ad);
4837 4838
		if (err) {
			selinux_netlbl_err(skb, err, 1);
4839
			return NF_DROP;
4840 4841
		}
	}
4842 4843 4844 4845 4846 4847

	if (secmark_active)
		if (avc_has_perm(peer_sid, skb->secmark,
				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
			return NF_DROP;

4848 4849 4850 4851 4852 4853 4854 4855
	if (netlbl_active)
		/* we do this in the FORWARD path and not the POST_ROUTING
		 * path because we want to make sure we apply the necessary
		 * labeling before IPsec is applied so we can leverage AH
		 * protection */
		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
			return NF_DROP;

4856 4857 4858
	return NF_ACCEPT;
}

4859
static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4860 4861 4862 4863 4864
					 struct sk_buff *skb,
					 const struct net_device *in,
					 const struct net_device *out,
					 int (*okfn)(struct sk_buff *))
{
4865
	return selinux_ip_forward(skb, in, PF_INET);
4866 4867 4868
}

#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4869
static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4870 4871 4872 4873 4874
					 struct sk_buff *skb,
					 const struct net_device *in,
					 const struct net_device *out,
					 int (*okfn)(struct sk_buff *))
{
4875
	return selinux_ip_forward(skb, in, PF_INET6);
4876 4877 4878
}
#endif	/* IPV6 */

4879 4880 4881
static unsigned int selinux_ip_output(struct sk_buff *skb,
				      u16 family)
{
4882
	struct sock *sk;
4883 4884 4885 4886 4887 4888 4889 4890
	u32 sid;

	if (!netlbl_enabled())
		return NF_ACCEPT;

	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
	 * because we want to make sure we apply the necessary labeling
	 * before IPsec is applied so we can leverage AH protection */
4891 4892 4893 4894 4895 4896 4897 4898 4899 4900 4901 4902 4903 4904 4905 4906 4907 4908 4909 4910 4911
	sk = skb->sk;
	if (sk) {
		struct sk_security_struct *sksec;

		if (sk->sk_state == TCP_LISTEN)
			/* if the socket is the listening state then this
			 * packet is a SYN-ACK packet which means it needs to
			 * be labeled based on the connection/request_sock and
			 * not the parent socket.  unfortunately, we can't
			 * lookup the request_sock yet as it isn't queued on
			 * the parent socket until after the SYN-ACK is sent.
			 * the "solution" is to simply pass the packet as-is
			 * as any IP option based labeling should be copied
			 * from the initial connection request (in the IP
			 * layer).  it is far from ideal, but until we get a
			 * security label in the packet itself this is the
			 * best we can do. */
			return NF_ACCEPT;

		/* standard practice, label using the parent socket */
		sksec = sk->sk_security;
4912 4913 4914 4915 4916 4917 4918 4919 4920
		sid = sksec->sid;
	} else
		sid = SECINITSID_KERNEL;
	if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
		return NF_DROP;

	return NF_ACCEPT;
}

4921
static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4922 4923 4924 4925 4926 4927 4928 4929
					struct sk_buff *skb,
					const struct net_device *in,
					const struct net_device *out,
					int (*okfn)(struct sk_buff *))
{
	return selinux_ip_output(skb, PF_INET);
}

4930 4931
static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
						int ifindex,
4932
						u16 family)
4933 4934 4935
{
	struct sock *sk = skb->sk;
	struct sk_security_struct *sksec;
4936
	struct common_audit_data ad;
4937
	struct lsm_network_audit net = {0,};
4938 4939
	char *addrp;
	u8 proto;
L
Linus Torvalds 已提交
4940

4941 4942 4943 4944
	if (sk == NULL)
		return NF_ACCEPT;
	sksec = sk->sk_security;

4945
	ad.type = LSM_AUDIT_DATA_NET;
4946 4947 4948
	ad.u.net = &net;
	ad.u.net->netif = ifindex;
	ad.u.net->family = family;
4949 4950 4951
	if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
		return NF_DROP;

4952
	if (selinux_secmark_enabled())
4953
		if (avc_has_perm(sksec->sid, skb->secmark,
4954
				 SECCLASS_PACKET, PACKET__SEND, &ad))
4955
			return NF_DROP_ERR(-ECONNREFUSED);
4956

4957 4958
	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
		return NF_DROP_ERR(-ECONNREFUSED);
4959 4960

	return NF_ACCEPT;
4961 4962
}

4963 4964
static unsigned int selinux_ip_postroute(struct sk_buff *skb,
					 const struct net_device *outdev,
4965
					 u16 family)
4966
{
4967 4968
	u32 secmark_perm;
	u32 peer_sid;
4969
	int ifindex = outdev->ifindex;
4970
	struct sock *sk;
4971
	struct common_audit_data ad;
4972
	struct lsm_network_audit net = {0,};
4973 4974 4975
	char *addrp;
	u8 secmark_active;
	u8 peerlbl_active;
4976

4977 4978 4979 4980
	/* If any sort of compatibility mode is enabled then handoff processing
	 * to the selinux_ip_postroute_compat() function to deal with the
	 * special handling.  We do this in an attempt to keep this function
	 * as fast and as clean as possible. */
4981
	if (!selinux_policycap_netpeer)
4982
		return selinux_ip_postroute_compat(skb, ifindex, family);
4983 4984 4985 4986 4987 4988 4989 4990

	secmark_active = selinux_secmark_enabled();
	peerlbl_active = selinux_peerlbl_enabled();
	if (!secmark_active && !peerlbl_active)
		return NF_ACCEPT;

	sk = skb->sk;

4991
#ifdef CONFIG_XFRM
4992 4993 4994 4995 4996
	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
	 * packet transformation so allow the packet to pass without any checks
	 * since we'll have another chance to perform access control checks
	 * when the packet is on it's final way out.
	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4997 4998 4999 5000 5001 5002 5003 5004
	 *       is NULL, in this case go ahead and apply access control.
	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
	 *       TCP listening state we cannot wait until the XFRM processing
	 *       is done as we will miss out on the SA label if we do;
	 *       unfortunately, this means more work, but it is only once per
	 *       connection. */
	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
	    !(sk != NULL && sk->sk_state == TCP_LISTEN))
5005
		return NF_ACCEPT;
5006
#endif
5007

5008
	if (sk == NULL) {
5009 5010 5011 5012
		/* Without an associated socket the packet is either coming
		 * from the kernel or it is being forwarded; check the packet
		 * to determine which and if the packet is being forwarded
		 * query the packet directly to determine the security label. */
5013 5014
		if (skb->skb_iif) {
			secmark_perm = PACKET__FORWARD_OUT;
5015
			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5016
				return NF_DROP;
5017 5018
		} else {
			secmark_perm = PACKET__SEND;
5019
			peer_sid = SECINITSID_KERNEL;
5020
		}
5021 5022 5023 5024 5025 5026 5027 5028 5029 5030 5031 5032 5033 5034
	} else if (sk->sk_state == TCP_LISTEN) {
		/* Locally generated packet but the associated socket is in the
		 * listening state which means this is a SYN-ACK packet.  In
		 * this particular case the correct security label is assigned
		 * to the connection/request_sock but unfortunately we can't
		 * query the request_sock as it isn't queued on the parent
		 * socket until after the SYN-ACK packet is sent; the only
		 * viable choice is to regenerate the label like we do in
		 * selinux_inet_conn_request().  See also selinux_ip_output()
		 * for similar problems. */
		u32 skb_sid;
		struct sk_security_struct *sksec = sk->sk_security;
		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
			return NF_DROP;
5035 5036 5037 5038 5039 5040 5041 5042 5043 5044 5045 5046 5047 5048 5049
		/* At this point, if the returned skb peerlbl is SECSID_NULL
		 * and the packet has been through at least one XFRM
		 * transformation then we must be dealing with the "final"
		 * form of labeled IPsec packet; since we've already applied
		 * all of our access controls on this packet we can safely
		 * pass the packet. */
		if (skb_sid == SECSID_NULL) {
			switch (family) {
			case PF_INET:
				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
					return NF_ACCEPT;
				break;
			case PF_INET6:
				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
					return NF_ACCEPT;
5050
				break;
5051 5052 5053 5054
			default:
				return NF_DROP_ERR(-ECONNREFUSED);
			}
		}
5055 5056 5057
		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
			return NF_DROP;
		secmark_perm = PACKET__SEND;
5058
	} else {
5059 5060
		/* Locally generated packet, fetch the security label from the
		 * associated socket. */
5061 5062 5063 5064
		struct sk_security_struct *sksec = sk->sk_security;
		peer_sid = sksec->sid;
		secmark_perm = PACKET__SEND;
	}
5065

5066
	ad.type = LSM_AUDIT_DATA_NET;
5067 5068 5069
	ad.u.net = &net;
	ad.u.net->netif = ifindex;
	ad.u.net->family = family;
5070
	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5071
		return NF_DROP;
5072

5073 5074 5075
	if (secmark_active)
		if (avc_has_perm(peer_sid, skb->secmark,
				 SECCLASS_PACKET, secmark_perm, &ad))
5076
			return NF_DROP_ERR(-ECONNREFUSED);
5077 5078 5079 5080 5081

	if (peerlbl_active) {
		u32 if_sid;
		u32 node_sid;

5082
		if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5083
			return NF_DROP;
5084 5085
		if (avc_has_perm(peer_sid, if_sid,
				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5086
			return NF_DROP_ERR(-ECONNREFUSED);
5087 5088

		if (sel_netnode_sid(addrp, family, &node_sid))
5089
			return NF_DROP;
5090 5091
		if (avc_has_perm(peer_sid, node_sid,
				 SECCLASS_NODE, NODE__SENDTO, &ad))
5092
			return NF_DROP_ERR(-ECONNREFUSED);
5093
	}
5094

5095
	return NF_ACCEPT;
L
Linus Torvalds 已提交
5096 5097
}

5098
static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5099 5100 5101 5102
					   struct sk_buff *skb,
					   const struct net_device *in,
					   const struct net_device *out,
					   int (*okfn)(struct sk_buff *))
L
Linus Torvalds 已提交
5103
{
5104
	return selinux_ip_postroute(skb, out, PF_INET);
L
Linus Torvalds 已提交
5105 5106 5107
}

#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5108
static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5109 5110 5111 5112
					   struct sk_buff *skb,
					   const struct net_device *in,
					   const struct net_device *out,
					   int (*okfn)(struct sk_buff *))
L
Linus Torvalds 已提交
5113
{
5114
	return selinux_ip_postroute(skb, out, PF_INET6);
L
Linus Torvalds 已提交
5115 5116 5117 5118 5119 5120 5121 5122 5123
}
#endif	/* IPV6 */

#endif	/* CONFIG_NETFILTER */

static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
{
	int err;

5124
	err = cap_netlink_send(sk, skb);
L
Linus Torvalds 已提交
5125 5126 5127
	if (err)
		return err;

5128
	return selinux_nlmsg_perm(sk, skb);
L
Linus Torvalds 已提交
5129 5130 5131 5132 5133 5134 5135
}

static int ipc_alloc_security(struct task_struct *task,
			      struct kern_ipc_perm *perm,
			      u16 sclass)
{
	struct ipc_security_struct *isec;
5136
	u32 sid;
L
Linus Torvalds 已提交
5137

J
James Morris 已提交
5138
	isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
L
Linus Torvalds 已提交
5139 5140 5141
	if (!isec)
		return -ENOMEM;

5142
	sid = task_sid(task);
L
Linus Torvalds 已提交
5143
	isec->sclass = sclass;
5144
	isec->sid = sid;
L
Linus Torvalds 已提交
5145 5146 5147 5148 5149 5150 5151 5152 5153 5154 5155 5156 5157 5158 5159 5160
	perm->security = isec;

	return 0;
}

static void ipc_free_security(struct kern_ipc_perm *perm)
{
	struct ipc_security_struct *isec = perm->security;
	perm->security = NULL;
	kfree(isec);
}

static int msg_msg_alloc_security(struct msg_msg *msg)
{
	struct msg_security_struct *msec;

J
James Morris 已提交
5161
	msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
L
Linus Torvalds 已提交
5162 5163 5164 5165 5166 5167 5168 5169 5170 5171 5172 5173 5174 5175 5176 5177 5178 5179
	if (!msec)
		return -ENOMEM;

	msec->sid = SECINITSID_UNLABELED;
	msg->security = msec;

	return 0;
}

static void msg_msg_free_security(struct msg_msg *msg)
{
	struct msg_security_struct *msec = msg->security;

	msg->security = NULL;
	kfree(msec);
}

static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5180
			u32 perms)
L
Linus Torvalds 已提交
5181 5182
{
	struct ipc_security_struct *isec;
5183
	struct common_audit_data ad;
5184
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5185 5186 5187

	isec = ipc_perms->security;

5188
	ad.type = LSM_AUDIT_DATA_IPC;
L
Linus Torvalds 已提交
5189 5190
	ad.u.ipc_id = ipc_perms->key;

5191
	return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
L
Linus Torvalds 已提交
5192 5193 5194 5195 5196 5197 5198 5199 5200 5201 5202 5203 5204 5205 5206 5207
}

static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
{
	return msg_msg_alloc_security(msg);
}

static void selinux_msg_msg_free_security(struct msg_msg *msg)
{
	msg_msg_free_security(msg);
}

/* message queue security operations */
static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
{
	struct ipc_security_struct *isec;
5208
	struct common_audit_data ad;
5209
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5210 5211 5212 5213 5214 5215 5216 5217
	int rc;

	rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
	if (rc)
		return rc;

	isec = msq->q_perm.security;

5218
	ad.type = LSM_AUDIT_DATA_IPC;
5219
	ad.u.ipc_id = msq->q_perm.key;
L
Linus Torvalds 已提交
5220

5221
	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
L
Linus Torvalds 已提交
5222 5223 5224 5225 5226 5227 5228 5229 5230 5231 5232 5233 5234 5235 5236 5237
			  MSGQ__CREATE, &ad);
	if (rc) {
		ipc_free_security(&msq->q_perm);
		return rc;
	}
	return 0;
}

static void selinux_msg_queue_free_security(struct msg_queue *msq)
{
	ipc_free_security(&msq->q_perm);
}

static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
{
	struct ipc_security_struct *isec;
5238
	struct common_audit_data ad;
5239
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5240 5241 5242

	isec = msq->q_perm.security;

5243
	ad.type = LSM_AUDIT_DATA_IPC;
L
Linus Torvalds 已提交
5244 5245
	ad.u.ipc_id = msq->q_perm.key;

5246
	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
L
Linus Torvalds 已提交
5247 5248 5249 5250 5251 5252 5253 5254
			    MSGQ__ASSOCIATE, &ad);
}

static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
{
	int err;
	int perms;

5255
	switch (cmd) {
L
Linus Torvalds 已提交
5256 5257 5258 5259 5260 5261 5262 5263 5264 5265 5266 5267 5268 5269 5270 5271 5272 5273
	case IPC_INFO:
	case MSG_INFO:
		/* No specific object, just general system-wide information. */
		return task_has_system(current, SYSTEM__IPC_INFO);
	case IPC_STAT:
	case MSG_STAT:
		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
		break;
	case IPC_SET:
		perms = MSGQ__SETATTR;
		break;
	case IPC_RMID:
		perms = MSGQ__DESTROY;
		break;
	default:
		return 0;
	}

5274
	err = ipc_has_perm(&msq->q_perm, perms);
L
Linus Torvalds 已提交
5275 5276 5277 5278 5279 5280 5281
	return err;
}

static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
{
	struct ipc_security_struct *isec;
	struct msg_security_struct *msec;
5282
	struct common_audit_data ad;
5283
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5284 5285 5286 5287 5288 5289 5290 5291 5292 5293 5294 5295 5296
	int rc;

	isec = msq->q_perm.security;
	msec = msg->security;

	/*
	 * First time through, need to assign label to the message
	 */
	if (msec->sid == SECINITSID_UNLABELED) {
		/*
		 * Compute new sid based on current process and
		 * message queue this message will be stored in
		 */
5297
		rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5298
					     NULL, &msec->sid);
L
Linus Torvalds 已提交
5299 5300 5301 5302
		if (rc)
			return rc;
	}

5303
	ad.type = LSM_AUDIT_DATA_IPC;
L
Linus Torvalds 已提交
5304 5305 5306
	ad.u.ipc_id = msq->q_perm.key;

	/* Can this process write to the queue? */
5307
	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
L
Linus Torvalds 已提交
5308 5309 5310
			  MSGQ__WRITE, &ad);
	if (!rc)
		/* Can this process send the message */
5311 5312
		rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
				  MSG__SEND, &ad);
L
Linus Torvalds 已提交
5313 5314
	if (!rc)
		/* Can the message be put in the queue? */
5315 5316
		rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
				  MSGQ__ENQUEUE, &ad);
L
Linus Torvalds 已提交
5317 5318 5319 5320 5321 5322 5323 5324 5325 5326

	return rc;
}

static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
				    struct task_struct *target,
				    long type, int mode)
{
	struct ipc_security_struct *isec;
	struct msg_security_struct *msec;
5327
	struct common_audit_data ad;
5328
	u32 sid = task_sid(target);
L
Linus Torvalds 已提交
5329 5330 5331 5332 5333
	int rc;

	isec = msq->q_perm.security;
	msec = msg->security;

5334
	ad.type = LSM_AUDIT_DATA_IPC;
5335
	ad.u.ipc_id = msq->q_perm.key;
L
Linus Torvalds 已提交
5336

5337
	rc = avc_has_perm(sid, isec->sid,
L
Linus Torvalds 已提交
5338 5339
			  SECCLASS_MSGQ, MSGQ__READ, &ad);
	if (!rc)
5340
		rc = avc_has_perm(sid, msec->sid,
L
Linus Torvalds 已提交
5341 5342 5343 5344 5345 5346 5347 5348
				  SECCLASS_MSG, MSG__RECEIVE, &ad);
	return rc;
}

/* Shared Memory security operations */
static int selinux_shm_alloc_security(struct shmid_kernel *shp)
{
	struct ipc_security_struct *isec;
5349
	struct common_audit_data ad;
5350
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5351 5352 5353 5354 5355 5356 5357 5358
	int rc;

	rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
	if (rc)
		return rc;

	isec = shp->shm_perm.security;

5359
	ad.type = LSM_AUDIT_DATA_IPC;
5360
	ad.u.ipc_id = shp->shm_perm.key;
L
Linus Torvalds 已提交
5361

5362
	rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
L
Linus Torvalds 已提交
5363 5364 5365 5366 5367 5368 5369 5370 5371 5372 5373 5374 5375 5376 5377 5378
			  SHM__CREATE, &ad);
	if (rc) {
		ipc_free_security(&shp->shm_perm);
		return rc;
	}
	return 0;
}

static void selinux_shm_free_security(struct shmid_kernel *shp)
{
	ipc_free_security(&shp->shm_perm);
}

static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
{
	struct ipc_security_struct *isec;
5379
	struct common_audit_data ad;
5380
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5381 5382 5383

	isec = shp->shm_perm.security;

5384
	ad.type = LSM_AUDIT_DATA_IPC;
L
Linus Torvalds 已提交
5385 5386
	ad.u.ipc_id = shp->shm_perm.key;

5387
	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
L
Linus Torvalds 已提交
5388 5389 5390 5391 5392 5393 5394 5395 5396
			    SHM__ASSOCIATE, &ad);
}

/* Note, at this point, shp is locked down */
static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
{
	int perms;
	int err;

5397
	switch (cmd) {
L
Linus Torvalds 已提交
5398 5399 5400 5401 5402 5403 5404 5405 5406 5407 5408 5409 5410 5411 5412 5413 5414 5415 5416 5417 5418 5419
	case IPC_INFO:
	case SHM_INFO:
		/* No specific object, just general system-wide information. */
		return task_has_system(current, SYSTEM__IPC_INFO);
	case IPC_STAT:
	case SHM_STAT:
		perms = SHM__GETATTR | SHM__ASSOCIATE;
		break;
	case IPC_SET:
		perms = SHM__SETATTR;
		break;
	case SHM_LOCK:
	case SHM_UNLOCK:
		perms = SHM__LOCK;
		break;
	case IPC_RMID:
		perms = SHM__DESTROY;
		break;
	default:
		return 0;
	}

5420
	err = ipc_has_perm(&shp->shm_perm, perms);
L
Linus Torvalds 已提交
5421 5422 5423 5424 5425 5426 5427 5428 5429 5430 5431 5432 5433
	return err;
}

static int selinux_shm_shmat(struct shmid_kernel *shp,
			     char __user *shmaddr, int shmflg)
{
	u32 perms;

	if (shmflg & SHM_RDONLY)
		perms = SHM__READ;
	else
		perms = SHM__READ | SHM__WRITE;

5434
	return ipc_has_perm(&shp->shm_perm, perms);
L
Linus Torvalds 已提交
5435 5436 5437 5438 5439 5440
}

/* Semaphore security operations */
static int selinux_sem_alloc_security(struct sem_array *sma)
{
	struct ipc_security_struct *isec;
5441
	struct common_audit_data ad;
5442
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5443 5444 5445 5446 5447 5448 5449 5450
	int rc;

	rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
	if (rc)
		return rc;

	isec = sma->sem_perm.security;

5451
	ad.type = LSM_AUDIT_DATA_IPC;
5452
	ad.u.ipc_id = sma->sem_perm.key;
L
Linus Torvalds 已提交
5453

5454
	rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
L
Linus Torvalds 已提交
5455 5456 5457 5458 5459 5460 5461 5462 5463 5464 5465 5466 5467 5468 5469 5470
			  SEM__CREATE, &ad);
	if (rc) {
		ipc_free_security(&sma->sem_perm);
		return rc;
	}
	return 0;
}

static void selinux_sem_free_security(struct sem_array *sma)
{
	ipc_free_security(&sma->sem_perm);
}

static int selinux_sem_associate(struct sem_array *sma, int semflg)
{
	struct ipc_security_struct *isec;
5471
	struct common_audit_data ad;
5472
	u32 sid = current_sid();
L
Linus Torvalds 已提交
5473 5474 5475

	isec = sma->sem_perm.security;

5476
	ad.type = LSM_AUDIT_DATA_IPC;
L
Linus Torvalds 已提交
5477 5478
	ad.u.ipc_id = sma->sem_perm.key;

5479
	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
L
Linus Torvalds 已提交
5480 5481 5482 5483 5484 5485 5486 5487 5488
			    SEM__ASSOCIATE, &ad);
}

/* Note, at this point, sma is locked down */
static int selinux_sem_semctl(struct sem_array *sma, int cmd)
{
	int err;
	u32 perms;

5489
	switch (cmd) {
L
Linus Torvalds 已提交
5490 5491 5492 5493 5494 5495 5496 5497 5498 5499 5500 5501 5502 5503 5504 5505 5506 5507 5508 5509 5510 5511 5512 5513 5514 5515 5516 5517 5518 5519 5520
	case IPC_INFO:
	case SEM_INFO:
		/* No specific object, just general system-wide information. */
		return task_has_system(current, SYSTEM__IPC_INFO);
	case GETPID:
	case GETNCNT:
	case GETZCNT:
		perms = SEM__GETATTR;
		break;
	case GETVAL:
	case GETALL:
		perms = SEM__READ;
		break;
	case SETVAL:
	case SETALL:
		perms = SEM__WRITE;
		break;
	case IPC_RMID:
		perms = SEM__DESTROY;
		break;
	case IPC_SET:
		perms = SEM__SETATTR;
		break;
	case IPC_STAT:
	case SEM_STAT:
		perms = SEM__GETATTR | SEM__ASSOCIATE;
		break;
	default:
		return 0;
	}

5521
	err = ipc_has_perm(&sma->sem_perm, perms);
L
Linus Torvalds 已提交
5522 5523 5524 5525 5526 5527 5528 5529 5530 5531 5532 5533 5534
	return err;
}

static int selinux_sem_semop(struct sem_array *sma,
			     struct sembuf *sops, unsigned nsops, int alter)
{
	u32 perms;

	if (alter)
		perms = SEM__READ | SEM__WRITE;
	else
		perms = SEM__READ;

5535
	return ipc_has_perm(&sma->sem_perm, perms);
L
Linus Torvalds 已提交
5536 5537 5538 5539 5540 5541 5542 5543 5544 5545 5546 5547 5548 5549 5550
}

static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
{
	u32 av = 0;

	av = 0;
	if (flag & S_IRUGO)
		av |= IPC__UNIX_READ;
	if (flag & S_IWUGO)
		av |= IPC__UNIX_WRITE;

	if (av == 0)
		return 0;

5551
	return ipc_has_perm(ipcp, av);
L
Linus Torvalds 已提交
5552 5553
}

5554 5555 5556 5557 5558 5559
static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
{
	struct ipc_security_struct *isec = ipcp->security;
	*secid = isec->sid;
}

5560
static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
L
Linus Torvalds 已提交
5561 5562 5563 5564 5565 5566
{
	if (inode)
		inode_doinit_with_dentry(inode, dentry);
}

static int selinux_getprocattr(struct task_struct *p,
5567
			       char *name, char **value)
L
Linus Torvalds 已提交
5568
{
5569
	const struct task_security_struct *__tsec;
5570
	u32 sid;
L
Linus Torvalds 已提交
5571
	int error;
5572
	unsigned len;
L
Linus Torvalds 已提交
5573 5574

	if (current != p) {
5575
		error = current_has_perm(p, PROCESS__GETATTR);
L
Linus Torvalds 已提交
5576 5577 5578 5579
		if (error)
			return error;
	}

5580 5581
	rcu_read_lock();
	__tsec = __task_cred(p)->security;
L
Linus Torvalds 已提交
5582 5583

	if (!strcmp(name, "current"))
5584
		sid = __tsec->sid;
L
Linus Torvalds 已提交
5585
	else if (!strcmp(name, "prev"))
5586
		sid = __tsec->osid;
L
Linus Torvalds 已提交
5587
	else if (!strcmp(name, "exec"))
5588
		sid = __tsec->exec_sid;
L
Linus Torvalds 已提交
5589
	else if (!strcmp(name, "fscreate"))
5590
		sid = __tsec->create_sid;
5591
	else if (!strcmp(name, "keycreate"))
5592
		sid = __tsec->keycreate_sid;
5593
	else if (!strcmp(name, "sockcreate"))
5594
		sid = __tsec->sockcreate_sid;
L
Linus Torvalds 已提交
5595
	else
5596 5597
		goto invalid;
	rcu_read_unlock();
L
Linus Torvalds 已提交
5598 5599 5600 5601

	if (!sid)
		return 0;

5602 5603 5604 5605
	error = security_sid_to_context(sid, value, &len);
	if (error)
		return error;
	return len;
5606 5607 5608 5609

invalid:
	rcu_read_unlock();
	return -EINVAL;
L
Linus Torvalds 已提交
5610 5611 5612 5613 5614 5615
}

static int selinux_setprocattr(struct task_struct *p,
			       char *name, void *value, size_t size)
{
	struct task_security_struct *tsec;
R
Roland McGrath 已提交
5616
	struct task_struct *tracer;
D
David Howells 已提交
5617 5618
	struct cred *new;
	u32 sid = 0, ptsid;
L
Linus Torvalds 已提交
5619 5620 5621 5622 5623 5624 5625 5626 5627 5628 5629 5630 5631 5632 5633
	int error;
	char *str = value;

	if (current != p) {
		/* SELinux only allows a process to change its own
		   security attributes. */
		return -EACCES;
	}

	/*
	 * Basic control over ability to set these attributes at all.
	 * current == p, but we'll pass them separately in case the
	 * above restriction is ever removed.
	 */
	if (!strcmp(name, "exec"))
5634
		error = current_has_perm(p, PROCESS__SETEXEC);
L
Linus Torvalds 已提交
5635
	else if (!strcmp(name, "fscreate"))
5636
		error = current_has_perm(p, PROCESS__SETFSCREATE);
5637
	else if (!strcmp(name, "keycreate"))
5638
		error = current_has_perm(p, PROCESS__SETKEYCREATE);
5639
	else if (!strcmp(name, "sockcreate"))
5640
		error = current_has_perm(p, PROCESS__SETSOCKCREATE);
L
Linus Torvalds 已提交
5641
	else if (!strcmp(name, "current"))
5642
		error = current_has_perm(p, PROCESS__SETCURRENT);
L
Linus Torvalds 已提交
5643 5644 5645 5646 5647 5648 5649 5650 5651 5652 5653
	else
		error = -EINVAL;
	if (error)
		return error;

	/* Obtain a SID for the context, if one was specified. */
	if (size && str[1] && str[1] != '\n') {
		if (str[size-1] == '\n') {
			str[size-1] = 0;
			size--;
		}
5654
		error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5655
		if (error == -EINVAL && !strcmp(name, "fscreate")) {
5656 5657 5658 5659 5660 5661 5662 5663 5664 5665 5666 5667 5668 5669 5670
			if (!capable(CAP_MAC_ADMIN)) {
				struct audit_buffer *ab;
				size_t audit_size;

				/* We strip a nul only if it is at the end, otherwise the
				 * context contains a nul and we should audit that */
				if (str[size - 1] == '\0')
					audit_size = size - 1;
				else
					audit_size = size;
				ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
				audit_log_format(ab, "op=fscreate invalid_context=");
				audit_log_n_untrustedstring(ab, value, audit_size);
				audit_log_end(ab);

5671
				return error;
5672
			}
5673 5674 5675
			error = security_context_to_sid_force(value, size,
							      &sid);
		}
L
Linus Torvalds 已提交
5676 5677 5678 5679
		if (error)
			return error;
	}

D
David Howells 已提交
5680 5681 5682 5683
	new = prepare_creds();
	if (!new)
		return -ENOMEM;

L
Linus Torvalds 已提交
5684 5685 5686
	/* Permission checking based on the specified context is
	   performed during the actual operation (execve,
	   open/mkdir/...), when we know the full context of the
D
David Howells 已提交
5687
	   operation.  See selinux_bprm_set_creds for the execve
L
Linus Torvalds 已提交
5688 5689
	   checks and may_create for the file creation checks. The
	   operation will then fail if the context is not permitted. */
D
David Howells 已提交
5690 5691
	tsec = new->security;
	if (!strcmp(name, "exec")) {
L
Linus Torvalds 已提交
5692
		tsec->exec_sid = sid;
D
David Howells 已提交
5693
	} else if (!strcmp(name, "fscreate")) {
L
Linus Torvalds 已提交
5694
		tsec->create_sid = sid;
D
David Howells 已提交
5695
	} else if (!strcmp(name, "keycreate")) {
5696 5697
		error = may_create_key(sid, p);
		if (error)
D
David Howells 已提交
5698
			goto abort_change;
5699
		tsec->keycreate_sid = sid;
D
David Howells 已提交
5700
	} else if (!strcmp(name, "sockcreate")) {
5701
		tsec->sockcreate_sid = sid;
D
David Howells 已提交
5702 5703
	} else if (!strcmp(name, "current")) {
		error = -EINVAL;
L
Linus Torvalds 已提交
5704
		if (sid == 0)
D
David Howells 已提交
5705 5706 5707 5708
			goto abort_change;

		/* Only allow single threaded processes to change context */
		error = -EPERM;
5709
		if (!current_is_single_threaded()) {
D
David Howells 已提交
5710 5711 5712
			error = security_bounded_transition(tsec->sid, sid);
			if (error)
				goto abort_change;
5713
		}
L
Linus Torvalds 已提交
5714 5715 5716

		/* Check permissions for the transition. */
		error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5717
				     PROCESS__DYNTRANSITION, NULL);
L
Linus Torvalds 已提交
5718
		if (error)
D
David Howells 已提交
5719
			goto abort_change;
L
Linus Torvalds 已提交
5720 5721 5722

		/* Check for ptracing, and update the task SID if ok.
		   Otherwise, leave SID unchanged and fail. */
D
David Howells 已提交
5723
		ptsid = 0;
5724
		rcu_read_lock();
5725
		tracer = ptrace_parent(p);
D
David Howells 已提交
5726 5727
		if (tracer)
			ptsid = task_sid(tracer);
5728
		rcu_read_unlock();
D
David Howells 已提交
5729 5730 5731 5732

		if (tracer) {
			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
					     PROCESS__PTRACE, NULL);
L
Linus Torvalds 已提交
5733
			if (error)
D
David Howells 已提交
5734
				goto abort_change;
L
Linus Torvalds 已提交
5735 5736
		}

D
David Howells 已提交
5737 5738 5739 5740 5741 5742 5743
		tsec->sid = sid;
	} else {
		error = -EINVAL;
		goto abort_change;
	}

	commit_creds(new);
L
Linus Torvalds 已提交
5744
	return size;
D
David Howells 已提交
5745 5746 5747 5748

abort_change:
	abort_creds(new);
	return error;
L
Linus Torvalds 已提交
5749 5750
}

5751 5752 5753 5754 5755
static int selinux_ismaclabel(const char *name)
{
	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
}

5756 5757 5758 5759 5760
static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
	return security_sid_to_context(secid, secdata, seclen);
}

5761
static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5762
{
5763
	return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5764 5765
}

5766 5767
static void selinux_release_secctx(char *secdata, u32 seclen)
{
5768
	kfree(secdata);
5769 5770
}

5771 5772 5773 5774 5775 5776 5777 5778 5779 5780 5781 5782 5783 5784 5785 5786 5787 5788 5789 5790 5791 5792 5793 5794 5795 5796
/*
 *	called with inode->i_mutex locked
 */
static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
{
	return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
}

/*
 *	called with inode->i_mutex locked
 */
static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
{
	return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
}

static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
{
	int len = 0;
	len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
						ctx, true);
	if (len < 0)
		return len;
	*ctxlen = len;
	return 0;
}
5797 5798
#ifdef CONFIG_KEYS

D
David Howells 已提交
5799
static int selinux_key_alloc(struct key *k, const struct cred *cred,
5800
			     unsigned long flags)
5801
{
D
David Howells 已提交
5802
	const struct task_security_struct *tsec;
5803 5804 5805 5806 5807 5808
	struct key_security_struct *ksec;

	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
	if (!ksec)
		return -ENOMEM;

D
David Howells 已提交
5809 5810 5811
	tsec = cred->security;
	if (tsec->keycreate_sid)
		ksec->sid = tsec->keycreate_sid;
5812
	else
D
David Howells 已提交
5813
		ksec->sid = tsec->sid;
5814

5815
	k->security = ksec;
5816 5817 5818 5819 5820 5821 5822 5823 5824 5825 5826 5827
	return 0;
}

static void selinux_key_free(struct key *k)
{
	struct key_security_struct *ksec = k->security;

	k->security = NULL;
	kfree(ksec);
}

static int selinux_key_permission(key_ref_t key_ref,
D
David Howells 已提交
5828
				  const struct cred *cred,
5829
				  unsigned perm)
5830 5831 5832
{
	struct key *key;
	struct key_security_struct *ksec;
5833
	u32 sid;
5834 5835 5836 5837 5838 5839 5840

	/* if no specific permissions are requested, we skip the
	   permission check. No serious, additional covert channels
	   appear to be created. */
	if (perm == 0)
		return 0;

D
David Howells 已提交
5841
	sid = cred_sid(cred);
5842 5843 5844 5845 5846

	key = key_ref_to_ptr(key_ref);
	ksec = key->security;

	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5847 5848
}

5849 5850 5851 5852 5853 5854 5855 5856 5857 5858 5859 5860 5861 5862
static int selinux_key_getsecurity(struct key *key, char **_buffer)
{
	struct key_security_struct *ksec = key->security;
	char *context = NULL;
	unsigned len;
	int rc;

	rc = security_sid_to_context(ksec->sid, &context, &len);
	if (!rc)
		rc = len;
	*_buffer = context;
	return rc;
}

5863 5864
#endif

L
Linus Torvalds 已提交
5865
static struct security_operations selinux_ops = {
5866 5867
	.name =				"selinux",

5868 5869 5870 5871 5872
	.binder_set_context_mgr =	selinux_binder_set_context_mgr,
	.binder_transaction =		selinux_binder_transaction,
	.binder_transfer_binder =	selinux_binder_transfer_binder,
	.binder_transfer_file =		selinux_binder_transfer_file,

5873
	.ptrace_access_check =		selinux_ptrace_access_check,
5874
	.ptrace_traceme =		selinux_ptrace_traceme,
L
Linus Torvalds 已提交
5875
	.capget =			selinux_capget,
D
David Howells 已提交
5876
	.capset =			selinux_capset,
L
Linus Torvalds 已提交
5877 5878 5879 5880 5881 5882 5883 5884
	.capable =			selinux_capable,
	.quotactl =			selinux_quotactl,
	.quota_on =			selinux_quota_on,
	.syslog =			selinux_syslog,
	.vm_enough_memory =		selinux_vm_enough_memory,

	.netlink_send =			selinux_netlink_send,

5885 5886 5887
	.bprm_set_creds =		selinux_bprm_set_creds,
	.bprm_committing_creds =	selinux_bprm_committing_creds,
	.bprm_committed_creds =		selinux_bprm_committed_creds,
L
Linus Torvalds 已提交
5888 5889 5890 5891 5892
	.bprm_secureexec =		selinux_bprm_secureexec,

	.sb_alloc_security =		selinux_sb_alloc_security,
	.sb_free_security =		selinux_sb_free_security,
	.sb_copy_data =			selinux_sb_copy_data,
5893
	.sb_remount =			selinux_sb_remount,
5894
	.sb_kern_mount =		selinux_sb_kern_mount,
5895
	.sb_show_options =		selinux_sb_show_options,
L
Linus Torvalds 已提交
5896 5897 5898
	.sb_statfs =			selinux_sb_statfs,
	.sb_mount =			selinux_mount,
	.sb_umount =			selinux_umount,
5899
	.sb_set_mnt_opts =		selinux_set_mnt_opts,
5900
	.sb_clone_mnt_opts =		selinux_sb_clone_mnt_opts,
5901 5902
	.sb_parse_opts_str = 		selinux_parse_opts_str,

5903
	.dentry_init_security =		selinux_dentry_init_security,
L
Linus Torvalds 已提交
5904 5905 5906

	.inode_alloc_security =		selinux_inode_alloc_security,
	.inode_free_security =		selinux_inode_free_security,
5907
	.inode_init_security =		selinux_inode_init_security,
L
Linus Torvalds 已提交
5908 5909 5910 5911 5912 5913 5914 5915 5916 5917 5918 5919 5920 5921 5922 5923 5924 5925
	.inode_create =			selinux_inode_create,
	.inode_link =			selinux_inode_link,
	.inode_unlink =			selinux_inode_unlink,
	.inode_symlink =		selinux_inode_symlink,
	.inode_mkdir =			selinux_inode_mkdir,
	.inode_rmdir =			selinux_inode_rmdir,
	.inode_mknod =			selinux_inode_mknod,
	.inode_rename =			selinux_inode_rename,
	.inode_readlink =		selinux_inode_readlink,
	.inode_follow_link =		selinux_inode_follow_link,
	.inode_permission =		selinux_inode_permission,
	.inode_setattr =		selinux_inode_setattr,
	.inode_getattr =		selinux_inode_getattr,
	.inode_setxattr =		selinux_inode_setxattr,
	.inode_post_setxattr =		selinux_inode_post_setxattr,
	.inode_getxattr =		selinux_inode_getxattr,
	.inode_listxattr =		selinux_inode_listxattr,
	.inode_removexattr =		selinux_inode_removexattr,
5926 5927 5928
	.inode_getsecurity =		selinux_inode_getsecurity,
	.inode_setsecurity =		selinux_inode_setsecurity,
	.inode_listsecurity =		selinux_inode_listsecurity,
5929
	.inode_getsecid =		selinux_inode_getsecid,
L
Linus Torvalds 已提交
5930 5931 5932 5933 5934

	.file_permission =		selinux_file_permission,
	.file_alloc_security =		selinux_file_alloc_security,
	.file_free_security =		selinux_file_free_security,
	.file_ioctl =			selinux_file_ioctl,
5935 5936
	.mmap_file =			selinux_mmap_file,
	.mmap_addr =			selinux_mmap_addr,
L
Linus Torvalds 已提交
5937 5938 5939 5940 5941 5942 5943
	.file_mprotect =		selinux_file_mprotect,
	.file_lock =			selinux_file_lock,
	.file_fcntl =			selinux_file_fcntl,
	.file_set_fowner =		selinux_file_set_fowner,
	.file_send_sigiotask =		selinux_file_send_sigiotask,
	.file_receive =			selinux_file_receive,

5944
	.file_open =			selinux_file_open,
5945

L
Linus Torvalds 已提交
5946
	.task_create =			selinux_task_create,
5947
	.cred_alloc_blank =		selinux_cred_alloc_blank,
5948
	.cred_free =			selinux_cred_free,
D
David Howells 已提交
5949
	.cred_prepare =			selinux_cred_prepare,
5950
	.cred_transfer =		selinux_cred_transfer,
5951 5952
	.kernel_act_as =		selinux_kernel_act_as,
	.kernel_create_files_as =	selinux_kernel_create_files_as,
5953
	.kernel_module_request =	selinux_kernel_module_request,
L
Linus Torvalds 已提交
5954 5955
	.task_setpgid =			selinux_task_setpgid,
	.task_getpgid =			selinux_task_getpgid,
5956
	.task_getsid =			selinux_task_getsid,
5957
	.task_getsecid =		selinux_task_getsecid,
L
Linus Torvalds 已提交
5958
	.task_setnice =			selinux_task_setnice,
5959
	.task_setioprio =		selinux_task_setioprio,
5960
	.task_getioprio =		selinux_task_getioprio,
L
Linus Torvalds 已提交
5961 5962 5963
	.task_setrlimit =		selinux_task_setrlimit,
	.task_setscheduler =		selinux_task_setscheduler,
	.task_getscheduler =		selinux_task_getscheduler,
5964
	.task_movememory =		selinux_task_movememory,
L
Linus Torvalds 已提交
5965 5966
	.task_kill =			selinux_task_kill,
	.task_wait =			selinux_task_wait,
5967
	.task_to_inode =		selinux_task_to_inode,
L
Linus Torvalds 已提交
5968 5969

	.ipc_permission =		selinux_ipc_permission,
5970
	.ipc_getsecid =			selinux_ipc_getsecid,
L
Linus Torvalds 已提交
5971 5972 5973 5974 5975 5976 5977 5978 5979 5980 5981 5982 5983 5984 5985 5986 5987

	.msg_msg_alloc_security =	selinux_msg_msg_alloc_security,
	.msg_msg_free_security =	selinux_msg_msg_free_security,

	.msg_queue_alloc_security =	selinux_msg_queue_alloc_security,
	.msg_queue_free_security =	selinux_msg_queue_free_security,
	.msg_queue_associate =		selinux_msg_queue_associate,
	.msg_queue_msgctl =		selinux_msg_queue_msgctl,
	.msg_queue_msgsnd =		selinux_msg_queue_msgsnd,
	.msg_queue_msgrcv =		selinux_msg_queue_msgrcv,

	.shm_alloc_security =		selinux_shm_alloc_security,
	.shm_free_security =		selinux_shm_free_security,
	.shm_associate =		selinux_shm_associate,
	.shm_shmctl =			selinux_shm_shmctl,
	.shm_shmat =			selinux_shm_shmat,

5988 5989
	.sem_alloc_security =		selinux_sem_alloc_security,
	.sem_free_security =		selinux_sem_free_security,
L
Linus Torvalds 已提交
5990 5991 5992 5993
	.sem_associate =		selinux_sem_associate,
	.sem_semctl =			selinux_sem_semctl,
	.sem_semop =			selinux_sem_semop,

5994
	.d_instantiate =		selinux_d_instantiate,
L
Linus Torvalds 已提交
5995

5996 5997
	.getprocattr =			selinux_getprocattr,
	.setprocattr =			selinux_setprocattr,
L
Linus Torvalds 已提交
5998

5999
	.ismaclabel =			selinux_ismaclabel,
6000
	.secid_to_secctx =		selinux_secid_to_secctx,
6001
	.secctx_to_secid =		selinux_secctx_to_secid,
6002
	.release_secctx =		selinux_release_secctx,
6003 6004 6005
	.inode_notifysecctx =		selinux_inode_notifysecctx,
	.inode_setsecctx =		selinux_inode_setsecctx,
	.inode_getsecctx =		selinux_inode_getsecctx,
6006

6007
	.unix_stream_connect =		selinux_socket_unix_stream_connect,
L
Linus Torvalds 已提交
6008 6009 6010 6011 6012 6013 6014 6015 6016 6017 6018 6019 6020 6021 6022 6023
	.unix_may_send =		selinux_socket_unix_may_send,

	.socket_create =		selinux_socket_create,
	.socket_post_create =		selinux_socket_post_create,
	.socket_bind =			selinux_socket_bind,
	.socket_connect =		selinux_socket_connect,
	.socket_listen =		selinux_socket_listen,
	.socket_accept =		selinux_socket_accept,
	.socket_sendmsg =		selinux_socket_sendmsg,
	.socket_recvmsg =		selinux_socket_recvmsg,
	.socket_getsockname =		selinux_socket_getsockname,
	.socket_getpeername =		selinux_socket_getpeername,
	.socket_getsockopt =		selinux_socket_getsockopt,
	.socket_setsockopt =		selinux_socket_setsockopt,
	.socket_shutdown =		selinux_socket_shutdown,
	.socket_sock_rcv_skb =		selinux_socket_sock_rcv_skb,
C
Catherine Zhang 已提交
6024 6025
	.socket_getpeersec_stream =	selinux_socket_getpeersec_stream,
	.socket_getpeersec_dgram =	selinux_socket_getpeersec_dgram,
L
Linus Torvalds 已提交
6026 6027
	.sk_alloc_security =		selinux_sk_alloc_security,
	.sk_free_security =		selinux_sk_free_security,
6028
	.sk_clone_security =		selinux_sk_clone_security,
6029
	.sk_getsecid =			selinux_sk_getsecid,
6030 6031 6032
	.sock_graft =			selinux_sock_graft,
	.inet_conn_request =		selinux_inet_conn_request,
	.inet_csk_clone =		selinux_inet_csk_clone,
6033
	.inet_conn_established =	selinux_inet_conn_established,
6034 6035 6036
	.secmark_relabel_packet =	selinux_secmark_relabel_packet,
	.secmark_refcount_inc =		selinux_secmark_refcount_inc,
	.secmark_refcount_dec =		selinux_secmark_refcount_dec,
6037
	.req_classify_flow =		selinux_req_classify_flow,
6038 6039
	.tun_dev_alloc_security =	selinux_tun_dev_alloc_security,
	.tun_dev_free_security =	selinux_tun_dev_free_security,
6040
	.tun_dev_create =		selinux_tun_dev_create,
6041
	.tun_dev_attach_queue =		selinux_tun_dev_attach_queue,
6042
	.tun_dev_attach =		selinux_tun_dev_attach,
6043
	.tun_dev_open =			selinux_tun_dev_open,
6044
	.skb_owned_by =			selinux_skb_owned_by,
6045 6046 6047 6048 6049

#ifdef CONFIG_SECURITY_NETWORK_XFRM
	.xfrm_policy_alloc_security =	selinux_xfrm_policy_alloc,
	.xfrm_policy_clone_security =	selinux_xfrm_policy_clone,
	.xfrm_policy_free_security =	selinux_xfrm_policy_free,
C
Catherine Zhang 已提交
6050
	.xfrm_policy_delete_security =	selinux_xfrm_policy_delete,
6051 6052
	.xfrm_state_alloc =		selinux_xfrm_state_alloc,
	.xfrm_state_alloc_acquire =	selinux_xfrm_state_alloc_acquire,
6053
	.xfrm_state_free_security =	selinux_xfrm_state_free,
C
Catherine Zhang 已提交
6054
	.xfrm_state_delete_security =	selinux_xfrm_state_delete,
6055
	.xfrm_policy_lookup =		selinux_xfrm_policy_lookup,
6056 6057
	.xfrm_state_pol_flow_match =	selinux_xfrm_state_pol_flow_match,
	.xfrm_decode_session =		selinux_xfrm_decode_session,
L
Linus Torvalds 已提交
6058
#endif
6059 6060

#ifdef CONFIG_KEYS
6061 6062 6063
	.key_alloc =			selinux_key_alloc,
	.key_free =			selinux_key_free,
	.key_permission =		selinux_key_permission,
6064
	.key_getsecurity =		selinux_key_getsecurity,
6065
#endif
6066 6067 6068 6069 6070 6071 6072

#ifdef CONFIG_AUDIT
	.audit_rule_init =		selinux_audit_rule_init,
	.audit_rule_known =		selinux_audit_rule_known,
	.audit_rule_match =		selinux_audit_rule_match,
	.audit_rule_free =		selinux_audit_rule_free,
#endif
L
Linus Torvalds 已提交
6073 6074 6075 6076
};

static __init int selinux_init(void)
{
6077 6078 6079 6080 6081
	if (!security_module_enable(&selinux_ops)) {
		selinux_enabled = 0;
		return 0;
	}

L
Linus Torvalds 已提交
6082 6083 6084 6085 6086 6087 6088 6089
	if (!selinux_enabled) {
		printk(KERN_INFO "SELinux:  Disabled at boot.\n");
		return 0;
	}

	printk(KERN_INFO "SELinux:  Initializing.\n");

	/* Set the security state for the initial task. */
D
David Howells 已提交
6090
	cred_init_security();
L
Linus Torvalds 已提交
6091

6092 6093
	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);

6094 6095
	sel_inode_cache = kmem_cache_create("selinux_inode_security",
					    sizeof(struct inode_security_struct),
6096
					    0, SLAB_PANIC, NULL);
L
Linus Torvalds 已提交
6097 6098
	avc_init();

6099
	if (register_security(&selinux_ops))
L
Linus Torvalds 已提交
6100 6101
		panic("SELinux: Unable to register with kernel.\n");

6102 6103 6104
	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
		panic("SELinux: Unable to register AVC netcache callback\n");

6105
	if (selinux_enforcing)
6106
		printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6107
	else
6108
		printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6109

L
Linus Torvalds 已提交
6110 6111 6112
	return 0;
}

6113 6114 6115 6116 6117
static void delayed_superblock_init(struct super_block *sb, void *unused)
{
	superblock_doinit(sb, NULL);
}

L
Linus Torvalds 已提交
6118 6119
void selinux_complete_init(void)
{
6120
	printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
L
Linus Torvalds 已提交
6121 6122

	/* Set up any superblocks initialized prior to the policy load. */
6123
	printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6124
	iterate_supers(delayed_superblock_init, NULL);
L
Linus Torvalds 已提交
6125 6126 6127 6128 6129 6130
}

/* SELinux requires early initialization in order to label
   all processes and objects when they are created. */
security_initcall(selinux_init);

6131
#if defined(CONFIG_NETFILTER)
L
Linus Torvalds 已提交
6132

6133
static struct nf_hook_ops selinux_nf_ops[] = {
6134 6135 6136
	{
		.hook =		selinux_ipv4_postroute,
		.owner =	THIS_MODULE,
6137
		.pf =		NFPROTO_IPV4,
6138 6139 6140 6141 6142 6143
		.hooknum =	NF_INET_POST_ROUTING,
		.priority =	NF_IP_PRI_SELINUX_LAST,
	},
	{
		.hook =		selinux_ipv4_forward,
		.owner =	THIS_MODULE,
6144
		.pf =		NFPROTO_IPV4,
6145 6146
		.hooknum =	NF_INET_FORWARD,
		.priority =	NF_IP_PRI_SELINUX_FIRST,
6147 6148 6149 6150
	},
	{
		.hook =		selinux_ipv4_output,
		.owner =	THIS_MODULE,
6151
		.pf =		NFPROTO_IPV4,
6152 6153
		.hooknum =	NF_INET_LOCAL_OUT,
		.priority =	NF_IP_PRI_SELINUX_FIRST,
6154
	},
L
Linus Torvalds 已提交
6155
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6156 6157 6158
	{
		.hook =		selinux_ipv6_postroute,
		.owner =	THIS_MODULE,
6159
		.pf =		NFPROTO_IPV6,
6160 6161 6162 6163 6164 6165
		.hooknum =	NF_INET_POST_ROUTING,
		.priority =	NF_IP6_PRI_SELINUX_LAST,
	},
	{
		.hook =		selinux_ipv6_forward,
		.owner =	THIS_MODULE,
6166
		.pf =		NFPROTO_IPV6,
6167 6168
		.hooknum =	NF_INET_FORWARD,
		.priority =	NF_IP6_PRI_SELINUX_FIRST,
6169
	},
L
Linus Torvalds 已提交
6170
#endif	/* IPV6 */
6171
};
L
Linus Torvalds 已提交
6172 6173 6174

static int __init selinux_nf_ip_init(void)
{
6175
	int err;
L
Linus Torvalds 已提交
6176 6177

	if (!selinux_enabled)
6178
		return 0;
6179 6180 6181

	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");

6182
	err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6183
	if (err)
6184
		panic("SELinux: nf_register_hooks: error %d\n", err);
L
Linus Torvalds 已提交
6185

6186
	return 0;
L
Linus Torvalds 已提交
6187 6188 6189 6190 6191 6192 6193
}

__initcall(selinux_nf_ip_init);

#ifdef CONFIG_SECURITY_SELINUX_DISABLE
static void selinux_nf_ip_exit(void)
{
6194
	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
L
Linus Torvalds 已提交
6195

6196
	nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
L
Linus Torvalds 已提交
6197 6198 6199
}
#endif

6200
#else /* CONFIG_NETFILTER */
L
Linus Torvalds 已提交
6201 6202 6203 6204 6205

#ifdef CONFIG_SECURITY_SELINUX_DISABLE
#define selinux_nf_ip_exit()
#endif

6206
#endif /* CONFIG_NETFILTER */
L
Linus Torvalds 已提交
6207 6208

#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6209 6210
static int selinux_disabled;

L
Linus Torvalds 已提交
6211 6212 6213 6214 6215 6216 6217 6218 6219 6220 6221 6222 6223 6224 6225
int selinux_disable(void)
{
	if (ss_initialized) {
		/* Not permitted after initial policy load. */
		return -EINVAL;
	}

	if (selinux_disabled) {
		/* Only do this once. */
		return -EINVAL;
	}

	printk(KERN_INFO "SELinux:  Disabled at runtime.\n");

	selinux_disabled = 1;
6226
	selinux_enabled = 0;
L
Linus Torvalds 已提交
6227

6228
	reset_security_ops();
L
Linus Torvalds 已提交
6229

6230 6231 6232
	/* Try to destroy the avc node cache */
	avc_disable();

L
Linus Torvalds 已提交
6233 6234 6235 6236 6237 6238 6239 6240 6241
	/* Unregister netfilter hooks. */
	selinux_nf_ip_exit();

	/* Unregister selinuxfs. */
	exit_sel_fs();

	return 0;
}
#endif